How to verify that your CCleaner installer is authentic

[Guest Stephen CCleaner]

Sometimes malicious groups seek to capitalise on CCleaner's popularity by repackaging our software installer with malware. In this case, your installer may look like CCleaner, but it could contain trojans and other nasty things. For this reason, we always advise our users to download the latest, most secure version of the product from Piriform.com. Alternatively, you can upgrade to the Pro version and it will keep you up-to-date automatically.

 

If you download a CCleaner installer and want to confirm its authenticity you can see if its 'hash signature' matches one of the signatures we have published in our release announcement here on the forums:

 

This is simpler than it sounds, just follow these straightforward steps:

1. First, we need to download a file hash utility. We recommend HashMyFiles* for its small size and straightforward drag-and-drop interface [ download the 64-bit version | download the 32-bit version ]
2. Copy the HashMyFiles 'zip' file and move it to where you want it. Next, right-click and 'unzip' HashMyFiles into your chosen folder.
3. At this stage, you may wish to Pin HashMyFiles to the Windows Start menu, or create a shortcut. To do this, just right-click HashMyFiles.exe and select the appropriate action.
4. Double-click HashMyFiles.exe to launch the application.
5. Go to View > Choose Columns and untick everything except Filename, SHA-256 and File Version.
6. Go to File > Add Files and select the 'ccsetup' installer you want to verify (e.g. ccsetup537.exe); optionally, you can drag the file into the HashMyFiles window if it's easier.
7. Your window should look something like this:

 

 

Final step: Go to the CCleaner Announcements section and check that the file hash shown in the version announcement thread matches what you have in HashMyFiles. If not, your CCleaner installer file could be damaged or may have been tampered with. In that case, visit Piriform.com to download the latest version of the CCleaner.

 

Piqued your interest? Learn more about how cryptographic hash functions work.

 

* Our company lawyers have advised me to make it clear that neither Piriform nor Avast can be liable for any problems, however unlikely, that may occur by installing this third-party software on your system.

[methesdula]

The announcement for the new release (5.38, 2017-12-12) does not include the hash. I'd think you'd want to post that at the same time as the installer....

[Nergal]

I believe the hashes will be posted later today, or at least that's what moderators were told this morning

 

#longlunch

[Andavari]

Perhaps an easier way to verify the hashes without the need to install any additional software is to use an online site such as Online MD5:
http://onlinemd5.com/