Piriform Hacked, CCleaner August Versions (v5.33.6162) Injected, Compromised

[LogitechFan]

Moreover, the current version that is distributed by Download.com (the link is on the piriform website as of this morning) is actually detected by Malwarebytes during the installation (tried it today). All I can say is - fucking insane! Will never use this POS again, and so should you.

 

[TheDeeGee]

My NOD32 alerted me this morning, and removed it while Windows was still starting programs ^^

Win32/CCleaner.A - Object: C:\Program Files\CCleaner\CCleaner.exe
Win32/CCleaner.B - Object: Werkgeheugen = CCleaner.exe

Strangely enough that's the 64-Bit Program Files folder... even though they said only 32-Bit is affected.

Also ran a scan with Immunet to be sure, nothing else found, nor anything in the registery named Agomo.

 

[rtwjunkie]

My NOD32 alerted me this morning, and removed it while Windows was still starting programs ^^

Win32/CCleaner.A - Object: C:\Program Files\CCleaner\CCleaner.exe
Win32/CCleaner.B - Object: Werkgeheugen = CCleaner.exe

Strangely enough that's the 64-Bit Program Files folder... even though they said only 32-Bit is affected.

Also ran a scan with Immunet to be sure, nothing else found, nor anything in the registery named Agomo.

The whole thing installs into the 64 bit Program Files folder. In there you should find both executable.

 

[TheDeeGee]

The whole thing installs into the 64 bit Program Files folder. In there you should find both executable.

Interesting.

That means the Auto Cleanup Feature on Startup uses the 32-Bit Exe...

That's why my NOD32 went off.

 

[Mindweaver]

Here is how you can check to see if you were infected.

 

[remixedcat]

I love the new Discover card alerts ad, they should alert everyone that Equifax is a dangerous website and has compromised their future credit due to hiring a music teacher/director for "diversity".

Best reply in here!

 

[kn00tcn]

that was regarding the multiple replies in this thread insulting the equifax security person having a music background, implying they cannot manage security

 

[DeathtoGnomes]

that was regarding the multiple replies in this thread insulting the equifax security person having a music background, implying they cannot manage security

if the shoe fits!

 

[Frick]

Were you using the infected version? Format and reinstall.

The second stage appears to use a completely different control network. The complex code is heavily obfuscated and uses anti-debugging and anti-emulation tricks to conceal its inner workings. Craig Williams, a senior technology leader and global outreach manager at Talos, said the code contains a "fileless" third stage that's injected into computer memory without ever being written to disk, a feature that further makes analysis difficult. Researchers are in the process of reverse engineering the payload to understand precisely what it does on infected networks.

"When you look at this software package, it's very well developed," Williams told Ars. "This is someone who spent a lot of money with a lot of developers perfecting it. It's clear that whoever made this has used it before and is likely going to use it again."

Stage one of the malware collected a wide assortment of information from infected computers, including a list of all installed programs, all running processes, the operating-system version, hardware information, whether the user had administrative rights, and the hostname and domain name associated with the system. Combined, the information would allow attackers not only to further infect computers belonging to a small set of targeted organizations, but it would also ensure the later-stage payload is stable and undetectable.

Now that it's known the CCleaner backdoor actively installed a payload that went undetected for more than a month, Williams renewed his advice that people who installed the 32-bit version of CCleaner 5.33.6162 or CCleaner Cloud 1.07.3191 reformat their hard drives. He said simply removing the stage-one infection is insufficient given the proof now available that the second stage can survive and remain stealthy.

The second stage seems to be targeted at things like Cisco, MS, Gmail, VMWare, Akamai and Samsung, but still. This is getting interesting.