Slashdot Mirror
Avast's CCleaner Free Windows Application Infected With Malware (bleepingcomputer.com)
Reader Tinfoil writes: Cisco Talos announces that malware cleaning app, CCleaner, has been infected with malware for the past month. Version 5.33 of the CCleaner app offered for download between August 15 and September 12 was modified to include the Floxif malware, according to a report published by Cisco Talos a few minutes ago. Cisco Talos believes that a threat actor might have compromised Avast's supply chain and used its digital certificate to replace the legitimate CCleaner v5.33 app on its website with one that also contained the Floxif trojan. The company said more 2.27 million had downloaded the compromised version of CCleaner.
CCleaner wasn't malware all along?
It certainly seemed that way given how they advertised.
It seems that most anti-virus programs slow your machine down more than the malware than they purport to protect you from - and they're as damaging to your privacy too.
I'm not at all clear on what value they bring to the table.
Ian Ameline
... AVAST AntiVirus! Who would have guessed that a great tool like CCleaner would be messed up by Avast in no time at all.
To Terminate, or not to Terminate, that's the question - SCSIROB
Avast bought it. Always was a quick easy way to dump the garbage off your computer instead of 2-3 or more programs to do the same thing.
From the linked article: "The malware collected information such as computer name, a list of installed software, a list of running processes, MAC addresses for the first three network interfaces, and unique IDs to identify each computer in part. Researchers noted that the malware only ran on 32-bit systems."
Someone capable of poisoning signed downloads (high complexity) should be able to select functional payload (low complexity). I don't see any alternative explanation to "ran on 32-bit systems" limitation other than incompetence. This doesn't add up.
Floxif is a malware downloader that gathers information about infected systems and sends it back to its C&C server. The malware also had the ability to download and run other binaries, but at the time of writing, there is no evidence that Floxif downloaded additional second-stage payloads on infected hosts.
The malware collected information such as computer name, a list of installed software, a list of running processes, MAC addresses for the first three network interfaces, and unique IDs to identify each computer in part. Researchers noted that the malware only ran on 32-bit systems. The malware also quit execution if the user was not using an administrator account.
As a regular and longtime user/installer of CCleaner, including version 5.33, it's possible that I may be infected. I've not seen any symptoms nor has Malware Bytes/Comodo detected anything, but....
Can any of the current tools check if any of my PCs are/may be infected?
The only applications that I use is Microsoft Defender and Malware Bytes. All the third-party applications for keeping WinXP running weren't needed in Vista/7/8/10.
Cisco Talos announces that malware cleaning app...
Except it wasn't a malware cleaning app. Just a cleaning app. Maybe it happened to clean malware that got caught in the recycle bin, but that's about the extent of it. Of course, it ended up being a malware-infected cleaning app. Maybe that's what the OP meant??
ASCII tastes bad dude.
Binary it is then.
Shit happens. Don't sue us, mkay?
Sure. CCleaner version 5.34. Available from downloads.ru today!
Do not look into laser with remaining eye.
That would be a cool trick - identifying itself as malware and then deleting it.
... First, Web of Trust and now this.
It little behooves the best of us to comment on the rest of us.
is it infected too?
Those of us "in the know" only trust APKs hosts file generator to stay protected from malware.
Cruz/Palin 2020
The other possibility is that Avast is actually just another Malware company. When you consider how bloated it has gotten and how many resources it consumes, I don't think it is that far-fetched.
https://news.ycombinator.com/i...
They tell everyone of the infection but don't provide hashes for the infected files and installers. Class act right there. Just get 5.34 which is totally okay, we promise.
Time to download CCleaner version 5.32, the last Piriform version of CCleaner, before Avast bought it.
Putting this in my permanent archive. Will never upgrade from this version.
http://filehippo.com/download_ccleaner/download/45657838f7d7df4140118c21888ca61d/
As i said: I always thought CCleaner was malware anyway?
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
What software detects it?
Windows Defender? Malwarebytes?
Spyhunter is trialware until you try to remove it.
See subject: It's easy using startup area enumerators like AutoRuns 1st & ProcessExplorer (addtionally exposes libs called beneath services etc. in usermode which you rightclick on (use DLL View panel/subpanel) & 'freeze' (HLT instruction stream intercept) & delete it on disk - kill process, can't return).
Lastly vs. rootkits?
Windows bootup disks (CD/DVD whatever) have disable command vs. driver driven rootkits, & FDisk vs. bootsector originated ones...
APK
P.S.=> As to that last part? I use what the inventor of those 2 tools above all "The best Windows, ever" & he was right - it let's me do all that, no bullshit, easy - it works... apk
A sad worlD. At
PC: Greetings, Professor:
Professor: Hi.
PC: Strange this Windows OS. The only winning move is not to use it. How about a nice Linux distribution?
With other treat about IOS removing antivirus from IOS store, I wonder if it will published on IOS. Doubleplus Good.
See subject: Hosts are good for that & also threats you have inside already that try communicate back to C&C (if they use hostnames, most do) but the QUESTION WAS HOW TO DETECT & REMOVE EXISTING ALREADY INTERNAL/INSIDE THREATS - the tools I noted do it.
* I "get it" you're just another UNIDENTIFIABLE "ne'er-do-well" troll STOOGE, but that's not MY fault - it's yours...
(... & @ least I did something about these threats, how about YOU?)
APK
P.S.=> Period... apk
A vast issue for them
How do you find time to post to slash dot when you are busy sucking so much moose dick?
It is because you are taking in the ass right now by one instead.
You are worse than cdreimer.
He is at least entertaining, you are just sad.
First of all, I'm fairly certain it's made by Piriform, not Avast. Second, it absolutely, unequivocally makes your computer slower with its default options. I mean deleting thumbnail cache? That's idiotic! So in that sense it absolutely is malware and always has been. But hopefully they get absolutely destroyed in court and get jail time so they shut down. I cannot stand their products.
See subject: IF something in hosts files offends you (or blocks access to), you can easiily edit out what you don't like using text editors...
* I wish you didn't HAVE to update it - I wouldn't have built APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ otherwise - so you DO stay current vs. the most current threats on the internet landscape.
APK
P.S.=> That is the TRUE BEAUTY of it, personal control (as well as kernelmode efficiency & speed in something that's proven for 44++ yrs. in hosts as part of the IP stack itself)... apk
See subject: YOU have to start a new FAKE NAME ACCOUNT (for your FAKE LIFE) named "BullShitWinkle", lol - you project it so much so I figured I'd give you a new name!
* RoTfLmAo...
APK
P.S.=> Rocky & Bullwinkle got NOTHING on you - you keep "going off" on mooses, I figure you are revisting some "childhood trauma" over some incident w/ a moose, hence BullWinkle, lol... apk
APK offers moose dick
And bullshit
See subject & my thoughts on what YOU need to do (lmao) https://it.slashdot.org/comments.pl?sid=11129871&cid=55221247/
APK
P.S.=> You keep projecting your issues w/ mooses, & Bullwinkle's a moose so, there ya go (lol)... apk
APK is rolling around in moose dick on the floor laughing while his ass gets filled
APK has real problems but just loves the moose dick too much to ever give it up even with all the trauma to internal organs it has cause him
that I don't update my software.
I installed CC Cleaner in my phone a couple of years ago. It couldn't do anything beyond what one can already do with the tools shipped with Android. And, as a bonus, it would interrupt you whenever it saw fit, and it used lots of CPU and battery to boot. This things has been nothing but malware from day one.
This post is sorely lacking tons of information and the few that are in it are wrong.
CCleaner is NOT a malware cleaning app. It's a registry and regular file cleaner software.
Furthermore, let's dig into the case:
- This ONLY affects the 32-bit version of CCleaner and CCleaner Cloud, which accounts for some 3% of Piriform users. If you are using 64-bit version, you are probably safe. From Piriform’s website: “This compromise only affected customers with the 32-bit version of the v5.33.6162 of CCleaner and the v1.07.3191 of CCleaner Cloud. No other Piriform or CCleaner products were affected.”;
- From Piriform’s accessment, here’s the actual danger: “The compromise could cause the transmission of non-sensitive data (computer name, IP address, list of installed software, list of active software, list of network adapters) to a 3rd party computer server in the USA. We have no indications that any other data has been sent to the server. Working with US law enforcement, we caused this server to be shut down on the 15th of September before any known harm was done.”
- The investigation is still ongoing, but Piriform is saying that the issue has been solved, that no harm was done, and what seems like it didn’t originate from official CCleaner/Piriform sources. Which is to say, it could be embedded code that was inserted on 3rd party download websites. There is further explanation on Talos' post how it was a sofisticated attack because whoever did it managed to put up a valid cert on the infected version of Ccleaner though, so there should be more information coming out as the investigation proceeds.
If you wanna dig more into the whole thing, here's Piriform's official statement:
https://www.piriform.com/news/...
And here's Talos security accessment of the case:
http://blog.talosintelligence....
APK's thoughts are always on moose dick
He is always trying to figure out how to get more of it
He did try getting 2 in his ass once but he was hospitalized for a couple of weeks
slash dot was a nicer place for those few short weeks
I am looking forward to my exit in supporting other people's Windows boxen. I cannot *wait* until I can say, with a big fat grin on my face, "Sorry, I don't do Windows support anymore", or better yet, "Sorry, I've literally *never* used Windows 11" (or whatever stupid Windows name they call it by then).
I'm getting goosebumps just thinking about it. Oh, happy days await me. =}
It is pitch black. You are likely to be eaten by a grue.
The real question is why are you running 32-bit software in this day and age?
Because that's the only version what was affected. ie. the 64-bit version is apparently OK.
There is a more technical breakdown of the malware from the folks at Talos that discovered it. According to them ClamAV has a signature to detect the altered installers. Also it looks like Malwarebytes has the signature too so if that is what you are using get the updated signature files and run a scan.
Otherwise look for outbound traffic attempting to go to 216.126.225.148, that is the hardcoded C2 server the malware uses.
Of all tyrannies, a tyranny sincerely exercised for the (supposed) good of its victims may be the most oppressive
The version before Avast bought it was version 5.32 on July 2017. Here we see version 5.33 with the Floxif malware after August 2017.
Coincidence? I think not.
Because a normal person wouldn't AC-respond to any comment buried 20 layers deep inside of a reimer spergfest to tell a rando that their behavior is "unhealthy"
I notice that some unpopular internet posters have the same reaction to their detractors that the general population has to them.
So reimer feels that it's normal to tell someone their internet behavior is "unhealthy" when you don't like what they're doing. But reimer's behavior is extremely unhealthy.. getting made fun of online is not good for one's mental health and making yourself into number one lolcow on the birthplace of the GNAA is extremely stupid.
Have you considered what would happen to you if someone like weev noticed you?
I mean I don't normally use windows (Linux for home for since the turn of century) but when I do always installed this to clean registry. I was never sure why microsoft didn't just add a cleaner but hey!