Gunra Ransomware Targets Windows and Linux, CISA Warns
A joint CISA/FBI advisory details Gunra ransomware, Windows .ENCRT and Linux .GNRA files, VPN entry paths, and evidence to preserve before recovery.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Golden Gh0st RAT: Loader, Risks, and Recovery
Golden Gh0st uses a separate loader to launch a modular remote-access Trojan. Learn how to isolate a suspected…
Vanta Stealer Malware: Removal and Account Recovery
Vanta Stealer may target browser sessions, gaming and messaging accounts, wallet data, and local documents. Follow the safe…
Guides
View all
Is Bright VPN Safe? Bundled Installs, Alerts, and Removal
Bright VPN can be a legitimate app or an unwanted bundled install. Learn how proxy sharing works, verify alerts, and remove Bright…
Repair desk
View all
WiiUDownloader Virus Alert: Is Wacatac.B!ml a False Positive?
Defender flagged WiiUDownloader as Wacatac.B!ml? Learn what the app is, check the download source, and scan the PC before restoring the file.
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into a fetch-and-execute PowerShell chain.
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Echo.ac Malware? Echo Anti-Cheat and echo_driver.sys Safety Check
Is Echo.ac malware? Learn when Echo Anti-Cheat is legitimate, why echo_driver.sys needs verification, and what to…
Latest from every desk
Tips & Tricks
Is LipaTask.com Legit? KES 100 Fee and Withdrawal Risks
LipaTask asks users to activate tasks before earning. See what the KES 100 fee…
Tips & Tricks
Is Appsolo.xyz Safe? Mod APK Risks and Cleanup Steps
Appsolo.xyz shows an app-store-style download flow, but a listing or source prompt does not…
Security News
AI Token Jacking: Stolen API Keys Fueled Nearly $1M Bills
Unit 42 says criminals added stolen AI API keys to gray-market proxy services within…
Troubleshooting
NisSrv.exe: Is It Safe and How to Fix High CPU?
NisSrv.exe is usually Microsoft Defender's Network Inspection process. Check its path and signature, fix…
Troubleshooting
MpDefenderCoreService.exe: Is It Safe and Why Is It Online?
Learn what MpDefenderCoreService.exe does, why it connects to Microsoft services, where the real file…
Troubleshooting
SteamWebHelper.exe High Memory: What’s Normal and How to Fix It
SteamWebHelper.exe can run several processes, but growing memory or repeated hangs need attention. Measure…
Troubleshooting
TiWorker.exe High CPU: When to Wait and How to Fix It
TiWorker.exe is normally Windows Modules Installer Worker. Learn when high CPU or disk use…
Security News
ENDLESSDOORS Backdoor in Zbtlink Routers: 20 Models to Replace
ENDLESSDOORS is embedded in firmware for 20 tested Zbtlink and Wiflyer router models. Check…
Tips & Tricks
Loadway.best Router Alert: Blocked Does Not Mean Infected
A Loadway.best router alert means a risky request was blocked, not automatically that malware…
Security News
Leaked n8n API Tokens Exposed 321 Live Instances
GitGuardian found 321 reachable n8n instances still accepting API tokens leaked in public GitHub…
Troubleshooting
Vitya Ransomware: .vitek Files, Data Theft, and Recovery
Learn what Vitya ransomware and .vitek files mean, how to stop encryption, check for…
Troubleshooting
What Is an etilqs File? Safe Deletion and Disk-Filling Fix
An etilqs file is usually SQLite temporary data. Find the creator, close it safely,…