Malware identified in CCleaner 5.33

Re:Malware identified in CCleaner 5.33 by tekni5 on Monday September 18, 2017 @06:37AM (#15274698)

So it was only the 32-bit executable that was affected?

By default CCleaner installs both the 32-bit and 64-bit versions, however on 64-bit systems it only runs the 64-bit executable and points every shortcut it makes to the 64-bit executable.

On one of my affected systems that appears to have had 5.33 installed, I noticed no registry keys that appear to be created and that system never ran the 32-bit executable.

Would it be safe to assume it's not affected and simply uninstalling CCleaner 5.33 is enough?

Piriform seems to suggest that only some useless system information was ever released by the compromised version. The general worry is that it wasn't just that information, but also other more important things like account logins and such.

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by lightedman on Monday September 18, 2017 @09:28AM (#15275690)

"By default CCleaner installs both the 32-bit and 64-bit versions"

So the default for CCleaner, which is supposed to get rid of old system bloat and cruft, is to be bloaty and crufty, and install versions of itself the system does not need or can not use?

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by giancarlostoro on Monday September 18, 2017 @07:14AM (#15274843)

According to: https://news.ycombinator.com/item?id=15274517

This blog post from Piriform has more details: http://www.piriform.com/news/release-announcements/2017/9/18...

Basically they believe it was only the 32-bit installer that was compromised.

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by r1ch on Monday September 18, 2017 @10:59AM (#15276496)

I wish there was more technical information, even the advisory is unclear here.

The CCleaner installer is always 32 bit for compatibility - it installs both 32 bit and 64 bit program binaries. On 64 bit systems, the default shortcuts are to the 64 bit binary.

So was the 32 bit installer compromised, or only the 32 bit binary? The original advisory makes references to the installer which is quite confusing. Tried to figure it out myself but I assume the loader has VM detection techniques as I wasn't able to infect a VM.

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by nothrabannosir on Monday September 18, 2017 @06:57AM (#15274778)

> Would it be safe to assume it's not affected

Well, it would be many things, but it wouldn't be "safe". Not a tinfoiler, just a pedant :) I could go with "reasonable".

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by ytta on Tuesday September 19, 2017 @09:59AM (#15284641)

I believe that it was just the 64-bit version. See their twitter reply:

https://twitter.com/piriform/status/910098222051446784

'The 64-bit version of CCleaner v5.33.6162 was not affected but we encourage all users to update to the latest version, 5.24.'

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by tekni5 on Monday September 18, 2017 @11:03PM (#15281478)

I found out that CCleanerSkipUAC in TaskScheduler appears to execute the 32-bit binary on 64-bit systems as well.

Avast/Piriform claim that the payload is not executed at all on 64 bit systems, and there is no secondary payload.

I guess it depends how much you want to trust that information.

[ Parent | on HN ]

Re:Malware identified in CCleaner 5.33 by jlgaddis on Monday September 18, 2017 @05:46PM (#15279930)

It might be "acceptable" or "reasonable" to assume it's not affected. It would be safe to assume that it is.

[ Parent | on HN ]