CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 had been compromised

[TomFace 539]

Not sure I want (or need) a replacement for CCleaner, but someone mentioned Glary Disk Cleaner.

Does anyone have any thoughts or opinions about Glary?

[novice 20]

On ‎9‎/‎21‎/‎2017 at 4:21 AM, peteyt said:

That article mentions a 64 bit as well as a 32 bit trojan. So did the 64 bit versions get attacked?

When I downloaded and installed CCleaner for my Win7 / 64 PC  , in installation folder the 32 bit version was present and deleted by  MSE.

I do not think the 32bit version ever ran or got installed.

Edited October 9, 2017 by John Alex

[peteyt 393]

On 09/10/2017 at 4:39 PM, TomFace said:

Not sure I want (or need) a replacement for CCleaner, but someone mentioned Glary Disk Cleaner.

Does anyone have any thoughts or opinions about Glary?

I do have Glary but don't really use it. It does seem to have a lot of options/tools though. I used to use TuneUp Utilities years ago but it became bloated and hard to disable, preferring to run into the background. Eventually it got bought out by AVG

[TJP 143]

On 10/10/2017 at 2:09 AM, TomFace said:

Not sure I want (or need) a replacement for CCleaner, but someone mentioned Glary Disk Cleaner.

Does anyone have any thoughts or opinions about Glary?

Not to sure about Glary but I do use Wise Disk Cleaner Portable version. It was highly rated by Major Geeks and does work really well.

[TomFace 539]

8 hours ago, TJP said:

Not to sure about Glary but I do use Wise Disk Cleaner Portable version. It was highly rated by Major Geeks and does work really well.

Thanks TJP, I'll take a look at it.

[BrentMc 0]

I have used CCleaner for years and often update it even thought I usually don't notice a change. I do not know if I installed this version. I went ahead and uninstalled it right away. I ran a scan with Eset, MalwareBytes and SuperAntiSpyWare and didn't find a thing. Do you think I am uninfected? I do not want to plug in my external HDD's until I am reasonably sure. Thank your for any help or advice you can give me.

[TJP 143]

@BrentMc Please read through the following link https://www.bleepingcomputer.com/how-to/security/ccleaner-malware-incident-what-you-need-to-know-and-how-to-remove/

It's a step by step guide to diagnose and remove any issues.

[BrentMc 0]

4 hours ago, TJP said:

@BrentMc Please read through the following link https://www.bleepingcomputer.com/how-to/security/ccleaner-malware-incident-what-you-need-to-know-and-how-to-remove/

It's a step by step guide to diagnose and remove any issues.

Thank you. As I removed CCleaner there is not a registry entry for piriform under software in the hkey local machine tab as shown in the link you sent me.

[BrentMc 0]

Don't you think one of those scans would have turned up something if I had installed the dangerous version of CCleaner?

[TJP 143]

3 hours ago, BrentMc said:

Don't you think one of those scans would have turned up something if I had installed the dangerous version of CCleaner?

Hi Brent,

I would have thought so as Eset did detect the virus not long after the discovery was made. From the information you've posted, you should be fine.

Futher, I was using the portable version of CCleaner which does not install itself. You can find the portable version on Major Geeks (https://www.majorgeeks.com/files/details/ccleaner_portable.html)

Be aware that the company behind the program will often break the link to the portable version and you may end up in a loop trying to download the portable version. If you have the time, read the comments on Major Geeks download page about the issue.

[Trooper311 0]

On 9/18/2017 at 4:39 PM, itman said:

For starters the "offending party" in this case, Avast, is the one responsible to developing a mitigation to this issue. Since the malware remained resident and undetected for a month, the likelihood that a backdoor was installed is high. The "bugger" is trying to find the backdoor if it remains in a dormant state. It could remain that way for days, weeks, months, or in some documented cases - years.

I realize that and was just looking for a quick fix at the time.  Wrote a script myself.  Sorry for the delayed response.  Been busy.