CCleaner: A Vast Number of Machines at Risk

Karizma said:

I'm on Win10 64 bit and CCleaner 64 bit, However I was on the hacked version and updated to the "Safe" version before any of the hacked news came out.

So I checked HKLM\SOFTWARE\Piriform\ and the only subfolder is ccleaner no Agomo of any type, and scanned with Malwarebytes and WinDefender and nothing came up. Does this mean I'm in the clear or should I be looking at anything else?

You were clear from the start since you used the 64-bit version of ccleaner, it was only the 32-bit that was affected.

Zardoc said:

I agree.

My two cents, I don't like Avast security software, I'm more of a NOD guy but that's my choice. Wouldn't be surprised that anti virus software gets hacked.

Still gonna use CCleaner until it probably gets bloated like PGP, Acronis and others that got taken over. Hope not...

I moved away from Avast recently, I felt it was too bloated and intrusive.

I did some experiment on a virtual machine with v5.33
At least, it is now detected by Windows Defender Antivirus & MalwareBytes

Code:

Category: Backdoor

Description: This program provides remote access to the computer it is installed on.

Recommended action: Remove this software immediately.

Items: 
taskscheduler:C:\Windows\System32\Tasks\CCleanerSkipUAC
file:C:\Program Files\CCleaner\CCleaner.exe
file:C:\Windows\System32\Tasks\CCleanerSkipUAC
regkey:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{53F0D184-E624-492B-9E46-099A892E7B7B}
regkey:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CCleanerSkipUAC

Get more information about this item online.

This confirm that the malware is only detected in the 32bits version (in CCleaner.exe only but not CCleaner64.exe)

IMPORTANT: If You're A CCleaner User You Need To Read This. | Gizmo's Freeware

Well, make of it what you will. Nothing to lose by updating.. I guess!

DavidE said:

Avast opens up about CCleaner hack and outlines how it will protect users

As an extra measure, the entire Piriform staff will be moved onto Avast's internal IT system -- something which has already been done for the Piriform build environment.

Interesting. Seems there is more going on that we know about...

In another forum I use, most users seem to be jumping ship of CC. Does anyone in here think this is really necessary at this point if you are using 64bit? I have used CC for so long, I guess i am to complacent in my thinking of it, maybe, but right now I think I will continue to use it. Using Windows Defender, MBAM (with rootkit scans, regular HitmanPro and regular EEK scans will hopefully keep me aware if a problem presents itself. Fingers crossed.