Ccleaner update

[JAY B.]

Hi,

Even though I was using the 64 bits version of CCleaner, there was a suppression of the malware done by Kaspersky.
Because Filehippo downloaded both versions (32 'n 64 Bits) when it updated CCleaner. But it was not active because only the 64 bits was executed.

So don't be surprised to see the same thing with your computer !

Hope these explanations were clear ???

Regards JAY B.

 

[JAY B.]

Hi,

A second malware has been discovered in CCleaner : https://www.ghacks.net/2017/09/21/ccleaner-malware-second-payload-discovered/

Bye JAY B.

 

[Wolfie]

I didn't know that CCleaner was from Avast, I will have to talk to my Czech friends and get them to pull their socks up!.

I just installed Avast and CCleaner on an old Windows 7 PC install I was working on, I'd better check it out sharpish like!.

Without reading through all the info posted in this thread (thanks everyone), how does the virus/malware manifest itself?.

 

[clifford_cooley]

I didn't know that CCleaner was from Avast,

This is the article I heard about it from.

Avast acquired Piriform, the maker of CCleaner and Speccy in July of 2017.
The year before Avast acquired AVG in July of 2016.

Makes me wonder which company Avast will acquire in July of 2018.

 

[davehc]

Windows 10?

 

[Bif]

This is the article I heard about it from.

Avast acquired Piriform, the maker of CCleaner and Speccy in July of 2017.
The year before Avast acquired AVG in July of 2016.

Makes me wonder which company Avast will acquire in July of 2018.

Note to self...
Buy stocks in Avast...

 

[JAY B.]

Hi,

how does the virus/malware manifest itself?.

By collecting your data !

You can search in your Registry for a key called « Agamo ».

HKEY_LOCAL_MACHINE\SOFTWARE\Piriform, and if you see « Agamo », you have to delete that key, and then you check in « HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Piriform » and once again if you see « Agamo », you delete it.

And you can consult the link I provided to check for other keys in the Registry.

I hope this will be helpful !

Bye

 

[davehc]

I was running '533, subsequently updated to '534.

I searched in the registry for the entries, and the suggested files and found nothing. I only use Defender and the built in firewalls in the router and windows 10, so perhaps anything malicious was, luckily, intercepted?

 

[JAY B.]

Hi davehc,

I did the same search as you did, and I had not found any of the keys nor the files but Kaspersky found and deleted the malicious .exe.

Glad you found nothing !

Regards JAY B.

 

[Wolfie]

Hi JAY B,

I took a look per your instructions and it doesn't look like I have anything lurking there, thanks!.