CCleaner 5.33 malware!

[Cuky]

Ne znam tko bi normalan uopce instalirao to smece na pc

[domy_os]

Kod mene verzija 5.30 posluži tu i tamo, to je valjda posljednja koja valja prije afere.

[The Exiled]

Ma nema tu više nikakve nade, služe se kojekakvim trikovima da korisnike na ovaj ili onaj način prebace na nove verzije, koje im pak služe za distribuciju sve i svačega.

[domy_os]

Može slobodno, to mi firewall sve blokira.

[IvanVk]

Autor domy_os

Može slobodno, to mi firewall sve blokira.

Upravo tako, najbolja opcija ili deinstalacija.

Evo uputa
- Kako blokirati popup oglase i spriječiti CCleaner za izlaz na Internet

[D/G]

Autor The Exiled

Ma nema tu više nikakve nade, služe se kojekakvim trikovima da korisnike na ovaj ili onaj način prebace na nove verzije, koje im pak služe za distribuciju sve i svačega.

Ako se instalirao Avast korisnici su sami krivi, pa to znači da npr. kod Adobe Reader / Flash Player oni instaliraju i MC Afee samo jer su ljeni pročitati i maknit kvačicu sa onog što ne žele ...itd.


Isto tako u postavkama CC maknut update ( pa i iz startup-a) i maknut monitoring .. .

[domy_os]

To nije dovoljno jer se neke verzije znaju same vratiti u startup ili task scheduler, ne samo CCleanera nego i drugih aplikacija. Treba mu baš preko firewalla ubiti vezu i onda si siguran.

[The Exiled]

Autor D/G

Ako se instalirao Avast korisnici su sami krivi, pa to znači da npr. kod Adobe Reader / Flash Player oni instaliraju i MC Afee samo jer su ljeni pročitati i maknit kvačicu sa onog što ne žele ...itd.

Iskreno, meni su i Avast i Acrobat i Flash Player i CCleaner i McAfee u istom košu. Ničem posebno (više) ne služe, a da na ovaj ili onaj način već nije integrirano u sam OS (bilo Windows, bilo Linux), a redovito su iskorištavani u maliciozne svrhe.

CCleaner je započel kao sasvim vredu sve-u-jednom alat, a evo sad moraš jako dobro paziti da njegovom instalacijom ne navučeš razno-razna smeća i još k tome pakira (nepoželjan/nepotreban) softver.

Nema smisla zajebavati se s tim, ako je jednostavnije zaobilaziti takve komade softvera, jer fala Bogu (ako nije dovoljno ono integrirano u OS) alternativa ima više nego ikad.

[The Exiled]

ASUS Live Update Infected with Backdoor in Supply Chain Attack

ASUS was one of the primary targets of the CCleaner attack. One of the possibilities we are taking into account is that’s how they intially got into the ASUS network and then later through persistence they managed to leverage the access … to launch the ASUS attack. The Kaspersky researchers believe the ShadowHammer attackers were behind the ShadowPad and CCleaner attacks and obtained access to the ASUS servers through the latter attack. They said they found similarities between the ASUS attack and ones previously conducted by a group dubbed ShadowPad by Kaspersky. ShadowPad targeted a Korean company that makes enterprise software for administering servers; the same group was also linked to the CCleaner attack. Although millions of machines were infected with the malicious CCleaner software update, only a subset of these got targeted with a second stage backdoor, similar to the ASUS victims. Notably, ASUS systems themselves were on the targeted CCleaner list.

Izvor: BleepingComputer i Motherboard

[A.J.]

Iskreno dugo nisam koristio CCleaner jer nisam osjetio potrebu. Ali eto ako se pokaže potreba, šta koristite sad nakon što više nije pouzdano koristit CCleaner?

[prileee]

Nista. Ne vidim potrebu.

Sent from my Redmi Note 5 using Tapatalk

[Brko]

Autor A.J.

Iskreno dugo nisam koristio CCleaner jer nisam osjetio potrebu. Ali eto ako se pokaže potreba, šta koristite sad nakon što više nije pouzdano koristit CCleaner?

BleachBit
Izuzetan free alat.

Sent from Usreo 2nd Mobara

[domy_os]

BleachBit pokrenem nakon svakog upgradea na novi Windows 10 build čisto da ubrzam stvar i ne brišem ručno, inače ne vidim preveliku potrebu za tako nečim.

[The Exiled]

Nastavak ASUS Live Update + CCleaner priče:

After admitting that an unknown group of hackers hacked its servers between June and November 2018, ASUS this week released a new clean version of its LIVE Update application (version 3.6.8) and also promised to add "multiple security verification mechanisms" to reduce the chances of further attacks. However, you should know that just installing the clean version of the software update over the malicious package would not remove the malware code from the infected systems. One of the things that makes ShadowHammer so unique is the fact that it uses a mass-infection vector to compromise a select number of targets. By one estimate, up to 1 million ASUS users may have downloaded the malware.

Yet, incredibly, analysis suggests that the real targets may have numbered only a few dozen at a time, and perhaps no more than 600 throughout the life of the entire campaign. In order to achieve this selectivity, the malware computes an MD5 hash of the infected machine’s MAC address (1 - 2). It then compares that against a table of hashes hardcoded into the malware. If there’s a match, the code begins the second stage of the attack by downloading further malware from the attacker’s C2 server. If there isn’t a match – the overwhelming majority of the cases – the malware remains dormant.

Izvor: The Hacker News i SentinelOne

[The Exiled]

Hackers breach Avast Antivirus Network through insecure VPN profile

Hackers accessed the internal network of Czech cybersecurity company Avast, likely aiming for a supply chain attack targeting CCleaner. Detected on September 25, intrusion attempts started since May 14. Following an investigation, the antivirus maker determined that the attacker was able to gain access using compromised credentials via a temporary VPN account. It is unclear if this is the same threat actor responsible for the CCleaner supply chain attack disclosed in 2017. Chances are low for discovering a connection between these two incidents. The company tracked the intruder by keeping the VPN profile active and monitoring the access going through it until mitigation actions could be deployed. Law enforcement has been notified of the intrusion and an external forensics team assisted Avast's efforts to verify the collected data.

Izvor: BleepingComputer

[Brko]

Znači uz CCrapware, izkarali su i Kravast. Odlično

[The Exiled]

Je, tak je cijela stvar i počela još prije par godina. Čim je Avast kupil Piriform, ode sve u Mp3.

[driftwood]

Zašto mi se CCleaner 4.19 pali sa windowsima 7 x86?
Monitoring je onemogućen, u msconfigu u startupu ga nema, nema ga niti u registryu u "run" (startup with windows). Pojavi se u notification area, i analizira i zatim se isključi i nema ga više.

Gdje mu je to zapisano da se upali sa windowsima?

[driftwood]

I dalje me ovo zanima...ako netko zna odgovor.

[Nikky]

Mora imati od nekud start, nađi ili ga deinstaliraj / ubij.

Jesi li gledao postavke unutar programa?
Tamo bude opcija hoće li se pokretati sa sys.

[domy_os]

Možda u Task Scheduler imaš nešto?

[Mario92]

Pogledaj sa Autoruns kaj ti se pokreće kod startupa pa tamo i zakolji

[driftwood]

Autor Nikky

Mora imati od nekud start, nađi ili ga deinstaliraj / ubij.

Jesi li gledao postavke unutar programa?
Tamo bude opcija hoće li se pokretati sa sys.

Nema, isključeno.

Autor domy_os

Možda u Task Scheduler imaš nešto?

Nema ništa.

Autor Mario92

Pogledaj sa Autoruns kaj ti se pokreće kod startupa pa tamo i zakolji

Ok. Provjerit ću sa tim.

[pogi]

Ako ga Autoruns od Sysinternals ne nađe onda je magija.

[The Exiled]

Avast AV accused of selling your click history, purchase details to third-parties

The company has come under fire in recent months due to a browser extension that was found to be sending user data to third-party marketing firms. At the time, Avast reassured users that their data was "fully de-identified and aggregated" during this process. However, an investigation by Motherboard and PCMag has uncovered that Avast is bending at the truth a bit, as it's relatively easy for marketers to build a profile on individuals, their purchase habits, and their browser click history. All of this trickery stems from Avast subsidiary Jumpshot, which provides user traffic details that it has obtained from 100 million devices around the globe. Data siphoned from users can be narrowed down to individual clicks timed down to the millisecond, which is then tied to a device ID. That persistent device ID will linger on until the Avast software is uninstalled from a customer’s computer. For its part, Avast says that this tracking is only attributable to its free antivirus software and adds that users can opt-out of data collection. For Avast users that may have missed this opt-out button previously, you can do so from within the Settings menu within the app.

Izvor: HotHardware

[Brko]

Kravast... sad bi trebao onaj meme sa Obi-Wanom i Anakinom gdje prvi potonjem kaže da je postao ono što se zakleo da će uništiti

[B0ss]

"Good" guy Defender...

[Brko]

M'lord.

[tiki66]

Sve je više i više tog šrotwarea

Baš sam nedavno radio PC sa Avastom, free edišn. Stalno neki pop-upovi da kupiš premium. Stvarno ne znam kome se to da trpiti, radije pustim Windows defender neka radi svoj posao

[The Exiled]

Avast shuts down Jumpshot after getting caught selling user's data - sramota je sad potpuna.