back to article Downloaded CCleaner lately? Oo, awks... it was stuffed with malware

Antivirus firm Avast has admitted inadvertently distributing a trojanised version of CCleaner, a popular PC tune-up tool, for nearly a month, infecting an estimated 2.27 million users. Cisco Talos discovered that servers distributing the program were leveraged to deliver malware to unsuspecting victims. "For a period of time …

Page:

    1. TRT Silver badge
      Facepalm

      Re: I'm an idiot

      Oh! It's a person. I thought it was a cool name for a team in a well known IT outfit. *red face*

  1. jimdandy
    Windows

    So...from the above, it seems that anyone who has used CCleaner in the past 6 mos is a sucker, and should have known better. And that anyone who has used Avast as an anti-malware/anitvirus/and-anti-whatever program is pretty much hoisted. By their own petard. And of course that includes those paid-for users.

    So, brilliant ones: what is your solution to the problem of people who want to keep their skirts clean, and like to do something about it once in a while? I get the "jettison Avast ASAP" point of view. Including the regardless-of-the-dirty-CCleaner-is-rotten POV.

    Most of the users out there are not the "striding-brilliantly-through-the-Cosmos" adepts that y'all are.

    Isn't it about time that you offered some alternate suggestions?

    1. Elmer Phud

      Yup, I didn't get round to updating on this machine (everything is set to ask - not update).

      But it's been a vital tool for quick cleans of friend's machines where years and years of basic usage has ended up with more detritus to wade through than actual useful stuff.

      Progs installed, uninstalled, half-installed, failed installs -- all sorts of backyard junk, plus the never ending 'temp' files.

      Usually Ccleaner then Malwarebyes - maybe the other way round next time?

    2. Patrician

      Alternatives to CCLeaner are not necessary on a modern OS no no alternative offered or needed. Alternative, free, AV? Stop trying to use free software and pay for a decent AV, Bit Defender, F-Secure, Eset etc. All are better than the "free" ones.

    3. JCitizen
      Coffee/keyboard

      All of my clients are on a budget...

      and cannot afford much more than one paid solution. I've been putting Avast on their systems for years, and sometimes they were using an inferior free bee, and always had trouble with them. Avast has its quirks, but they are usually easy to correct. Now I only recommend even poor people should try to buy MBAM. If they go in together and buy a 3 license copy, they can get a really good deal and spread them among them selves. I still recommend Avast, because it will block many problems before they ever get on the computer, so MBAM has nothing to deal with in those instances. Avast is noisy, and I think that is why people think it acts like malware - I LIKE It to get noisy, because other wise you don't know the otherwise legitimate site is using bad security practices. There are just too many good features on Avast, like the application updater, and notifier, to ignore it. I will admit, that on folks using Windows 10, I feel the built in Defender is enough, but even then I recommend MBAM Premium if they have anything to lose! I will admit the paid for version of Avast is a pain in the behind and I will never recomment it!

      1. Charles 9

        Re: All of my clients are on a budget...

        "Now I only recommend even poor people should try to buy MBAM."

        And if they're TOO poor even for that?

  2. Ruisert

    I've used CCleaner for years (10 at least) and find it to be very handy at cleaning crap (CCleaner's original name was Crap Cleaner) like temp files many product installations fail to clean up. And when I do run it, it generally frees up a GIG or two of drive space. My mom, who is the very epitome of a clueless computer user picked up another browser hijacker the other day - I ran CCleaner on it, all better.

    But I guess it's typical human behavior to blast something without having a clue as to what it actually does.

    1. VulcanV5
      Paris Hilton

      Re: Ruisert

      Not sure about it being typical human behaviour, more like typical Generation Moron behaviour from some commentards trying to show off their intellectual superiority on here and failing miserably.

      I too have used CCleaner since the days it was known as CrapCleaner (the name didn't upset its home UK market but was eventually deemed too much for sensitive souls across the Pond) and of course, it isn't malware.

      CCleaner started life more than a decade ago as a quick and easy cleaner of crap. It still is. Additional tools have been bundled in over the years, including a 'registry cleaner' whose value (to me) has always seemed pointless, as well as hazardous, but which others seem to like: their choice. The CCleaner version I run is the freebie, not the paid-for, and is old enough to have cobwebs all over it. But it works fast to clear caches, cookies and what have you whenever required, and plays nicely with my Malwarebytes Premium, Panda AV, and WinPatrol. It has always erred on the safe side, and though out-performed, as it were, by the only other utility of this type I've ever bothered with -- Kerish Doctor -- it has, unlike Kerish, never mis-identified any of the clutter.

      I'm sorry Piriform has sold out to Avast because it's the end of an era and past experience of Avast has taught me to keep well clear of any of its bloatware. I'll keep on though with CCleaner 5.13.5460 which, as far as I'm aware, is still available on software archival sites, and leave the Generation Moron representatives on here to continue on with their own condemnation of a product about which they very clearly know absolutely sod all.

      1. TRT Silver badge

        Re: Ruisert

        I've always found the registry cleaner to work well. Its value is limited nowadays, but on a 32-bit machine with 2-4Gb of memory and several programs running, risking the HIVE files getting too big to fit into actual RAM and becoming paged to disk instead... well, CCleaner's registry tool would prune 100s of K off the file, the machine still worked, and the reported things being removed were mostly left over broken links to .NET files orphaned by upgrades. If a machine had been sitting there updating for years, with software going on and coming off, then the reported issues from that tool could easily run into the thousands. I always used to rerun it until I got two consecutive "no problems", because keys referred to keys, which referred to keys, which referred to nothing.

      2. Charles 9

        Re: Ruisert

        "I too have used CCleaner since the days it was known as CrapCleaner (the name didn't upset its home UK market but was eventually deemed too much for sensitive souls across the Pond) and of course, it isn't malware."

        Why didn't they just rename it CrudCleaner? Same implication, cleaner cuss word.

    2. Hans 1

      But I guess it's typical human behavior to blast something without having a clue as to what it actually does.

      CCleaner does more harm than good, it is a useless piece of software, snake oil, if you like.

      Don't trust me, fine, would you trust an MVP more than the MHP ?

      https://answers.microsoft.com/en-us/windows/forum/windows_7-performance/recommended-registry-cleaners/871eb3a9-3b97-4113-a257-6a43795f2175?auth=1

      I the MHP (Microsoft Most Hated Professional) recommends against using that crap ...

      To those who doubt ... I know ccleaner, I have used it in the past to see what it does ... it is snake oil.

      1. JCitizen
        Megaphone

        I call BS to any detractor of this people's choice!!

        I cal BS to anybody claiming to be a professional that says CCleaner is useless - maybe you don't want to mess with the registry cleaner OH KAYYyy! But too many of the other features and proven themselves, along with the reg cleaner to me over the years, to convince me of any other reality. I've NEVER had a problem with CCleaner - I've ALWAYS solved problems with it, and all of my clients have breathed a sigh of relief every since.

        NOBODY can talk me down or convince me otherwise, as I have just seen too much happen; especially in my honeypot lab! In fact I have actually seen malware try to manipulate CCleaner icons, and shortcuts in an effort to foil any restricted rights user from operating it - you can't tell me it is not effective in removing most threats that stay inside the parameters the operating system sets, just as long as the user doesn't fall for any Social Engineering to allow the attack. I've seen too much proof to be convinced other wise!

        1. TRT Silver badge

          Re: I call BS to any detractor of this people's choice!!

          CCleaner removes threats? Really? Are people getting it confused with some sort of malware protection?

      2. VulcanV5

        @ Hans 1

        Your ability to comprehend the user-chooser multiple functionality of CCleaner is obviously as fitful as your ability to express coherent thought. For the record: I wouldn't even trust CHP to tell me anything useful about that particular software, never mind MVPs or MHPs. Or any other Muddled Vacuous Pratt, either.

      3. David Nash Silver badge

        @Hans1

        On that link you posted MHP etc... the writer (Ken Blake) responds to a commenter asking what he should be doing, if not running a reg cleaner:

        "But there are many things you can do in this regard that are

        completely safe. For example, you can run Disk Cleanup and do all of

        the choices there. No problem and it gets rid of some things you don't

        need, thereby saving a little (usually very little) disk space.

        Similarly, you can run CCleaner, which does a lot of the same things,

        perhaps a little more thoroughly. CCleaner is safe to use, as long

        as you don't use its registry cleaning functionality, which is not

        safe."

        Interestingly he also recommends Avast, amongst other things.

  3. Wayland

    Wise Care and Kasperski installed but...

    ... still CC Cleaner managed to find it's way onto the system after only a day with the customer.

    Getting 666 Threats detected please pay £20 and occasional BSD.

    Kasperski is usually quite picky who it will let on your system so how come it did not detect the bad guys? It looks like I am going to have to wipe and start again.

    1. Elmer Phud

      Re: Wise Care and Kasperski installed but...

      ".. still CC Cleaner managed to find it's way onto the system after only a day with the customer."

      It takes a click or two to do it -- AFAIK it needs help to get there.

    2. Roland6 Silver badge

      Re: Wise Care and Kasperski installed but...

      ... still CC Cleaner managed to find it's way onto the system after only a day with the customer.

      But did the customer/end user know what Wise Care did?

      I suspect that someone simply installed a cleanup tool they knew and understood; unfortunately, the version happened to have been compromised...

      Kasperski is usually quite picky who it will let on your system so how come it did not detect the bad guys?

      Yes, it would seem that questions need to be answered as to why the payload wasn't detected. Suspect that as it was a 'trusted' installer, the security scanner turned a blind eye, whereas some tools will (if set to the correct level of paranoid) scan every file installed and executed by an installer.

  4. imanidiot Silver badge
    Facepalm

    Uhhhhhhm, what?

    "Ondrej Vlcek, Avast's CTO, told The Register that there was "no indication that the second-stage payload activated" and hence no need to do a wipe and clean install as recommended by Cisco Talos."

    Ohh, I have (currently) unactived mallware on my system, but this guy says it's fine so let's do nothing....

  5. Dixx

    Monat miene arsche. The first time I saw this was eighteen moths ago. Catch up guys.

    1. Captain Badmouth

      @ Dixx

      <The first time I saw this was eighteen moths ago.>

      You should clean out that machine...

  6. Patrician

    Isn't CCleaner nothing but malware in it's own right?

  7. Grimsterise

    Forsooth!

    Lets get that straight: Independent company is sold to big antivirus firm.

    One month later their flagship product is infected with a virus.

    Hmmm, and arched eyebrows all round.

  8. Norman123

    I appreciate your dissemination of this info. I just uninstalled CCleaner and hope my Kaspersky had stopped its bad behavior. Any feedback if other antivirus could defect and stop it?

  9. thosrtanner

    only the 32 bit installer?

    Well, I have a 64 bit version of windows. Yet somehow windows defender (yup, free, comes with windows) detected the malware and quarantined it (as well as the downloaded file). And detected and cleaned registry entries.

    Yes, I use ccleaner because windows doesn't automatically clean your tmpdir and it ends up with tons of crap. not so impressed with the cookie/history cleaning and I treat the registry cleaning with a large pinch of salt (there are some programs that have been known to put entries in the registry that purport to be a file path, but the path doesn't exist, the program appears merely to be looking for the key), and to be honest I've hardly ever used it.

  10. JJKing
    Pirate

    Oh dear.

    Arrr, it be just in time for the world Speak Like A Pirate Day arrr.

    Avast me hearties, malware borders away, arrr.

  11. GrapeBunch

    VM ?

    I wonder if in the "future" we're going to be using VMs instead of most of our anti-malware. At the end of the session, the software might offer to preserve any files you've asked to be downloaded. These files will have been malware-checked by anti-malware software running in the background (so reduced real-time bottlenecks). It's a bit like the way public computers boot to ROM (not literally, I'm just calling it that) with each new user. New software? Runs in a VM, too. It would not be computing as we know it. There might be hurdles in regard to EULAs and copy protection. But it might be safer than what we have. Just a suggestion. Let the experts weigh in!

  12. Paul Woodhouse

    Been many years since I used CCleaner, I did used to but IIRC it may or may not have been responsible for b0rking a couple of machines I was trying to clean up, certainly didn't help them, what I tend to use now for cleaning is a combination of malwarebytes, autoruns and treesize for a basic cleanup will fire up process explorer if I'm suspicious of anything....

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like