CCleaner Malware Incident – What You Need to Know and How to Remove

Improve Security & Performance With .htaccess
Improve Security & Performance With .htaccess
September 18, 2017
Network Attacks Containing Cryptocurrency CPU Mining Tools Grow Sixfold
September 19, 2017

An unknown threat group compromised the CCleaner infrastructure.

The attacker added malware to the CCleaner 5.33.6162 and CCleaner Cloud 1.07.3191 installers, but the malware only executed on 32-bit systems and when run by a user with admin rights.

The files were available for download between August 15 and September 12.


Who is affected?

Everybody who downloaded and installed the affected versions in that timespan.

Avast estimates the number of affected machines at 2.27 million.


How can I tell if I was infected?

When an infected version of CCleaner was installed it would have created a Windows Registry key located at HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\Agomo. Under this key will be two data values named MUID and TCID, which are used by the installed Floxif infection.

You can use Registry Editor to navigate to the Agomo key and see if it exists. If it does, then you are infected with this malware.

Please note. as seen below, upgrading to version 5.34 will not remove the Agomo key from the Windows registry. It will only replace the malicious executables with legitimate ones so that the malware is no longer present.


What does the Floxif malware do?

The malware — named Floxif — collects data from infected computers, such as computer name, a list of installed software, a list of running processes, MAC addresses for the first three network interfaces, and unique IDs to identify each computer in part.

The malware could also download and execute other malware, but Avast said it did not find evidence that attackers ever used this function.


How do I remove the Floxif or CCleaner Malware?

The malware was embedded in the CCleaner executable itself. Updating CCleaner to v5.34 removes the old executable and the malware. CCleaner does not have an auto-update system, so users must download and install CCleaner 5.34 manually.

Avast said it already pushed an update to CCleaner Cloud users, and they should be fine. The clean version is CCleaner Cloud 1.07.3214.


Source: bleepingcomputer

United Communication Group
United Communication Group
United Communication Group is a copyrighted and registered trademark in the field of communications, IT and web services providing.

Leave a Reply

Your email address will not be published. Required fields are marked *

four × four =

Get Your Hosting Today