Windows 10: CCleaner: A Vast Number of Machines at Risk

My CC was the paid Pro version which I've had for years. So who knows anymore, It's getting to be a minefield out there.

 

Ran a Defender full scan, MBAM & AdwCleaner all came up clean. Even did the Registry search as mentioned above with no hits. This is making me paranoid for sure.

Edit:

2 hours later and I've scanned this thing with everything but a cat and it still comes up clean. This usually isn't the way my luck runs, but I'll take it.

 

Cisco Talos thinks this may be an inside job. Since Avast recently merged with Piriform, one might speculate that the Czech Anti-Virus vendor might have rogue employee in the house.

"It is also possible that an insider with access to either the development or build environments within the organization intentionally included the malicious code or could have had an account (or similar) compromised which allowed an attacker to include the code."

 

Removed CC from start up and auto update until the dust settles and this is fully resolved. Really considered an uninstall and still might do that.

 

Started Operation Clean Sweep! Removing all Piriform products atm...

 

I think it's wise to remove ccleaner for now until the next update addresses this issue specifically, but I don't think its time to call time on ccleaner as a whole just yet.

I have removed it from my machine just to be safe as well.

 

Think some of you folks are getting carried away on this......Never removed mine, and I have no issues, no threats, nothing....everything checks out just fine.

 

Probably, but best be safe, specially if you rely on your computer for a living.

 

There is only one installer for CCleaner and has both 32 and 64 bit .exe files and that is why MB detects the Trojan. When installed on a 64bit OS you get the 64bit exe in the shortcut so the 32bit is not run as the trojan was tied into the 32bit exe file.

All my systems are 64bit so trojan was not activated and all is good.

Jim *Cool

 

IMHO: When maintenance software you have to trust for 1000% gets compromised - by what- or whomever / in- or external - my zero-tolerance measurements kick in: DEFCON-1 *Busted

= removing all!

EDIT: of course awaiting for further news and/or instructions.

Cheers

 

News - Popular Registry Cleaner CCleaner Hacked - Infected With Malware for up to 4 Weeks

 

This hacking incident is yet another good reason why I don't use 3rd party maintenance software.

Open and Use Disk Cleanup in Windows 10 Windows 10 Performance Maintenance Tutorials

 

I certainly wouldn't recommend anyone keep a program that was intentionally infected with a Trojan or virus. It's what we can't see that's worrisome in this instance. For now, I definitely would advise to remove until the issue is remedied.

BTW I've never used CC Cleaner, see no reason for it, and never recommend it. That's me. That however, has nothing to do with my stated comment.

 

That is NO reason to suggest that other users ignore this and are getting carried away..

 

This only affects 32 bit versions of CCleaner, 64bit versions are not affected. You can also check your registry for this line.
HKLM\SOFTWARE\Piriform\Agomo:MUID

If its there then you have been hit.