Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
302 lab recordsBehavior:Win32/Fynloski.gen!A is a heuristic detection of Microsoft Defender that flags activities of Fynloski malware. This malicious program allows attackers to control the infected system and install other malware remotely. Such malware usually spreads through...
Win32/Uwamson.A!ml is a specific name of a Microsoft Defender detection. This designation indicates that the suspicious...
PUABundler:Win32/MemuPlay is a Microsoft Defender detection that should be judged by the affected file path, source,...
Defender found PUADlManager:Win32/Sepdot or PUADIManager? Check the path, remove downloader bundles, scan leftovers, and avoid unsafe...
127.0.0.1 is your computer’s IPv4 loopback address. Learn how localhost and ports work, fix “refused to connect,” and check an unknown local proxy safely.
The Pornographic Virus Alert from Microsoft is a fake tech support warning. Do not call the number: close the browser, block the site, remove...
Defender reported VirTool:Win32/DefenderTamperingRestore? Check MSERT auto-heal, policy conflicts, exclusions, repeat alerts, and cleanup leftovers.
Chromstera Browser is a Chromium-based browser that users often report as unwanted because it can appear after bundled installs, set itself as default, change...
Universal Browser is a name of a browser that users spectate in a strange update window that pops up in the system, occasionally reporting...
Wave Browser keeps opening or came bundled with another download? Learn how to uninstall it, remove startup leftovers, reset affected browsers, and stop it...
PUA:Win32/Conduit is a Defender alert for Conduit/Search Protect browser hijacking. Learn quarantine, browser reset, persistence, and cleanup steps.
Adaware Web Companion is often unwanted. Learn how to uninstall it, check WCAssistantService, browser extensions, startup entries, and bundled PUA leftovers.
PUA:Win32/MyWebSearch is a Microsoft Defender potentially unwanted application detection tied to browser/search changes. It is usually not a destructive virus, but it can change...
Broom Cleaner is an unwanted program that at first glance seems to be a safe tool for cleaning and optimizing your computer. However, in...
PC Accelerate Pro is a fake optimizer and potentially unwanted app. Learn how to remove it, stop popups, clean leftovers, and prevent similar bundled...
URL:Scam in Avast or AVG means a web shield blocked a suspicious scam URL. Learn when it is a real threat, when it may...
The Walliant application is a Potentially Unwanted Application (PUA). It is promoted as an app that automatically changes desktop wallpapers. Though it in fact...
SMApps is a malicious program that aims at spreading illegal promotions. It mainly attacks browsers by changing settings and redirecting search queries from Google...
Hunt ransomware is a new sample of the Dharma/CrySis ransomware family that appeared on April 5, 2024. This malware aims at encrypting the files...
Researchers uncovered a vulnerability in Apple Silicon processors, dubbed GoFetch. It allows attackers to extract secret keys from Mac computers while performing widespread cryptographic...
