Floxif virus: what it is and how to remove it

Trojan.Floxif is a trojan horse infection that was active from August 15 to September 12, 2017, infecting more than 2 million users worldwide. The malware was embedded in CCleaner versions 5.33.6162 and CCleaner Cloud 1.07.3191 by someone who hacked the legitimate program's executable. Users downloading these specific hacked versions from the Piriform website unknowingly installed malware alongside the cleaning utility.

The virus gathered substantial system data including installed software, unique ID numbers, and MAC addresses, transmitting this information to Command and Control servers. Although it was capable of downloading and installing additional threats, no evidence confirmed it did so. The infection demonstrated how legitimate software can be compromised to deliver malware.

The Floxif trojan was embedded specifically in CCleaner version 5.33.6162 and CCleaner Cloud version 1.07.3191. The infected versions were available on the official Piriform developers' website from August 15 through September 12, 2017. After Piriform discovered the compromise, they released version 5.34 and CCleaner Cloud 1.07.3192 with the malware removed.

Anyone who downloaded CCleaner between these specific dates and version numbers during this period received the infected version. Users with CCleaner versions before August 15, 2017, or after September 12, 2017, were not affected. The compromise was limited to this specific timeframe and version combination, making version checking essential to determine if you were victimized.

While 2.27 million users downloaded the infected CCleaner version, the virus only executed on 32-bit Windows systems. Additionally, the malware required administrator account privileges to launch its payload—users running standard accounts were partially protected. Researchers detected targeted attacks against major technology companies including Microsoft, Samsung, and Sony, with approximately 20 computers at these organizations infected.

The broader 2.27 million infections represented users from diverse backgrounds including businesses, enterprises, and individuals. Given the targeted focus on tech giants and the execution limitations, most casual users may have had limited additional exposure, though the initial infection and data gathering still occurred. Approximately 2 million people potentially required remediation.

Floxif gathered extensive technical information about infected systems including the computer name, list of installed programs, list of active processes, and MAC addresses of the first three network adapters. This system profiling provided attackers detailed understanding of each victim's computing environment. The malware also tracked personal victim information potentially including login credentials and credit card data.

The information was transmitted to Command and Control servers controlled by attackers. This data collection enabled criminals to identify high-value targets, understand system vulnerabilities, and plan future attacks. While the initial infection phase only involved data gathering, the C&C communication capability theoretically allowed activation of additional malware payloads remotely at any time.

The CCleaner executable at Piriform was hacked, and malicious code was injected directly into the program binary. This represented a sophisticated supply-chain attack targeting a legitimate software vendor. Attackers gained access to Piriform's software build infrastructure or distribution server, allowing them to modify the binary before distribution.

The injected code executed alongside the legitimate CCleaner functionality, making detection difficult. Users trusted Piriform as a legitimate company and downloaded what appeared to be authentic software directly from the official website.

This supply-chain attack demonstrated how attackers can compromise user trust by compromising software vendors directly rather than targeting individual users. No user-level protection could have prevented this initial compromise.

Although Trojan.Floxif was capable of downloading and installing additional threats after connecting to its Command and Control server, no evidence confirmed it actually deployed secondary malware.

Researchers observed the malware infrastructure and capabilities but found no documented cases of additional malware being installed. This suggests either the attackers chose not to deploy secondary payloads, or they reserved this capability for targets of interest like the technology companies.

The presence of the capability meant infected users remained vulnerable to additional malware installation at any time, even after the initial infection period ended. Users should have treated Floxif infection as requiring complete system cleaning regardless of secondary malware evidence.

Users who downloaded CCleaner between August 15 and September 12, 2017, should update immediately to CCleaner version 5.34 or higher. This removes the infected executable from your system. Scan your device with reputable malware removal software such as professional antivirus tools to detect any remaining malicious components.

The Floxif trojan may have modified Windows Registry and installed files elsewhere on your system. Use system repair utilities to restore Windows functionality and repair damage caused by the infection.

After updating CCleaner and running antivirus scans, change all important passwords including social media, email, banking, and other accounts. It's unknown what personal data attackers accessed, so changing credentials prevents unauthorized access to these accounts.

Download software only from official developer websites and verify digital signatures when available. Keep all installed software updated to the latest versions promptly—Piriform released version 5.34 quickly after detecting the compromise. Use reputable antivirus software providing real-time protection against known malware.

Monitor system activity for suspicious processes or network connections indicating malware activity. Assume vendor security can be compromised—no software vendor is completely immune. Back up important data regularly to restore systems after infection without data loss.

Create separate user accounts for daily computing rather than administrator accounts, limiting malware capabilities. Use password managers with unique passwords for each account preventing credential compromise from spreading across multiple services. Stay informed about security incidents affecting popular software.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Floxif virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.