Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that ran, then verify cleanup.
Threat research notebook
Gridinsoft Security Lab
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
309 lab recordsRotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed...
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,...
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import...
Research log
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware risks. Learn how to inspect, delete, rescan, and...
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram and EmailJS, shows fake password errors, and redirects...
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in, deposit, or reuse a Jagex password, and what...
Echo.ac Malware? Echo Anti-Cheat and echo_driver.sys Safety Check
Is Echo.ac malware? Learn when Echo Anti-Cheat is legitimate, why echo_driver.sys needs verification, and what to check before allowing or removing it.
SocGholish Malware: Fake Update Removal Guide
SocGholish, also called FakeUpdates, uses fake browser update prompts on compromised sites. Learn what to do if you downloaded or ran the fake update.
Trojan.Malware.300983.susgen
Learn what Trojan.Malware.300983.susgen means in VirusTotal results, when it is likely a false positive, and when to quarantine or scan the file.
Behavior:Win32/BrowserKill.A!MTB: Meaning and Removal
Seeing Behavior:Win32/BrowserKill.A!MTB in Microsoft Defender? Learn what the alert means, what to check in cmd.exe and Task Manager, and how to scan for leftovers.
Neshta.Virus.FileInfector.DDS
Neshta.Virus.FileInfector.DDS is a file-infector alert. Learn what a Recycle Bin hit means, what to check, when it may be a false positive, and how...
Notepad++ XML File Risk
Notepad++ 8.9.6.1 fixes config.xml and shortcuts.xml code execution flaws. Learn who is affected, how to update, and what to inspect after suspicious shortcuts or...
World Cup 2026 Ticket Scam: Fake FIFA Sites to Avoid
World Cup 2026 ticket scams use fake FIFA domains, ads, and resale offers to steal payment data and credentials. Check official routes and recover...
Extension Keeps Returning?
If a browser extension keeps reinstalling itself, remove the source that restores it: sync, browser policy, startup tasks, companion apps, or PUA/adware persistence.
VFXmed Virus Warning
Downloaded a VFXmed installer? Learn why cracked VFX software is risky, what Themida/DLL-hijack/infostealer alerts mean, and what to scan or secure next.
VectorGatewa.exe Removal
VectorGatewa.exe keeps coming back after a game download? Learn what the file means, how to remove persistence safely, and which accounts to secure.
Adidas Fan Kit 2026 Scam: msgdeal.cc and 2-Euro Trap
Got a msgdeal.cc, offerwa.cc, or promokit.cc Adidas Fan Kit 2026 WhatsApp link? See why the 2-euro prize page is unsafe and what to do...
Lively.Watchdog.exe Check
Lively.Watchdog.exe is usually part of Lively Wallpaper, but suspicious copies can be malware. Check the path, source, hash, and behavior before deleting it.
sdaCollector.vbs: Is It Safe?
sdaCollector.vbs is usually tied to Slate Digital Connect, but path, startup entry, hash, and Possible Threat detections decide whether to keep or remove it.