software.security-analyze.ltd: a server that handed out PowerShell scripts and DLL files, and what to do if a PC fetched them
software.security-analyze.ltd is a web address that URLhaus lists five times in two days for malware downloads: three PowerShell scripts (faceit.ps1, faceitAnalyze.ps1, InstallAutostart.ps1) and two DLL files (dsound.dll, game_library.dll). A file like that is not something you meet by browsing; a script or a program that is already running on a Windows PC fetches it.
If you only saw the name in a log, nothing is proven. If something on your PC may have fetched these files, treat the PC as watched: change your passwords from another device, then scan, check what starts with Windows and clean or reset the PC.
Facts checked October 17, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
An automatic scan checks installed programs, startup items and browser extensions for anything that came with a script, loader or program that downloads .ps1 or .dll files from software.security-analyze.ltd.
Do it yourself · free Remove software.security-analyze.ltd (PowerShell scripts and DLL files) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Software.security-analyze.ltd (PowerShell scripts and DLL files): summary
| Type | A malware server: URLhaus lists three PowerShell scripts and two DLL files as malware_download, with no family named |
|---|---|
| Risk | High if your PC fetched and ran its files: unknown code with your rights, possible startup entry, accounts at risk. Low if you only saw the name |
| Symptoms | Often none. A vanished PowerShell window, an unknown startup entry or task, or a stray dsound.dll or game_library.dll are the signs the file names point to |
| How to get rid of it | Change passwords from another device, run Microsoft Defender Offline, remove the startup entries and stray DLLs, and reset Windows if you are not sure |
| Our check (17 October 2026) | One plain request from our server to the home page: status 200, a domain welcome page. That clears nothing; the danger rating comes from URLhaus |
| Running since / first seen | Domain registered 8 July 2026; first script reported 13 October 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Platform | Windows. Nothing we read says Mac or phones are affected |
|---|---|
| Detection names | No Microsoft detection name is known for these files, because we did not open them and URLhaus gives no tags |
| Name | Software.security-analyze.ltd |
| Domain registered | 8 July 2026 |
| Evidence | 5 write-ups by security sites; details still limited |
| First seen | 13 October 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 17 October 2026 |
Facts checked on 17 October 2026 against the URLhaus data for this subdomain held in our database (five entries, all marked offline), RDAP for security-analyze.ltd read on 13 October 2026, one plain request from our server, and pages by Microsoft, MITRE ATT&CK, Securonix and Sucuri.
We did not download the files, we ran no browser and we infected no PC; the file name readings are ours and the removal steps follow Microsoft's pages and were not tried on a live infection.
What software.security-analyze.ltd is, and what we know about it
software.security-analyze.ltd is not a program on your PC. It is a subdomain of security-analyze.ltd that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this address, so what follows is what URLhaus shows, what our own plain request saw, and what Microsoft, MITRE and other published pages say about the techniques the file names point to.
- 1
What URLhaus lists
Five file addresses on software.security-analyze.ltd, all on the secure web port, all in the top folder of the site. Three end in .ps1 (faceit.ps1, faceitAnalyze.ps1, InstallAutostart.ps1) and two end in .dll (dsound.dll, game_library.dll). All five carry the threat label malware_download and were reported by the same account, Kejult. None has a tag, so URLhaus does not name a malware family.
- 2
What the file types mean
A .ps1 file is a PowerShell script, a text file that Windows can run as a program. A .dll file is a library of code that a program loads while it runs. Neither opens by looking at it or by visiting the address. They run only when something on the PC asks for them and starts them. That something is not visible from the server side.
- 3
What we could not confirm
We did not download any of the five files, so we cannot tell you what they contain, which family they belong to or where they report to. URLhaus shows a label and a reporter, not an analysis. We also do not know which message, download or program makes a victim's PC ask for them.
- 4
What this means for you
If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these files. Nobody needs to visit this address by hand.
- Kind of threat
- A server that hands out PowerShell scripts and DLL files, listed as malware_download; no family named
- Where the files are
- hxxps://software[.]security-analyze[.]ltd/ followed by faceit.ps1, faceitAnalyze.ps1, InstallAutostart.ps1, dsound.dll or game_library.dll
- Domain registered
- 8 July 2026 for security-analyze.ltd, registrar PDR Ltd. d/b/a PublicDomainRegistry.com, status client transfer prohibited (RDAP, read 13 October 2026)
- URLhaus entries
- 5 file addresses, added 13 October (1) and 14 October 2026 (4). All 5 are marked offline in our copy of the data
- Home page
- Our request to security-analyze.ltd on 17 October 2026 got status 200 and a page titled as a domain welcome page, behind Cloudflare
- Platform
- Windows. PowerShell scripts and DLL files of this kind are Windows things. Nothing we read says Mac, iPhone or Android are affected
What software.security-analyze.ltd (PowerShell scripts and DLL files) does on an infected PC
What we checked on 17 October 2026, and what we could not
Our check was a plain request from our server to the home page of the registered domain, security-analyze.ltd. It was not a browser visit and it clicked nothing. That is a weak test, and a quiet answer clears nothing.
Our request, 17 October 2026
- The home page answered with a welcome pageThe server replied with status 200, no redirect, and a page title that reads like a domain welcome page, served through Cloudflare. A page like that usually means the domain is parked or has no real site on its front door. It tells you nothing about the files in the folders behind it.
- Why that is not a clean resultA server that hands out malware files often has an empty or boring front page. The files can be removed, hidden or served only to some visitors. A plain request cannot see any of that.
- Notification requestNot mentioned in the page we received. We did not run a browser, so pop-ups and redirects by script were not tested.
- URLhaus listingFive malware_download entries for this subdomain, three PowerShell scripts and two DLL files, reported on 13 and 14 October 2026. All five are marked offline in our data, which means they did not answer when URLhaus last checked, not that they were harmless.
- Downloads and the files themselvesWe did not download any file and cannot tell you what is inside.
Dangerous: treat it as a malware server Our request was one plain visit to the front page and proves nothing either way. The rating comes from the five URLhaus reports, not from our request. Do not request files from this address and do not run anything that does.
What happened to the domain, from registration to today
The domain is about three months old and every report is from the last week. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.
8 July 2026
security-analyze.ltd is registered
RDAP shows the domain registered on 8 July 2026 at about 20:51 UTC through PDR Ltd. d/b/a PublicDomainRegistry.com. The only status is client transfer prohibited, which is a normal lock against moving the domain to another registrar. It says nothing about the owner.
13 October 2026
The first script is reported
At about 05:23 UTC the account Kejult adds hxxps://software[.]security-analyze[.]ltd/faceit.ps1 as malware_download. This is 97 days after registration. In our data it is marked offline.
14 October 2026, morning
A DLL file is reported
At about 07:46 UTC the same account adds dsound.dll. The name is the name of a DirectSound library that Windows games load, which matters for the sideloading section below.
14 October 2026, 08:21 UTC
Three more files within two seconds
faceitAnalyze.ps1 and game_library.dll are added at 08:21:08 and InstallAutostart.ps1 at 08:21:10. Five files from one folder, reported by one account in about 27 hours, look like one operator's toolkit being listed together. That is our reading, not a statement from any report.
All five URLhaus reports we hold for software.security-analyze.ltd. The file names are the only clues to what the files do. 17 October 2026
Our request
The home page of security-analyze.ltd answers with a plain welcome page. All five file addresses are still marked offline in our copy of the data.
What the pattern suggests, and what it does not: a young domain, a subdomain called software, and a short burst of reports with no tags. It does not tell us who runs the server, what the files do or how many PCs asked for them. A server marked offline can come back, and the same operator can move the same files to another name.
What the five file names suggest, and what is only our reading
No report we found explains these files, so this section is our reading of the names. Treat it as a guess that helps you know what to look for, not as a fact about the files.
| File | What the name suggests | How sure we are |
|---|---|---|
| faceit.ps1 | A PowerShell script with the name FACEIT, which is a well known online platform where gamers play organised matches. The name may be bait for players, or the name of a tool that is said to work with that platform | Not confirmed. We found no source linking these files to the platform, and the platform is not accused of anything |
| faceitAnalyze.ps1 | A second script with an analyze theme, matching the domain name security-analyze and the idea of a tool that analyses a player or a PC | Not confirmed |
| InstallAutostart.ps1 | A script that sets something up to start on its own, for example a startup entry or a scheduled task | Our reading of the words only; we did not read the script |
| dsound.dll | A DLL named like the Microsoft DirectSound library that games load. A copy placed next to a program can be loaded in place of the real one | Possible, not shown. The name fits the sideloading technique, but we did not open the file |
| game_library.dll | A DLL with a generic game theme, which could be a payload or a helper library | Not confirmed |
Put together, the names look like a lure aimed at people who play on a matchmaking platform: a tool that promises to analyse your account or stats, a script that installs it, and a library that gets loaded by a game or a loader. This is a theory built from five words. It could be wrong in any part, and the same files could serve a different purpose.
How a DLL such as dsound.dll can be used to run malware
A DLL cannot hurt you by sitting in a folder. It works only when a program loads it. MITRE describes several ways attackers use that, and the best known is called DLL sideloading. We did not see these files, so this is how the technique works in general, not proof about this server.
- 1
A script is started first
Microsoft's PowerShell documentation describes a script as a file that PowerShell runs, and it says the execution policy is not a security boundary: a user can get around it by pasting the script's contents into a window. Sucuri (2025) describes fake web pages that tell a visitor to copy and paste a PowerShell command as a fix for an error. So a person can start a script by hand without knowing what it does.
- 2
The script fetches more files
A downloader script asks a server for the next pieces. In this case the listed pieces are two DLL files and a script named InstallAutostart.ps1. We do not know which of the three scripts did the fetching.
- 3
A trusted program loads a planted DLL
MITRE (T1574.001) says that in DLL sideloading attackers place a malicious DLL next to a legitimate, trusted application so the application loads the attacker's code. It also describes search order hijacking, where the planted DLL sits in a folder that Windows searches before the real one. The legitimate program is the cover; the code that runs is the attacker's.
- 4
The malware runs inside the trusted program
MITRE notes that benign executables used this way may not be flagged, and that payloads may be encrypted or packed until they are loaded into the memory of the trusted process. In Task Manager the process then has a harmless name.
- 5
It stays, if a startup script says so
A script named InstallAutostart.ps1 would fit a step that makes the whole chain start again after a restart. We did not read it. It is the reason the checks below look at startup entries and scheduled tasks.
MITRE lists what helps against this: application control that blocks DLLs loaded by legitimate software, keeping Safe DLL Search Mode on, and keeping software updated. For a home user the practical defence is earlier: do not run the first script, and do not copy and paste commands that a web page tells you to run.
What software.security-analyze.ltd (PowerShell scripts and DLL files) can steal or download
What this can cost you
Reading the name or seeing it in a log costs nothing. The risks below apply to a Windows PC where one of these files was fetched and run. Because we do not know the family, we describe what the delivery methods allow, not what these files are known to do.
- High
Unknown code running with your rights
A PowerShell script and a DLL loaded by a program run with the rights of the user who started them. Code with those rights can read your documents, your browser profile and anything else you can open. What it actually did on a given PC is not known.
- High
Passwords and accounts
If the payload is an information stealer or a keylogger, passwords you saved or typed are exposed. We have no evidence that these files are either. Because the family is unknown, assume the worst for the accounts you used on that PC until the PC is clean.
- High
Game accounts and in game items
The file names point at gamers. If a lure of this kind was aimed at players, accounts on game stores, launchers and matchmaking sites are the likely targets. This follows from the names and is our reading.
- Medium
It may start again after a restart
A script called InstallAutostart suggests a startup entry. If so, deleting one file is not enough; the entry must be found and removed.
- Medium
More malware on the same PC
A downloader is a door. The server is offline now, but a PC that already ran the chain may have been given other files before that.
- Low
Nothing, if you only saw the name
A name in a block list, a log or a warning is not an infection.
What you may notice, and what you may not
Loaders are built to be quiet. The signs below come from how the technique works; none is certain, and many victims notice nothing.
| Sign | Why it fits |
|---|---|
| A PowerShell window that flashed open and closed | A script ran. People who pasted a command or ran a downloaded script often remember a window that vanished |
| A startup entry or scheduled task you did not make | A script named InstallAutostart.ps1 would fit a setup of this kind. This is our reading of the name |
| A DLL file next to a game or a program where it does not belong | MITRE describes sideloading as a DLL placed next to a trusted application. A dsound.dll in a folder of a program that does not use DirectSound, or in a Downloads or Temp folder, is worth a look |
| A trusted program doing network traffic it should not | The malware may run inside a legitimate process, according to MITRE's description of the technique |
| A Defender detection or a blocked script | Defender may have caught a part. Look in Protection history |
| Accounts you did not touch | Logins from new places, password reset emails or messages sent from your accounts follow from stolen logins |
| Nothing at all | A quiet PC is not a clean PC |
How to check the PC for software.security-analyze.ltd (PowerShell scripts and DLL files)
Who can meet this, and how a PC ends up asking for these files
Nobody visits software.security-analyze.ltd on purpose to read it. The request comes from a program or a script, so the question is how that program got on the PC. We cannot say for this server. The routes below are the ones the sources describe for the same kinds of files.
- 1
A tool that promises to analyse your game account
The names faceit and Analyze fit a download that is offered to players as a helper or stats tool. This is our reading of the names. If you ran a script or an installer from a game forum, a chat group, a video description or a direct message, that is the first thing to think back to.
- 2
A web page that tells you to paste a command
Sucuri (2025) describes a fake Google Meet page that shows an error and tells the visitor to copy and paste a PowerShell command to fix it. The command is the first stage and fetches the rest. We do not know whether this server was used that way.
- 3
A program that loads a library from its own folder
For the DLL files, MITRE describes how a trusted program loads a planted library placed next to it. Cheats, mods and cracked games are often run from a folder the user fills with files from many sources, which is a place where this can happen.
- 4
A legitimate or hacked site with one bad file
This address is a subdomain of a domain registered in July 2026, so it is unlikely to be an old honest site that was hacked. If you own security-analyze.ltd or a site on it, check the files in the folder, the accounts that can upload and the DNS records, and remove anything you did not put there. The registration does not show who owns the domain, and we make no claim about the owner.
Check your PC before you delete anything
Start with the question that matters: did something on this PC contact the address, or did you run a PowerShell script, a game helper, a cheat or an installer from an unknown source? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.
While you check, stop using the PC for banking, email, work or game accounts. If you can, disconnect it from the network.
- 1
Disconnect first
Turn off Wi-Fi or unplug the network cable. Malware that fetches more files or sends data needs the connection.
- 2
Find which device asked for the address
If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.
- 3
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined at the time of the first contact, especially a script. Microsoft says the results of an offline scan also appear there.
- 4
Open Task Scheduler
Press Start, type Task Scheduler and open it. Look in Task Scheduler Library for tasks you do not know, with random names, or that run powershell.exe or a program from a user folder. Do not delete yet; write down the name and the program it runs.
- 5
Look at Startup apps
Open Settings > Apps > Startup. Look for names you did not install. A script named InstallAutostart.ps1 would be about making something start with Windows, so this list matters.
- 6
Look for stray DLL files
In File Explorer search your Downloads folder, the Temp folder (type %TEMP% in the address bar) and the folders of your game helpers and mods for dsound.dll and game_library.dll. Finding one is a strong sign; not finding one proves nothing, because a script can delete its traces. Do not open or run it, and write down the path.
- 7
Look at running programs
Open Task Manager and sort the Processes tab by network or CPU. Look for a program you did not start or a trusted program using a lot of network with no reason. Their presence is not proof and their absence does not clear the PC.
- 8
Check your accounts from another device
Look at the sign in activity of your email, game store, launcher and bank accounts. This is quicker than any file check.
- 9
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC and no vendor publishes a removal procedure for these files, so the order of this plan is our judgement from Microsoft's pages, not a tested result.
How to remove software.security-analyze.ltd (PowerShell scripts and DLL files)
How to remove software.security-analyze.ltd
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to software.security-analyze.ltd or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever software.security-analyze.ltd installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, an iPhone or an Android phone
PowerShell scripts and DLL files of this kind are Windows things. We found nothing that says the files on this server affect anything else.
| Your device | What we know | What to do |
|---|---|---|
| Mac | DLL files are Windows libraries and the scripts are PowerShell scripts for Windows. We saw no sign of a Mac version | Nothing to remove for this threat. Do not follow the Windows steps on a Mac |
| iPhone or iPad | No source we read describes these files on iOS | Nothing to remove. If you typed a password into a page from a link, change it |
| Android | No source we read mentions it | Nothing to remove for this threat; change passwords if you entered any |
After removal: passwords, accounts and prevention
After a clean PC: protect what may have been taken
The PC is one half. The other half is everything you typed or stored on it while the chain may have been running. The order matters: another device first, then the PC.
- 1
Change passwords from a clean device
Use a phone or another computer that never touched the files. Start with email, because it resets everything else, then game stores and launchers, bank, work and cloud storage. Anything typed on the PC while it was affected may be known.
- 2
Sign out other sessions and turn on two step sign in
Most accounts have a setting that signs out all devices. Use it, and turn on two step sign in with an authenticator app or a security key where offered. Update the recovery email and phone while you are there.
- 3
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet and recovery phrase on a clean device and move the funds there.
- 4
Run Microsoft Defender Offline
Microsoft says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: you are signed out, Windows restarts, and the scan takes about 15 minutes. It runs outside the normal Windows, so malware has a harder time hiding. Results are under Protection history. If BitLocker is on, Microsoft says to suspend it first or the restart may ask for the recovery key. Microsoft also says the scan needs the Windows Recovery Environment to be enabled; if nothing happens,
reagentc /infoshows the status. - 5
Remove what the check found, with care
If Task Scheduler or Startup apps showed an entry that you can tie to the files, remove it, and delete a stray dsound.dll or game_library.dll that sits where it does not belong. Do not delete a dsound.dll from a game's own folder if you are unsure: it may be the genuine library. If you cannot tell, do not guess; the safe answer is the reset below.
- 6
If you are not sure, reset Windows
Microsoft's recovery page puts the reset at Settings > System > Recovery > Reset this PC. Keep my files removes apps and settings but keeps personal files; Remove everything wipes the PC. For a PC that may have run unknown code with a startup entry, the full wipe is the answer that does not depend on finding every piece. Back up first.
- 7
Restore only documents by hand
Copy back documents and photos, not programs, game mod folders or a full system image from after the first contact. Install apps from their makers' own sites.
- 8
Rebuild logins in a password manager
Do not let the browser save passwords again on a PC that may have been watched. Use a password manager and two step sign in.
- 9
Watch your money and your accounts
Check card statements and game store purchase history for a few weeks and turn on alerts.
- 10
Tell the people you message
If your accounts were used to send links, tell your contacts not to open them.
Keep a PC out of this kind of chain
The files on this server are the late part of the chain. Every route described above starts earlier, with a script a person ran or a command a person pasted.
Do
- Treat a web page that tells you to paste a PowerShell command to fix an error as an attack and close it.
- Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.
- Show file endings in File Explorer so a .ps1 script posing as a document or a tool is visible.
- Get game tools, mods and launchers from their makers' own sites or official stores.
- Use a password manager and two step sign in, so one stolen password is not enough.
- Keep a backup of documents on a disk that you unplug.
Don't
- Do not run a script from a game chat, a forum or a video description that promises stats, a boost or an analysis of your account.
- Do not put DLL files from unknown sources next to a game or a program.
- Do not rely on PowerShell's execution policy to protect you; Microsoft says it is not a security boundary.
- Do not change your passwords on the PC you suspect.
- Do not rely on a quiet scan to say that you are safe.
Questions about software.security-analyze.ltd (PowerShell scripts and DLL files)
What is software.security-analyze.ltd?
It is a web address, a subdomain of security-analyze.ltd, that URLhaus lists for five malware downloads:
- three PowerShell scripts called faceit.ps1
- faceitAnalyze.ps1 and InstallAutostart.ps1
- two DLL files called dsound.dll and game_library.dll
They were reported on 13 and 14 October 2026. It is not a program on your PC and not a site anyone is meant to browse. We did not download the files, so what they contain is not confirmed by us.
Is software.security-analyze.ltd safe to open?
No. Do not request files from it and do not run anything that does. Our own check was a plain request to the home page of the main domain, which answered with a welcome page.
That proves nothing: a server that hands out malware often has a boring front door, and the files can be removed or shown only to some visitors. The rating comes from the five URLhaus reports, and all five files are marked offline in our data.
Is it a virus or a scam?
URLhaus lists the files as malware_download, so the reporter treated them as malware, but it gives no tag and no family name, and we did not open the files.
The file names suggest a lure aimed at gamers, and that is our reading only. We found no source that links the files to the FACEIT platform, and nothing here accuses that platform. Treat the address as dangerous and the contents as unknown.
What is a .ps1 file and why is it dangerous?
A .ps1 file is a PowerShell script, a text file that Windows can run as a program. It runs with the rights of the user who starts it, so a bad one can download more files, change settings or set up a startup entry.
Microsoft says PowerShell's execution policy is not a security boundary, because a user can get around it by pasting the script into a window. Do not run a script from a source you do not know.
What is dsound.dll and is it a virus?
The genuine dsound.dll is a DirectSound library that Windows games load, so the name alone is not a virus. The risk is a fake copy. MITRE describes DLL sideloading, where an attacker places a malicious DLL next to a trusted program so the program loads it.
We did not open the file from this server, so we cannot say what it does. A dsound.dll in a Downloads or Temp folder, or next to a program that has no reason to use it, deserves a check.
I saw this address in my firewall or DNS log. Am I infected?
Not necessarily, and the name alone proves nothing. It does mean that a device on your network asked for it, and a person does not usually do that by hand. Find which device it was, disconnect it, and run the checks on this page:
- Protection history
- Task Scheduler
- Startup apps
- stray DLL files
- a Microsoft Defender Offline scan
Do the account changes from another device, not from the one in question.
How do I remove this from Windows?
Change your passwords from another device first. Then run a Microsoft Defender Offline scan in Windows Security under Virus and threat protection, Scan options. Check Task Scheduler and Startup apps for entries you did not make, and remove the ones you can tie to the files.
If you are not sure, reset Windows with Remove everything and restore only documents. We followed Microsoft's pages and did not test the steps on an infected PC.
Does it affect Mac, iPhone or Android?
We found nothing that says so. PowerShell scripts and DLL files of this kind are Windows things, and nothing we read describes a Mac, iPhone or Android version.
On those devices there is nothing to remove for this threat. If you typed a password into a page that came from a suspicious link, change it from a clean device and turn on two step sign in.
I own a site on security-analyze.ltd or a similar domain. What should I do?
Remove any file you did not put there, starting with the five named on this page, and check who can upload to the server and to the DNS records. Change the hosting and registrar passwords and turn on two step sign in.
Ask your host whether the files were uploaded through your account. The registration does not show who owns the domain and we make no claim about the owner, but a quiet front page does not mean the folders behind it are clean.
Will Fortect remove software.security-analyze.ltd?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For software.security-analyze.ltd, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- MITRE ATT&CK: Hijack Execution Flow, DLL, T1574.001 (modified 11 September 2026) (read October 17, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) (read October 17, 2026)
- Microsoft Learn: about Execution Policies (PowerShell) (read October 17, 2026)
- Securonix: Detecting DLL sideloading techniques in malware attack chains (read October 17, 2026)
- Sucuri: Fake Google Meet page tricks users into running PowerShell malware (2025) (read October 17, 2026)