CCleaner and installing avast with out permission...

[Eddy]

Things like this sure make it a lot easier to step away from avast and stop seeing them as a trusted company.

[Asyn]

But Cisco (and others) made a good point, why hasn't the Symantec signing certificate been revoked?
I see that the newest (safe) release of CC Cleaner (534) is still using the same exact Symantec signing key as the version with the backdoor?

I've to agree, get rid of these lousy Symantec certs ASAP...!!

[REDACTED]

I see that someone had uploaded the CC Cleaner in question to VirusTotal back on August 22nd 2017 and 10 different AV engines flagged it as a Trojan back then.
**updated to read..**
Just to be clear, this was found under "compressed parents" below the actual CC Cleaner scan.
https://www.virustotal.com/#/file/135808f7953e83e663bc8318d4a05024d1a29d5965024f8738e67c28b1c2c4f8/detection

[REDACTED]

I have contacted VirusTotal and filed a "bug report" regarding VPS updates.

[REDACTED]

Things like this sure make it a lot easier to step away from avast and stop seeing them as a trusted company.

I ditched my subscription to a well known AV product several months ago even though I have a valid license till 2019 after I found a java based SSH client (JSch) hidden inside their mobile application and when I questioned them about it's function I was lied to.

[REDACTED]

I Use Avast , and why Avast still don't delete the traces of ""Agomo"" in Registry Editor where is the only place where this infected file from  CCleaner v.5.33, have left traces   ....... Soo after update to v.5.34 CCleaner - beside we all know the Registry Editor is ""scary"" place to delete things - manually delete this ""Agomo"" from Registry Editor :

[/img][/img]

[Charyb-0]

I'm disappointed with 3rd party extras. I use Windows disk optimizer, cleanup, image, backup, etc. and have had no problems here.

[REDACTED]

I Use Avast , and why Avast still don't delete the traces of ""Agomo"" in Registry Editor

Deleting that registry key does nothing but also causes no harm if you delete the entry as was already stated by an Avast representative.

[REDACTED]

So I received an email response from VirusTotal regarding the "bug report" about Avast's detection engines on
VirusTotal's website not flagging the malicious CC Cleaner.
--------------------------------------
Sep 19, 2:13 AM PDT

Subject: Bug report
Email: **********@yahoo.com
Text:

I uploaded a "tainted" version of "CC Cleaner" to VirusTotal twice today,
and while most of the AV engines on
VirusTotal are flagging it as a Trojan I see that none of the Avast (that
owns CC Cleaner)AV products are flagging it.
Does VirusTotal's AV engines all have automatic updates for detection rules
in place?
https://www.virustotal.com/#/file/1a4a5123d7b2c534cb3e3168f7032cf9ebf38b9a2a97226d0fdb7933cf6030ff/detection
-------------------------------------
Karl Hiram   
Karl Hiramoto (VirusTotal)
Sep 19, 2:29 AM PDT

Yes,  we  check for updates every hour.      If you think avast is not behaving correctly please contact avast.     If avast

thinks there is a problem, they can contact us.

We are just aggregating the information produced.


Karl Hiramoto - VirusTotal - www.virustotal.com
---------------------
The Avast AV on VirusTotal is NOW flagging the tainted CC Cleaner but as of 01:17 AM 09/19/2017  when I captured this screenshot it still was not.

[REDACTED]

A new update: https://blog.avast.com/progress-on-ccleaner-investigation

The 2nd stage payload was executed, all though on a limited amount of machines (properly), but also on 64bit machines, if I understand the blog post correctly.

[bob3160]

A new update: https://blog.avast.com/progress-on-ccleaner-investigation

The 2nd stage payload was executed, all though on a limited amount of machines (properly), but also on 64bit machines, if I understand the blog post correctly.

According to Avast, it's not your system that determines your vulnerability but, the version of Ccleaner you installed.
If you installed the 64 bit version, you're safe. If you installed the 32 bit version of CCleaner, you're not and needed to update asap.
So, you could have installed a 32 bit version on your 64 bit system and had a problem.
Naturally, you could not have installed the 64 bit version on your 32 bit system.

[Eddy]

Playing the devil her... *evil grin*
avast was installed with permission.
Doing a.'express' install means you agree to install the application along with everything that is pre-checked.

[bob3160]

Playing the devil her... *evil grin*
avast was installed with permission.
Doing a.'express' install means you agree to install the application along with everything that is pre-checked.

One of the reasons we all stress "Custom Install" - No Matter What You Install.

[1234ava]

@Eddy

Doing a.'express' install means you agree to install the application along with everything that is pre-checked.

A number of antimalware scanners will flag as "PUP" any installer that hides pre-checked additional software installation behind an "Express" option.
Personally I know perfectly well I have to always choose the Custom installation, but average Joe will pick the Express installation and be tricked into installing something he did not really want.
When it happens with a small software company, they flag it as "malware" or like that. When it happens with the big dogs, they say it's OK. Hmm. Double standards?

[bob3160]

@Eddy

Doing a.'express' install means you agree to install the application along with everything that is pre-checked.

A number of antimalware scanners will flag as "PUP" any installer that hides pre-checked additional software installation behind an "Express" option.
Personally I know perfectly well I have to always choose the Custom installation, but average Joe will pick the Express installation and be tricked into installing something he did not really want.
When it happens with a small software company, they flag it as "malware" or like that. When it happens with the big dogs, they say it's OK. Hmm. Double standards?

If you insist on using the express install, at least first install Unchecky ( https://unchecky.com/ )