CCleaner: A Vast Number of Machines at Risk

What I don't understand is that the second play load checks for 32bit or 64bit and gets either a 32bit or 64bit dll. But on a 64bit system, the 64bit ccleaner isn't infected just the ccleaner.exe. (32bit version).

I'm also wondering if the virus is active only when ccleaner is running in the system tray and if the first and second payload is even able to drop if ccleaner on a 32bit machine isn't running in the system tray and that feature is turned off. As this is the first feature of ccleaner I turn off upon installation.

I'm also wondering if it even goes through with the 2nd payload if the IP address it collects from the user in stage 1 doesn't match a large tech company.

vgchat said:

For anyone using ccleaner, make sure to remove this after you make it upgrade.



And this is using the 64 bit version only btw.

That's because the 32bit and 64bit are packaged in the same installer. It unpacked the installer and flagged ccleaner (32bit). it's also just in your temporary internet folder from downloading ccleaner. Probably wouldn't do any harm just sitting there. Only if you run it.

I've read all of the posts and the only the CCleaner 32-bit v5.33 is supposed to be affected.
I picked up a 64-bit desktop last week and turned it on yesterday and it has CCleaner 64-bit v5.35 with Floxif on it.
When I booted up the computer, Windows Defender notified me and I let WD remove it after taking the following screenshots.
In post #113, it's mentioned ""That's because the 32bit and 64bit are packaged in the same installer. It unpacked the installer and flagged ccleaner (32bit). I suspect that's possible, but that just proves a 64bit can be affected.
I don't recall which posts it has been mentioned, but it seems v5.35 is supposed to remove whichever infection from v5.33 is included.
That didn't happen on the computer I picked up.
Anyway I immediately had Windows Defender remove Floxif but didn't read all of the posts until the computer was cleaned out.

The portable version of CCleaner is safe. I don't see why anyone would use the install version... and that goes for lots of other software.

ICIT2LOL said:

Agreed I have used Kaspersky for the last seven years and apart for a little dummy spit once with the trial version of MBAM not a hint of anything crap. I have yet to try out the free version but from what I can make of it it lacks only a few features of the paid for and some of those I don't use anyway.

ICIT, I've had Kaspersky for a few years now and my experience has been very good just like yours.