Movidown Unwanted Application
Movidown is an Unwanted Application that initially mimics a utility for controlling fan speed. However, beneath this shell, it has the capabilities of a dropper malware, which it right away uses to deploy browser...
Threat research notebook
Gridinsoft Security Lab
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
302 lab recordsPUABundler:Win32/YandexBundled
PUABundler:Win32/YandexBundled is a detection of potentially unwanted application (PUA) associated with the Russian company Yandex. It...
Docker Engine Authentication Bypass Vulnerability Exploited
Attackers are actively exploiting a critical vulnerability in the Docker Engine that may allow for authentication...
Hamster Kombat Players Targeted in a New Malware Spreading Scheme
Players of Hamster Kombat have become prime targets for scammers promoting phishing schemes aimed at those...
Research log
Trojan:BAT/PSRunner.VS!MSR
Trojan:BAT/PSRunner.VS!MSR is a detection of malware that executes malicious commands on a compromised system. It does not do much hurt by itself and rather...
Jellyfish Loader Malware Discovered, Threatens 2024 Olympics
A new threat has been discovered in the form of a Windows shortcut that is actually a .NET-based shellcode downloader called Jellyfish Loader. It...
CSRF (Cross-Site Request Forgery) vs XSS
Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) is an attack targeting vulnerabilities in computer security, posing significant risks to user information and accounts. It...
Phishing vs Spoofing: Difference, Examples, and Safe Checks
Phishing is the trick; spoofing is the disguise. See examples, spoofed-vs-hacked sender checks, AI/QR/caller ID lures, and what to do after a click.
Trojan:Script/Downloader!MSR: Meaning and Removal Guide
Trojan:Script/Downloader!MSR is a Microsoft Defender alert for a script that can download another payload. Check the source, quarantine status, false-positive signs, and leftover persistence...
Trojan:Win32/Bearfoos.B!ml: False Positive or Malware?
Defender found Trojan:Win32/Bearfoos.B!ml or Bearfoos.A!ml? Check false-positive clues, file path risk, leftovers, and safe removal steps.
Polymorphic vs Metamorphic Virus: Key Differences
Polymorphic malware changes its encrypted wrapper; metamorphic malware rewrites its code. Learn the difference, detection signs, examples, and safe removal steps.
Fake Instagram Hacking Services
Instagram hacking scams is an old-new direction of online fraud that targets people who want to get into someone’s accounts on social media. Frauds...
Stopabit Virus
Stopabit is an unwanted application that has almost no useful functionality. Users can see its promotions as a useful tool for screen time control,...
Weather Zero Virus or Adware? High CPU and Removal Guide
Weather Zero can run WeatherZeroService.exe, use high CPU, show ads, and leave stubborn files. Learn how to uninstall it, stop the service, and clean...
Bloom.exe
Bloom.exe is a malicious miner that masquerades as a legitimate process. Its job is to use the victim's device to mine cryptocurrency for con...
Trojan:Win32/Tnega!MSR and Tnega!ml: False Positive or Remove?
Seeing Tnega!MSR, Tnega!ml, or Adware:Win32/Tnega in Defender? Check the path, source, false-positive clues, recurrence, and safe removal steps.
InstallCore Malware? PUADlManager:Win32/InstallCore Guide
InstallCore is a bundler/PUA detection, not always a classic virus. Check Microsoft and F-Secure context, remove bundled apps, browser changes, and leftovers.
PUA:Win32/Caypnamer.A!ml: What It Is and Removal
PUA:Win32/Caypnamer.A!ml is a Microsoft Defender detection that should be judged by the affected file path, source, signature, and behavior, not by the name alone....
Virus:Win32/Floxif.H Removal
Virus:Win32/Floxif.H is a severe Microsoft Defender file-infector alert. Learn how to remove it, rescan safely, and handle infected files or backups.
Virus:Win32/Grenam.VA!MSR and Ground.exe Removal
Defender flagged Virus:Win32/Grenam.VA!MSR or Ground.exe? Learn why Grenam can affect EXE files, transparent icons, USB drives, and cleanup decisions.