CCleanup: A Vast Number of Machines at Risk

[Jeff P]

CCleanup: A Vast Number of Machines at Risk:
http://blog.talosintelligence.com/20...s-malware.html

For a period of time, the legitimate signed version of CCleaner 5.33 being distributed by Avast also contained a multi-stage malware payload that rode on top of the installation of CCleaner. CCleaner boasted over 2 billion total downloads by November of 2016 with a growth rate of 5 million additional users per week. Given the potential damage that could be caused by a network of infected computers even a tiny fraction of this size we decided to move quickly. On September 13, 2017 Cisco Talos immediately notified Avast of our findings so that they could initiate appropriate response activities. The following sections will discuss the specific details regarding this attack.

and:

On September 13, 2017 while conducting customer beta testing of our new exploit detection technology, Cisco Talos identified a specific executable which was triggering our advanced malware protection systems. Upon closer inspection, the executable in question was the installer for CCleaner v5.33, which was being delivered to endpoints by the legitimate CCleaner download servers. Talos began initial analysis to determine what was causing this technology to flag CCleaner. We identified that even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download. During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. We confirmed that this malicious version of CCleaner was being hosted directly on CCleaner's download server as recently as September 11, 2017.

-jp

.

[_______]

Very useful!

I run the free version. It doesn't appear the compromised version ever loaded onto my home machine. It doesn't seem that individuals would have been the target. This was aimed at enterprise.

Nonetheless, if you have a version that auto updates you were compromised.

[AltonKelsey]

Had an old version installed which I just nuked

[Clocker]

Originally Posted by _______

Nonetheless, if you have a version that auto updates you were compromised.

As I read that article, which is tough because I don't speak geek, it says that the free version does not auto update.

Question for those more computer literate on such matters. I have version 5.24 and the CC web site says version 5.34 is available. It sounds like my current version should be clean, and that it is OK to go ahead and download 5.34, right?

[_______]

Originally Posted by Clocker

As I read that article, which is tough because I don't speak geek, it says that the free version does not auto update.

Question for those more computer literate on such matters. I have version 5.24 and the CC web site says version 5.34 is available. It sounds like my current version should be clean, and that it is OK to go ahead and download 5.34, right?

I believe you have this correct.

[Jeff P]

Clocker, I also think you would be OK to download v 5.34.

From the article on the Cisco's Talos Intelligence Group blog:
http://blog.talosintelligence.com/20...s-malware.html

It is also important to note that while previous versions of the CCleaner installer are currently still available on the download server, the version containing the malicious payloads has been removed and is no longer available.

-jp

.

[Marshall Bennett]

Originally Posted by Clocker

As I read that article, which is tough because I don't speak geek, it says that the free version does not auto update.

Question for those more computer literate on such matters. I have version 5.24 and the CC web site says version 5.34 is available. It sounds like my current version should be clean, and that it is OK to go ahead and download 5.34, right?

I downloaded version 5.34 a few days ago and works well. I use it almost daily.

[AltonKelsey]

Originally Posted by Marshall Bennett

I downloaded version 5.34 a few days ago and works well. I use it almost daily.

Why would you use that daily. I nearly NEVER use these things. Maybe I'm missing some great experience

[Clocker]

I just checked the CCleaner web site and and the free version of the update (Version 5.34) is available. They are also offering the professional version for $19.95. Anyone use the Pro version, and is it worth getting? Thanks.

http://www.piriform.com/ccleaner/download?upgrade

[_______]

Originally Posted by AltonKelsey

Why would you use that daily. I nearly NEVER use these things. Maybe I'm missing some great experience

I use it when I get an alert that I haven't used it lately and it can save me "X" amount of storage. I'm also confused by why anyone would use it daily.

[_______]

Originally Posted by Clocker

I just checked the CCleaner web site and and the free version of the update (Version 5.34) is available. They are also offering the professional version for $19.95. Anyone use the Pro version, and is it worth getting? Thanks.

http://www.piriform.com/ccleaner/download?upgrade

One of the "benefits" of the pro version is automatic updates. The absence of which saved all us cheapskates the trouble of restoring settings to an earlier uncontaminated date.

I'm sure this can be turned off (I don't let my anti-virus auto update) but if you aren't an enterprise I'd be confident saying you don't need the pro version.

[Tom]

I'm still using 4.09 Free version.
It does the job, so I have never bothered to update it.
If it ain't broke.....

[Zaf]

Yup I have 5.19 works great, I'll stick with this one.

Z

[Marshall Bennett]

Originally Posted by AltonKelsey

Why would you use that daily. I nearly NEVER use these things. Maybe I'm missing some great experience

It checks to see all of your storage and where it is. Takes 10 seconds. Also I clean registry (10 seconds) and clean cache on Firefox and Chrome (perhaps 30 seconds). I don't run the cleaner on anything but what I've mentioned.
My computer is older. I suppose if you have a massive amount of storage it makes little difference.

[Ocala Mike]

I'm running v5.13.5460. Am I ok?