Linked by Thom Holwerda on Tue 19th Sep 2017 09:58 UTC
Privacy, Security, Encryption

Talos recently observed a case where the download servers used by software vendor to distribute a legitimate software package were leveraged to deliver malware to unsuspecting victims. For a period of time, the legitimate signed version of CCleaner 5.33 being distributed by Avast also contained a multi-stage malware payload that rode on top of the installation of CCleaner. CCleaner boasted over 2 billion total downloads by November of 2016 with a growth rate of 5 million additional users per week. Given the potential damage that could be caused by a network of infected computers even a tiny fraction of this size we decided to move quickly. On September 13, 2017 Cisco Talos immediately notified Avast of our findings so that they could initiate appropriate response activities. The following sections will discuss the specific details regarding this attack.

Don't use registry cleaners. They serve no purpose.

Thread beginning with comment 648994
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:

Let me follow this up by saying a reinstall and an uninstall and then install also did not fix the issue.

Reply Parent Score: 2

Kochise Member since:

Yup, used to install our products using InstallShield that had the bad habit to leave traces/leaks all around the registry and hard disk, making further installations hazardous if not plain futile.

I had to program my own version of a registry cleaner to remove any hints of a previous installation to allow customers to reinstall our software. I then switched to InnoSetup and all problems were gone.

Hail to good guy Jordan Russell.

Reply Parent Score: 4