Cisco Talos thinks this may be an inside job. Since Avast recently merged with Piriform, one might speculate that the Czech Anti-Virus vendor might have rogue employee in the house.
"It is also possible that an insider with access to either the development or build environments within the organization intentionally included the malicious code or could have had an account (or similar) compromised which allowed an attacker to include the code."
Removed CC from start up and auto update until the dust settles and this is fully resolved. Really considered an uninstall and still might do that.
There is only one installer for CCleaner and has both 32 and 64 bit .exe files and that is why MB detects the Trojan. When installed on a 64bit OS you get the 64bit exe in the shortcut so the 32bit is not run as the trojan was tied into the 32bit exe file.
All my systems are 64bit so trojan was not activated and all is good.
Jim
IMHO: When maintenance software you have to trust for 1000% gets compromised - by what- or whomever / in- or external - my zero-tolerance measurements kick in: DEFCON-1
= removing all!
EDIT: of course awaiting for further news and/or instructions.
Cheers
This hacking incident is yet another good reason why I don't use 3rd party maintenance software.
Open and Use Disk Cleanup in Windows 10 Windows 10 Performance Maintenance Tutorials
Quote
