.Xyz Ransomware: Identify .xyz Files Before Restore
Learn what encrypted .xyz files may mean, how to identify Xyz or Paradise-style ransomware, and how to clean the system before restoring files.
Threat research notebook
Gridinsoft Security Lab
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
307 lab recordsAce Browser Removal Guide
Ace Browser or AceLauncher appeared after a download or quiz? Remove the app, extension, redirects, startup...
Carbonate Browser: Is It Safe or a PUA?
Carbonate Browser looks like a PUA when it changes defaults, comes from bundles, or returns after...
PowerShell Opens on Startup or Connects Out: What to Do
If powershell.exe opens at startup or keeps making blocked outbound connections, find the scheduled task, startup...
Research log
OnePlatform PUA Removal
PUADIManager:Win32/OnePlatform is a Microsoft Defender PUA alert for bundled installers. Remove the wrapper, check browsers/startup, and scan for adware leftovers.
Trojan:PowerShell/AgentTesla.SHD!MTB Removal
Defender detected Trojan:PowerShell/AgentTesla.SHD!MTB? Keep it quarantined, scan for dropped files, check startup persistence, and change passwords from a clean device if anything ran.
Can Malware Activate Later? What to Do
Yes, malware can activate later after an EXE runs. Check persistence, account symptoms, Defender history, and run a full scan before trusting the PC.
Behavior:Win32/Interhta.Int: What It Means and How to Remove It
Behavior:Win32/Interhta.Int is a Microsoft Defender mshta.exe behavior alert. Record the affected path, keep mshta.exe intact, remove the relaunch trigger, run a Gridinsoft Full Scan,...
Service Miner Removal Guide
A suspicious Windows service miner can persist through services, scheduled tasks, and startup entries. Learn what paths to check, how to remove it safely,...
Infostealer After Downloading a Game or Mod: What to Do First
If you ran a game, mod, launcher, crack, or private build and then saw account alerts, Discord spam, or an email-bombing flood, clean the...
RenPy Loader Virus: Fake Game Installer, Removal & Recovery
Ren'Py itself is safe, but RenPy Loader hides stealers in fake game installers. Learn how the MSBuild chain works, remove leftovers, and secure accounts.
Is Roblox Account Manager a Virus? Safe or Trojan?
Roblox Account Manager is not automatically a virus, but it is a high-trust third-party Roblox account utility. Learn when antivirus alerts may be false...
Trojan:Win32/Cerdigent.A!dha: DigiCert False Positive Fix
Defender shows Trojan:Win32/Cerdigent.A!dha or rootcert? Check the DigiCert false positive, update Defender, and scan if the alert returns or points to a file.
Browser Hijacker Removal Guide: Remove PUA Redirects
Remove browser hijackers, PUA redirects, unwanted extensions, forced search, blocked security sites, and settings that return after Chrome or Edge reset.
Trojan:JS/ChatGPTStealer!MSR: What It Means and What to Do
Microsoft Defender can flag Trojan:JS/ChatGPTStealer!MSR when a malicious or suspicious JavaScript file targets browser sessions, AI-related pages, tokens, or credentials. Here is how to...
ETR-Invspt.ca SMS Scam Leads to Fake Interac Deposit Page
A Canadian smishing campaign sends etr-invspt.ca SMS links that redirect to inc-gdep.com, a fake Interac deposit page impersonating Government of Canada and banks.
Critical-service.cc removal: stop the pop-ups and redirects
Critical-service.cc is a browser-based scam page that pushes fake alerts, pop-ups, and redirect loops. It usually is not a full system infection, but it...
Hosting-control.cc removal: stop the pop-ups and redirects
Hosting-control.cc is a browser-based scam page that pushes fake alerts, pop-ups, and redirect loops. It usually is not a full system infection, but it...
Is ExLoader Safe? Cheat Loader Virus Risks and Cleanup
ExLoader is a cheat loader with real malware and account-theft risk. Learn fake-site risks, when to treat it as unsafe, how to uninstall it,...
Microsoft Anti Xploit Guard email scam: how to spot and avoid it
"Microsoft Anti Xploit Guard" emails are phishing messages that pretend to be urgent security alerts. The goal is to scare you into clicking a...