Fix We couldn’t install some updates

If you got an error message saying, “Windows Update failed to install error 0x80240034” when trying to update your Windows 10 then it’s probably due to some update services that are failing at some point. In addition, you might also see Error constant WU_E_DOWNLOAD_FAILED with the description that “Update has failed to download”. The Windows Update failed to install error 0x80240034 might be caused by some connection problem or there might be a duplicate update or that installation is not allowed and so on. And so to fix the problem, we’ve prepared some options that could help. Make sure to follow them accordingly but before you proceed, you need to verify if you have a stable internet connection.

Option 1 – Restart your computer and try installing the Updates again

Restarting your computer can also help in fixing the Windows Update failed to install error 0x80240034. There are cases where the issue resolves on its own as it could just be some simple network or PC error.

Option 2 – Try to disable your antivirus program

The Windows Update failed to install error 0x80240034 might be caused by the antivirus program installed in your computer which is why disabling the antivirus program or any security software installed in your computer is always a good idea you can try when the Windows Update process does not go smoothly. So before you try updating your computer again, make sure to disable the antivirus or security program and once the Windows Update is done, don’t forget to enable the antivirus program back again.

Option 3 – Clean up temporary and junk files

• Open Setting > System > Storage from the WinX Menu.
• From there, you will see a list of all the local and connected storage devices along with the details on the free space.
• Now make sure that the Storage Sense feature is turned On then go find a link that says “Free Up Space” and click it to open.
• After that, a screen which is the built-in program in Windows 10 will appear and will scan your computer for the following junk files so you can free up disk space:
• Windows Upgrade Log Files
• The system created Windows Error Reporting Files
• Thumbnails
• Temporary Internet Files
• Previous Windows Installation Files
• Delivery Optimisation Files
• DirectX Shader Cache

Note: Once you’re done freeing up space on your drive, try to run the setup file again.

Option 4 – Run the Windows Update Troubleshooter

Running the built-in Windows Update troubleshooter is one of the things you can first check out as it is known to automatically resolve any Windows Update errors like error 0x80240034. To run it, go to Settings and then select Troubleshoot from the options. From there, click on Windows Update and then click the “Run the troubleshooter” button. After that, follow the next on-screen instructions and you should be good to go.

Option 5 – Delete Files from Software Distribution Folder & Catroot2 folders

The downloaded Windows Updates are placed in a folder called “SoftwareDistribution”. The files downloaded in this folder are automatically deleted once the installation is completed. However, if the files are not clean up or if the installation is still pending, you can delete all the files in this folder after you pause the Windows Update service. For complete instructions, refer to the steps below.

• Open the WinX Menu.
• From there, open Command Prompt as admin.
• Then type in the following command – don’t forget to hit Enter right after typing each one of them.

net stop wuauserv net start cryptSvc net start bits net start msiserver

• After entering these commands, it will stop the Windows Update Service, Background Intelligent Transfer Service (BITS), Cryptographic, and the MSI Installer
• Next, go to the C:/Windows/SoftwareDistribution folder and get rid of all the folders and files thereby tapping the Ctrl + A keys to select them all and then click on Delete. Note that if the files are in use, you won’t be able to delete them.

After resetting the SoftwareDistribution folder, you need to reset the Catroot2 folder to restart the services you just stopped. To do that, follow these steps:

• Type each one of the following commands.

net start wuauserv net start cryptSvc net start bits net start msiserver

• After that, exit Command Prompt and restart your computer, and then try to run Windows Update once more.

Option 6 – Run the DISM tool

If the first five options didn’t work, then running the Deployment Imaging and Servicing Management tool might help as it can repair the Windows System Image as well as the Windows Component Store in Windows 10.

• After you access the Advanced Startup options, select Command Prompt by using the arrow keys on your keyboard.
• Next, type in this command: DISM /Online /Cleanup-Image /RestoreHealth
• Do not close the window if the process takes a while as it will probably take a few minutes to finish.

Option 7 – Run System File Checker

Running the SFC scan or System File Checker might also help in fixing error 0x80240034.

• Tap Win + R to launch Run.
• Type in cmd in the field and tap Enter.
• After opening Command Prompt, type in sfc /scannow and hit Enter.
• Restart your PC.

Option 8 – Try to use the Media Creation tool

The Media Creation tool in Windows allows you to use the ISO installation file to make a bootable device that you can use to install Windows on your PC. Note that this is kind of different from the usual installation process as it could erase your computer’s current settings and data on the primary drive. Thus, before you proceed, you need to backup all your data into some removable drive and then use the Media Creation Tool to make a bootable drive.

• After making the bootable drive, you need to plug it into your computer and then reboot.
• Next, tap the F10 or Esc key to open the boot options.
• Now set the boot priority of the removable drive the highest. Once the setup comes forth, follow the next onscreen instructions and install Windows without any problems.

So, what is Electron bot, and why it even matters if it is in the MS store. Electron bot is malware that somehow found its way inside MS Store via game clones of popular games temple run and subway surfer. This infiltration led to the infection of around 5000 systems over the globe in a very short period of time.

This malware is a backdoor that gives complete system control to the attacker. Any type of execution can be performed remotely in real-time. Usually, this kind of attack was aimed at a spread of click fraud over popular social media like Facebook, google, youtube, etc.

Primary goal

Electron Bot's primary goals in the ongoing campaign analyzed by researchers are:

• SEO poisoning – Create malware-dropping sites that rank high on Google Search results.
• Ad clicking – Connect to remote sites in the background and click on non-viewable advertisements.
• Social media account promotion – Direct traffic to specific content on social media platforms.
• Online product promotion – Increase store rating by clicking on its advertisements.

These functions are offered as services to those who want to increase their online profits illegitimately, so the gains for the malware operators are indirect.

Publishers that contain malware

For now, users may take note of the publishers who released confirmed malicious game apps using the following names:

• Lupy games
• Crazy 4 games
• Jeuxjeuxkeux games
• Akshi games
• Goo Games
• Bizzon Case

The latest update from Panos Panay on Twitter is including New and redesigned Snipping tool inside Windows 11. From the shared video, we can see that it includes modern Windows 11 UI redesign and it looks and feels like a part of Windows 11. More things that can be seen from the shared video is that it looks like the new snipping tool is a merged version of the old with snip & sketch. It is good to see that it is still possible to capture screen with easier way natively inside Windows 11 but some more functionality would be more welcome I guess. Users were asking for added functions for a long time like adding simple text for example but from shared video, no new features were presented so for some users 3^rd party solutions will still be the way to go. The new and redesigned Snipping tool will roll out with the next update and we will see then about all new features inside it firsthand. Until then, take care.

Error 651 - What is it?

Are you a Windows 7 PC user? Are you experiencing error 651? If yes, then read on. We will discuss what is this error, the causes, and easy DIY solutions to help you resolve this issue immediately. Error 651 is a common Windows 7 error. This error occurs when you try to connect using your PPPoE connections. The error message is displayed in the following format:

“Error 651: The Modem (or other connecting device) has reported an error.”

Solution

Error Causes

The error code 651 occurs due to multiple reasons. However, some of the most common error causes include:

• The raspppoe.sys file saved in the wrong location
• IP setting  issues
• Registry issues

Further Information and Manual Repair

Here are some of the best and easiest solutions to resolve the error code 651 on your system immediately. These solutions are so easy to perform that you don’t need any technical expertise or knowledge to get started. So here we go!

Solution 1: Reset TCP/IP Settings

To reset TCP/IP settings on your PC, here’s what you need to do. Simply replace the RAS PPPoE driver. First open a command prompt, then write the following command in the command prompt:  TAKEOWN /F"C:Windowssystem32driversraspppoe.sys" ICACLS "C:Windowssystem32driversraspppoe.sys" /grant administrators:F. After that, press enter to continue. Now close the command prompt and go to the folder C:\Windows\system32\drivers, here rename the raspppoe.sys file to raspppoe2.sys. Now right click on save the link as Vista RAS PPPoE Driver and save it in the C:\Windows\system32\drivers folder. Once this process is complete, to activate changes made, restart your PC. This is most likely to resolve the error code 651 on your system.

Solution 2: Try Power Cycling your Modem and your Router

This is another way to resolve error 651. However, before you try this solution, it is recommended that you save all your work on your system, close all your open applications, and then shut down your PC. After that first turn your router off and wait for about 2 minutes. Then turn off your modem too. Now disconnect all the Ethernet cables that are connected to your modem, router and your system. Reconnect them again and make sure that the connections are not loose. After reconnecting the cables, reboot your PC and switch on the modem first. After your modem gets initialized, turn on the router. See if this procedure works. If it does, then that’s great the issue is resolved. However, if the error persists, then this indicates deeper problems. The error message is triggered due to registry issues.

Solution 3: Clean and Repair the Registry

Sometimes the underlying cause of error 651 is a corrupt and damaged registry. Registry is the database where operating system stores all the information associated with installed programs and activities performed on your PC. Registry issues typically result due to poor PC maintenance. When you don’t clean the registry the unnecessary and obsolete files accumulate and acquire a lot space. It damages the registry and DLL files. This often leads to disk fragmentation and files are then saved in segments in different locations. This also slows down your PC performance. This could also be the reason for why the raspppoe.sys file is saved in the wrong location. Though you can repair the registry manually but it may be complex for you especially if you are not technically sound. And besides, it is also slightly time-consuming.

Restoro - Premier Registry Cleaner

Therefore, to resolve errors like 651 triggered by the registry issues on your system in seconds, it is advisable to download Restoro. Restoro is a cutting-edge and multi-functional PC Fixer. It is deployed with a powerful intuitive algorithm and multiple highly functional utilities designed to resolve practically all types of PC errors. It includes utilities like a registry cleaner, an antivirus, and a system optimizer. The registry cleaning feature scans for all types of registry issues and errors and resolves them instantly. It wipes out unnecessary and redundant files like cookies, internet history, junk files, and bad/ invalid registry entries. It cleans the registry freeing up space. Furthermore, it also repairs the damaged files and restores the registry back to normal.

Restoro Special Features

Other features include an antivirus that removes all types of malicious software hiding in your PC including viruses, Trojans, spyware, malware, and adware. The system optimizer feature ensures that your computer performs at its optimal level at all times. Restoro is safe and bug-free. Its user-friendly interface and simple navigations makes it quite easy for users to operate it without any difficulty. Furthermore, compatibility is not an issue with this software. You can download it on any Windows version. Click here to download Restoro and fix error 651 on your PC today!

If you suddenly encountered Error Code 0xc1900130 while trying to update your Windows 10 computer, read on for this post will help you fix the problem. This kind of Windows Update error may occur when the network connection between the Windows Update server and the client machine is interrupted and the install can’t continue since the instance hash was not found. In such cases, you will see the following error message in Settings:

“Failed install attempt – 0xc1900130”

Here are the technical details of the error:

“Error Code: 0XC1900130 Message: MOSETUP_E_INSTALL_HASH_MISSING Description: The install cannot continue because the instance hash was not found.”

If you are currently facing this problem when you tried to install a Feature Update, you might have to check your internet connection and then try to install the Windows Update again. However, if it didn’t work, then you can refer to each one of the given options below to fix the error.

Option 1 – Reset the Windows Update components

If by any chance that the second option didn’t work, resetting the Windows Update components could also help you resolve the problem. How? Refer to the following steps:

• Open Command Prompt with admin privileges.
• After that, type each one of the following commands and hit Enter after you key in one after the other.
  • net stop wuauserv
  • net stop cryptsvc
  • net stop bits
  • net stop msiserver

Note: The commands you entered will stop the Windows Update components such as Windows Update service, Cryptographic services, BITS, and MSI Installer.

• After disabling WU components, you need to rename both the SoftwareDistribution and Catroot2 folders. To do that, type each one of the following commands below, and don’t forget to hit Enter after you type one command after the other.
  • ren C:WindowsSoftwareDistribution SoftwareDistribution.old
  • ren C:WindowsSystem32catroot2 Catroot2.old
• Next, restart the services you’ve stopped by entering another series of commands. Don’t forget to hit Enter after you key in one command after the other.
  • net start wuauserv
  • net start cryptsvc
  • net start bits
  • net start msiserver
• Close Command Prompt and reboot your PC.

Option 2 – Try configuring the Windows Update-related Services

• Tap the Win + R keys to open the Run dialog box.
• Then type “cmd” in the field and tap Enter to open an elevated Command Prompt.
• Next, execute the following commands. Note that you have to type and enter each command one after the other.
  • SC config wuauserv start= auto
  • SC config bits start= auto
  • SC config cryptsvc start= auto
  • SC config trustedinstaller start= auto
• The commands you executed will make sure that the Windows Update-related services are available. Once it’s done, restart your computer and see if the Windows Update error is now fixed.

Option 3 – Try downloading and installing the Windows Updates manually

Windows Upgrade Error Code 0xc1900130 might be due to a Windows Update that has failed. So if it is not a feature update and only a cumulative update, you can download the Windows Update and install it manually. But first, you need to find out which update has failed, and to do so, refer to the following steps:

• Go to Settings and from there go to Update and Security > View Update History.
• Next, check which particular update has failed. Note that Updates that have failed to install will be displayed under the Status column which has a label of “Failed”.
• After that, go to the Microsoft Download Center and look for that update using its KB number and once you find it, download and then install it manually.

Note: You can also use the Microsoft Update Catalog, a service from Microsoft that provides a list of software updates that can be distributed over a corporate network. With the help of this service, it can be easier for you to find Microsoft software updates, drivers as well as fixes.

Option 4 – Try to run the Windows Update troubleshooter

Windows 10 have various troubleshooters that can help you resolve many system issues. So if you’re dealing with Windows Update errors like Error Code 0xc1900130, you can run the Windows Update troubleshooter to resolve it. To run it, go to Settings and then select Troubleshoot from the options. From there, click on Windows Update and then click the “Run the troubleshooter” button. After that, follow the next on-screen instructions and you should be good to go.

Option 5 – Try to flush the DNS cache

You could also try to flush the DNS cache as it might fix the problem. To do so, follow these steps:

• Right-click on the Start button and click on Command Prompt (administrator) so you can pull up an elevated Command Prompt.
• After that, execute the following command to flush the DNS cache

ipconfig /flushdns

• Next, restart your PC and check if the problem’s fixed.

Note: You might also check your internet connection or reboot your router or plug out and then plug in your Ethernet connection manually to verify the reliability of your internet connection since intermittent connection could also cause Windows Update errors like Error Code 0xc1900130.

Modem Error 633 error is a dial-up error that usually occurs when using a USB modem with a Windows computer. The Modem Error 633 error message is displayed as the following:

“Error 633: The Modem is already in use or not configured properly.”

Solution

Error Causes

This error can be triggered due to several reasons such as:

• A software program conflicts with the USB modem
• The modem is not configured properly
• The Telephon.ini file is missing or damaged
• There is some issue with the way Windows is managing the communication (COM) ports on your computer.

Further Information and Manual Repair

If you experience the Modem Error 633 on your PC, you don’t have to panic. Though this error does not pose any major threats like data loss, it may hamper your ability to use the internet therefore it is advisable to resolve the error. Repairing the Modem Error 633 is quite easy. There are a number of ways to fix this error. So, let’s get started:

Solution 1: Delete Incompatible Software and Non-Present Modems

• Click on the start menu and go to the ‘Control Panel’. Now choose the option ‘Phone and Modem’.
• Here you will see three tabs, the dialing rules, modems, and advanced. Choose the tab ‘Modems’. As you click on it, you will see modems installed on your PC. To repair the Modem Error 633, select and remove all the incompatible software and modems that are not present and click ‘OK’.
• Now to bring the changes into effect, restart your system with the modem plugged in and try connecting to the internet again.

Solution 2: Change the Communication Ports

If the error occurs because the modem is not properly configured, then this solution is possibly the best way to resolve this error. Here’s what you need to do:

• Click on the Start menu and choose My Computer.
• Now click on the option ‘Manage’ to open the Computer Management Window.
• Once it opens, click the option ‘Device Manager and then expand the option modems. Click on Properties, then the Advanced tab, and the Advanced Port Settings button.
• As you click on the Advanced Port Settings, then click on the COM Port Number drop-down box.
• Choose a new Communication Port. However, make sure it is not already in use.
• Once you make changes, click ‘OK’ and then restart your PC.
• Now Open Device Manager again. Open the Modern Properties Window and then Click the Diagnostics tab.
• After that view the command response window to verify if the error is fixed. If yes, then create a new dial-up connection and connect to the internet with ease.

Solution 3: Disable the Startup items

• Another way to resolve Modem Error 633 on your PC is to go to the start menu and type ‘msconfig’ into the search box and then press ‘enter’.
• Open the misconfig.exe program. As you open it, you will see 4 tabs, General, Boot, Service, Start-up, and Tools.
• Now click on the ‘Start-up’, ‘Disable All’, and then press Apply.
• After you press Apply, a window will pop up asking to restart the computer.
• Confirm it and click restart.
• Once the computer restarts now try connecting to the internet again. This will hopefully resolve the Modem Error 633.

Hello and welcome everyone, today we will be talking about dreaded keyloggers, why they are dangerous, and how to know if you might have one in your system. Keylogger is a malicious application placed in your system and hidden with only one goal in mind, to get information about what are you typing and by that means for a person who infected you to get information about your credit card information or other sensitive data. They can be introduced into your systems in various ways and often can not be detected easily. Modern antivirus applications have ways of detecting them and removing but this tutorial aims to teach you how to spot them all by yourself since new keyloggers are produced daily and sometimes relying on antivirus alone is not enough. Unlike viruses and trojans, keyloggers are not heavy on system resources and you will not feel slow down on your computer if you have one which makes them harder to sport with regular work. Some of them can be even tracking you on the website and not even be physically present on your computer. Generally, we could categorize keylogger into 4 categories:

1. Web browser-based keylogger. Some websites would have CSS scripts, input web forms, or so-called man in the middle keylogger. Lucky for us even Windows defenders with the latest update can detect this type of keylogger and successfully deal with it and how keylogger itself is not present on our system we are safe.
2. General spyware keylogger. This keylogger is present in your system, usually, it infected it via email attachment, social media download, torrent download, some malicious so-called fixer application, etc. Most antivirus applications and windows defenders can detect these types as well and remove them successfully.
3. Kernel-level keylogger. This keylogger is a more dangerous type they tend to operate underneath Windows as a rootkit and can go undetected by antivirus and windows defenders.
4. Hypervisor-based keylogger. This is the most dangerous keylogger, they use virtualization techniques to hide and mask themselves as a replica of the operating system and they scan all keystrokes by the user. These are very rare keyloggers but they do exist.

If you suspect that you have a keylogger or just want to check your system for precaution reasons follow these tips and guides and luckily you will solve your issue in no time and your data will be safe.

1. Use Task Manager to find suspicious entries.

   Task manager is a great application implemented in Windows that is constantly monitoring and showing all services, applications, and processes currently running on your system and thus a great tool to monitor your system if you know how to use it. First, open task manager by pressing CTRL + SHIFT + ESC Then take a good look into it, try to find suspicious names, probably duplicate of running application, something like Windows logon application, or keylog or anything similar which seems out of ordinary. If you manage to find a suspicious running application right-click on it and close it. Also while you are in task manager jump into the startup tab and check to see are there some unusual applications starting with your Windows, if you find anything, disable it right away. This is the most simple and quickest way to get some information right away if you suspect to have some simpler keylogger in your system.

2. Use the command prompt to monitor your network.

   In order to check connections to your computer and find potential suspicious ones start the command prompt in administrator mode, press ⊞ Win + X, and choose command prompt (administrator). type in netstat -b and press ENTER. All website and application connections to your computer are now visible. ignore svchost, edge browser, windows store, etc ad check the IP of the remaining ones using the internet.

3. Use keystroke encryption.

   Install encrypting software and even if you have a keylogger, the application will encrypt each stroke and all that attacker will get is gibberish

Please remember to always download files from trusted sources, do not open unknown emails, and do not share your information publicly. Take common protection steps in order to protect yourself in the digital world.

The standard icon place in the Taskbar inside Windows 11 is in the center. Some users welcomed this change, some not so much. If you are part of the user base that is not so much thrilled with this Microsoft’s idea of innovation, do not worry, there is an easy way to move all icons and start button on the left inside Taskbar.

Moving icons in Taskbar

1. Open Windows settings by using ⊞ WINDOWS + I key combination
2. Click on Personalization
3. Select Taskbar
4. Click on Taskbar Behaviors
5. Click on the drop-down menu beside Taskbar Alignment
6. Select your desired option of icon alignment
7. Close settings

Your options will be active right away and you will see icons switching to the position of your choosing.

Today most users have an SSD drive, times have changed and SSD has become your typical computer equipment. A lot of time has passed from the first SSD hard drives up to today and technology has evolved and improved but still, there are some cool tricks and tips to speed up and extend the lifespan of your SSD hard drive. That being said let us dive right into what I would like to call the essentials of having an SSD hard drive.

1. Keep your SSD firmware up to date.

   This one really is a no-brainer, keeping your firmware updated at all times will ensure longer life and SSD stability. The trick here is that each SSD manufacturer has its own ways of updating firmware so this is not something universal, you will have to go to the official website of your SSD manufacturer and get firmware updates and instructions from them directly.

2. Enable ACHI.

   Advanced controller host interface or short ACHI is a feature that will ensure that your Windows will support all of the features that come with running SSD on your computer. It controls the TRIM feature which is crucial in helping Windows itself in its garbage collection on your hard drive. In order to enable ACHI, you will have to do it from your BIOS and it would be very good if the feature is enabled before Windows itself is installed so it can take full advantage of it.

3. Enable TRIM.

   TRIM feature is vital in extending your SSD lifespan and it should be enabled by default in Windows but you can never be too cautious and double-check and enable if needed. To make sure it is enabled, open your command prompt and type in: fsutil behavior set disabledeletenotify 0

4. Make sure your system restore is enabled.

   In the first SSD days, system restore was really a feature that you wanted to be disabled in order to prevent and extend the life span of your SSD drive, but we came a long way from there and today there is no reason to keep this feature turned off since it can be helping many ways with both your system and SSD.

5. Disable Indexing in Windows.

   A large portion of the speed of your SSD drive is used for indexing files in Windows. Of course, the indexing feature is great if you store everything on your SSD drive but if by any chance you have another drive for your backup, pictures, music, etc. it would be highly beneficial for you to turn it off on your SSD. To turn indexing off click on your start menu, click on the computer. Right-click on your SSD and then click on properties. De-select box that says: Allow files to have contents indexed in addition to file properties and click OK. Once you do this the operating system will apply this to all the files and folders on the drive. If you see a dialog telling you that it couldn’t remove a file from the index, click Ignore All.

6. Keep Windows defrag ON.

   This also was the option in early SSD days which was better to be OFF, but as said before since technology has been making progress and Windows has been improved and made aware of SSD drives, defrag has evolved as well, and now it is more of optimization tool then defragmenter which was once.

7. Disable Prefetch and Superfetch.

   Windows is placing information in both physical and virtual memory for applications that you are not currently using but they are used often in order to speed their response time. If you are running low on space or having struggles with virtual memory it would be best to turn them both off. Go to registry manager and find: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters, there you have 2 values: EnablePrefetcher and EnableSuperfetch, set both values to 0.

8. Disable Search and Superfetch services.

   Disabling Superfetch in the registry is not all work, Press WINDOWS + R to bring run dialog, type in it services.msc, Find both Search and Superfetch and disable them.

9. Configure Write Caching.

   Write caching can be enabled and disabled in the device manager by expanding disk drives, right-clicking on SSD, then click properties, select the policies tab. In the tab, there is the option to Enable write caching on the device. Now trick in this is that you will need to try and benchmark your SSD with both options turned ON and OFF since different manufacturers have different performances with this option being ON or OFF.

10. Disable CleanPageFileAtShutdown and LargeSystemCache.

    Page file and a large cache of page files are not something that we longer need, since SSD writes with great speed in its flash memory both of these options can be disabled and you will both speed up shut down the process of your system and save some SSD life since page files will not be written. Find both options in the registry under the key: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management set both to 0

11. Set high performance in Power options.

    This option in power management will prevent your SSD from constantly shutting down and bringing it up increasing speed without sacrificing its life span.

These are tips and tricks for having great and longer life as well as speed for your SSD drive. We hope that you have found them useful and that you will come again to check new articles published daily for easier IT life.

On September 18th, 2017, Cisco’s Talos announced that CCleaner, a popular utility with billions of worldwide users, had been compromised by hackers, and was used to unwittingly distribute hidden malware in its installer. Later in the day, Piriform, the publisher of CCleaner, confirmed the problem.

Undetected by all but 1 major antivirus including CCleaner’s own parent company, this occurred for over a month and impacted over 2.7 million users. Users of CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 for 32-bit Windows are affected. These downloads were live on CCleaner’s official site from August 15th to September 12th, 2017. Anyone who downloaded the program during this time could be affected. The company claims that while the hackers set up the backdoor and many users were impacted, that the perpetrators have been arrested and that the malware never successfully performed its full task and compromised user’s PCs or sent out their data; in the wake of recent security breaches such as Equifax, users are understandably worried. Given the severity of the threat of hacking and data theft, users should take action immediately if they have CCleaner.

Technical Details of CCleaner Malware Injection

First reported by Talos, the malware, which was hidden in the CCleaner installer without the publisher noticing (despite them being owned by Avast, a massive Anti-virus company), modified a core program DLL file to evade detection, and creates several registry keys. Not only were these files not flagged by any major Anti-Virus, but they were also even digitally signed by Piriform via their Symantec certificate, meaning your PC and security program would likely whitelist and trust the malicious installer. The malware gathers personal information on a user’s PC, including IP address and running programs, and sends it to a remote server. In our testing, the program sent data to IP 216.126.225.148.

Restore Your PC (If Possible)

As of the publication of this article, there have been no assurances given that updating or even uninstalling CCleaner will remove the malware is installed. The only action thus far has been shutting down the remote server where user data was being sent has been shut down by authorities. For this reason, it is best to remove the underlying malware separately, as its presence represents a serious security threat. Unfortunately, as this could have been installed as far back as August 15th, 2017, your System Restore points may not go back that far, or even if they do, restoring to such an outdated point may cause unintended problems with other programs you use and potentially lost files and data. Manually backing up files and doing a full format or clean Windows installation would likely be successful in fully removing the malware, but is extremely time-consuming and can be difficult for many PC users. Unfortunately, this makes a PC Restore or format an unattainable option for many.

Update CCleaner to the Latest Version

While CCleaner has told users to update to the latest version of the program. Prior to doing so, we recommend fully uninstall CCleaner, ensuring you check its program files folders and registry keys, manually deleting any remnants, and then re-downloading the latest version from the official site and reinstalling clean.