Gootloader Disrupted: Police Cut Malware Delivery Routes
Police cleaned compromised sites and seized Gootloader domains. The disruption breaks delivery routes but does not clear every previously infected computer.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
SEGA Newsletter Breach Exposes 2.2 Million Email Addresses
SEGA says 11 newsletters were affected by the ARARA breach. Check the mailing dates and see what the…
Swarm Desktop and bee-js Updates Targeted Wallet Keys
Swarm Desktop 0.56.2 and bee-js 13.3.0 could expose Bee wallet keys. Check what ran and what to replace…
Guides
View all
Casino Asking for Another Deposit to Withdraw Winnings? What to Do
A casino says it needs one more payment to release your winnings. Check what left your account, distinguish a real ID check…
Repair desk
View all
Trojan:PowerShell/Powersploit: Did the Script Run?
Defender flagged Trojan:PowerShell/Powersploit. Check what it quarantined, why a Kali USB can trigger it and what to do if you already ran…
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Troubleshooting
Chrome Redirects to Bing Even When Google Is the Default
Find what changes a Chrome search to Bing. Compare the address bar with a…
Troubleshooting
Virus Found in System Volume Information: Is It Still Active?
Read the scan path, time, and action to tell a suspect restore point from…
Troubleshooting
How to Back Up Files From an Infected Windows PC
Choose which files to rescue before reinstalling Windows, protect your last good backup, and…
Troubleshooting
App Control for Business Blocked an App: What to Check
Find the file Windows blocked, read event 3077, and decide who can approve the…
Troubleshooting
GfxDownloadWrapper.exe: How to Check an Intel Crash or Firewall Alert
Check which copy of GfxDownloadWrapper.exe ran, match it to your Intel graphics driver, and…
Troubleshooting
SmartScreen Can’t Be Reached Right Now: What to Check Before Running an App
SmartScreen unavailable when opening an installer? Check the connection and the file separately, and…
Troubleshooting
CC_Engine_x64.exe High CPU: Diagnose MSI Center Safely
CC_Engine_x64.exe using high CPU? Verify the MSI file, isolate monitoring triggers, separate WMI load…
Troubleshooting
Blazer Virus Pop-Ups: Stop Alerts and Remove Blazer Browser
Stop Blazer virus pop-ups by checking the notification sender, blocking unwanted sites, and removing…
Troubleshooting
Modern Setup Host High CPU: Check Progress Before Stopping It
Modern Setup Host using high CPU? Check update progress, SetupDiag logs and the real…
Security News
Chainalysis Restores Reactor and KYT After Token Exposure
Chainalysis restored Reactor, KYT and Address Screening on November 7. See what leaked and…
Security News
Ukraine Sends UAH 700,000 Telegram Dating-Bot Fraud Case to Court
Ukraine’s Cyber Police say a Telegram dating-bot introduction led to a request for an…
Troubleshooting
Trojan:Win32/Rimecud!pz: What to Do After a USB Alert
Defender flagged Trojan:Win32/Rimecud!pz on a USB drive? Understand Removed status, check the PC and…