- Jul 6, 2017
- 2,392
They must provide a tool for those affected... and henceforth demonstrate that it is a safe program.
What should Avast do with CCleaner backdoor?
- Thread starter Windows_Security
- Start date
It's just a bit more than frustrating when learning resources are consolidated here at MalwareTips for user convenience and education - right at the fingertips - and very few bother to avail themselves of any of the resources.
- Apr 5, 2017
- 836
I voted for provide a removal tool, i didn't use CC cleaner myself anymore( after it removed something from my registry twice but that was probably something i checked or unchecked after or during the installation) my reason for voting that option is that for just the average joe bloggs home user (me, with next to no knowledge) i wouldn't feel comfortable deleting things from the registry and i don't think i should be expected to. I believe that if they provide this, there is no need to offer discounts etc as no real damage was done to anyones pc from what i gather.
Surely when Avast acquired CCcleaner/Piriform they also inherit the responsibility of the software, you don't get to pick and choose which bits you want to keep, it's a package.
Surely when Avast acquired CCcleaner/Piriform they also inherit the responsibility of the software, you don't get to pick and choose which bits you want to keep, it's a package.
- Mar 30, 2014
- 468
Intersting ..!
Cisco's Talos Intelligence Group Blog: CCleanup: A Vast Number of Machines at Risk
CONCLUSION
This is a prime example of the extent that attackers are willing to go through in their attempt to distribute malware to organizations and individuals around the world. By exploiting the trust relationship between software vendors and the users of their software, attackers can benefit from users' inherent trust in the files and web servers used to distribute updates. In many organizations data received from commonly software vendors rarely receives the same level of scrutiny as that which is applied to what is perceived as untrusted sources. Attackers have shown that they are willing to leverage this trust to distribute malware while remaining undetected. Cisco Talos continues to monitor all aspects of the threat landscape to quickly identify new and innovative techniques used by attackers to target organizations and individuals around the world.
Cisco's Talos Intelligence Group Blog: CCleanup: A Vast Number of Machines at Risk
CONCLUSION
This is a prime example of the extent that attackers are willing to go through in their attempt to distribute malware to organizations and individuals around the world. By exploiting the trust relationship between software vendors and the users of their software, attackers can benefit from users' inherent trust in the files and web servers used to distribute updates. In many organizations data received from commonly software vendors rarely receives the same level of scrutiny as that which is applied to what is perceived as untrusted sources. Attackers have shown that they are willing to leverage this trust to distribute malware while remaining undetected. Cisco Talos continues to monitor all aspects of the threat landscape to quickly identify new and innovative techniques used by attackers to target organizations and individuals around the world.
- Jul 13, 2014
- 766
Well, Cisco Talos is using this ''event'' for some marketing and manipulations to make some cash
- Aug 7, 2017
- 270
Analysed a late August and an early Sept Macrium image of my C drive (over 60 full/incremental images are saved based on retention rules) to check if my PC was infected. My Start Menu shortcuts always ran the x64 version which did not have the malware payload. Phew! Dodged a bullet there.
What should Avast do? Well, it IS Avast's baby now and they ought to clean up the mess. Firstly, tighten development/build server security to ensure this never happens again. Publish removal instructions and better still offer a free removal tool that makes it easy for users to get rid of the malware. Not every Windows user is comfortable editing the Windows registry.
What should Avast do? Well, it IS Avast's baby now and they ought to clean up the mess. Firstly, tighten development/build server security to ensure this never happens again. Publish removal instructions and better still offer a free removal tool that makes it easy for users to get rid of the malware. Not every Windows user is comfortable editing the Windows registry.
Last edited:
You'd be very wrong to assume that.
I was shocked when I heard of this. Luckily, I (for some reason I don't remember) had disabled the update check setting so I never updated from .32 to .33. Updated to .35 now since we can't know for sure if .32 was infected.
I think they should provide a cleanup tool for the mess they infected the users with. I can't see why they should give away their or Avast products for free though.
I think they should provide a cleanup tool for the mess they infected the users with. I can't see why they should give away their or Avast products for free though.
There's no need, Only the CCleaner exe was infected. If you update to the current version, or uninstall it, the infection will be gone.
Seems Avast is unlucky about hacked sites, before it was their forum that was hacked
- Nov 19, 2014
- 2,350
Either luck or negligence. You decide which one you prefer.Seems Avast is unlucky about hacked sites, before it was their forum that was hacked
- Apr 5, 2014
- 6,008
Hi
I choose "Provide a specific removal tool, because Talos (security experts) advise image recovery"
I choose "Provide a specific removal tool, because Talos (security experts) advise image recovery"
- May 7, 2016
- 1,307
Progress on CCleaner Investigation by the Avast Security Threat Labs team
Progress on CCleaner Investigation
Progress on CCleaner Investigation
- Nov 26, 2016
- 699
It's detected by avast! AV and it's literally just a binary. It doesn't actually install anything on the system. So, deleting it or uninstalling is enough.
- May 7, 2016
- 1,307
Last edited by a moderator:
Well this makes me very glad I am using Excubits MZwritescanner. It is a pain in the butt, but detects DLL's dropped anywhere on the system.
