Windows 10: CCleaner: A Vast Number of Machines at Risk

One virus more or less makes one hell of a difference.

 

The title of this thread "A VAST..." is on par!

 

No, its utterly not necessary to jump ship. Only time I'd consider doing so would be if they ruined ccleaner in other ways such as unwanted ware and ui changes.

 

I agree with you, good post *Thumbs

 

Poor phrasing on my part. *Redface
I should have written, "don't rely on finding the Registry Key, check the installer directly".

There must be more to it than just running the infected installer.
I installed CC v5.33 on multiple systems including my XP install & XP VM (both 32 bit).
I can't find that Registry Key.

Something must have stopped the malware from installing/running. *Confused
It wasn't my AV, as I didn't get any AV alerts during installation.

I'm using Avast on my physical installs and AVG on my VMs.
Avast is set to run a Quick Scan every day and a Full Scan on Sundays.
This means that several Full Scans found nothing.

I run MBAM Quick Scans every week (roughly).

I selected the CC installer and ran MBAM on it directly (using the Context Menu option).

I'm not sure what type of scan MBAM performed.
I always set all MBAM AV scan options to "On".

I also checked the installed exe files, but they are apparently clean. *Confused

 

Here is my contribution to the info here. I am running Windows 10 Pro x64. No problems on my system at all for two years. Wandered over to Piriform on August 15th to download CCleaner because I had not had it on my system in a while. Just my luck that I got the version with the malware attached, although I did not know of the problem at the time, of course. I installed CCleaner and used it once or twice in the ensuing month. I also rebooted and shut down/restarted several times in that time frame.

I see the news about the malware the afternoon the problem was reported, and I immediately begin attempting to check out my machine. Well, for the first time ever, I am unable to show hidden files and folders to look inside my Users/UserName folders. Hmmmm. I could do it before I installed CCleaner. I do it regularly since I am a power user and check things over often. Despite having "show hidden files and folders" selected and overriding the "hide protected operating system files" settings, I get nothing...nada. Just my regular folders and files only. When I go under the "view" tab and check the "hidden files" checkbox, it immediately UNchecks itself right in front of my eyes. That is NOT normal. Needless to say, I spent several hours last night resetting passwords for all my banking and important logins via my iPad, and I will be formatting my laptop HD and reinstalling Windows today (sigh). I will also be changing my network wireless password. I also noticed about five days ago, before I got wind of this malware issue, that I got a BSOD in Windows 10 for the first time ever with a message about a .sys file. Hmmm again.

So, if anyone got this malware riding on the CCleaner executable, 32 bit or 64 bit, I would highly recommend being safe now rather than very sorry later. Change your passwords from a clean device ASAP. Understand that many security suites will not flag a program or even a threat these days if the program or threat is thought of as a low risk and trusted program. Yes, that can happen. It just depends on the right set of circumstances. Windows Defender did not pick this up on my machine on download or at all. Bitdefender only picked it up after a forced direct file scan. Kaspersky did not pick this up on our secondary machine until after the announcement came out and a definition update showed up. If the malware was downloaded to your machine, and you installed the CCleaner version in question, and IF you value your data and computing environment, then a reformat and reinstall is in order. Running processes can be hidden, registry keys can be hidden, programs deemed "safe" as part of a group in order to reduce scanning overhead for security suites can be unsafe. Those of us who think of ourselves as PC experts can be caught with our pants down despite our best efforts and smarts. It would be foolish and arrogant to assume that because you have been computing since the early 90s (me) or earlier that you will never have a virus or malware problem. Remember, it is not paranoia if they really are out to get you.

 

As Windows defender Antivirus detect it, we can check there is no rootkit in a PC

 

For those of you that do not use Defender, Malwarebytes does the same thing, IF you check "Scan for rootkits" as its OFF by default. Also does it online.

 

thanks OldMike65

nothing detected both in Windows Defender & MalwareBytes
I had installed the faulty CCleaner v5.33 on x64 Computer
the shorcut in Windows Menu is "C:\Program Files\CCleaner\CCleaner64.exe" *chuckle

only "C:\Program Files\CCleaner\CCleaner.exe" (existing on disk..) is infected *Sick





I think I am OK then...

 

The CCleaner version you should have installed is version CCleaner v5.34.6207
If you have version CCleaner v5.33.6162 delete it and upgrade to latest release.

 

I think the latest version of CCleaner is 5.35.6210

 

Confirmed 5.35.6210, it's just downloaded here today, again as an "important update".

 

*Ditto

 

Yup was just released maybe within the last hour....

Latest CCleaner Version Released - Windows 10 Forums

 

This is i always chuckle from people who claim to not need AV protection, who always want to be admin and say that common sense is all you need. Sometimes, legit sites can get hit too. Reputable software becomes compromised. I appreciate the vendor who steps up, announces what happened and quickly fixes.