ENDLESSDOORS Backdoor in Zbtlink Routers: 20 Models to Replace
ENDLESSDOORS is embedded in firmware for 20 tested Zbtlink and Wiflyer router models. Check the model, isolate the device, and plan replacement.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Arch Freezes AUR Pushes After Malware Wave: Check Your System
Arch temporarily stopped AUR pushes after malicious package takeovers. Check openconnect-sso exposure, Linux persistence, stolen secrets, and the…
Rails CVE-2026-66066: Patch Active Storage and Rotate Secrets
Rails patched CVE-2026-66066 in Active Storage. Check whether your app uses vulnerable libvips processing, update, rotate exposed secrets,…
Guides
View all
Loadway.best Router Alert: Blocked Does Not Mean Infected
A Loadway.best router alert means a risky request was blocked, not automatically that malware ran. Identify the device, assess exposure, and clean…
Repair desk
View all
Vitya Ransomware: .vitek Files, Data Theft, and Recovery
Learn what Vitya ransomware and .vitek files mean, how to stop encryption, check for data theft, remove malware, and recover files and…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it, restore search, and check persistence.
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Echo.ac Malware? Echo Anti-Cheat and echo_driver.sys Safety Check
Is Echo.ac malware? Learn when Echo Anti-Cheat is legitimate, why echo_driver.sys needs verification, and what to…
SocGholish Malware: Fake Update Removal Guide
SocGholish, also called FakeUpdates, uses fake browser update prompts on compromised sites. Learn what to do…
Latest from every desk
Troubleshooting
LocalServiceControl.exe Popup at Startup: Safe Fix and Removal
LocalServiceControl.exe is a Hikvision browser helper. Verify its path, stop startup prompts, uninstall leftovers,…
Troubleshooting
Un_A.exe: Temp Uninstaller or Malware Lookalike?
Learn why NSIS creates Un_A.exe, how to identify its parent app, and when a…
Troubleshooting
crashpad_handler.exe: Safe Process, Parent App, and Error Fix
Learn what crashpad_handler.exe does, identify its parent app, fix Application Error or high CPU,…
Troubleshooting
Quick Driver Updater Removal: Stop qdu.exe and Leftovers
Remove Quick Driver Updater, qdu.exe, recurring scheduled tasks, and leftovers, then safely recover from…
Troubleshooting
Trojan:Win32/Suweezy Keeps Coming Back: Removal Guide
Remove Trojan:Win32/Suweezy, check Defender exclusions and persistence, verify a CrystalDiskMark download, and stop the…
Troubleshooting
Audiveris.com Is a Fake Download Site: What to Do
Audiveris.com is not the official Audiveris project. Learn what to do if you visited,…
Security News
Coldcard Seed Flaw: Update Firmware and Move Funds
Coldcard weak seed generation affects Mk3 and earlier Mk4, Mk5, and Q releases. Updating…
Troubleshooting
Windows Defender Full Scan Finishes Immediately: Fix It
A Defender Full scan that ends in seconds after only a few files is…
Security News
Adform Script Swapped Crypto Wallet Addresses on Websites
A compromised Adform tracking script could replace Bitcoin, Ethereum, and Tron recipient addresses while…
Troubleshooting
jhi_service.exe: Safe Intel Service, Errors, and CPU Fix
jhi_service.exe is usually Intel's DAL Host Interface service. Learn when it is needed, fix…
Troubleshooting
NVIDIA Web Helper.exe: Is It Safe? Errors and Repair
NVIDIA Web Helper.exe is usually a legacy GeForce Experience helper. Learn what stopping it…
Troubleshooting
ArmouryCrate.UserSessionHelper.exe High CPU: Safe Fix
ArmouryCrate.UserSessionHelper.exe can cause sustained CPU, WMI, or crash-loop symptoms. Learn how to test it…