Hakiran CCleaner

Nikada nisam vjerovao ovom i sličnim "cleaner-ima". Ne volim terije zavjere ali sam uvijek mislio da po instalaciji i "čišćenju" lažno prijave ili eventualno donesu sa sobom ono što prijave da je uklonjeno sa računara. Ovaj tip softvera ne koristim više od 10 godina.

Službeni odgovor iz Avasta;

"Guys,

I just had a chance to read this thread and I'm a bit horrified as I think that there's quite some misconception about what actually went on.

First of all, the bottom line is: to the best of our knowledge, no harm was done to any CCleaner users as the threat was removed before it had a chance to fully activate. 
This is really not about downplaying the issue. This is a statement based on a pretty thorough analysis, partially shared below and partially still embargoed because of the ongoing investigation.

Now, some facts:
- Avast acquired a company (Piriform) which was in the process of being hacked. We have good evidence that the attack started at least several weeks before the acquisition.
- Immediately after we first learned about something wrong with the CCleaner product (which was on September 12, i.e. 6 days ago) we started working on it and have been working on it around the clock since then.
- The #1 priority for us was to protect the CCleaner customers and minimize the actual customer impact of the incident.
- For that reason, we first focused on fully understanding the malicious code and disconnecting the bad actors from their ability to control the backdoor, i.e. taking down the CnC servers.
- The CnC server was taken down on September 15, three days after we first learned about the incident. Given how difficult these things tend to be, we consider this a very good result and I don't see how we could have done it any better. (By that time, the secondary CnC servers (the DGA domains) were already sinkholed as well, so that technically cut the attackers off their ability to control the backdoor).

At the same time, we wanted to understand whether the second stage payload could have already activated before the threat was discovered. Now, the good thing is that about 30% of CCleaner users also run Avast security software, which allowed us to analyze behavioral, traffic and file/registry data from those machines.  Based on this analysis, we can say with high confidence that to the best of our knowledge, the second stage payload never activated, i.e. the only malicious code present on customer machines was the one embedded in the ccleaner.exe binary itself. We also asked our colleagues from other security companies, but haven't heard anyone seeing anything suspicious either. And that's great news, as it means that despite the high sophistication of the attack, we managed to disarm the system before it was able to do any harm. To that end, we don't consider the advice to reformat and/or restore the affected machines to the pre-August 15 state to be based on facts (by similar logic, security companies are not usually advising customers to reformat their machines after a remote code execution vulnerability is identified on their computer, just because there was a hypothetical possibility that something might have gotten in). 

BTW, I have to say I was quite disappointed by the approach taken by the Cisco Talos team who appears to be trying to use information about this incident to drive marketing activities and piggyback on the case to increase the visibility of their upcoming product. And, I should probably also say that it wasn't Cisco who first notified us about the problem. The threat was first discovered and reported to us by researchers in a security company called Morphisec (thank you!). The threat was real, but to the best of our knowledge, it was fortunately mitigated before it could do any harm.

We plan to be issuing more communication about this as we go. This is a very unfortunate incident and of course, it's in our highest interest to properly investigate the issue and make sure it never happens again. Unfortunately, as you can imagine, the security measures in small companies are usually not up to the standard and that's a big lesson for us in terms of what to look for in case of future acquisitions.

Thanks,
Vlk"

https://forum.avast.com/index.php?topic=208612.msg1421249#msg1421249

Da mi je samo znati postotak paničnog brisanja ccleanera poslije pročitane vijesti ;)

Placebo....

I problem rijesen....

 - smisao foruma/tema je upravo to.. raspravljati, pomagati, iznositi mišljenja i prijedloge.

ali, i primjedba, radiš istu grešku, predlažeš (na ćoravo) npr instalirati office.. nikad ne predlaži jer tvoje potrebe i potrebe ostatka svijeta ne moraju biti ni slične, jednako HW i svaki drugi kriterij.

korisnik koji ne treba office, neće ga ni instalirati, onaj koji treba, hoće.. jednako je s browserom, playerima, igrama, itd.. nešto drugo je u odgovarajućoj temi preglagati koji office ili koji player, kako ga podesiti i sl.

.. jer, upravo po tom primjeru, automatizmom, korisnici instaliraju alate tipa CC, DT, browsere, office.. svašta. Treba instalirati SAMO ONO ŠTO JE POTREBNO za korištenje a to jedino korisnik (svaki za sebe) može znati. Sve ostalo je višak (smeće), neovisno jel najkvalitetniji soft u pitanju. Korisnik-počertnik, koji ne zna što mu treba, još manje treba instalirati po ovakvim na ćoravo preporukama. .. dok će mu svaka web reklama nuditi da instalira nešto, chrome, flash, igre.. KISS pravilo, sve što se tako nudi, ne treba.

Kad korisnik instalira (samo) ono što mu treba, tad će naučiti i koristiti .. računalo-apps, to je upravo korištenje. Igre, posao, ista stvar, sve što se ne koristi je višak=smeće (i potencijalni malware).

- umijesto preporučavanja što sve da netko instalira, bolje je preporučiti da pogleda opcije u već postojećim alatima unutar OSa, kao što djigibao gore prikazuje za čišćenje diska.. jer ti alati rade, tu su, samo ih treba kliknuti.. (pošto su sad win kompletno lokalizirani, ni jezik nije problem-izgovor, mada je meni draža eng.terminologija za PC, tako i početnik može čitati-odlučiti što mu treba, razumjeti što želi i kako to napraviti, često ljudi ne razumiju engleski.. i koriste bez razumijevanja što su kliknuli).

evo, ja ću predložiti npr umjesto instaliranja winzipa-winrara, instalirati 7z. .. jer je free-alternativa (daleko bolje nego crackani soft+malware), ali samo u kontekstu takvog pitanja-teme. Ako korisnik nema potrebu za zipovima, tad je i 7z višak. Tako da NHF, nijepljuckanje na mišljenje... više kao pohvala/preporuka za forumsko sudjelovanje :)

Druga napomena (kad se predlaže neki soft), za kućne korisnike nije pretjerano važno, za firme obavezno, razmišljati o licenci. Svaki soft ima, mora imati licencu za korištenje. Bez licence, kao za auto, je kažnjivo. I free soft ima licencu. Za firme-komercijalnu upotrebu svi (skoro svi) freeware/shareware i sl. nisu free, odnosno, free su samo za kućne korisnike, ne za firme. 7z je free za sve i to je navedeno u licenci. Zato, ako preporučim 7z ... radi, ima licencu kriterij. Ne da je po nečemu bolji od ostalih (jer rade istu stvar, na isti-sličan način i ugl su kompatibilni) a to često korisnici tvrde za bilo koji soft-alat (ugl neopravdano, bez argumenta). Drugi problem je Office-kompatibilnost... pa i navika. Uzalud nekome free kad nakon par dana traži MSO, ponekad čak nema izbora. Svaki korisnik to mora za sebe odlučiti, ne zato jer ja kažem.. jednako svatko tko navodi da je neki alat bolji, trebao bi to nekako argumentirati. (još čekam neke dokaze da je računalo s CCom npr brže-bolje-sigurnije.. da je recimo potreban za bolji rad bez problema) :)

 Slažem se, mislio sam reći da treba instalirati na sistem ono što nam stvarno treba,a najprije bi trebalo na svakom osu (bio to win,mac,linux) isprobati programe koji dođu instalirani i tek onda instalirati što nam stvarno treba. A dokaze da komp radi bolje s cc, glaryem vjerovatbo nećeš dobiti.

 ne znaci nista. 

https://partner.microsoft.com/en-US/membership/core-benefits

shutup radi nesto nad cim ti nemas konktrolu nego samo vjeru da to radi dobro. Kao i ccleaner....

Ako ti tako kazes....

Ako ne vjeruješ da radi, stavi ga na virtualku i testiraj. Nađi hostove koje blokira i pokušaj ih pingat. Ja sam ti već dokazao da se program ne spaja na internet. Osim toga, ako misliš da program kvari Windows 10 jer popravlja njegove mane i to možeš testirati i javiti nam što je to točno program pokvario.

 - ništa, tj samo da su potrošač MSovih proizvoda i da ih dalje preprodaju, istu stvar kao plaketu može isprintati svaki trgovac.. (PC opreme i softwarea by MS).

Svaki certificirani serviser, mvp, dok firme ovisno o veličini (manje-srednje) na taj način najjeftinije dolaze do licenci za sve MSove proizvode (win, mso, server, ..). To znači, .. ništa :)

tek mrvicu iznad .. (karikiram) da sebe proglasim partnerom HEPa..

dakle, zaklučak je bug genijalaca da jedino microsoftov dick cleanup koji se podesi na automatiku, (Wns 10) ili ne, besprijekorno čisti smeće, popravlja reg i što još ?!

Bemt ti, taj je svemoguć.

Na XP-u, sedmici i osmici ste se rugali tom alatu a sad je odjedanput s dolaskom win 10 postao Dark killer za elektronsko smeće. 

što se tiče svih tih komercijalnih čistača, instalirajte ih jedno 10 od raznih firmi.

to sam napravio prije desetak godina.

Nakon svakog čistača ovaj drugi će pronaći nešto što ovaj prije njega nije počistio ili "popravio".

NOD32 jucer na laptopu detektirao sa CCleanera nesto, mislim da je cak Trojan pisalo i jos neki vrag, i CCleaner sam azurirao uredno opet radi.
No na PC moram install nod32, a to mi je tlaka kasnije micat, jeli ga detektira bit defender free? Na laptopu imam original NOD32... zato pitam.

Ili win defender i malo razmisljanja prije nego kliknes na ok cim iskoci i isto miran ;)