4 ms·

So it was only the 32-bit executable that was affected? By default CCleaner installs both the 32-bit and 64-bit versions, however on 64-bit systems it only run

by tekni5 9y ago

So it was only the 32-bit executable that was affected? By default CCleaner installs both the 32-bit and 64-bit versions, however on 64-bit systems it only runs the 64-bit executable and points every shortcut it makes to the 64-bit executable. On one of my affected systems that appears to have had 5.33 installed, I noticed no registry keys that appear to be created and that system never ran the 32-bit executable. Would it be safe to assume it's not affected and simply uninstalling CCleaner 5.33 is enough? Piriform seems to suggest that only some useless system information was ever released by the compromised version. The general worry is that it wasn't just that information, but also other more important things like account logins and such.

nothrabannosir 9y ago
> Would it be safe to assume it's not affected Well, it would be many things, but it wouldn't be "safe". Not a tinfoiler, just a pedant :) I could go with "reasonable".
giancarlostoro 9y ago
According to: https://news.ycombinator.com/item?id=15274517 https://news.ycombinator.com/item?id=15274517 This blog post from Piriform has more details: http://www.piriform.com/news/release-announcements/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users http://www.piriform.com/news/release-announcements/2017/9/18... Basically they believe it was only the 32-bit installer that was compromised.
- r1ch 9y ago
  I wish there was more technical information, even the advisory is unclear here. The CCleaner installer is always 32 bit for compatibility - it installs both 32 bit and 64 bit program binaries. On 64 bit systems, the default shortcuts are to the 64 bit binary. So was the 32 bit installer compromised, or only the 32 bit binary? The original advisory makes references to the installer which is quite confusing. Tried to figure it out myself but I assume the loader has VM detection techniques as I wasn't able to infect a VM.
lightedman 9y ago
"By default CCleaner installs both the 32-bit and 64-bit versions" So the default for CCleaner, which is supposed to get rid of old system bloat and cruft, is to be bloaty and crufty, and install versions of itself the system does not need or can not use?
tekni5 9y ago
I found out that CCleanerSkipUAC in TaskScheduler appears to execute the 32-bit binary on 64-bit systems as well. Avast/Piriform claim that the payload is not executed at all on 64 bit systems, and there is no secondary payload. I guess it depends how much you want to trust that information.
jlgaddis 9y ago
It might be "acceptable" or "reasonable" to assume it's not affected. It would be safe to assume that it is.
ytta 9y ago
I believe that it was just the 64-bit version. See their twitter reply: https://twitter.com/piriform/status/910098222051446784 https://twitter.com/piriform/status/910098222051446784 'The 64-bit version of CCleaner v5.33.6162 was not affected but we encourage all users to update to the latest version, 5.24.'

by tekni5 9y ago

nothrabannosir 9y ago

> Would it be safe to assume it's not affected Well, it would be many things, but it wouldn't be "safe". Not a tinfoiler, just a pedant :) I could go with "reasonable".

giancarlostoro 9y ago

According to: https://news.ycombinator.com/item?id=15274517 https://news.ycombinator.com/item?id=15274517 This blog post from Piriform has more details: http://www.piriform.com/news/release-announcements/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users http://www.piriform.com/news/release-announcements/2017/9/18... Basically they believe it was only the 32-bit installer that was compromised.

r1ch 9y ago
I wish there was more technical information, even the advisory is unclear here. The CCleaner installer is always 32 bit for compatibility - it installs both 32 bit and 64 bit program binaries. On 64 bit systems, the default shortcuts are to the 64 bit binary. So was the 32 bit installer compromised, or only the 32 bit binary? The original advisory makes references to the installer which is quite confusing. Tried to figure it out myself but I assume the loader has VM detection techniques as I wasn't able to infect a VM.

lightedman 9y ago

"By default CCleaner installs both the 32-bit and 64-bit versions" So the default for CCleaner, which is supposed to get rid of old system bloat and cruft, is to be bloaty and crufty, and install versions of itself the system does not need or can not use?

tekni5 9y ago

I found out that CCleanerSkipUAC in TaskScheduler appears to execute the 32-bit binary on 64-bit systems as well. Avast/Piriform claim that the payload is not executed at all on 64 bit systems, and there is no secondary payload. I guess it depends how much you want to trust that information.

jlgaddis 9y ago

It might be "acceptable" or "reasonable" to assume it's not affected. It would be safe to assume that it is.

ytta 9y ago

I believe that it was just the 64-bit version. See their twitter reply: https://twitter.com/piriform/status/910098222051446784 https://twitter.com/piriform/status/910098222051446784 'The 64-bit version of CCleaner v5.33.6162 was not affected but we encourage all users to update to the latest version, 5.24.'