CCleaner has been hacked, attached malware, things to know and how to fix it

An unknown hacker group attacked CCleaner's infrastructure and added malware to the 32bit versions of CCleaner 5.33.6162 and CCleaner Cloud 1.07.3191. These files are available for download from August 15 to September 12. Users who have installed CCleaner during this time are likely to have become victims of the attack.

Who is affected?

Those who have downloaded and installed CCleaner 5.33.6162 and CCleaner Cloud 1.07.3191 during the above period. Avast estimates the number of affected machines up to 2.27 million.

What does CCleaner malware do?

This malware is called Floxif, collecting data from infected computers, such as computer name, list of installed software on the computer, list of running processes on the computer, MAC address for 3 networks. The first interface and unique IDs to identify each computer.

The malware also downloads and executes another malware, but Avast said it found no evidence that hackers used it.

CCleaner has been hacked, attached malware, things to know and how to fix it Picture 1

How to delete malware on CCleaner?

Malware is embedded directly into CCleaner's executable file. Updating CCleaner to version 5.34 will remove old executables and malware. CCleaner does not have an automatic update system, so users must download and install CCleaner 5.34 manually.

Avast said it has released an update for CCleaner Cloud users, and there is no problem with malware being detected. The clean version is CCleaner Cloud 1.07.3214.

Anything else?

Malware is only executed if the user is using the Administrator account. If you are using a low-powered account and installing CCleaner 5.33, you are not affected much. However, updating to version 5.34 is necessary,

Why does antivirus software not detect this malware?

CCleaner binaries include malware signed by a valid digital certificate issued by Symantec to Piriform, so antivirus software does not notice the difference and therefore does not detect malware. Furthermore, the hacker used the Domain Generation Algorithm (DGA) so that if their server crashed, the DGA could create new domain names and send stolen information.

Users also do not notice anything unusual because every installation operation is done automatically like normal. In summary, download CCleaner 5.34 here and reinstall immediately if you are using the affected CCleaner 5.33 version.

9 most effective antivirus software for Windows today

Avast got the malware when it just bought CCleaner not long ago, a security company, released software bundled with malware, didn't know which haker group "scratched" so .

Latest update: Avast blocked the server connected to malware.

CCleaner

Micah Soto

Update 24 May 2019

You should read it

May be interested

Microsoft put CCleaner on a 'black list' on the official forum
recently, microsoft has decided to put ccleaner application on the blacklist on the official microsoft support forum to ensure safety for users when searching information on its forum.
The UN acknowledges that cyberattacks are extremely sophisticated and cannot identify the culprit
the united nations recently acknowledged the organization was the target of a massive cyberattack in the summer of 2019.
How to delete repeat file to save computer memory by CCleaner
in the process of using the computer, users can easily encounter the situation of saving the same data file on different partitions of the hard drive. for example: you saved a music video to drive d, but later for some reason, you saved the same file in the other drive of the device.
Good tips, features on CCleaner
many people know and use ccleaner to clean their computers and registry cleaners, but there are many other useful features of ccleaner that you may not know.
3 things to do right after removing the malware
after removing the malware you need to change some of the system settings, which were previously altered by malicious software. the following article will show 3 important things that you need to do immediately after removing malware from your computer.
12 signs that your computer is hacked
just relying on the strange signs that appear during the use of the computer, you can easily know whether your computer has been attacked or not to find a way to fix it. these are signs that your computer has been hacked.
How to fix hacked / infected phone
in today's internet of things (iot) era, every electronic device that supports internet connection is at risk of being hacked / infected with viruses. the cell phone is of course no exception.
How to Tell if Your Asus Router Is One of the Thousands of Hacked Models
more than 9,000 asus routers have been quietly hacked, and if you own one of those routers, there's a good chance yours is on the list. luckily, you don't have to wait for things to go wrong to find out.
Docker Hub is used by hackers to spread Cryptojacking malware
malicious software is installed by the hacker into docker images and spreads through the docker hub itself.
Signs show clearly that your system is being hacked
if an email requests any sensitive information such as your address, bank account, social security number, or even the date of birth, chances are it's a fake email.

CCleaner has been hacked, attached malware, things to know and how to fix it

You should read it

May be interested

Tech info