11 MSI RadiX AXE6600 Flaws Allow Root Command Injection
Eleven critical flaws in MSI RadiX AXE6600 firmware v781521 allow root command injection. Update to v782418 and review router exposure.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
ENDLESSDOORS Backdoor in Zbtlink Routers: 20 Models to Replace
ENDLESSDOORS is embedded in firmware for 20 tested Zbtlink and Wiflyer router models. Check the model, isolate the…
Leaked n8n API Tokens Exposed 321 Live Instances
GitGuardian found 321 reachable n8n instances still accepting API tokens leaked in public GitHub commits. Revoke exposed keys,…
Guides
View all
Is LipaTask.com Legit? KES 100 Fee and Withdrawal Risks
LipaTask asks users to activate tasks before earning. See what the KES 100 fee and withdrawal claims prove, what they do not,…
Repair desk
View all
StartMenuExperienceHost.exe Crashing: Fix the Windows Start Menu
Fix StartMenuExperienceHost.exe crashes safely: restart the host, check Event IDs 1000/1001, repair Windows files, and verify suspicious copies.
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it, restore search, and check persistence.
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Echo.ac Malware? Echo Anti-Cheat and echo_driver.sys Safety Check
Is Echo.ac malware? Learn when Echo Anti-Cheat is legitimate, why echo_driver.sys needs verification, and what to…
SocGholish Malware: Fake Update Removal Guide
SocGholish, also called FakeUpdates, uses fake browser update prompts on compromised sites. Learn what to do…
Latest from every desk
Troubleshooting
VGTray.exe: Riot Vanguard Process, Startup, and Safe Disable
VGTray.exe is Riot Vanguard's tray app. Check its path and signature, understand vgc/vgk, and…
Troubleshooting
PresentMon_x64.exe: Find the Owner and Fix High CPU
PresentMon_x64.exe usually belongs to a performance overlay such as NVIDIA FrameView. Find the owner,…
Troubleshooting
backgroundTaskHost.exe Error: Find the App That Crashed
backgroundTaskHost.exe hosts Windows app tasks. Use Event Viewer to find the package that failed,…
Troubleshooting
iFrmewrk.exe: Intel PROSet Process, Safe Disable, and Fix
iFrmewrk.exe is a legacy Intel PROSet/Wireless helper. Verify its path and signature, disable startup…
Troubleshooting
OVRServer_x64.exe: Safe Process, High CPU, and Disable
OVRServer_x64.exe is the Meta Quest Link runtime server. Verify its path and signature, fix…
Troubleshooting
LocalServiceControl.exe Popup at Startup: Safe Fix and Removal
LocalServiceControl.exe is a Hikvision browser helper. Verify its path, stop startup prompts, uninstall leftovers,…
Security News
WARDEN Stealer: Claims, Cookie Theft Risk, and Removal
See what is verified about WARDEN Stealer, how cookies, passwords, wallets, and clipboard data…
Troubleshooting
Un_A.exe: Temp Uninstaller or Malware Lookalike?
Learn why NSIS creates Un_A.exe, how to identify its parent app, and when a…
Security News
Keyv npm Worm Poisoned 444 Packages: Check Before Rotating Tokens
The Keyv npm worm poisoned hundreds of packages and can react when a stolen…
Troubleshooting
crashpad_handler.exe: Safe Process, Parent App, and Error Fix
Learn what crashpad_handler.exe does, identify its parent app, fix Application Error or high CPU,…
Security News
Heisenberg RAT: Claims, Hidden Desktop Risk, and Removal
See what is verified about Heisenberg RAT, how hidden desktops can expose browser sessions,…
Security News
Pass-ta-key Attack Lets Malware Hijack Google Passkeys
Unit 42 showed how malware on Chrome for Windows can abuse synced Google passkeys.…