CCleaner infected with Malware

[BobR]

As a non-tech kind of person I am kind of flabbergasted that a company that is there to help you optimize your computer has placed malware on some computers.

The little bit I have read doesn't tell me a lot but it seems most personal data is safe, so they want you to believe.

I guess I need to check which version of CC is on my desktop and my wife's laptop tonight. I will check, but I am most likely OK, it was only supposed to have hit 32 bit WIN 10 machines.

http://www.msn.com/en-us/news/technology/ccleaner-hack-affects-227-million-computers-heres-what-to-do/ar-AAs8Ukp?OCID=ansmsnnews11

https://www.cnet.com/news/hackers-hid-malicious-code-in-popular-ccleaner-software/

https://techcrunch.com/2017/09/18/avast-reckons-ccleaner-malware-infected-2-27m-users/

I wonder what an event like this does to a company's bottom line when it is a freeware program? Does it trickle into the fee items this company markets?


bob

[Ben]

Was just gonna post this as I knew many here use it.

Looks like the updated software will take care of the problem. Still, I wonder how long the problem existed or other problems existed previous to Avast buying them? It seems like maybe it was only discovered due to Avast security audits?

 

[Mannlicher]

from what I read,  only recent downloads were effected.  Any current down load corrects the issue.  Says Avast, the parent company.

[charby]

Using free software to protect your computer is like hiring a music major to run your IT security.

[BobR]

Using free software to protect your computer is like hiring a music major to run your IT security.

Never seen IT at a VA have you?



bob

[MechAg94]

Using free software to protect your computer is like hiring a music major to run your IT security.

English majors are okay?  

[lee n. field]

Never seen IT at a VA have you?



bob

Let me guess.  Microsoft Security Essentials, running on an XP box.

[RocketMan]

I went to use ccleaner yesterday on this laptop, and it rather forcefully suggested that I upgrade to the latest version.  It was just short of actually pushing the upgrade automatically.  Now I know why.
After seeing this thread I went back to the downloads folder and sure enough, the previous version of ccleaner had been the infected one.
Multiple scans done and thankfully nothing showed up.

[Hawkmoon]

The article I read said the infected version was the one available for download during August. Does anyone know what version that is (was)?  I have 5.29.6033, and I'm pretty certain that's older than August of 2017. I ran a virus scan a couple of days ago and my system was clean -- does that mean I dodged the bullet?

[mtnbkr]

Using free software to protect your computer is like hiring a music major to run your IT security.

 

Maybe we're thinking different scales here, but we use a LOT of free (as in beer and speech) software in enterprise security operations on a global scale. 

Chris

[RevDisk]

Using free software to protect your computer is like hiring a music major to run your IT security.

Not to mention, you don't need CCleaner or similar software anymore. It's much more likely to cause a problem than fix it. Some people swear by it religiously, but I've literally never seen a case where it was particularly useful on a recent OS.

Maybe we're thinking different scales here, but we use a LOT of free (as in beer and speech) software in enterprise security operations on a global scale. 

Chris

I don't think he's referring to serious FOSS like ssh, nagios, OpenVAS, nmap, snort, etc. He was probably meaning crap grade ad delivery software that pretends to be useful. Plenty of that around.

[mtnbkr]

I don't think he's referring to serious FOSS like ssh, nagios, OpenVAS, nmap, snort, etc. He was probably meaning crap grade ad delivery software that pretends to be useful. Plenty of that around.

Possibly, there is a real Enterprise-level bias against FOSS in some companies.  I've run into it with some of my customers as recently as 2015.

Chris

[charby]

I don't think he's referring to serious FOSS like ssh, nagios, OpenVAS, nmap, snort, etc. He was probably meaning crap grade ad delivery software that pretends to be useful. Plenty of that around.

Exactly