Usermode Font Driver Host / UMFD-0: Safe or Malware?
Usermode Font Driver Host is fontdrvhost.exe. Learn when UMFD-0 or Temp.font driver host is normal, how to verify System32 and Microsoft signature, and how to fix high CPU or memory.
Threat research notebook
Gridinsoft Security Lab
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
305 lab recordsTrojan:Win32/Mamson.A!ac: What It Means and Removal
Trojan:Win32/Mamson.A!ac is a Microsoft Defender detection that should be judged by the affected file path, source,...
What Is OmApSvcBroker.exe?
What is OmApSvcBroker.exe? OmApSvcBroker.exe is usually an MSI Center, MSI Dragon Center, or MSI NBFoundation Service...
AW Manager / Advanced Window Manager Removal Guide
Remove AW Manager, Windows Manager, or AdvancedWindowManager.exe from Windows. Check the app entry, Program Files leftovers,...
Research log
Program:Win32/Uwamson.A!ml
Win32/Uwamson.A!ml is a specific name of a Microsoft Defender detection. This designation indicates that the suspicious program or file scanned by the antivirus has...
PUABundler:Win32/MemuPlay: What It Is and Removal
PUABundler:Win32/MemuPlay is a Microsoft Defender detection that should be judged by the affected file path, source, signature, and behavior, not by the name alone....
PUADlManager:Win32/Sepdot: Remove, Restore, or False Positive?
Defender found PUADlManager:Win32/Sepdot or PUADIManager? Check the path, remove downloader bundles, scan leftovers, and avoid unsafe exclusions.
What Is 127.0.0.1? Localhost, Ports, Errors & Safety
127.0.0.1 is your computer’s IPv4 loopback address. Learn how localhost and ports work, fix “refused to connect,” and check an unknown local proxy safely.
Pornographic Virus Alert From Microsoft
The Pornographic Virus Alert from Microsoft is a fake tech support warning. Do not call the number: close the browser, block the site, remove...
VirTool:Win32/DefenderTamperingRestore: Settings Restored or Threat?
Defender reported VirTool:Win32/DefenderTamperingRestore? Check MSERT auto-heal, policy conflicts, exclusions, repeat alerts, and cleanup leftovers.
Chromstera Browser: What It Is and How to Remove It
Chromstera Browser is a Chromium-based browser that users often report as unwanted because it can appear after bundled installs, set itself as default, change...
Universal Browser
Universal Browser is a name of a browser that users spectate in a strange update window that pops up in the system, occasionally reporting...
Wave Browser Removal Guide: Uninstall It Completely
Wave Browser keeps opening or came bundled with another download? Learn how to uninstall it, remove startup leftovers, reset affected browsers, and stop it...
PUA:Win32/Conduit Removal: Browser Hijacker Cleanup
PUA:Win32/Conduit is a Defender alert for Conduit/Search Protect browser hijacking. Learn quarantine, browser reset, persistence, and cleanup steps.
Adaware Web Companion: Is It Safe or a PUA?
Adaware Web Companion is often unwanted. Learn how to uninstall it, check WCAssistantService, browser extensions, startup entries, and bundled PUA leftovers.
PUA:Win32/MyWebSearch: Browser Hijacker Meaning and Removal
PUA:Win32/MyWebSearch is a Microsoft Defender potentially unwanted application detection tied to browser/search changes. It is usually not a destructive virus, but it can change...
Broom Cleaner App (Virus Removal)
Broom Cleaner is an unwanted program that at first glance seems to be a safe tool for cleaning and optimizing your computer. However, in...
PC Accelerate Pro Removal Guide
PC Accelerate Pro is a fake optimizer and potentially unwanted app. Learn how to remove it, stop popups, clean leftovers, and prevent similar bundled...
URL:Scam Avast Warning: Meaning, False Positives, and Fix
URL:Scam in Avast or AVG means a web shield blocked a suspicious scam URL. Learn when it is a real threat, when it may...
Walliant App
The Walliant application is a Potentially Unwanted Application (PUA). It is promoted as an app that automatically changes desktop wallpapers. Though it in fact...