This malware issue affected my two 64 bit windows 7 systems. The malware also attempts to change the Internet Explorer Home Page at every new launch of Internet Explorer. The warning that some program is trying to do this appears every time. Uninstalling the malware after using Malwarebytes or Bitdefender eliminates this effect until reboot. I can establish cause and effect here. The way that I discovered it was on Sept 19th, Bitdefender blocked the ccleaner exe. When I rebooted, once the system tray application which runs by default loaded, the problem of the IE homepage hijack returned as well as a subsequent security warning regarding ccleaner. This means that the malware is not only in the install file, but rather running in one or more of the program modules. Only total uninstall eliminated the problem. Additionally, simply because a system is 64 bit and ccleaner installs itself under a 64 bit heading, this does not exclude the fact that 32 bit modules are running. The system tray module is a 32 bit module. Lots of software running on 64 bit OS's is 32 bit in whole or in part.
On one of my systems an additional malware was blocked on the program path: backdoor.Agent.ABXS.
Nice thing is that one of my systems was a complete system reload, not used for anything of consequence yet, so the ccleaner exploit happened in a rather controlled environment.
I have notified http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html of this and made my systems available to them if they want to look since I doubt that we will be receiving any truth from Avast/Piriform.
I love the story about them keeping it quiet while working with law enforcement. I called it years ago that this would be the BS excuse for companies to hide security breaches and address the lateness of announcing it to the general public.
