[resolved] CCleaner is detected as Trojan?

[joshkmartinez]

Sometimes when I scan with Malwarebytes it detects CCleaner as a trojan. Others it doesn't... What is going on here?

[Aura]

CCleaner v5.33 was compromised. The binary was modified to perform malicious tasks. Though only on Windows 32-bit. It's all over the news.

https://www.bleepingcomputer.com/news/security/ccleaner-compromised-to-distribute-malware-for-almost-a-month/
https://www.bleepingcomputer.com/how-to/security/ccleaner-malware-incident-what-you-need-to-know-and-how-to-remove/
https://www.bleepingcomputer.com/news/security/avast-clarifies-details-surrounding-ccleaner-malware-incident/
https://www.bleepingcomputer.com/news/security/ccleaner-hack-carried-out-in-order-to-target-big-tech-companies/

[Metallica]

Do the detections match the ones mentioned here:

https://blog.malwarebytes.com/security-world/2017/09/infected-ccleaner-downloads-from-official-servers/

and here:

If not, let us know and we'll investigate further.

[joshkmartinez]

Just to be clear, CCleaner portable is not compromised correct?

[HCS]

Yes, I would assume that the portable version would also be compromised. I don't have access to version 5.33 to check, but executables in the installed and portable versions of version 5.35 are identical. 

Edited September 22, 2017 by HCS
clarification

[Porthos]

Just consider all the 5.33 compromised.

[joshkmartinez]

oh my...

[joshkmartinez]

@Metallica I have the full version malware bytes but my computer seems to have the floxif Trojan. you said " As mentioned before the full version of Malwarebytes could have protected your computer against this threat. " 

What happened?

(I have CCleaner portable)

[Porthos]

3 minutes ago, joshkmartinez said:

What happened?

(I have CCleaner portable)

Where is this portable file located at?

[joshkmartinez]

@Porthos On the desktop

[Porthos]

1 minute ago, joshkmartinez said:

@Porthos On the desktop

if it 5.33 just delete it and run your AV and MB.  If the scan is clean don't worry about it any longer. I wouldn't.

[joshkmartinez]

Thanks.

[AdvancedSetup]

Topic has been answered. I will close this topic now.