CCleaner malware report (Floxif)

[Bruce_B]

With the news regarding the Ccleaner vulnerability we've created a blog post to help you investigate whether any computers in your network are potentially infected with the CCleaner 5.33 Malware, Floxif. Click here to open the blog post. In the blog post you will find instructions on how to configure your Lansweeper environment to find which computers have been affected by the Ccleaner exploit.

This topic is for any questions or discussions related to the blog post and its contents.

[Bruce_B]

As far as I'm aware, the Ccleaner installer does not provide the option to install a x86 or x64 version. It installs the x86 version on x86 systems and the x64 version on x64 systems automatically when you run the installer. We did test this with the latest Ccleaner version, and not the infected version 5.33.

If you're certain that for version 5.33 you did have the choice to install the x86 version on x64 systems, you can remove the relevant where clause from the report.

[andri]

Yes but the report you are providing limits to searching x86 systems "Where tblComputersystem.SystemType Not Like 'x64%'"
but the 32bit version of CCleaner can be installed on x64 systems and the report does not show these systems that can potentially be infected

[Bruce_B]

From our testing, there is only one Ccleaner installer, and it installs the 32-bit version only on 32-bit systems. You're not presented with a choice during installation. With this being the case and it being reported that the vulnerability was limited to the 32-bit Ccleaner version, we're reporting specifically on this.

[andri]

Does this vulnerability only affect 32bit OS architecture, will this not affect x64 OS systems that installed the 32bit Ccleaner 5.33
The "CCleaner malware report" does not scan the program files (x86) on x64 OS systems 😕