Malware found in official Ccleaner installers

[Cohen]

While it's unfortunate that this happened, it's a good thing Piriform went public with this rather than fixing it and not saying anything.
I hope they learn from their mistakes and take the appriopriate actions to make sure something like this doesn't happen again in the future.

 

[L S]

Here is ok:
Uploadfiles.io - Upload files, for free, securely, anonymously, without limits.

Tnx

Here Is the file : Uploadfiles.io - ccsetup533pro.exe 30 days available (from now)

 

[Transhumana]

I have just logged in on my other machine to see which version I've been running and somehow luckily I never updated to that infected version. Nothing is (completely) safe and everything can become compromised, we all know that, but still as someone who uses CCleaner on daily basis I am disturbed to read that information. As I don't have the infected version, I'll leave it as it is for now.

 

[Av Gurus]

Here Is the file : Uploadfiles.io - ccsetup533pro.exe 30 days available (from now)

Here is VT score (4/62):

VirusTotal

 

[Marko :)]

Luckily, I had v5.31 until now. It was telling me that there is new version but I was lazy to update it. See guys, being lazy sometimes is a good thing!

 

[Bleak]

was illegally modified before it was released to the public

I find something suspicious about this quote, imo they probably did it and when this got revealed they came up with this reply, because how come they never noticed this since it was hosted on THEIR own site since September 11, and just noticed it when the internet started talking? .. quoting: "Talos warned in a blog Monday that the affected version was released on August 15, but on September 12 an untainted version 5.34 was released." so the modified version that got released by that "unknown" hacker who also managed to SIGN the application with their Certificate? and also managed to release this on their own site AS WELL?

I Have It !!!
How / Where you want me to send it ???

Please make sure to not name it just "Ccleaner", compress it and add a password to the archive, upload to zippyshare.com and mark it as "Private".

 

[robin hood]

Does anybody have that infected version to shear or does somebody have VT link score with this problematic version?

v.5.31.0.6105 (date modified 28-06-2017). Win 7/x86
Uploadfiles.io - ccsetup531 (1).exe

VirusTotal

 

[Daljeet]

Thanks ls for file

 

[Marko :)]

v.5.31.0.6105 (date modified 28-06-2017). Win 7/x86
Uploadfiles.io - ccsetup531 (1).exe

v5.31 shouldn't be affected, only v5.33.

 

[shmu26]

I have the affected version installed, but x64
I opened the program to check the version number, and I got a message that the latest version contains "important changes", and it is recommended that I update...

 

[L S]

Please make sure to not name it just "Ccleaner", compress it and add a password to the archive, upload to zippyshare.com and mark it as "Private".

It's already done ! :/
P.S. BTW This version is downloaded more than 1000 000 times , sooo .......
& All (almost all) Big Antivirus & Antimalware Softwares have that "infected file = malware"

 

[Deletedmessiah]

Thanks ls for file

ClamAV be like, "You made fun of me for years. What do you say now?"

 

[Transhumana]

Just called my family members to check if they got it and it seems that dad has the infected version, and he even bought the PRO license after installation. I think he'll never ever bother to hear my software recommendations again.

 

[Marko :)]

FileHippo doesn't have v5.33 in their version history. Seems like they removed it.

 

[Av Gurus]

Here is analysis:
https://malwr.com/analysis/NzA4NDVlYmYyZDE4NGEzZWFlNDVmYTMzMTE4MGIzYzQ/#

 

[ispx]

crap cleaner is now itself crap. piriform was always an adware company & then it was bought by the bigger adware company, avast.

as someone who uses CCleaner on daily basis

why? what kind of magic do you think it does to your computer? ccleaner is the epitome of snake oil happily & willingly lapped up by users.

imo they probably did it and when this got revealed they came up with this reply

bingo

now that is what i call hitting the nail on the head @Bleak never minces his words & this time what he has stated is the gospel truth.

ClamAV be like, "You made fun of me for years. What do you say now?"

DM, i have been made fun of since years for advising against ccleaner but now i stand vindicated

if you guys seriously think this shady stuff has just started you are so naive, piriform has been doing this since ccleaner 4.17 back in 2014.

 

[ispx]

proof 2017 :

https://malwr.com/analysis/NzA4NDVlYmYyZDE4NGEzZWFlNDVmYTMzMTE4MGIzYzQ/#

proof 2014 : https://malwr.com/analysis/Y2M0YTFhNGQwYWYzNDlmZTllN2I0ZGUyOGEyMzFiMjE/

 

[Av Gurus]

When this .exe is extracted we have two version x32 and x64, here is VT score for them:

 

[shmu26]

When this .exe is extracted we have two version x32 and x64, here is VT score for them:

View attachment 167459

I don't get it. So how come most major AVs are still not identifying it? What about Avast, even they don't know about their own "product"?

 

[ispx]

So how come most major AVs are still not identifying it?

piriform is a known legitimate company which is why they let it pass.

What about Avast, even they don't know about their own "product"?

you think avast did not know this when they bought piriform