Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on September 13, 2017, 05:54:53 PM
-
A friend at BBR installed CCleaner and it not only came bundled with avast
One was to install a free trial of Avast, the other said something like "not now." It defaulted to install Avast.
SEE thread here:
https://www.dslreports.com/forum/r31606972-Updated-CCleaner-V-v5-34-6207~start=21#31608728
edit quoted correctly :)
-
I just downloaded CCleaner and it doesn't come bundled with anything.
No clue where your friend got it from, but is sure wasn't from a trusted site if it did come with other things.
-
Hello Eddy can you post at the thread for BBR?
-
No.
I posted here and that is enough.
-
I downloaded CCleaner from the Piriform downloads page last night and it only had the usual offer for Chrome, no Avast to be seen.
-
I downloaded CCleaner from the Piriform downloads page last night and it only had the usual offer for Chrome, no Avast to be seen.
I downloaded and installed the latest CCleaner update and I always do a custom install (and I uncheck every option) and then install it for me only. I certainly haven't seen anything.
I would have thought it would be the other way round avast giving the option to install CCleaner given that Piriform is now a part of Avast Software. But avast has its avast cleaner now that may well more a bit to encompass more options from ccleaner.
-
Sounds like someone is trying to start a rumor. I'm fully up to date on both Ccleaner and Avast.
Certainly didn't see any offer to install Avast when installing Cleaner. I also always use a custom install and there aren't any options to install Avast.
-
Sounds like someone is trying to start a rumor. I'm fully up to date on both Ccleaner and Avast.
Certainly didn't see any offer to install Avast when installing Cleaner. I also always use a custom install and there aren't any options to install Avast.
No, not according to this Bob. Shame on Avast.
-
Why " Shame on Avast"????
Avast acquires Piriform, maker of CCleaner
https://press.avast.com/avast-acquires-piriform-maker-of-ccleaner
-
That's what happens when you use the primary Install button option I suspect.
With updates/new installs ALWAYS use the Custom option with any software.
The reason for the shame should be obvious.
If this is really happening when the AVAST install box is unticked (BTW deep shame on AVAST for pre-ticking it, one of the sneakiest tricks in the book) or even when opting out of the CCleaner Pro Trial then AVAST should be vilified and held to account.
Many people would assume that opting out of the CCleaner Pro trial also meant not wanting AVAST either. Obviously that AVAST box must be unticked whatever option you choose.
Dark practice and they'll be damned for it in all the PC magazines and software review web sites until that is changed.
-
https://www.tenforums.com/antivirus-firewalls-system-security/93249-making-avast-go-away.html#post1137603 (https://www.tenforums.com/antivirus-firewalls-system-security/93249-making-avast-go-away.html#post1137603)
-
Strange, I just uninstalled Ccleaner then re-installed it here are the screens I saw:
(http://screencast-o-matic.com/screenshots/u/Lh/1505352143245-49953.png)
(http://screencast-o-matic.com/screenshots/u/Lh/1505352211098-83060.png)
Where is this stuff about Avast showing up ??? What kind of installation are you doing for that to happen ???
-
Sounds like someone is trying to start a rumor. I'm fully up to date on both Ccleaner and Avast.
Certainly didn't see any offer to install Avast when installing Cleaner. I also always use a custom install and there aren't any options to install Avast.
Because you already use Avast.
-
Sounds like someone is trying to start a rumor. I'm fully up to date on both Ccleaner and Avast.
Certainly didn't see any offer to install Avast when installing Cleaner. I also always use a custom install and there aren't any options to install Avast.
Hey Bob..It may not have happened to you..but to call someone saying they or them are trying to start fake news is a shame!!
Over at BBR forum there are a few that this has happened to...NOT good in my opin and avast should STOP doing it
-
I just downloaded CCleaner and it doesn't come bundled with anything.
No clue where your friend got it from, but is sure wasn't from a trusted site if it did come with other things.
Check your facts and it was from Piriforms download page! NOT cool
-
Hi guys, maybe best to ask in the CCleaner forum directly...
-> https://forum.piriform.com/index.php?showforum=4
-
Hi hayc59, how are you :)
Bob and me have contacted the Product Manager CCleaner desktop, and they are aware of this and take action to resolve it.
Greetz, Red.
-
What's strange is that some of us can't find this Avast add-on and others apparently are.
Ccleaner has been notified. We'll let them reply to this. Sorry.
-
Sounds like the sort of quick response you would hope for.
There was another issue like this with CCleaner a few months ago where even if you had unticked the check for new versions option in the settings it would still inform you a new version was available. That was considered objectionable not only because it ignored your settings but because the "New version update available" install button actually replaced the manual "Check for updates" button.
That matter was addressed after two later CCleaner updates.
When installing/updating free CCleaner you should always use the "Builds" link hidden away at the bottom of the download page. The main install button takes you to FileHippo for the download and maybe it is this one which has the AVAST pre-ticked install option.
Also, as most of us here already have AVAST, isn't there the possibility that the CCleaner installer detects that and removes the AVAST content from the install screens?
-
Also, as most of us here already have AVAST, isn't there the possibility that the CCleaner installer detects that and removes the AVAST content from the install screens?
Most probably, as none of us could reproduce it...
-
All we can do is assume or speculate. Neither is acceptable.
Best to wait for a reply directly from Piriform (Avast). :)
-
1. All we can do is assume or speculate. Neither is acceptable.
2. Best to wait for a reply directly from Piriform (Avast). :)
1. Well, it's certainly acceptable but not helpful. ;)
2. Agreed Bob. :) Cheers
-
I just got another pm from the Product Manager CCleaner desktop :
We have paused distribution of this while we improve the experience to make it clearer to the customer how to accept or decline the Avast offer.
Greetz, Red.
-
I just got another pm from the Product Manager CCleaner desktop :
We have paused distribution of this while we improve the experience to make it clearer to the customer how to accept or decline the Avast offer.
Greetz, Red.
Red thank you and very happy to see someone here is on the ball at all times :)
-
LordPuffer(from DSL/BBR Forum) posted this image today..sure a lot of crap loaded with CCleaner
eh?!
-
LordPuffer(from DSL/BBR Forum) posted this image today..sure a lot of crap loaded with CCleaner
eh?!
Posting a screenshot of What ??? Ccleaner on my system resides in C:\Program Files\CCleaner
-
Bob, try to get this OK! he does not have or ever has had avast on his system..that all came when
he installed the latest CCleaner version GOT IT? Man S.O.S.
-
Bob, try to get this OK! he does not have or ever has had avast on his system..that all came when
he installed the latest CCleaner version GOT IT? Man S.O.S.
Did you get out of bed on the wrong side this morning ??? I'm trying to get information.
I obviously don't have your problem.
Since apparently Avast was installed, all that information pertains to Avast. Not CC.
-
Bob, try to get this OK! he does not have or ever has had avast on his system..that all came when
he installed the latest CCleaner version GOT IT? Man S.O.S.
Did you get out of bed on the wrong side this morning ??? I'm trying to get information.
I obviously don't have your problem.
1- Helping a friend from BBR that just does not want to join another forum
2-I dont use a bed its a coffin!
3-I used to and still kinda do have a lot of respect for CCleaner and avast, but if this continues
one of them has to go :)
4- would you like to join up at BBR forum and ect..ect...
5- edit to your edit that avast crap would not be there if CCleanr did bundle it with the installation .exe named .ccleaner .exe!! damn
-
4. Sorry, my plate is full.
As you can see from Rednose's reply, Ccleaner is already working on this.
Right now the best thing to do is wait for their answer and resolve.
-
Right on and its avast that owns CCleaner now not the other way
so Culpability lies on the plate it was served :) muhaaaa....
-
Right on and its avast that owns CCleaner now not the other way
so Culpability lies on the plate it was served :) muhaaaa....
Never said it wasn't Avast's responsible. Just stated who was working on the fix.
-
I just got another pm from the Product Manager CCleaner desktop :
We have paused distribution of this while we improve the experience to make it clearer to the customer how to accept or decline the Avast offer.
Greetz, Red.
Hi Red, thanks for the info/update. Cheers
-
CCleaner Compromised to Gather and Transmit Information About Its Users
http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml
https://www.techspot.com/news/71018-malware-discovered-ccleaner-puts-millions-users-risk.html
had been modified to include the Floxif malware
-
CCleaner Compromised to Gather and Transmit Information About Its Users
http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml (http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml)
Update to the latest version and you're fine. https://www.piriform.com/ccleaner/download
-
At this moment, Avast can't detect the infected CCleaner files. It says everything about how poorly Avast has handled this:
https://www.virustotal.com/#/file/6f7840c77f99049d788155c1351e1560b62b8ad18ad0e9adda8218b9f432f0a9/detection
https://www.virustotal.com/#/file/1a4a5123d7b2c534cb3e3168f7032cf9ebf38b9a2a97226d0fdb7933cf6030ff/detection
https://www.virustotal.com/#/file/36b36ee9515e0a60629d2c722b006b33e543dce1c8c2611053e0651a0bfdb2e9/detection
Also why they haven't released a utility to scan and remove the trojan is baffling. And the information form Piriform (Avast) is not exactly reassuring, with no information on how to check if you were infected, other then "update ccleaner". It's clear they are trying to downplay the issue.
-
Good morning/afternoon
I have been using the free CCleaner for years no complaints , my question, should I delete the older one then install the latest issue
Thks Flyfsher
-
CCleaner Compromised to Gather and Transmit Information About Its Users
http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml (http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml)
Update to the latest version and you're fine. https://www.piriform.com/ccleaner/download
I still had to manually delete this reg key :
HKLM\SOFTWARE\Piriform\Agomo
-
Good morning/afternoon
I have been using the free CCleaner for years no complaints , my question, should I delete the older one then install the latest issue
Thks Flyfsher
It should be fine to install the latest version on top of the old version.
-
CCleaner Compromised to Gather and Transmit Information About Its Users
http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml (http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml)
Update to the latest version and you're fine. https://www.piriform.com/ccleaner/download
I still had to manually delete this reg key :
HKLM\SOFTWARE\Piriform\Agomo
Which means the trojan has been executed on your system and other malware could be installed. The dropper (CCleaner) might not be present anymore, but the damage has been done. I would suggest you run some extra scans full scans with malwarebytes and a proper antivirus program like Bitdefender.
-
CCleaner Compromised to Gather and Transmit Information About Its Users
http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml (http://news.softpedia.com/news/ccleaner-compromised-to-gather-and-transmit-information-about-its-users-517750.shtml)
Update to the latest version and you're fine. https://www.piriform.com/ccleaner/download (https://www.piriform.com/ccleaner/download)
I still had to manually delete this reg key :
HKLM\SOFTWARE\Piriform\Agomo
Which means the trojan has been executed on your system and other malware could be installed. The dropper (CCleaner) might not be present anymore, but the damage has been done. I would suggest you run some extra scans full scans with malwarebytes and a proper antivirus program like Bitdefender.
Don't agree with you. Even if executed, the information revealed really doesn't amount to anything.
-
Don't agree with you. Even if executed, the information revealed really doesn't amount to anything.
Really? You should really hold back on what kind of advice you are giving out, when it's clearly not your field of expertise. You can quite easily lead people down an incorrect path, because of your blind faith in Avast. A company which gone from being a security company to an software company which bases it's income on adware.
Ignoring the results and taking an approach that everything is properly alright, is a very dangerous attitude in a situation like this.
You do realize what happened? Piriform (Avast), has been hosting an malware infected CCleaner on their servers FOR A MONTH, which had Piriform Ltd's digital signature on, which means that not only were their servers compromised, but the dev and signing process at Piriform has been compromised. On top of that, it's important to realize that both 32bit and 64bit systems were hit by this, as the 32bit executable is executed at user logon via the CCleanerSkipUAC job created in task scheduler, also on 64-bit machines.
Do not downplay this, this is pretty much as bad as it gets and the lack of proper response from Avast and Piriform is sadly telling, how much they are trying hide, that they have been compromised and meanwhile completely destroyed CCleaners reputation and hurt Avast' reputation even more.
-
@Erroneus,
My advice has nothing to do with blind or any other faith in Avast.
I'm as upset about this as you and have expressed my disappointment.
Since I'm on a 64 bit system and that's the version I install, I personally, was actually really never affected.
-
Since I'm on a 64 bit system and that's the version I install, I personally, was actually really never affected.
Expect on 64bit OS, the 32bit version is still executed on user logon via the CCleanerSkipUAC job created in task scheduler.
Now if that's enough is unclear at the moment, because the information level from Avast and Piriform is unacceptable at every level. They want us to update ccleaner and ignore they have infected millions of systems. Shady and not good enough.
-
Your computer your choice. My computer, my choice.
Doesn't mitigate the severity but in the end, almost all of us at one time or another
have been compromised to some extent. It's a sign of the times.
None of us like it but there is only so much one can do about it unless you're willing to
totally remove yourself from the internet. I'm not.
-
Certainly have to agree with bob3160, think of this:
https://www.bleepingcomputer.com/news/security/over-36-000-computers-infected-with-nsas-doublepulsar-malware/
What defense against that do you have there, as "they", that infect,
consider themselves above the law of the land & the world actually to do their "spying implants". :o
Always work a normal user account, never as admin, and have your back-up routine ready.
Sign of the times, alas, and avast has to adopt as well. Don't rock the boat...we are all affected.
polonus
-
Guys,
I just had a chance to read this thread and I'm a bit horrified as I think that there's quite some misconception about what actually went on.
First of all, the bottom line is: to the best of our knowledge, no harm was done to any CCleaner users as the threat was removed before it had a chance to fully activate.
This is really not about downplaying the issue. This is a statement based on a pretty thorough analysis, partially shared below and partially still embargoed because of the ongoing investigation.
Now, some facts:
- Avast acquired a company (Piriform) which was in the process of being hacked. We have good evidence that the attack started at least several weeks before the acquisition.
- Immediately after we first learned about something wrong with the CCleaner product (which was on September 12, i.e. 6 days ago) we started working on it and have been working on it around the clock since then.
- The #1 priority for us was to protect the CCleaner customers and minimize the actual customer impact of the incident.
- For that reason, we first focused on fully understanding the malicious code and disconnecting the bad actors from their ability to control the backdoor, i.e. taking down the CnC servers.
- The CnC server was taken down on September 15, three days after we first learned about the incident. Given how difficult these things tend to be, we consider this a very good result and I don't see how we could have done it any better. (By that time, the secondary CnC servers (the DGA domains) were already sinkholed as well, so that technically cut the attackers off their ability to control the backdoor).
At the same time, we wanted to understand whether the second stage payload could have already activated before the threat was discovered. Now, the good thing is that about 30% of CCleaner users also run Avast security software, which allowed us to analyze behavioral, traffic and file/registry data from those machines. Based on this analysis, we can say with high confidence that to the best of our knowledge, the second stage payload never activated, i.e. the only malicious code present on customer machines was the one embedded in the ccleaner.exe binary itself. We also asked our colleagues from other security companies, but haven't heard anyone seeing anything suspicious either. And that's great news, as it means that despite the high sophistication of the attack, we managed to disarm the system before it was able to do any harm. To that end, we don't consider the advice to reformat and/or restore the affected machines to the pre-August 15 state to be based on facts (by similar logic, security companies are not usually advising customers to reformat their machines after a remote code execution vulnerability is identified on their computer, just because there was a hypothetical possibility that something might have gotten in).
BTW, I have to say I was quite disappointed by the approach taken by the Cisco Talos team who appears to be trying to use information about this incident to drive marketing activities and piggyback on the case to increase the visibility of their upcoming product. And, I should probably also say that it wasn't Cisco who first notified us about the problem. The threat was first discovered and reported to us by researchers in a security company called Morphisec (thank you!). The threat was real, but to the best of our knowledge, it was fortunately mitigated before it could do any harm.
We plan to be issuing more communication about this as we go. This is a very unfortunate incident and of course, it's in our highest interest to properly investigate the issue and make sure it never happens again. Unfortunately, as you can imagine, the security measures in small companies are usually not up to the standard and that's a big lesson for us in terms of what to look for in case of future acquisitions.
Thanks,
Vlk
-
Finally some proper information, that's a step in the right direction.
While you might be pleased on how Avast has handled this and got the CnC servers shut down, you also have to understand, the lack of proper information is scary for end users, who doesn't have the details and don't know if they were infected or not. If you don't want people to restore their systems, then deliver more precise information.
-
The Payload stored information at HKLM\SOFTWARE\Piriform\Agomo but there doesn't seem to be any evidence that the second stage executed. I've got the malicious CCleaner on a spare PC without any anti-virus and waiting to see any behaviour changes. If you're feeling suspicious feel free to delete the registry entry. Most, if not all anti-virus detect CCleaner with the embedded malicious code. The 64bit version of CCleaner was also unaffected to my understanding.
The question here is simple, how did the unauthorised code appear in CCleaner software?
-
The Payload stored information at HKLM\SOFTWARE\Piriform\Agomo but there doesn't seem to be any evidence that the second stage executed. I've got the malicious CCleaner on a spare PC without any anti-virus and waiting to see any behaviour changes..
There was no second stage -- but of course, feel free to monitor the PC (we have done quite a bit of that already).
If you're feeling suspicious, feel free to delete the registry entry. Most, if not all anti-virus detect the CCleaner with the embedded malicious code. The 64bit version of CCleaner was also unaffected to my understanding.
Deleting the registry entry doesn't resolve anything, but also doesn't harm.
Yes only 32-bit Windows users were affected.
The question here is simple, how did the unauthorised code appear in CCleaner software?
See my post above.
-
I have windows 7 64-bit and today when running ccleaner my antivirus ESET Smart Security 10 notified me of this threat:
Hour; 9/18/2017 1:32:40 p.m
Scan module; Memory scan
Type of object; archive
Object; Operating Memory = CCleaner.exe (1124)
Threat; a variant of Win32 / CCleaner.B Trojan
Action; disinfected - contained infected files
User;
Information;
Hash; 38365DFEDF883AB2CF0F21434686BF58B8FAE5F6
First seen here
If it is assumed that the 64-bit version was not affected, why did eset throw me this alert when running ccleaner?
-
I have windows 7 64-bit and today when running ccleaner my antivirus ESET Smart Security 10 notified me of this threat:
Hour; 9/18/2017 1:32:40 p.m
Scan module; Memory scan
Type of object; archive
Object; Operating Memory = CCleaner.exe (1124)
Threat; a variant of Win32 / CCleaner.B Trojan
Action; disinfected - contained infected files
User;
Information;
Hash; 38365DFEDF883AB2CF0F21434686BF58B8FAE5F6
First seen here
If it is assumed that the 64-bit version was not affected, why did eset throw me this alert when running cclener?
Because both 32b and 64b binaries are present on the HDD... but the payload doesn't activate on 64-bit.
You can check the existence of the registry key HKLM\SOFTWARE\Piriform\Agomo -- if it exists, the backdoor activated, otherwise it didn't.
Thanks
Vlk
-
I have windows 7 64-bit and today when running ccleaner my antivirus ESET Smart Security 10 notified me of this threat:
Hour; 9/18/2017 1:32:40 p.m
Scan module; Memory scan
Type of object; archive
Object; Operating Memory = CCleaner.exe (1124)
Threat; a variant of Win32 / CCleaner.B Trojan
Action; disinfected - contained infected files
User;
Information;
Hash; 38365DFEDF883AB2CF0F21434686BF58B8FAE5F6
First seen here
If it is assumed that the 64-bit version was not affected, why did eset throw me this alert when running cclener?
Because both 32b and 64b binaries are present on the HDD... but the payload doesn't activate on 64-bit.
You can check the existence of the registry key HKLM\SOFTWARE\Piriform\Agomo -- if it exists, the backdoor activated, otherwise it didn't.
Thanks
Vlk
Thank you very much, no, I do not have any keys with that name.
-
Because both 32b and 64b binaries are present on the HDD... but the payload doesn't activate on 64-bit.
You can check the existence of the registry key HKLM\SOFTWARE\Piriform\Agomo -- if it exists, the backdoor activated, otherwise it didn't.
Thanks
Vlk
I have this registry key on my Windows 10 (x86) machine. What can I do now?
I have already:
1) upgraded Ccleaner 5.34
2) deleted this registry key
3) done several system scans with Kaspersky Internet Security 2018 and Malwarebytes 3.2.2.2018 (nothing was found)
Is it enough or I must to format my machine?
Thank you in advice
-
Is it enough or I must to format my machine?
Thank you in advice
You're good to go, no need to format.
-
Because both 32b and 64b binaries are present on the HDD... but the payload doesn't activate on 64-bit.
On 64bit systems, the 32bit binary is executed on login via TaskScheduler and the job CCleanerSkipUAC. Can you confirm the payload is not executed when the CCleanerSkipUAC job is executed.
Thanks
-
Think this thread should be splitted in two as it has gone off topic way to long.
-
Is it enough or I must to format my machine?
Thank you in advice
You're good to go, no need to format.
Thank you ;)
-
Is it enough or I must to format my machine?
Thank you in advice
You're good to go, no need to format.
Thank you ;)
You're welcome. :)
-
I just scanned the "tainted" CC Cleaner in question through Virustotal and while most AV engines are now flagging it as a Trojan or modified CC Cleaner all of Avast's products running on Virustotal are still giving the specimen a "pass".
(But as Eddy said on another thread, perhaps Virustotal hasn't updated the Avast's VPS detections recently?)
https://www.virustotal.com/#/file/1a4a5123d7b2c534cb3e3168f7032cf9ebf38b9a2a97226d0fdb7933cf6030ff/detection
But Cisco (and others) made a good point, why hasn't the Symantec signing certificate been revoked?
I see that the newest (safe) release of CC Cleaner (534) is still using the same exact Symantec signing key as the version with the backdoor?
-
Things like this sure make it a lot easier to step away from avast and stop seeing them as a trusted company.
-
But Cisco (and others) made a good point, why hasn't the Symantec signing certificate been revoked?
I see that the newest (safe) release of CC Cleaner (534) is still using the same exact Symantec signing key as the version with the backdoor?
I've to agree, get rid of these lousy Symantec certs ASAP...!!
-
I see that someone had uploaded the CC Cleaner in question to VirusTotal back on August 22nd 2017 and 10 different AV engines flagged it as a Trojan back then.
**updated to read..**
Just to be clear, this was found under "compressed parents" below the actual CC Cleaner scan.
https://www.virustotal.com/#/file/135808f7953e83e663bc8318d4a05024d1a29d5965024f8738e67c28b1c2c4f8/detection
-
I have contacted VirusTotal and filed a "bug report" regarding VPS updates.
-
Things like this sure make it a lot easier to step away from avast and stop seeing them as a trusted company.
I ditched my subscription to a well known AV product several months ago even though I have a valid license till 2019 after I found a java based SSH client (JSch) hidden inside their mobile application and when I questioned them about it's function I was lied to.
-
I Use Avast , and why Avast still don't delete the traces of ""Agomo"" in Registry Editor where is the only place where this infected file from CCleaner v.5.33, have left traces ??? ....... Soo after update to v.5.34 CCleaner - beside we all know the Registry Editor is ""scary"" place to delete things - manually delete this ""Agomo"" from Registry Editor :
[/img][/img]
-
I'm disappointed with 3rd party extras. I use Windows disk optimizer, cleanup, image, backup, etc. and have had no problems here.
-
I Use Avast , and why Avast still don't delete the traces of ""Agomo"" in Registry Editor
Deleting that registry key does nothing but also causes no harm if you delete the entry as was already stated by an Avast representative.
-
So I received an email response from VirusTotal regarding the "bug report" about Avast's detection engines on
VirusTotal's website not flagging the malicious CC Cleaner.
--------------------------------------
Sep 19, 2:13 AM PDT
Subject: Bug report
Email: **********@yahoo.com
Text:
I uploaded a "tainted" version of "CC Cleaner" to VirusTotal twice today,
and while most of the AV engines on
VirusTotal are flagging it as a Trojan I see that none of the Avast (that
owns CC Cleaner)AV products are flagging it.
Does VirusTotal's AV engines all have automatic updates for detection rules
in place?
https://www.virustotal.com/#/file/1a4a5123d7b2c534cb3e3168f7032cf9ebf38b9a2a97226d0fdb7933cf6030ff/detection
-------------------------------------
Karl Hiram
Karl Hiramoto (VirusTotal)
Sep 19, 2:29 AM PDT
Yes, we check for updates every hour. If you think avast is not behaving correctly please contact avast. If avast
thinks there is a problem, they can contact us.
We are just aggregating the information produced.
Karl Hiramoto - VirusTotal - www.virustotal.com
---------------------
The Avast AV on VirusTotal is NOW flagging the tainted CC Cleaner but as of 01:17 AM 09/19/2017 when I captured this screenshot it still was not.
-
A new update: https://blog.avast.com/progress-on-ccleaner-investigation
The 2nd stage payload was executed, all though on a limited amount of machines (properly), but also on 64bit machines, if I understand the blog post correctly.
-
A new update: https://blog.avast.com/progress-on-ccleaner-investigation (https://blog.avast.com/progress-on-ccleaner-investigation)
The 2nd stage payload was executed, all though on a limited amount of machines (properly), but also on 64bit machines, if I understand the blog post correctly.
According to Avast, it's not your system that determines your vulnerability but, the version of Ccleaner you installed.
If you installed the 64 bit version, you're safe. If you installed the 32 bit version of CCleaner, you're not and needed to update asap.
So, you could have installed a 32 bit version on your 64 bit system and had a problem.
Naturally, you could not have installed the 64 bit version on your 32 bit system.
-
Playing the devil her... *evil grin*
avast was installed with permission.
Doing a.'express' install means you agree to install the application along with everything that is pre-checked.
-
Playing the devil her... *evil grin*
avast was installed with permission.
Doing a.'express' install means you agree to install the application along with everything that is pre-checked.
One of the reasons we all stress "Custom Install" - No Matter What You Install. :)
-
@Eddy
Doing a.'express' install means you agree to install the application along with everything that is pre-checked.
A number of antimalware scanners will flag as "PUP" any installer that hides pre-checked additional software installation behind an "Express" option.
Personally I know perfectly well I have to always choose the Custom installation, but average Joe will pick the Express installation and be tricked into installing something he did not really want.
When it happens with a small software company, they flag it as "malware" or like that. When it happens with the big dogs, they say it's OK. Hmm. Double standards?
-
@Eddy
Doing a.'express' install means you agree to install the application along with everything that is pre-checked.
A number of antimalware scanners will flag as "PUP" any installer that hides pre-checked additional software installation behind an "Express" option.
Personally I know perfectly well I have to always choose the Custom installation, but average Joe will pick the Express installation and be tricked into installing something he did not really want.
When it happens with a small software company, they flag it as "malware" or like that. When it happens with the big dogs, they say it's OK. Hmm. Double standards?
If you insist on using the express install, at least first install Unchecky ( https://unchecky.com/ )
-
Like I said I never use the express install :)
-
Like I said I never use the express install :)
Neither do I but, it's still possible to overlook something. I know I have.
-
A new update: https://blog.avast.com/progress-on-ccleaner-investigation (https://blog.avast.com/progress-on-ccleaner-investigation)
The 2nd stage payload was executed, all though on a limited amount of machines (properly), but also on 64bit machines, if I understand the blog post correctly.
According to Avast, it's not your system that determines your vulnerability but, the version of Ccleaner you installed.
If you installed the 64 bit version, you're safe. If you installed the 32 bit version of CCleaner, you're not and needed to update asap.
So, you could have installed a 32 bit version on your 64 bit system and had a problem.
Naturally, you could not have installed the 64 bit version on your 32 bit system.
32 bit and 64 bit installer is one in the same (like the Avast installer), you cant choose to download one or the other.
-
Guys,
I just had a chance to read this thread and I'm a bit horrified as I think that there's quite some misconception about what actually went on.
First of all, the bottom line is: to the best of our knowledge, no harm was done to any CCleaner users as the threat was removed before it had a chance to fully activate.
This is really not about downplaying the issue. This is a statement based on a pretty thorough analysis, partially shared below and partially still embargoed because of the ongoing investigation.
Now, some facts:
- Avast acquired a company (Piriform) which was in the process of being hacked. We have good evidence that the attack started at least several weeks before the acquisition.
- Immediately after we first learned about something wrong with the CCleaner product (which was on September 12, i.e. 6 days ago) we started working on it and have been working on it around the clock since then.
- The #1 priority for us was to protect the CCleaner customers and minimize the actual customer impact of the incident.
- For that reason, we first focused on fully understanding the malicious code and disconnecting the bad actors from their ability to control the backdoor, i.e. taking down the CnC servers.
- The CnC server was taken down on September 15, three days after we first learned about the incident. Given how difficult these things tend to be, we consider this a very good result and I don't see how we could have done it any better. (By that time, the secondary CnC servers (the DGA domains) were already sinkholed as well, so that technically cut the attackers off their ability to control the backdoor).
At the same time, we wanted to understand whether the second stage payload could have already activated before the threat was discovered. Now, the good thing is that about 30% of CCleaner users also run Avast security software, which allowed us to analyze behavioral, traffic and file/registry data from those machines. Based on this analysis, we can say with high confidence that to the best of our knowledge, the second stage payload never activated, i.e. the only malicious code present on customer machines was the one embedded in the ccleaner.exe binary itself. We also asked our colleagues from other security companies, but haven't heard anyone seeing anything suspicious either. And that's great news, as it means that despite the high sophistication of the attack, we managed to disarm the system before it was able to do any harm. To that end, we don't consider the advice to reformat and/or restore the affected machines to the pre-August 15 state to be based on facts (by similar logic, security companies are not usually advising customers to reformat their machines after a remote code execution vulnerability is identified on their computer, just because there was a hypothetical possibility that something might have gotten in).
BTW, I have to say I was quite disappointed by the approach taken by the Cisco Talos team who appears to be trying to use information about this incident to drive marketing activities and piggyback on the case to increase the visibility of their upcoming product. And, I should probably also say that it wasn't Cisco who first notified us about the problem. The threat was first discovered and reported to us by researchers in a security company called Morphisec (thank you!). The threat was real, but to the best of our knowledge, it was fortunately mitigated before it could do any harm.
We plan to be issuing more communication about this as we go. This is a very unfortunate incident and of course, it's in our highest interest to properly investigate the issue and make sure it never happens again. Unfortunately, as you can imagine, the security measures in small companies are usually not up to the standard and that's a big lesson for us in terms of what to look for in case of future acquisitions.
Thanks,
Vlk
Sir,
a few years back forum.avast.com was compromised, user email and other information was leaked, my email also leaked (my old id, I am not a new user, i am using avast since the year 2006, I am stopped using avast after window 10 released due to the compatibility issue) and now this incident. I think it is too bad for a security company.
now in India, facing unknown error(Is Avast still having issues with their update servers?) too frequently (once/twice a week)
-
The question remains, how did this malware get into the CCleaner distribution? And while I don't have any answer to that, conspiracy theorists everywhere must wonder about the timing of the launch of a new product from Avast, "Avast Cleanup Premium", on sale now at 50% off!!!
http://view.emails.avast.com/?qs=e2b051d7a1872e5a6b3f7243a048f8c0848f5ddd1a572446286662e0ae6ca318fe2ec005e55d3a4906268a928860ca45501577ded9a13c068540704a2a125c3e
Nevermind I already own CCleaner - I no longer trust it and uninstalled it. So I buy this new product? Not likely. This is lame.
-
The question remains, how did this malware get into the CCleaner distribution? And while I don't have any answer to that, conspiracy theorists everywhere must wonder about the timing of the launch of a new product from Avast, "Avast Cleanup Premium", on sale now at 50% off!!!
http://view.emails.avast.com/?qs=e2b051d7a1872e5a6b3f7243a048f8c0848f5ddd1a572446286662e0ae6ca318fe2ec005e55d3a4906268a928860ca45501577ded9a13c068540704a2a125c3e (http://view.emails.avast.com/?qs=e2b051d7a1872e5a6b3f7243a048f8c0848f5ddd1a572446286662e0ae6ca318fe2ec005e55d3a4906268a928860ca45501577ded9a13c068540704a2a125c3e)
Nevermind I already own CCleaner - I no longer trust it and uninstalled it. So I buy this new product? Not likely. This is lame.
Speculations are just that, speculations. Eventually the culprits will be caught.
The fact is that one has nothing to do with the other.
-
The question remains, how did this malware get into the CCleaner distribution? And while I don't have any answer to that, conspiracy theorists everywhere must wonder about the timing of the launch of a new product from Avast, "Avast Cleanup Premium", on sale now at 50% off!!!
http://view.emails.avast.com/?qs=e2b051d7a1872e5a6b3f7243a048f8c0848f5ddd1a572446286662e0ae6ca318fe2ec005e55d3a4906268a928860ca45501577ded9a13c068540704a2a125c3e
Nevermind I already own CCleaner - I no longer trust it and uninstalled it. So I buy this new product? Not likely. This is lame.
Hi smday999. That's something that is still under investigation. We have released some blog posts including all the information we have available and the steps we've taken after we learned about this attack, you can find them (in chronological order) at:
https://blog.avast.com/update-to-the-ccleaner-5.33.6162-security-incident
https://blog.avast.com/progress-on-ccleaner-investigation
https://blog.avast.com/avast-threat-labs-analysis-of-ccleaner-incident
https://blog.avast.com/additional-information-regarding-the-recent-ccleaner-apt-security-incident
What we can say for sure is that definitely the release of an illegally modified version of CCleaner was not by any means a marketing strategy to boost Avast Cleanup, and the release of a new version of the latter days after the affected CCleaner version was purely coincidental.
Although Piriform (the company behind CCleaner) was purchased by Avast in mid July, they continue working in CCleaner very independently from the development of the Avast-branded tools we already had in our catalogue. It would never be our intention to damage one brand from our family to help another one nor to use such sensitive incident for marketing purposes.
-
Here it is Nov 18, and avast still sneaking in on Ccleaner download. I did a custom install and didn't take my eyes off the screen cuz I know all about bundling. Not a thing about avast. Yet, there it is, installed on my computer. It didn't take long for avast to screw up a good thing. First, this sneak move and now there is a backdoor trojan on some of Ccleaner's downloads. Way to go avast. I don't use avast having tried it before. It slowed up my system but that wasn't the worst part. Trying to uninstalled it was near impossible. I resent having anything forced on me and refusing to get it's hooks out of me just sends a red flag that this type of app is not to be trusted. Now I will uninstall both Ccleaner and (God willing) avast and never use either again.
-
Here it is Nov 18, and avast still sneaking in on Ccleaner download. I did a custom install and didn't take my eyes off the screen cuz I know all about bundling. Not a thing about avast. Yet, there it is, installed on my computer. It didn't take long for avast to screw up a good thing. First, this sneak move and now there is a backdoor trojan on some of Ccleaner's downloads. Way to go avast. I don't use avast having tried it before. It slowed up my system but that wasn't the worst part. Trying to uninstalled it was near impossible. I resent having anything forced on me and refusing to get it's hooks out of me just sends a red flag that this type of app is not to be trusted. Now I will uninstall both Ccleaner and (God willing) avast and never use either again.
Currently being discussed on the developers channel. (It's also the weekend.)
-
The latest CCleaner installer does indeed offer a pre-ticked Avast install, I noticed it on the first screen during install and was able to deselect it, strangely enough the same installer I transferred between three Win10 systems of which two of them got the Avast pre-ticked offer and one got the Chrome offer ::)
-
You have to wonder why all these "antivirus" companies are pushing so hard to get their warez onto your device.
I'm sure it's all because they are concerned about your safety and privacy.
Make sure you enable all the "security" features so you get the protection you need to keep some nasty "virus" from scanning all your files, bookmarks, MMS messages, media etc. and sending all that data off to some "cloud" somewhere.
Thank God we have antivirus companies that protect our data from being exfilterated!
...Oh wait :-[
-
December 31 2017, last day of 2017 nearly 2018 AND IT'S STILL HAPPENING!!
I'm an engineer with 20 years of Microsoft software development and system installs, I quadruple checked for pre-checked and pre-ticked sneaky boxes during the install and absolutely nothing was ticked.... Yet when the install finished it asked me to restart my computer and guess what... AVAST WAS THERE!!!
This is a brand new clean Windows 10 X64 December 2017 RS3 installation obtained directly from Microsoft, CCleaner was the first thing I installed as a test, downloaded directly from the official CCleaner Piriform website. I even quadruple checked the domain and hash checked the download.
To add insult to injury your Avast forum tries to trick you into installing Avast on your Android phone when you sign up, to complain about this!!
http://i.imgur.com/YNg8nK4.png
This is two blatant violations of EU consumer law and statutory rights. I suggest you get it dealt with because companies and individuals are already busy reporting you to ICO's all over Europe.
-
Looking at the offer, it's not hard or select "no thank you".
I wouldn't call that misleading.
-
Sounds like someone is trying to start a rumor. I'm fully up to date on both Ccleaner and Avast.
Certainly didn't see any offer to install Avast when installing Cleaner. I also always use a custom install and there aren't any options to install Avast.
That is BS. I just saw Avast Icon on my taskbar and freak it out. I am very careful what I am putting on my PC. So the fact that Piriform got bought by a malware producing company just to shove in their unsuccessful products on people's PCs is infuriating beyond anything. Now I will have to scrap Piriform software which I really liked it.
-
Been using Avast since 2006, if i had any PC with Ccleaner update that showed Avast in the install window there, i'd just uncheck it and go about my business, as i feel Avast provides the best protection for virus, malware, spyware, without slowing down the systems, Currently installed on 2 Desktops, and Laptop, and happy to report no issues, and yes all systems still use ccleaner
Only one it showed that on was Insider Preview system, all i did was uncheck the avast in the program, installed Ccleaner, and done
Nothing too big a deal i feel to get upset over
-
I just downloaded CCleaner from piriform's ccleaner website. There was no box to check or uncheck and yet I got Avast installed.
Now, I used avast for a LONG time. It wasn't until about two years ago that it started being a problem. Lower performance, bloated application with WAYYYY too much feature creep, and worst, it was missing viruses that other applications were detecting. If you are an anti-virus program, I don't care if you can defrag my hard drive while baking a cheesecake, if you can't stop viruses, you're gone. I was really not happy about this because I loved Avast and, now that I'm living and working in Prague, I'm close to their really amazing office that I still might visit during an open house. However, they have really screwed up their product and I won't use it in its current form.
Now, finding this completely silent installation, I not only don't want to use Avast, I'm actively pissed off. What kind of legitimate app installs silently like some kind of trojan virus in another application? This is absolutely unacceptable. This is the kind of thing that both CCleaner and Avast should be trying to stop, not colluding to make it happen!
-
@cew182: I just downloaded CCleaner from piriform's website ans this is how installation dialog looks like.
-
@cew182:Always use UnChecky it is a best software for unwanted offers. :)
-
@cew182: I just downloaded CCleaner from piriform's website ans this is how installation dialog looks like.
Had that been unchecked by default, it would have been fine and Avast would probably wind up with
more Avast customers who actually wanted the product instead of possible loosing a Ccleaner customer.
-
@cew182: I just downloaded CCleaner from piriform's website ans this is how installation dialog looks like.
Had that been unchecked by default, it would have been fine and Avast would probably wind up with
more Avast customers who actually wanted the product instead of possible loosing a Ccleaner customer.
I think it is a bit much for a program that is 10.7MB to pre check an option for a program that is over 230MB.
I just downloaded the latest CCleaner version and installed over the top of the existing v5.38 version and it must be checking if you have Avast installed as I had on pre-checked option.
-
I just downloaded CCleaner from piriform's ccleaner website. There was no box to check or uncheck and yet I got Avast installed.
.
.
.
Now, finding this completely silent installation, I not only don't want to use Avast, I'm actively pissed off. What kind of legitimate app installs silently like some kind of trojan virus in another application? This is absolutely unacceptable. This is the kind of thing that both CCleaner and Avast should be trying to stop, not colluding to make it happen!
Add me to the VIOLENTLY P!SSED OFF LIST !
I have it installed on my machine and on a clients machine and even though I have download and run avastclear.exe from the Administrator account while in Safe Mode there are a lot of bits and pieces left around that I can not delete !
Worse, it has set a group policy on Window Defender so that I can not use it and even Administrator can nor change the policy !
-
Hey guys,
I'm the Product Manager of CCleaner. I'd like to make it clear that silent, drive-by installs of Avast are absolutely not the intended result here. You should always see the consent screen when installing CCleaner Free edition or Pro Trial (see attached image). The paid 'Pro', 'Business' and 'Technician' editions do not contain this promotion.
We are monitoring a small number of edge cases where it seems the consent checkbox is not displaying correctly. After gathering what information we could from our users on the CCleaner forums, we were able to identify a case where high system load could delay the offer from displaying immediately. This allowed us to reproduce the issue internally and resolve it. We made change to guard against this root cause and released it in v5.39 (January 16th). There is potential for another bug/edge case to be causing the consent checkbox to not be visible, and this is what I would like to continue to investigate with your assistance.
If you have encountered this issue in the installer of CCleaner v5.39 or later, it would be of huge help if you could respond to the following questions so we can identify some reproducible conditions and gather clues to the root cause. We want this fixed just as much as you do. Together, I'm confident we can get to the bottom of this.
Questions
- Which version of CCleaner were you installing?
(e.g. v5.39) - At the time you installed CCleaner, had you restarted your computer in the past 30 minutes?
- Did you use any of the Custom Installation Options in the CCleaner installer?
- Which version of Windows were you running?
(e.g. Windows 7, Windows 10) - If Windows 10, did you update from an older version?
(e.g. Yes, I updated from Windows 7) - If known, what is your operating system architecture?
(e.g. 32-bit, 64-bit) - Which malware/antivirus applications did you have active?
(e.g. Windows Defender, Malwarebytes, Eset) - Which internet browser do you primarily use?
(e.g. Edge, Firefox, Chrome)
I'll keep an eye on this topic for replies as they come through. Thank you in advance for any assistance you can provide.
-
(https://screencast-o-matic.com/screenshots/u/Lh/1517582389094-27568.png)
If that little box were only unchecked. Ccleaner and Avast would both be making friends
instead of disgruntled customers.
-
@ StephenCC
I have a thing about pre-checked option boxes (always have) the user should opt-in, then there is no mistake.
Having to opt-out making mistakes/just clicking errors possible. One thing that it does is get users hacked off, not a good foundation for a happy avast user.
I have to ask, what happens when avast is installed on a users system when they have an existing AV solution ?
Even more so if that user is using a paid AV option.
-
We are monitoring a small number of edge cases where it seems the consent checkbox is not displaying correctly.
First, I have been using the FREE version of CCleaner for many, MANY years. As a retired PROFESSIONAL, I have found it to be the BEST product for "cleaning up" a computer, especially the Registry clean up. I have recommended it to dozens if not hundreds of friends.
I think I am one of those. I do not recall seeing the consent box come up.
Which version of CCleaner were you installing? I am currently running 5.39. I am 99% certain that Avast showed up with it
At the time you installed CCleaner, had you restarted your computer in the past 30 minutes? Likely not
Did you use any of the Custom Installation Options in the CCleaner installer? NO
Which version of Windows were you running? Windows 7
If known, what is your operating system architecture? AMD64
Which malware/antivirus applications did you have active? Windows Defender
Which internet browser do you primarily use? Chrome
What REALLY PISSED ME OFF was that avastclear.exe does a poor job of cleaning ! I had to do a lot of Googling to find the "magic" hidden setting in the Registry that turned off Windows Defender. And just because I HATE SOFTWARE THAT LEAVE CRUMBS BEHIND ! I had to boot a Linux rescue disc to clean up the crap in C:\Windows\winsxs[/list]
-
Thanks for the info, theoldwizard1
Just one other point: in the next release of CCleaner (v5.41, due February 13th) we will suppress the Avast AV offer if you have already declined it before. This at least should avoid a repeat install of Avast if it was previously installed erroneously. Thank you for your continued patience while we work to resolve this.
-
I have to ask, what happens when avast is installed on a users system when they have an existing AV solution ?
Even more so if that user is using a paid AV option.
There is logic there to suppress the offer where it cannot make a positive difference to the end-user's PC security.
-
Thank you for your continued patience while we work to resolve this.
How about fixing avastclear !
-
Thanks for the info, theoldwizard1
Just one other point: in the next release of CCleaner (v5.41, due February 13th) we will suppress the Avast AV offer if you have already declined it before. This at least should avoid a repeat install of Avast if it was previously installed erroneously. Thank you for your continued patience while we work to resolve this.
A reputable company would suppress it permanently instead of tricking people into installing Avast when they don't want it.
-
Thank you for your continued patience while we work to resolve this.
How about fixing avastclear !
avastclear has nothing to do with Ccleaner.
-
This happened to me today when updating CCleaner Free to v5.40. Did not notice any bundled offers, and I am always on the lookout for them. Always use advanced install options too.
Questions / Answers
Which version of CCleaner were you installing? / v5.40
At the time you installed CCleaner, had you restarted your computer in the past 30 minutes? / yes
Did you use any of the Custom Installation Options in the CCleaner installer? / yes
Which version of Windows were you running? / Windows 7 Pro
If known, what is your operating system architecture? / 64-bit
Which malware/antivirus applications did you have active? / Bitdefender Free
Which internet browser do you primarily use? / Chrome
HTH
-
Just updated CCleaner to 5.40 and in the lower left corner of the update verbage, was the prechecked box for Avast. So if you don't at least due a cursory scan of the CCleaner update page, don't be surprised if Avast shows up on your machine. I already have Avast Internet Security 18.1.2326 (build 18.1.3800.0) running.
-
Just updated CCleaner to 5.40 and in the lower left corner of the update verbage, was the prechecked box for Avast. So if you don't at least due a cursory scan of the CCleaner update page, don't be surprised if Avast shows up on your machine. I already have Avast Internet Security 18.1.2326 (build 18.1.3800.0) running.
The box would only be pre-checked if you don't have Avast installed on your computer.
I've had it happen after totally uninstalling Avast and then doing an update to the latest version of Ccleaner.
I've never seen the installation request of Avast while Avast was on my systems.
-
I may be a newbie in this forum, but have been an active Avast user for over 10 years, and active on several other computer and security forums. I have also been recommending it to all my friends and family who are casual computer users. Haven't spent much time around here, as I have not needed much help.
But this automatic opt-in just stinks. The technology is good, but this is clearly a matter of conflicting business practices. This is surely counterproductive to the goal of the company.
I am griping to let my feelings be known, and because I wasted a couple hours of my weekend trying to understand what had happened.
Free product, use at own risk ... yes I get that.
The problem is fixed for me now, but will I recommend this product in the future? A remedial response from the company will determine that one. For now, I will leave Avast on my 'not recommended' list'.
-
If you have encountered this issue in the installer of CCleaner v5.39 or later, it would be of huge help if you could respond to the following questions so we can identify some reproducible conditions and gather clues to the root cause. We want this fixed just as much as you do. Together, I'm confident we can get to the bottom of this.
Maybe the right thing to do would be to halt the promotion until this bug has been completely fixed.
-
I stumbled into this yesterday.
Already thinking of dispose of Ccleaner completely because of unwanted shovelware.
-
I stumbled into this yesterday.
Already thinking of dispose of Ccleaner completely because of unwanted shovelware.
-> https://forum.avast.com/index.php?topic=208612.msg1446139#msg1446139
-
Questions
- Which version of CCleaner were you installing?
(e.g. v5.39) - At the time you installed CCleaner, had you restarted your computer in the past 30 minutes?
- Did you use any of the Custom Installation Options in the CCleaner installer?
- Which version of Windows were you running?
(e.g. Windows 7, Windows 10) - If Windows 10, did you update from an older version?
(e.g. Yes, I updated from Windows 7) - If known, what is your operating system architecture?
(e.g. 32-bit, 64-bit) - Which malware/antivirus applications did you have active?
(e.g. Windows Defender, Malwarebytes, Eset) - Which internet browser do you primarily use?
(e.g. Edge, Firefox, Chrome)
I'll keep an eye on this topic for replies as they come through. Thank you in advance for any assistance you can provide.
- v5.42
- No
- Yes, I chose "custom" and then "more", looking to avoid installing anything else besides CCleaner.
- Windows 7 Ultimate
- -
- 64-bit
- Panda Free
- Opera
I downloaded the installer from
https://files.downloadnow-1.com/s/software/16/11/30/22/ccsetup542.exe?token=1526703121_d38461d8df1a5bcc15aeb0add87878b9&fileName=ccsetup542.exe
(From cnet.com)
I saw the same screens bob3160 posted in the first page of this thread (https://forum.avast.com/index.php?topic=208612.msg1420322#msg1420322).
I was surprised CCleaner wasn't able to remove some Avast ActiveX registry entries (I've used Avast in the past) and then I realized I had its icon in the tray... I couldn't believe it.
-
These people are liars and scoundrels. They know full well that CCleaner free edition installs Avast anti-virus with ZERO warning or consent. Just happened to me with v5.43.6522. BURN IN HELL, Piriform/Avast.
-
This just happened to me as well.
Questions
- Which version of CCleaner were you installing?
(e.g. v5.39) - At the time you installed CCleaner, had you restarted your computer in the past 30 minutes?
- Did you use any of the Custom Installation Options in the CCleaner installer?
- Which version of Windows were you running?
(e.g. Windows 7, Windows 10) - If Windows 10, did you update from an older version?
(e.g. Yes, I updated from Windows 7) - If known, what is your operating system architecture?
(e.g. 32-bit, 64-bit) - Which malware/antivirus applications did you have active?
(e.g. Windows Defender, Malwarebytes, Eset) - Which internet browser do you primarily use?
(e.g. Edge, Firefox, Chrome)
CCleaner version: 5.43.6522
Restart: Probably? I was doing a new setup, so it's likely.
Custom Options: Changed directory
Windows version: Windows 10
Updated from earlier Windows?: No
Architecture: 64-bit
Malware/av programs: Malwarebytes, AVG
Browser: Chrome
-
These people are liars and scoundrels. They know full well that CCleaner free edition installs Avast anti-virus with ZERO warning or consent. Just happened to me with v5.43.6522. BURN IN HELL, Piriform/Avast.
Totally agree.
It happened to me too.
ccleaner 5.43 installed avast without consent. There was no option to opt out of avast installation.
Piriform are bastards.
-
Hey guys,
I'm the Product Manager of CCleaner. I'd like to make it clear that silent, drive-by installs of Avast are absolutely not the intended result here. You should always see the consent screen when installing CCleaner Free edition or Pro Trial (see attached image). The paid 'Pro', 'Business' and 'Technician' editions do not contain this promotion.
We are monitoring a small number of edge cases where it seems the consent checkbox is not displaying correctly. After gathering what information we could from our users on the CCleaner forums, we were able to identify a case where high system load could delay the offer from displaying immediately. This allowed us to reproduce the issue internally and resolve it. We made change to guard against this root cause and released it in v5.39 (January 16th). There is potential for another bug/edge case to be causing the consent checkbox to not be visible, and this is what I would like to continue to investigate with your assistance.
If you have encountered this issue in the installer of CCleaner v5.39 or later, it would be of huge help if you could respond to the following questions so we can identify some reproducible conditions and gather clues to the root cause. We want this fixed just as much as you do. Together, I'm confident we can get to the bottom of this.
Questions
- Which version of CCleaner were you installing?
(e.g. v5.39) - At the time you installed CCleaner, had you restarted your computer in the past 30 minutes?
- Did you use any of the Custom Installation Options in the CCleaner installer?
- Which version of Windows were you running?
(e.g. Windows 7, Windows 10) - If Windows 10, did you update from an older version?
(e.g. Yes, I updated from Windows 7) - If known, what is your operating system architecture?
(e.g. 32-bit, 64-bit) - Which malware/antivirus applications did you have active?
(e.g. Windows Defender, Malwarebytes, Eset) - Which internet browser do you primarily use?
(e.g. Edge, Firefox, Chrome)
I'll keep an eye on this topic for replies as they come through. Thank you in advance for any assistance you can provide.
This is not fixed.
I just installed ccleaner 5.43 today 2 june 2018
It auto installed avast without consent and no opt out. There was no check box on the setup page to opt out of installation. Evil company go burn in hell. Liars.
-
My Ccleaner isn't like that
You are already running Avast.
-
This is still not fixed!!! >:( >:( >:( >:( >:(
I just installed ccleaner 5.43.6522 today 16th of june 2018.
It auto installed Avast without consent and no opt out. There was no check box on the setup page to opt out of installation!!!!! You guys should be ashamed to do this kind of business. When will you realize that people you FORCE your product into like this are less likely going to buy your product, or do some good publicity about it ??? All the contrary!
I use CCleaner since the first day it came available to the public, and I supported (paid!) and trusted this program and company for being against installing bloatware and other non wanted programs, but now my trust is gone and I am going to look for other alternate company to put my trust into now.
Also, under California law, it is absolutely forbidden to install any program without the user consent. So be ready for a big lawsuit coming up your way soon!!
Which version of CCleaner were you installing? CCleaner v5.43.6522
At the time you installed CCleaner, had you restarted your computer in the past 30 minutes? yes right after last Windows 10 update.
Did you use any of the Custom Installation Options in the CCleaner installer? Yes, I chose "custom" and then "more", unchecked all boxes there and looking to avoid installing anything else besides CCleaner.
Which version of Windows were you running? Windows 10 home with latest update on it
If Windows 10, did you update from an older version? Yes from Windows 8 that was previously installed on this laptop.
If known, what is your operating system architecture? 64 bits
Which malware/antivirus applications did you have active? Bitdefender plus 2018
Which internet browser do you primarily use? Mozilla Firefox & Google Chrome
-
Again reported to developers. :(
-
Hello,
I registered today to inform you that after installing CCleaner, I've found Avast installed in my computer without having given any consent.
I was a buyer of Avast and I was reconsidering purchasing it once again, but after having found that you are now into the territory of shady practices, I will now stay away from your product and I will suggest my customers to avoid installing your antivirus.
Regards
-
During the install process you need to untick the Avast install option, depending on what is installed already on the system there is generally two optional softwares offered - either Avast or Chrome.
-
Hello,
thanks for your reply, but I regret to inform you there was no such option.
Not only that, but to be sure I didn't overlook it, I actually went through the installers two more times just to be 100% sure.
-
Hello,
thanks for your reply, but I regret to inform you there was no such option.
Not only that, but to be sure I didn't overlook it, I actually went through the installers two more times just to be 100% sure.
I just downloaded a fresh copy from Piriform to test, the pic below is what I see as the first screen that opens after running the exe file, clearly displayed is a preticked Avast install option.
-
Hello,
thanks for your reply, but I regret to inform you there was no such option.
Not only that, but to be sure I didn't overlook it, I actually went through the installers two more times just to be 100% sure.
I just downloaded a fresh copy from Piriform to test, the pic below is what I see as the first screen that opens after running the exe file, clearly displayed is a preticked Avast install option.
Whilst it may well be there, there really is no way that option should be pre-checked by default, not for what is such a major program, not some little function. When you consider the size of CCleaner (approx 16MB), Vs avast at aprox 256MB for the off-line installation.
Now I know that they aren't downloading the off-line installation file, but it is even worse when compared against the installed size of avast.
Even more, something as critical as an AV being installed, shouldn't be an opt-in option. You are effectively installing Avast when there would be another AV present, even if this was windows defender.
-
David, I completely agree (was just pointing out that the option is there) that Avast shouldn't be prechecked or even included to be honest, same with the Chrome option that occasionally gets offered as well.
These included and prechecked programs are why I no longer recommened Avast or CCleaner for friends and family, there has just been too many instances of unwanted additions being installed via missed check boxes or deceptive advertising that I end up having to rectify.
-
I know you were pointing that out, it is just infuriating that this practice is still going on, given that we had some input from an Avast team member previously about this very thing.
I got the impression that it may well be offered, but would have to be opt-in, given installing a security application is no light matter.
-
After avast was registered on the stock exchange it is all about revenue and they now use evry legal trick in the book, annoying or not
They have the world's largest user base but most of it is the free version so shareholders want a larger pice of the cake that the big ones have, Symantec / McAfee / Trend Micro .... it is all about $ now
-
I only logged in today for the first time because of the shameful behaviour of CCleaner installer. I downloaded today the newest version of CCleaner because I had a very old one, and silently was installed Avast antivirus as well. I'm always careful installing free programs casue I know that frequently there is a bundle with other programs such as browsers or antivirus or other security programs and so on. But no window or checkbox appeared during installation warning me of the possibility to install Avast antivirus. My system is protected by another security solution and I don't want a second antivirus program on my computer nor a sneaky one, moreover. I'm really pissed off and I will not recommend CCleaner or Avast to anyone.
-
To add further insult the latest update 5.44.6575 version release will display popup ad's just about every time you open the UI >:(
-
This just happened to me. It's incredibly maddening, esp after the data breach a while back, WTF is going on at CCCleaner???
-
Feeling nostalgic - decided to install CCleaner. Extremely pissed off and disappointed at avast malware being bundled and silently installed. This is so shitty and insulting that I won't buy your products again.
-
Feeling nostalgic - decided to install CCleaner. Extremely pissed off and disappointed at avast malware being bundled and silently installed. This is so shitty and insulting that I won't buy your products again.
This has been reported to Avast via a lot of channels and the next version should address all of these concerns.
We'll see once it's released. (No date for that release has been given.)
-
Really wtf.. Just created an account for this... I have also been scammed. I as many others here was careful and read the boxes.. So either way it wasn't there or was very well hidden... How the fuck is such a thing even legal..
How sad that such big companies who were respected in the past like avast and CCleaner fell so low...
PS. I'm trying to post this and I need to verificate but the fucking image is an unreadable mess... I keep refreshing but nothing better wtf..
-
PS. I'm trying to post this and I need to verificate...
Captcha is only needed for your first 3 posts. (Spam protection)
-
Yeah I understand that and respect that but use a readable verification program.. I had to refresh about 20 times to get something readable.
-
Posting here since this is the first relevant thread on google.
Just a heads up, avast is still being silently installed (no checkbox) with CCleaner. Pretty unethical practice from all parties here. Sad.
-
Jup although they keep claiming it isn't true... That we just didn't see it. I think the problem is the screen loads to slow so you press next without seeing the avast screen ...
CCleaner and avast are both bullshit in my eyes now
-
I came here just to protest about Avast being installed surreptitiously with CCleaner which I've been using and updating for years. Quite surprised when Windows told me my antivirus was being interfered with.
So yeah, one year on and it's still happening >:(
-
Just to add my penny worth. I have just removed 'Avast free' for the nth time and I had updated CCCleaner the day before. I have never before noticed any warning that Avast was bundled with the program. I will continue to use CCleaner but not update to the new versions. I have a notion that programs that need updating every few weeks are just seeking another opportunity to download yet another unwanted bundled program and collect the fee. I find it hard to believe that a simple cleaning program needs such frequent updating. I have a simple CD burning program that offers an update every few weeks - you would think it must be the most intensively developed software for this application in the history of the universe. Or perhaps it's an opportunity to download another PUP.
I agree with an early comment that this is irresponsible because it compromises computer security - many AV programs interfere with each other. Both CCCleaner and Avast are to blame and should suffer the damage to their reputation they richly deserve.
-
Just to add my penny worth. I have just removed 'Avast free' for the nth time and I had updated CCCleaner the day before. I have never before noticed any warning that Avast was bundled with the program. I will continue to use CCleaner but not update to the new versions. I have a notion that programs that need updating every few weeks are just seeking another opportunity to download yet another unwanted bundled program and collect the fee. I find it hard to believe that a simple cleaning program needs such frequent updating. I have a simple CD burning program that offers an update every few weeks - you would think it must be the most intensively developed software for this application in the history of the universe. Or perhaps it's an opportunity to download another PUP.
I agree with an early comment that this is irresponsible because it compromises computer security - many AV programs interfere with each other. Both CCCleaner and Avast are to blame and should suffer the damage to their reputation they richly deserve.
Yep, true but it is possible to block auto-install. Problem really originates from default opt-out checkboxes. All such boxes should be opt-in only as you say.
You should try this application: https://unchecky.com/ (https://unchecky.com/)
I've not had issues like the ones you and others are describing since install. :(
-
Chrome was installed for me with no option to uncheck.
I also have unchecky running !
very sneaky tactics
-
Chrome was installed for me with no option to uncheck.
I also have unchecky running !
very sneaky tactics
This topic is completely different there are however topics going back a very long time about people ending up with Chrome installer.
I have never had Chrome installed on this or any of my other systems.
Always do a Custom install and ensure you uncheck any options that you don't need/want and always read what is on the various screens that are presented.
Just one point, are you talking about Google Chrome, rather than the Avast Secure Browser which is based on Chrome ?
-
Always do a custom install.
It was Google chrome.
also did it about 8 updates ago. >:(
-
Always do a custom install.
It was Google chrome.
also did it about 8 updates ago. >:(
There are screens outside of the installation before you select a Custom install that could have been checked by default. Either that or there can/had been another screen after the installation and boot that had chrome pre checked.
Eight updates ago is a relatively long time ago in terms of a program update, but we need to be alert and not click to move on.
I'm totally against pre-checking requiring the user to Opt Out and not pre checked to Opt In. So we really have to slow down and read what is presented and that applies to other program installations also.
-
This auto background install of Avast is just ridiculous. over the past year ish I have gotten uncommanded installs of Avast three times, this forum says there is a box to uncheck to avoid that, HOWEVER I have attempted to update CC Cleaner four times now and regardless of watching intently for that box FOUR times I have yet to find it. You have me so paranoid now I flat refuse to click on the install button for fear of getting that damned Avast again.
I love CC Cleaner but I will discourage everyone I know from now on not to go there as these people are NOT honest folks.
-
@ islandduo,
You can put this free PUP blocker on your system and your problems with unwanted installs are pretty much over, and not just only avast, but others too: https://unchecky.com/ (https://unchecky.com/)
-
I personally recommend the following, https://www.ccleaner.com/ccleaner/builds
From there choose CCleaner - Portable Since it's a standalone version, it doesn't contain any add ons.
-
I feel I should not have to block anything, besides I have never seen the block to uncheck.
-
I created this account to complain.
avast installed itself sneakily by hiding in the updater to Partition Wizard by Minitool. The updater was launched through the software, so it attached itself to a legit program.
Why can't I stop the service. why can't I end the 700 avast programs it runs and launches on startup?
This is deliberately attempting to stop me removing it.
Wonderful software you guys have! I have to do a system restore to get this contamination off my hdd.
-
This page is SEO'd to show up when people search "avast installed itself" so I want to make it clear: Avast is a joke of a antivirus. You literally have to pay ppl to sneakily include it in their installers - that's how big a joke avast antivirus is.
-
This page is SEO'd to show up when people search "avast installed itself" so I want to make it clear: Avast is a joke of a antivirus. You literally have to pay ppl to sneakily include it in their installers - that's how big a joke avast antivirus is.
You're entitled to your opinion. There are 430+ Million that disagree with you.
I'm just one of those 430+ Million.
-
IT tech here
Was preparing some screenshots to show "clean install of a nice utility" for my book on malwares, where I (wanted to) explain that you must not install anything without carefull verification.
CCleaner was the "good" exemple
Unlocker was the "bad" exemple
I have all the screen grabs that show NOT CHECKBOX or information on avast
But.. avast STILL TRIED TO INSTALL ITSELF ??? (I have some protection, but still it got partially intalled, very bad garbage)
unlocker has a checkbox, allready checked, and I fought it was bad behavior. CCleaner, THAT IS VERY BAD BEHAVIOR !!!
Uninstalled CCleaner (and what of avast that got through).
Will never use it again
Preparing big information campain agaist you, on twitter, fb and so on.
You are bad.