Warning, Opinions ahead.
Claims and Questions
Infected file: 32-bit CCleaner.exe (version 5.33.6162)
AFAIK the 32-bit exe is present in the following versions: Standard, Portable, Pro, and Slim.
I have the slim and portable versions here. The 32-bit exe is identical in both.
AFAIK the portable version doesn’t make registry entries.
Are all versions effected?
Information out there does not add up.
Piriform/Avast says uninstalling is enough.
According to the guys that discovered the malware, “Uninstalling the tool will not remove the malware“.
This is why I haven’t offered any definitive advice on ridding yourself of the problem. Anybody who says that anything other than restoring from an image will fix this is jumping the gun. We do not have all the info.
What? Why? Who?
They said the malware didn’t seek any sensitive info.
The malware put a random unique number to identify the system and then uploaded the following info:
– Name of the computer
– List of installed software, including Windows updates
– List of running processes
– MAC addresses of first three network adapters
– Additional information whether the process is running with administrator privileges, whether it is a 64-bit system, etc.
That is really bizarre. Why go through all that trouble for that little bit of info? Possibilities:
– They did it for the lulz.
– They did it to hurt the reputation of the software/vendor.
– Info we have been given is wrong and the hack is worse.
Then Who?
– They did it for the lulz.
OK, nice hack. No harm on the users end.
– They did it to hurt the reputation of the software/vendor.
Mission accomplished. Now, pissed off employee, ex-employee, or competitor?
– Info we have been given is wrong and the hack is worse.
Whole can of worms here. Leet hackers, state sponsored, organized crime???
Put your tinfoil hat on and chime in!
vlad says
http://www.techrepublic.com/article/if-you-used-ccleaner-software-to-clean-up-your-device-you-may-have-infected-yourself-instead/
Eric (a.k.a. TweakHound) says
Replaced text with link.
Stop the press says
“About 30% of CCleaner users also run Avast security software, which enables us to analyze behavioral, traffic and file/registry data from those machines. Based on the analysis of this data, we believe that the second stage payload never activated, i.e. the only malicious code present on customer machines was the one embedded in the ccleaner.exe binary,” they explained.
“Therefore, we consider restoring the affected machines to the pre-August 15 state unnecessary. Customers are advised to update to the latest version of CCleaner, which will remove the backdoor code from their systems. As of now, CCleaner 5.33 users are receiving a notification advising them to perform the update.”
https://www.helpnetsecurity.com/2017/09/19/ccleaner-backdoor-incident/
Eric (a.k.a. TweakHound) says
“About 30% of CCleaner users also run Avast security software” The company that allowed CCleaner to be compromised.