One thing people often miss after a scare: check your browser extensions in Windows and…

8 Octporterneuman.mx: PowerShell and JavaScript files tied to the AveMaria remote access trojan, and what to do 8 Octdonutclientsmods.xyz: fake DonutSMP Minecraft mods tagged SilentNet, and what to do if you ran one 8 Octsqpengg.com: a server handing out crypted PowerShell scripts, and what to do if one ran on your PC 8 Octdonutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one 8 Octmaciejbi.hosting24.pl: a hosting subdomain that served Remcos scripts and a stego picture, and what to do if your PC fetched them 8 Oct87130921-60-20220830152356.webstarterz.com: an open folder serving Formbook and XWorm PowerShell scripts, and what to do if one ran 8 Octficus.in: picture files hiding the Remcos remote access trojan, and what to do if a script fetched them 8 OctOpenDrive virus: why web.opendrive.com shows up in malware alerts, and what to do if a file from it installed Remcos

Claire Holloway

5 Oct· post

One thing people often miss after a scare: check your browser extensions in Windows and remove anything you don’t recognise. Bad extensions can keep showing fake alerts, change search results, or watch what you type. If one was added recently, treat that as a warning sign.

2 comments

…

More from this wall

all →

Claire Holloway

4 Oct· post

One simple check people miss: in Windows Security, make sure Tamper Protection is turned on. If malware gets in, it can try to switch off your protection first. It takes seconds to check, and it closes an easy door attackers like to use.

5,441 members already hereReading, writing, commenting and voting. 0 verified · 166 joined this year

All members Join