Use CCleaner? You May Have Been Exposed To Malware

[Rick Ace]

This came out a few days ago, but I haven't seen anyone discussing it yet.

https://www.usatoday.com/story/tech...free-app-meant-clean-out-computers/678277001/

It still isn't clear from most of these articles how the malware was inserted and how many of the 2.2 million downloads were tainted. (I've read that only the 32bit version was affected, but I wouldn't rely on that.)

I would recommend BleachBit for anyone looking for an alternative. Its GUI isn't fancy and doesn't do the program justice, but the actual application itself works spectacularly (even better than most paid alternatives).

So, how do you guys feel about this? Concerned about malware entering an Avast company, an antivirus company out of everyone?

 

[Joshua Farrell]

I am surprised that the company didn't have the downloads on a more secure server.

 

[Svoboda]

I am surprised that the company didn't have the downloads on a more secure server.

Really? Most freeware or non-commercial software is available at tons of mirrors. Honestly, I'm not surprised this isn't a more common occurrence.

 

[Page]

I used to use it when I had windows 7 on to clean my system and to make GTA4 that unstable to run better. Since Windows 10 I never got it

 

[Rick Ace]

I am surprised that the company didn't have the downloads on a more secure server.

The most surprising aspect is that the company behind CCleaner is Avast. When you think of Avast, you normally think of anti-virus programs.

However, here's an update with new information.
https://www.forbes.com/sites/thomas...er-attacks-target-tech-industry/#396b231f45fc

"At the time the server was taken down, the attack was targeting select large technology and telecommunication companies in Japan, Taiwan, UK, Germany and the US," Avast added. The company has contacted firms targeted, but isn't disclosing names.

So, it could be more than Avast that was affected. The initial research on the attack only consisted of limited logs.

Vlcek told Forbes that he believed eight or nine companies had been contacted, indicating some victims had more than one PC infected. He said the second payload was "a stage of a multi—stage attack." "It doesn't do anything malicious… all it's doing is basically waiting for a command to update it for a third-stage," he added. The investigation now moves on to determine whether or not that third-stage was activated.

The good news is that it sounds like the attack has been thwarted before the malware caused harm. But the bad news is that there are probably infected computers out there that are ticking time bombs.

What was clear to both Avast and Cisco was that this was a sophisticated targeted attack on the tech industry. Showing just how the attackers were carefully selecting their targets, more than 700,000 computers of the 2.3 million infected reported back to the hackers' server over few days the researchers were able to gather data, Cisco found. But just over 20 machines were hit with the second-stage attack, in which "reconnaissance information" about infected computers, such as IP address and software active on the machine, were sent to the attackers.

This is the most unusual part of the story, and if true would change the way we view the hack. In other words, the hackers did infect many computers, but they were aiming at harming a select few computers. What this means is that someone was trying to do specific damage instead of just harming as many computers as possible for money. So, who would benefit from doing specific damage? Businesses may benefit from taking down their competitors. Nations (governments) may also benefit. And then there are fringe and terror groups. It's too early to say who is responsible though. The article quickly suspects a Chinese group, but take that with a grain of salt because China, Russia, and North Korea are usually the first to be blamed for most hacking attempts. And it's only much after that we learn if it was truly one of them.

 

[UFPlanets]

The good news is that it sounds like the attack has been thwarted before the malware caused harm. But the bad news is that there are probably infected computers out there that are ticking time bombs.

The solution there could just be that the next update of CCleaner removes any malicious code, pushed through the updating thingy within the programme. It could prompt people to update it before they can continue using the application, that would be the best way to remove the infection from those computers.

 

[Page]

update of CCleaner removes any malicious code

I known it yo be cleaning the unwanted files that doesn't get used and taken space.. Not for malware. Still isn't always going to fully remove it

 

[UFPlanets]

No, what I mean is that an update for CClearner could include a quick scan for the specific signature of malware and remove it if it exists. Not to scan someones computer for malware, it would only be cleaning the specific piece that relates to this breach.

 

[Corzhens]

Oh oh, our home desktop is 32 bit and the anti virus is Avast. I wonder if we have an issue with a malware. Maybe I have to scan our desktop via a website that provides free service. Just to be sure that our desktop is clean.

 

[lunorian]

From what the researchers found, 18 tech companies were targeted, only the 32-bit windows version was exposed. I use macOS but I've uninstalled all Avast Products. I no longer trust them.