An Anti-Virus Company Accidentally Distributed a PC Virus, And Maybe Let’s Just Cancel the Internet

If you downloaded and installed a copy of Avast’s CCleaner between August 15 and September 12, your computer may very well be infected with malware.

The malicious software was somehow injected into a downloadable copy of CCleaner, which is a desktop maintenance app, and distributed to more than 2 million users over that time period. The malware appeared to do little more than send information about the computers it infected back to a server, according to an analysis by security researchers at Cisco, but also has the potential to run harmful code.

Installing the latest version of CCleaner should remove the malware from infected computers, according to Piriform, the firm that originally developed the app and was acquired by the anti-virus company Avast in July.

Given the level of access required to inject the malware into the download, the Cisco researchers believe the intruder likely had high-level access to CCleaner development environment, and said it is currently unclear whether the operation was carried out by an outside hacker or a malicious insider.

Computer attacks that target the software supply chain in this fashion are particularly dangerous. Last June, a computer virus that spread through Ukraine and shut down its top energy companies, private and state banks, an airport, and Kyiv’s metro system, was found to have been distributed through a software update from a legitimate company that makes productivity apps similar to Microsoft Office. The virus went global within a few hours.

At a certain point we probably should at least ask ourselves if typewriters were really that bad.