• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

TweakHound

Computer stuff...

  • Home
  • Windows XP
  • Windows Vista
  • Windows 7
  • Windows 8
  • Windows 10
  • Windows 11
  • Linux
  • Tweak Guides
  • Site Info
    • About
    • About Me
    • TweakHound’s World
    • Contact
    • My Computers
    • Old Articles
    • Privacy Policy
    • Old Index
    • Advanced Search

CCleaner Compromised, part 2

CCleaner

September 18, 2017, 14:26(EDT) By Eric (a.k.a. TweakHound)

Warning, Opinions ahead.

Claims and Questions
Infected file: 32-bit CCleaner.exe (version 5.33.6162)
AFAIK the 32-bit exe is present in the following versions: Standard, Portable, Pro, and Slim.
I have the slim and portable versions here. The 32-bit exe is identical in both.
AFAIK the portable version doesn’t make registry entries.
Are all versions effected?

Information out there does not add up.
Piriform/Avast says uninstalling is enough.
According to the guys that discovered the malware, “Uninstalling the tool will not remove the malware“.
This is why I haven’t offered any definitive advice on ridding yourself of the problem. Anybody who says that anything other than restoring from an image will fix this is jumping the gun. We do not have all the info.

What? Why? Who?
They said the malware didn’t seek any sensitive info.
The malware put a random unique number to identify the system and then uploaded the following info:
– Name of the computer
– List of installed software, including Windows updates
– List of running processes
– MAC addresses of first three network adapters
– Additional information whether the process is running with administrator privileges, whether it is a 64-bit system, etc.

That is really bizarre. Why go through all that trouble for that little bit of info? Possibilities:
– They did it for the lulz.
– They did it to hurt the reputation of the software/vendor.
– Info we have been given is wrong and the hack is worse.

Then Who?
– They did it for the lulz.
OK, nice hack. No harm on the users end.
– They did it to hurt the reputation of the software/vendor.
Mission accomplished. Now, pissed off employee, ex-employee, or competitor?
– Info we have been given is wrong and the hack is worse.
Whole can of worms here. Leet hackers, state sponsored, organized crime???

Put your tinfoil hat on and chime in!

Tagged With: Freeware, Security

Reader Interactions

Comments

  1. vlad says

    September 18, 2017, 14:48(EDT) at 14:48

    http://www.techrepublic.com/article/if-you-used-ccleaner-software-to-clean-up-your-device-you-may-have-infected-yourself-instead/

    • Eric (a.k.a. TweakHound) says

      September 18, 2017, 15:04(EDT) at 15:04

      Replaced text with link.

  2. Stop the press says

    September 19, 2017, 12:23(EDT) at 12:23

    “About 30% of CCleaner users also run Avast security software, which enables us to analyze behavioral, traffic and file/registry data from those machines. Based on the analysis of this data, we believe that the second stage payload never activated, i.e. the only malicious code present on customer machines was the one embedded in the ccleaner.exe binary,” they explained.

    “Therefore, we consider restoring the affected machines to the pre-August 15 state unnecessary. Customers are advised to update to the latest version of CCleaner, which will remove the backdoor code from their systems. As of now, CCleaner 5.33 users are receiving a notification advising them to perform the update.”

    https://www.helpnetsecurity.com/2017/09/19/ccleaner-backdoor-incident/

    • Eric (a.k.a. TweakHound) says

      September 19, 2017, 13:32(EDT) at 13:32

      “About 30% of CCleaner users also run Avast security software” The company that allowed CCleaner to be compromised.

Primary Sidebar

Popular Articles

Windows 10

Tweaking Windows 10

My Windows 10 Tweaks

Windows 10 Privacy Settings

Win10 Diagnostics Tracking Service Gone?

Windows 10 Advanced Disk Cleanup

Win10 Customize Installation Options

Windows 10 Dark Theme

Win10 Wallpapers, Graphics, etc.

All Windows 10 Articles

Windows 8

Tweaking Windows 8.1

Advice On Installing Windows 8.1

Clean Install Windows 8.1

Cleanup After Windows 8.1 Upgrade

Create Shutdown, Restart, Logoff Tiles For Windows 8

Tweaking Windows 8

Install Windows 8 – Clean Install With Upgrade Media

Install Windows 8 – Upgrade

Windows 8 – Cleaning Up After You’ve Upgraded

Windows 8 Freeware Machine

Windows 8 SSD Settings, Etc.

How To Resize Your Windows 8 Partition

Create Windows 8 Recovery Media

Windows 8 – Elevated Command Prompt

How To Fix The Windows Bootloader

Windows 7

Installing Windows 7

Tweaking Windows 7

Windows 7 Diagnostics Tracking Service

The Windows 7 Freeware Machine

The Windows 7 Pagefile And Running Without One

Bad Tweaks

SSD Tweak Guide (sort of)

The noguiboot (no GUI Boot) Tweak

NtfsMemoryUsage=2 Tweak

More Windows 7 articles here.

Windows Vista

Installing Windows Vista

Tweaking Windows Vista

More Windows Vista articles here.

Windows XP

eXPired - The Last Windows XP Guide You'll Ever Need

The Right Way To Install Windows XP

Super XP Tweaking Guide

The Freeware XP Machine

Bad Tweaks

More XP Articles here and here.

Backup

Backup Article Greatest Hits – Vol. 1

Other

Cataloging Your Music Collection

Finding Good Album Art

Converting Vinyl Records To Digital Music – A Non-Audiophiles Guide

Windows All-In-One Recovery Flash Drive

SSD Tweak Guide (sort of)

Raidmax Blackstorm Case Review

Disk Partitioning

Ditch Those CD's! A Guide To Using USB Flash Drives

Checking Your Disks For Problems

Bad Tweaks

More articles here

Tags

Android Backup Beer Computer Hardware Computer News Cool Tools Freeware How-To's Linux Off Topic openSUSE Playlists Privacy Security Software This Site vacation Veterans Windows 7 Windows 8 Windows 10 Windows 11 Windows Vista Windows XP

TweakHound - Optimize Your Computing Experience! TweakHound - Optimize Your Computing Experience!

Copyright 2002-2025 by Eric Vaughan All material contain here is the property of the materials owner. Windows, Windows XP, Windows Vista, Windows Seven, Windows 8, Windows 10, Windows 11, Microsoft, and all associated logos are trademarks/property of Microsoft. You may not use or copy any material from tweakhound.com without expressed written permission. Hotlinking to any material within this site is forbidden. Privacy Policy