NIKKE Launcher Cleanup Can Erase Compromise Evidence
NIKKE players should save launcher logs before cleanup. Independent research separates evidence of agent execution from unproven credential theft.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Fake Installers Turn Windows PCs into Proxies and Compute Workers
Microsoft traced fake Navicat and FabFilter downloads to WorldProxyPool and BOINC. One blocked payload may leave other bundled…
Beget Says Attackers Wiped Cloud Data After Management-Layer Breach
Beget reports wiping scripts, lost VPS disk images and surviving file backups. What the November 3 update means…
Guides
View all
beacon.ser and Beacon Trojans: Check, Remove, and Recover
Found beacon.ser or a Beacon Trojan alert? Check the file and warning, scan with Gridinsoft Anti-Malware, remove threats, and secure affected accounts.
Trojan:Win32/Posilod.EB!cl: Is the DLL a False Positive?
Trojan:JS/Phish!MSR: Cache, Extension, or Phishing File?
Virus:Win32/virut: What to Scan After a Defender Alert
Tesla Purchase Order Email Scam: Where the “Download Order” Button Points
Coffin Locker Ransomware: Preserve Keys and Recover .coffin Files
Repair desk
View all
PDM:Trojan.Win32.Generic: Kaspersky Alert and Removal
Understand Kaspersky’s PDM:Trojan.Win32.Generic alert, choose the right disinfection option, investigate false positives, and handle repeat warnings.
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Troubleshooting
DmClient.exe: Check a Windows Feedback or Firewall Alert
Saw dmclient.exe in a firewall or antivirus alert? Match the file, signer and scheduled…
Troubleshooting
Dell TechHub UserProcess.exe Error: What to Check Before Repair
Match Dell TechHub error 0xe0434352 to its Windows event, identify the failed SupportAssist feature,…
Security News
Five-Star Reviews for Sale: The Trade That Hides Complaints
New research documents sellers offering five-star reviews and complaint removal. Their promises show why…
Security News
CyberStrikeAI Directed Intruders From SQL Server to Domain Admin
A server-side AI helped attackers navigate educational networks, steal credentials and collect databases. The…
Security News
Ukraine Air Alert Hack Sent False Warnings; Service Partly Restored
Ukraine’s Air Alert team confirms interference, pauses push, then partly restores service. What returned,…
Security News
Fake Teams Support Calls Led to Privileged Certificates and Data Theft
Microsoft traces two Teams help-desk scams into AD CS certificate abuse. One excluded privileged…
Security News
Polymarket Script Hijack Drained Wallets; Refund Plan Reaches $3.9M
Polymarket says a compromised monitoring script abused active sessions. Its October 30 update separates…
Security News
Searchjacked: Hidden Chrome Extensions Put a Proxy Between You and Search
Socket traces 319 extensions across a decade. See how a simple search setting routes…
Security News
VOLTA Stealer Asks AI to Rank Victims Using Stolen Receipts and Sessions
Talos finds VOLTA turning stolen sessions and receipts into an AI-ranked dossier. What its…
Security News
Claude Code in Cursor Planted an SSH Backdoor That Outlives Uninstall
Tampered Claude Code builds in Cursor’s marketplace planted SSH keys and startup scripts. Check…
Troubleshooting
VBCSCompiler.exe: High CPU, Safe Shutdown, or Suspicious Copy?
VBCSCompiler.exe is usually a legitimate compiler server. Check high CPU, stop the right build…
Security News
Binance Hack: $6.3B Theft Exposes Questions About Signing Access
Binance says losses will be covered after a $6.3 billion theft. Investigators trace signing…