Trojan.Multi.BroSubsc.gen: what the Kaspersky alert means and how to remove it

What Trojan.Multi.BroSubsc.gen is, and what it is not

Trojan.Multi.BroSubsc.gen is the verdict Kaspersky gives when it finds, in the settings of a browser, a website that is allowed to show you advertising notifications. It is not a program you installed and cannot uninstall. Kaspersky's threat page says the family is installed on browsers deceptively after a visit to fraudulent or advertising resources, and that it shows advertising messages even when the browser is inactive.

1. 1

   You press Allow on a prompt

   A page asks whether it may show notifications and disguises the question as a check, a video player or a download. Kaspersky's support post of 21 September 2021 puts it this way: if you agree to accept notifications from a site, the browser settings end up holding the unwanted resource. Chrome's help page says the browser asks whenever a site, app or extension wants to send notifications, and the answer is kept until you change it (Chrome Help).

2. 2

   The browser keeps the site in its settings

   The site's address stays in the browser's list of allowed senders. Microsoft's page for Edge says notifications for an allowed site still appear when the browser is closed (Microsoft Support); Apple says the same for Safari on a Mac. This is the mechanism behind Kaspersky's line about ads with an inactive browser.

3. 3

   Kaspersky reads those settings

   Support told users in February 2019, in a text a user copied to Habr, that the verdict is given while checking autorun objects, when the settings of a supported browser (then Chrome, Yandex, Opera and Vivaldi) hold a URL that Kaspersky detects as the source of these ad notifications. The alert in our pictures names the object as System Memory; we found no source that explains that label.

4. 4

   Treating it flips Allow to Block

   According to the same text, treatment changes the status of the detected URLs from Allow to Block. The Habr post says the window offered to treat by restarting the PC and that, with some probability, the alert then came back, round and round. That fits a list that holds more than one such site.

Shown by

Kaspersky products: the cases we read name Free Antivirus, Endpoint Security for Windows and the Virus Removal Tool

Kaspersky's labels

Class Trojan, platform Multi, parent class TrojWare; detect date 2 February 2019 on its threat page

What it points at

A website allowed to send notifications in your browser; the detection is about a setting, not a file we could name

What it is not

Not ransomware: a forum helper wrote on 29 June 2023 that it is definitely not a ransomware issue. In another case the helpers said the evidence pointed to adware

How to stop it

Block or remove the sites in your browser's notification list, and let Kaspersky run its Advanced Disinfection with a restart

Spelling

Kaspersky writes BroSubsc. Our 2020 guide wrote Brosubsc, and one of its pictures is named brosubc

Our 2020 guide called this a trojan that deactivates Task Manager, steals passwords and installs more malware. None of that is in the Kaspersky pages and forum cases we read. The chapters below say, claim by claim, what held up and what did not.

How to read the name and the alert, part by part

Kaspersky does not publish a page that explains each part of the name, so the right-hand column says where each reading comes from. Where it is our reading, it says so.

Search for the whole string you were shown. A detection named Trojan.Multi.Accesstr.ash, which appeared in the same forum log for a different PC, is a different alert and needs its own look.

What we checked on 6 October 2026, and what we could not

There is no website to open and no file to run, because the verdict names a permission inside your own browser and the sites behind it differ from PC to PC. We read Kaspersky's threat page, its support post, a 2019 Habr post that quotes Kaspersky support, a Kaspersky support article and four forum cases. We ran no scanner and opened no site.

The detection from 2019 to 2026

Our guide dates from 4 November 2020. Its three pictures all show the same Kaspersky alert, so the history below uses two of them where our own guide enters the story, and the pictures are not screenshots we took.

1. 2 February 2019

   Kaspersky lists the family

   The threat page gives the detect date 02/02/2019, the class Trojan, the platform Multi and this description: malware of this family is installed on browsers deceptively after the user visits fraudulent or advertising resources, and it displays advertising messages even if a browser is inactive. It gives no sample hashes and no date for its country statistics.

2. 13 February 2019

   A signature is added

   The Habr post below quotes Kaspersky support saying the signature in question was added on 13 February 2019. That is eleven days after the threat page's date, and we cannot tell how the two relate.

3. 28 February 2019

   A user explains the alert on Habr

   A Habr user wrote that he was swamped with reports from Kaspersky Free Antivirus users who saw a window about infection with this name, which offered treatment by restart and then, with some probability, appeared again, round and round. He copied support's answer: users complain of advertising notifications after rash clicks on dubious sites, and the verdict appears when browser settings hold detected URLs. He listed where to switch notifications off in Chrome, Opera and Vivaldi, and for Firefox the setting dom.webnotifications.enabled in about:config, which he credited to a commenter. The page shows 189 thousand readers.

4. 4 November 2020

   Our first guide

   We published it as a trojan that is mostly active in Russia and drops advertising content even when the browser is disabled. The first half of that is Kaspersky's own country list; the guide then added Task Manager, registry and password claims that no source we read supports.

   

5. 26 March 2021

   An administrator asks why it is hard to remove

   A user of Kaspersky Endpoint Security for Windows 11.0.0.6499 wrote that the report said the path was System memory and the action N/A, that deleting and reinstalling the browser seemed to help but in one case it came back, and asked whether it could be a false positive. Replies said to deny all notifications or allow only chosen sites, to check the Allowed box at chrome://settings/content/notifications and to remove suspicious sites; another wrote that Advanced Disinfection makes it go away. The false positive question got no answer.

6. 1 April 2021

   Our guide was last edited

   The old page has not changed in its claims since. Our backlink data lists 3 referring domains and 8 links to it, and we have no search volume for the name.

   

7. 11 May 2021

   A log shows the fields

   In the same thread a Kaspersky Endpoint Security log was posted. For the BroSubsc detection it shows type Trojan, threat level Exactly, precision High, object type File, object name System Memory and the reason Expert analysis. A second PC in the log shows Trojan.Multi.Accesstr.ash with the reason Automatic analysis. We read Expert analysis as a rule written by an analyst; Kaspersky does not say so.

8. 21 September 2021

   Kaspersky posts its removal guide

   A forum post titled What to do if Kaspersky detects trojan.multi.brosubsc.gen gives the explanation above and two steps: update the databases, run a Quick scan and then Advanced Disinfection with a Windows restart; and check the browser's notifications, subscriptions, permissions and extensions, resetting or disabling anything suspicious. The thread from March 2021 was closed with a link to it.

9. 16 to 17 January 2023

   Detected twice

   A user whose product treated it twice found that only a news site had notifications allowed, switched them off in Chrome and ran a full scan with nothing found. He asked whether the PC was clean. A helper pointed to the 2021 post and later to Kaspersky's adware article, and wrote that if he had followed them and Kaspersky reported nothing, it was safe to assume the system was clean; for doubts he should contact Kaspersky Support. The thread is marked solved.

10. 16 February 2023

    Kaspersky's adware article is updated

    Support article 10319 tells readers to update databases, run a Full Scan, remove the program from Programs and Features if one brought the ads, and remove the extension. For Chrome it adds a check of chrome://settings/content/notifications: an unknown site in the Allow tab is removed with the Other options button.

11. 20 June to 18 July 2023

    A Virus Removal Tool user asks if it is a trojan

    He had never seen an unwanted ad and asked about backdoor access. A reader guessed ransomware; a helper replied that ransomware encrypts files and that this was definitely not that. An AdwCleaner scan log he posted listed potentially unwanted entries and adware, and the helper said Kaspersky Threats and AdwCleaner pointed to adware. The thread ends with a request for the full detection window.

Across more than seven years the explanation has not changed: a browser permission for a site that sends ads. What changed is the number of people who ask whether the word trojan means they are infected.

Where Kaspersky sees it most

The old guide said the trojan is mostly active in Russia. Kaspersky's page supports that, and gives the share of attacked users by country; it gives no date and no user count.

The old guide called these countries victims. Kaspersky's wording is attacked users, which means users whose product reported the detection; it does not say how many lost money or data, and the cases we read show none who did.

What it can cost you

The old guide listed stolen passwords, drained bank accounts and ransomware. No Kaspersky page or forum case we read ties the detection to any of them. The real cost is what the ad pages try to get from you.

• Medium

  Ads that reach you outside the browser window

  Kaspersky says the family displays advertising messages even when the browser is inactive, and Microsoft says site notifications appear with Edge closed. They look like system alerts and invite a click.

• Medium

  What the ad pages offer

  A notification opens a page, and a page can offer a fake cleaner, a survey, a prize or a download. That choice is where money and data are lost, and it is not specific to this name.

• Low

  Stolen passwords and bank access

  The old guide said the trojan steals saved passwords and uses them on bank and social accounts. We found no source for this in the Kaspersky family text or in four forum cases. If you typed a password into a page a notice opened, treat that password as exposed.

• Low

  More malware installed by it

  The old guide said trojans pass on miners and ransomware. The only helpers who answered the question said this detection was not ransomware and pointed to adware. We know of no case where this detection installed other software.

• Low

  A repeating alert

  The 2019 Habr post describes a window that offers treatment by restart and then returns. It is tiring rather than harmful, and it stops when every ad-sending site has been removed from the browser.

What you may notice, and what the cases show

The old guide said the trojan shows very few symptoms, then listed a slow PC and a high CPU load. The cases show a different picture: the alert is often the only sign.

Our 2020 claims, checked one by one

We kept every claim of the old guide here so you can see which ones the sources support. Where no source supports one, we say so rather than drop it silently.

How it gets onto a PC: what our old guide said and what the sources show

The route in Kaspersky's text is a click on a prompt after a visit to a fraudulent or advertising resource. The old guide named email attachments, fake updates, cracks and pirate sites instead; the table says what supports each claim.

1. 1

   A click you may not remember

   The permission can be weeks or years old. Chrome says it may remove the notification permission of sites you have not visited for a while and show a Safety Check list of removed permissions, so an old grant may already be gone.

2. 2

   A site you think is harmless

   In the January 2023 case the only site with notifications allowed was a news site. We do not know whether that site was the source of the detection; the user guessed so, and no helper confirmed it.

Which browsers the check reads

The old guide said the trojan can enter Chrome, Firefox, Explorer and Safari. Kaspersky's own list was shorter, and it was written in 2019 and repeated in 2021, so it may have grown since.

Remove it from Windows 11 and Windows 10

Kaspersky's own steps come first, then the browser steps below, then a Microsoft scan as a second opinion. We did not run any of them on an infected PC; each step names its source.

1. 1

   Copy the alert

   Take a screenshot of the full detection window, with its extended details. Forum helpers ask for exactly that, and for the product name and version, before they say anything about your case.

2. 2

   Update and run a Quick scan

   Kaspersky's 2021 post tells you to update the product's databases and run a Quick scan. A scan does not remove a browser permission by itself, which is why the next two steps matter.

3. 3

   Run Advanced Disinfection and restart

   Choose Advanced Disinfection and let Windows restart when asked. According to the support text on Habr, treatment sets the URLs it found from Allow to Block. An administrator in the 2021 thread wrote that it goes away after Advanced Disinfection.

4. 4

   Review the notification list in every browser

   Open each browser you use, in each profile, and look at the sites allowed to send notifications. Remove or block any you did not choose, and not only the ones Kaspersky changed. The tabs in the browser steps give the menu path for Chrome, Edge, Firefox and Safari.

5. 5

   Remove extensions you do not recognise

   Kaspersky's post says to check installed extensions, and its adware article says to remove the advertising extension. Do this in each browser as well.

6. 6

   Uninstall a program you did not choose

   If ads began after you installed something, open Settings > Apps > Installed apps (Apps & features in Windows 10), sort by install date and uninstall what appeared at that time. Kaspersky's article names Control Panel > Programs and Features for the same job.

7. 7

   Run a Microsoft scan as a second opinion

   Open Windows Security > Virus & threat protection > Scan options, choose Full scan and Scan now. For a second pass choose Microsoft Defender Offline scan: Microsoft says it runs outside the normal Windows kernel, takes about 15 minutes and restarts the PC; with BitLocker on, suspend protection first, and read the result under Protection history.

8. 8

   Look again after a day

   Open the notification lists again and run the Quick scan once more. If the verdict returns, a site has been allowed again, or an extension or program is putting it back; follow the steps for asking Kaspersky below.

You do not need Safe Mode, System Restore or a registry cleaner for this detection. The old guide sent you there, and none of Kaspersky's pages we read does. Never install a repair tool because a notification tells you to.

Could it be a false alarm?

Possibly, and only Kaspersky's virus lab can say, as a helper wrote in June 2023. The cases show a verdict that was explained as adware, never one that was shown to be wrong. Use the table to decide how careful to be.

1. 1

   Ask Kaspersky with the evidence

   The Kaspersky Support Forum has a Virus and Ransomware section. Give the product and version, the date, the full detection window and what the browser's list showed. Helpers there also asked for an AdwCleaner scan log, with the instruction not to fix anything first.

2. 2

   Do not turn off protection

   Do not switch off your security product or exclude a folder to stop the alert.

3. 3

   Do not rely on one scan

   A scan with nothing found means the sites Kaspersky lists are gone. Another site you allowed can still send notifications, so review the browser list yourself.