CCleaner v5.33 32-bit compromised

spud17

esuhl wrote: »

Apparently the malware was part of the CCleaner executable and doesn't replicate itself. Simply uninstalling CCleaner (or installing the latest unaffected version) should be enough to get rid of the malware.

So they say... :-/

Yup, read the article, but ...
I used RevoUnistaller, but still some bits left in registry somewhere because reinstall had my preferences already set.
I'm glad I never set it to auto-update which is the default, this means I'm generally a few editions behind, which is no biggie with this type of program.

Jackmydad

esuhl wrote: »

I use BleachBit in GNU/Linux, which does a similar thing. There's a Windows version too, if you're looking for an alternative to CCleaner:

https://www.bleachbit.org/download/windows

Thanks for that. I was just going to do a search for an open source alternative after reading ccleaner had been sold.

spud17

Just turned on my main pc, Win 10 Pro 64 bit and had this alert, it is the 5.33.6162 64 bit version.



ETA: Defender has now quarantined and deleted CCleaner v5.333 from my 'Downloads' folder.

Also I see that The Guardian refers to CCleaner as an 'Anti-malware program', 'nuff said
https://www.theguardian.com/technology/2017/sep/19/ccleaner-2m-users-install-anti-malware-program-security-avast-supply-chain-attack-hack

debitcardmayhem

I've had two emails today containing floxif but not to address related to my ccleaner

System

Only affected 32 bit versions. Yet another reason to move to x64.

Terry98

Tarambor wrote: »

Only affected 32 bit versions. Yet another reason to move to x64.

Why? Although I only have a rough idea of the differences between 32 and 64bit I didn't think security was one of them.

Like Spud I am running WIN10 64 bit and Malwarebytes Premium has just found Floxit this morning.So much for it only affecting 32 bit versions!

spud17

Perhaps Defender has been updated to detect all instances of CCleaner 5.33.6162?
Just to be on the safe side.

GunJack

Terry98 wrote: »

Why? Although I only have a rough idea of the differences between 32 and 64bit I didn't think security was one of them.

Like Spud I am running WIN10 64 bit and Malwarebytes Premium has just found Floxit this morning.So much for it only affecting 32 bit versions!

its the 32- or 64-bit version of ccleaner, not your operating system

for clarification, you can run the 32-bit version of ccleaner on a 64-bit OS

esuhl

Terry98 wrote: »

Why? Although I only have a rough idea of the differences between 32 and 64bit I didn't think security was one of them.

64-bit Windows OSes have kernel patch protection, hardware-based DEP, no 16-bit support, mandatory driver signing, and WOW64 which provides better security when running 32-bit executables.

I don't know how much difference all that makes to infection rates in practise, though.

Terry98

GunJack wrote: »

its the 32- or 64-bit version of ccleaner, not your operating system

for clarification, you can run the 32-bit version of ccleaner on a 64-bit OS

Thanks but I am running and have always run the 64 bit version of ccleaner and cannot understand why Malwarebytes picked up Floxit yesterday morning if the 32 bit version was only affected.