Popular software CCleaner infected with backdoor

Published by

Click here to post a comment for Popular software CCleaner infected with backdoor on our message forum
https://forums.guru3d.com/data/avatars/m/240/240605.jpg
You´re never really safe are you? Such a cool little program, what a shame... 🙁
https://forums.guru3d.com/data/avatars/m/180/180832.jpg
Moderator
glad i use the portable one
https://forums.guru3d.com/data/avatars/m/266/266714.jpg
Thank you for the warning
https://forums.guru3d.com/data/avatars/m/88/88775.jpg
Jesus, makes you wonder doesn't it. Inside job?
data/avatar/default/avatar02.webp
One less thing to install after Windows!
https://forums.guru3d.com/data/avatars/m/242/242134.jpg
not an issue for me or machines i work on. stopped using newer releases after 5.18.5607, when they went with "premium" crap. even that i dont believe in "dont fix a working system", its not always the best to update everything as soon as possible.
https://forums.guru3d.com/data/avatars/m/169/169351.jpg
So we need a crap cleaner for CCleaner now :')
https://forums.guru3d.com/data/avatars/m/256/256350.jpg
It should be noted that all communications from piriform indicate it affects only 32-bit Windows systems.
https://forums.guru3d.com/data/avatars/m/248/248721.jpg
Thanks for the heads up HH!
https://forums.guru3d.com/data/avatars/m/16/16662.jpg
Administrator
ubercake:

It should be noted that all communications from piriform indicate it affects only 32-bit Windows systems.
Actually, I think what they meant is this, it involves the 32-bit installer, which most normal people download download and which installs just fine on 64-bit OSes.
https://forums.guru3d.com/data/avatars/m/179/179091.jpg
WhiteLightning:

glad i use the portable one
I use it too. In fact, I always use portable editions over classic setup ones (whenever that option is present, of course).
https://forums.guru3d.com/data/avatars/m/271/271834.jpg
Damn it. I was running that version of CCleaner. Scanning with Malwarebytes as I type this and I see it detected the trojan 🙁 I'll wait for the scan to finish and hope it takes care of it. Cant remember the last time I got infected. Will really suck if i have to reinstall windows. I had already scanned with windows defender both a full scan and the offline one and it didn't see it...
https://forums.guru3d.com/data/avatars/m/216/216235.jpg
Just use the Portable build. Always used it myself.
https://forums.guru3d.com/data/avatars/m/196/196426.jpg
Version handled by Chocolatey is 5.34.6207 and just ran a malwarebytes scan - 0 infections detected. I seriously recommend this to handle your free software installations, not only that it does them automatically ( like Linux package managers ), but also is another layer of safety ( every update on all their software is thoroughly scanned, so chance of such mishaps is very slim ) https://chocolatey.org/ Started using it about 5 months back and I would never go back to manual installs, that feels so archaic ! http://dl.wavetrex.eu/2017/chocolatey.png
https://forums.guru3d.com/data/avatars/m/245/245459.jpg
I supposedly had the affected version of CCleaner installed, but regular Malwarebytes & Avira scans that I do have never picked up any infection. Either way I downloaded the new version of CCleaner & I'm running a full deep scan again with Malwarebytes - I'll update this post if it finds any malware - I doubt it as I did a scan a few days ago. Mind you I always delete the setup program file after installation & I see the user above me just detected the trojan in the setup file, maybe that's why my PC has been coming up clean recently after scans. EDIT: just finished scans - yep, no detections.
data/avatar/default/avatar39.webp
I don’t miss Windows.
data/avatar/default/avatar02.webp
Moto_Life:

It did remove it. Think I'm all good now?
Malware bytes didn't detect a problem with a system. It found a problem with the installer. You could try to boot into safe mode (F8) and scan again, but most likely, you're fine.
data/avatar/default/avatar29.webp
how can i check if i was infected? not enough details in the article....