Tel Posted May 13, 2014 Share Posted May 13, 2014 I've just tried to download the new version (413) of Ccleaner, and it all looks very different from the last time I did this. Instead of being able to download from the Piriform website, it winds up downloading from "Soft Now", and when I go to run the exe file that's also very different from what's always happened in the past, including wanting to download additional, unwanted, software. I stopped the installation. Is this all as it's supposed to be, or have I downloaded something different to Ccleaner? Is it safe to proceed? Thanks. Link to comment Share on other sites More sharing options...
Alan_B Posted May 13, 2014 Share Posted May 13, 2014 Very UNsafe. Something went wrong if you were not able to download from Piriform. Link to comment Share on other sites More sharing options...
Moderators mta Posted May 13, 2014 Moderators Share Posted May 13, 2014 If for whatever reason you can't get it from Piriform, the next trustworthy site is FileHippo. It sounds like what you got was wrapped up with some other crap so it's good you stopped that install. Here's the link for Piriform, http://www.piriform.com/ccleaner/builds and if the standard installer doesn't work out, try the portable or slim. Backup now & backup often.It's your digital life - protect it with a backup.Three things are certain; Birth, Death and loss of data. You control the last. Link to comment Share on other sites More sharing options...
Tel Posted May 13, 2014 Author Share Posted May 13, 2014 Thanks. I did manage to get a "correct" download from Piriform eventually, and I'm scanning the computer now, just in case. The worrying thing is that I started the first update by opening ccleaner and clicking on "check for updates". This took me to what looked to be the true Piriform site; I clicked on the "Download" button and went to what claimed to be File Hippo; I clicked on "download" there, was taken to "Soft Now", and what I downloaded was a file called "CCleaner_TSA 13AIJZ" with an icon I'd never seen before. There's something dangerous going on there I think. Link to comment Share on other sites More sharing options...
Moderators Nergal Posted May 13, 2014 Moderators Share Posted May 13, 2014 The download now you clicked on was probably a file hippo advert, read the download page carefully and there should be a more obviously ccleaner download on the page re-read the previous post and changed my opinion ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF. Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark) ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T. Support at https://support.ccleaner.com/s/?language=en_US Pro users file a PRIORITY SUPPORT via email support@ccleaner.com Link to comment Share on other sites More sharing options...
Moderators hazelnut Posted May 13, 2014 Moderators Share Posted May 13, 2014 The software you downloaded from that site Tel may contain Conduit and/or SweetPacks and is certainly not a recommended CCleaner download site, nor has anything to do with them. Scan your pc with a few different things until you are certain you are not in trouble. Support contact https://support.ccleaner.com/s/contact-form?language=en_US&form=general or support@ccleaner.com Link to comment Share on other sites More sharing options...
Hav0c Posted May 13, 2014 Share Posted May 13, 2014 The software you downloaded from that site Tel may contain Conduit and/or SweetPacks and is certainly not a recommended CCleaner download site, nor has anything to do with them. Scan your pc with a few different things until you are certain you are not in trouble. Some recommended tools we users use that may help you scan your PC can be found here Every line of code written by man can be undone by man . "A loser in the real world is still a loser in the net!" - .hack//SIGN . Getting old is inevitable, growing up is optional !! Link to comment Share on other sites More sharing options...
Tel Posted May 14, 2014 Author Share Posted May 14, 2014 THanks everyone. I scanned with Norton yesterday and that was clean. I've got a full MBAM scan running now, with rootkits ticked. If that's OK is there any need to scan with MBAntirootkit also? PS: A few minutes later: the MBAM scan found 6 nasties, comprising the conduit and sweetpacks mentioned. All are quarantined. Does that mean the computer is OK now, please? Link to comment Share on other sites More sharing options...
Moderators hazelnut Posted May 14, 2014 Moderators Share Posted May 14, 2014 It may well be a good idea to go to one of the sites mentioned in item Number 10 of the forum rules and get checked out. http://forum.piriform.com/index.php?showannouncement=15&f=4 They will check all is removed and help you re-set your browsers homepage etc, don't forget to provide them with the logs they ask for when you make your first post. Let us know how you go on. Support contact https://support.ccleaner.com/s/contact-form?language=en_US&form=general or support@ccleaner.com Link to comment Share on other sites More sharing options...
Tel Posted May 15, 2014 Author Share Posted May 15, 2014 Good idea - thanks. I'll do as you say. Link to comment Share on other sites More sharing options...
Tel Posted May 19, 2014 Author Share Posted May 19, 2014 The end of the matter (hopefully): I went onto the Malwarebytes forums and posted my problem. I got a reply from a malware removal expert, and over the next couple of days he patiently got me to go through a series of scans with different downloaded software, and these found some remnants of the original 6 items of malware, which were also removed. As well as being annoyed at myself for letting this happen, I'm disappointed that Norton neither stopped the malware from downloading, nor found it when I ran a scan. However, it seems that the major security suites are vulnerable to some clever malware, so I'm sticking with Norton, but have purchased the Premium version of MBAM - this works out at £10 pa for each of our 2 computers, which is a modest amount for the increased security. Thanks again. Link to comment Share on other sites More sharing options...
Moderators hazelnut Posted May 19, 2014 Moderators Share Posted May 19, 2014 Very glad to hear you are all sorted now Tel. And thanks for letting us know Support contact https://support.ccleaner.com/s/contact-form?language=en_US&form=general or support@ccleaner.com Link to comment Share on other sites More sharing options...
Hav0c Posted May 19, 2014 Share Posted May 19, 2014 Glad all is sorted, As well as being annoyed at myself for letting this happen, I'm disappointed that Norton neither stopped the malware from downloading, nor found it when I ran a scan. Hope you send Norton the files telling them "Hey guys you missed this files !!!" Every line of code written by man can be undone by man . "A loser in the real world is still a loser in the net!" - .hack//SIGN . Getting old is inevitable, growing up is optional !! Link to comment Share on other sites More sharing options...
Druco Posted June 26, 2014 Share Posted June 26, 2014 The download site for the v4.15 update is riddled with crapware still. Why would Piriform allow that? It seems like it will cause a bad impression for potential customers. Link to comment Share on other sites More sharing options...
Moderators Nergal Posted June 26, 2014 Moderators Share Posted June 26, 2014 Thread closed as original issue pertained to malicious software posing as ccleaner, and deemed solved. Not the Advertising practices of a third-party distributor. The update itself has no "crapware" (unless you consider G products as crapware). ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF. Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark) ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T. Support at https://support.ccleaner.com/s/?language=en_US Pro users file a PRIORITY SUPPORT via email support@ccleaner.com Link to comment Share on other sites More sharing options...
Recommended Posts