anti-malware Archives

Tech Optimizer

May 22, 2026

Threat Protection Pro: all you need to know about IPVanish’s anti-malware tool

Virtual Private Networks (VPNs) have evolved into comprehensive cybersecurity solutions, offering features like ad-blockers, antivirus software, and dark web monitoring. IPVanish offers a feature called Threat Protection Pro, available with the Advanced plan, which protects against malware, ads, and trackers. It enhances online security by blocking ads and tracking scripts, quarantining suspicious downloads, and preventing access to malicious websites. All IPVanish plans include core Threat Protection, utilizing DNS filters to combat trackers and malware across various platforms. Threat Protection Pro, launched in March 2026, provides 24/7 malware and antivirus protection, even when the VPN is not active. This feature is exclusive to Advanced-tier subscribers and currently supports Windows and Mac platforms. It employs VIPRE’s antivirus engine and initiates detailed measures to identify risks at multiple levels. Users can activate Threat Protection Pro through a straightforward setup process on Windows or MacOS. IPVanish allows unlimited devices per subscription and includes DNS and IPv6 leak protection, a kill switch, and a no-logs policy. Advanced users also have access to a Secure Browser for disposable browsing.

Tech Optimizer

May 17, 2026

Norton 360 explained: features, protection and US use

Norton 360 is a subscription-based security suite developed by Gen Digital, designed to protect various devices, including Windows PCs, Macs, smartphones, and tablets, from threats like malware and phishing attacks. It includes features such as antivirus and anti-malware scanning, a smart firewall, a password manager, a secure VPN, and dark web monitoring. The suite operates quietly in the background, continuously monitoring for malicious behavior. Norton 360 is marketed in the US and available in Europe and Asia-Pacific, targeting households with multiple devices and online accounts. Gen Digital, the company behind Norton 360, is publicly traded on Nasdaq under the ticker GEN.

Tech Optimizer

May 5, 2026

The best mobile antivirus software of 2026: Expert tested and reviewed

Bitdefender Mobile Security is currently regarded as the best mobile antivirus software, achieving a 100% detection rate for malware on Android devices according to AV-TEST's August 2025 report. The 2026 version introduces App Anomaly Detection and includes features like Scam Alert and anti-theft tools. Sophos Intercept X for Mobile offers a free version with a perfect score in AV-TEST's comparisons and features such as multi-factor authentication and a Privacy Advisor. Surfshark Antivirus, part of the Surfshark One package, scored six out of six in AV-TEST's evaluations and includes various security tools, but is only available for Android, macOS, and Windows. Avast Mobile Security is a popular free option with robust features and achieved perfect scores in protection and usability in AV-TEST's September-October 2025 report. AVG Antivirus, operating on the same engine as Avast, also detected 100% of malware in AV-TEST's March-April 2025 evaluations and includes anti-theft tools.

Winsage

May 5, 2026

Defender yanks root certs as Windows updates blocks backups

Microsoft's Defender anti-malware tool update version 1.449.425.0 removed two DigiCert root digital certificates, leading to false positives that flagged them as severe malware (Trojan:Win32/Cerdigent.A!dha). This incident was later identified as a false positive, and updating to version 1.449.430.0 or later reinstates the certificates. The issue may be linked to a DigiCert employee encountering disguised malware. Additionally, Windows updates from April 14 caused third-party backup applications to malfunction due to the addition of vulnerable psmounterex.sys kernel driver versions to a blocklist. Users experienced difficulties with mounting backup image files, and Microsoft referenced a vulnerability rated 9.3 out of 10 in the driver. Other affected software includes Acronis Cyber Protect Cloud and UrBackup server. Microsoft has not explained the delay in adding the vulnerable driver to the blocklist, and other recent update-related issues have also been reported.

AppWizard

April 29, 2026

New Android spyware Morpheus linked to Italian surveillance firm

Morpheus is a new spyware identified by the nonprofit organization Osservatorio Nessuno, which spreads through counterfeit Android applications that appear as legitimate updates. Attackers use SMS messages to direct victims to a fraudulent website mimicking an Internet Service Provider (ISP). The spyware installs a dropper app that deploys a concealed payload, which disguises itself as legitimate system components and manipulates users into granting dangerous permissions, including Accessibility access. Once granted, Morpheus initiates a Permission Workflow that creates a fake update overlay, disabling the touchscreen to prevent user interaction. It ensures persistence by restarting after device reboots and can request device administrator privileges. The spyware exploits overlay windows and Accessibility features to gain control of the device and bypass security measures, including disabling antivirus solutions without requiring root access. Analysis suggests Morpheus has Italian origins, with connections to an Italian firm, IPS Intelligence, known for lawful interception technologies. The spyware is capable of invasive actions such as recording audio and video, linking to WhatsApp, and compromising device security. The report highlights a network of dubious companies and shared contacts linked to the spyware's distribution.

Tech Optimizer

April 15, 2026

Malware Is Scary. Here’s CNET’s Guide to Cleaning an Infected Laptop

88% of U.S. adults with laptops have taken measures against potential malware in the past year. Among those who encountered malware, 60% manually deleted the file or closed the offending website, while 35% initiated an anti-malware scan. Recommended steps for responding to a malware infection include disconnecting the device from Wi-Fi, connecting to a guest network, using antivirus software to remove the threat, and performing a factory reset or wiping the hard drive if necessary. It is advised to run at least two different antivirus programs to ensure comprehensive protection and to avoid restoring data from backups that may harbor malware.

Tech Optimizer

April 13, 2026

Fake Claude site installs malware that gives attackers access to your computer

Claude, an AI tool developed by Anthropic, receives nearly 290 million web visits monthly and has become a target for cybercriminals. A fake website has been found that impersonates Claude, distributing a trojanized installer named Claude-Pro-windows-x64.zip. This installer, while appearing legitimate, deploys PlugX malware, granting attackers remote access to users' systems. The fraudulent site mimics the official download page and uses passive DNS records linked to commercial bulk-email platforms, indicating active maintenance by the operators. The ZIP file contains an MSI installer that incorrectly spells "Claude" as "Cluade" and creates a desktop shortcut that launches a VBScript dropper. This script runs the legitimate claude.exe while executing malicious activities in the background, including copying files to the Windows Startup folder to ensure persistence after reboot. The attack utilizes a DLL sideloading technique recognized by MITRE as T1574.002, where a legitimate G DATA antivirus updater is exploited with a malicious DLL. Within 22 seconds of execution, the malware establishes a connection to an IP address associated with Alibaba Cloud, indicating control over the compromised system. The dropper script also employs anti-forensic measures to delete itself and the VBScript after deployment. Indicators of compromise include the filenames Claude-Pro-windows-x64.zip, NOVUpdate.exe, avk.dll, and NOVUpdate.exe.dat, along with the network indicator 8.217.190.58:443 (TCP) as the command and control destination. Users are advised to download Claude only from the official site and to remain vigilant against potential compromises.

Tech Optimizer

April 4, 2026

Best antivirus for Windows 11: Guide to choosing the right software

Windows 11 provides a more secure environment than previous versions, but recovery remains a concern for users. Built-in protections are limited against threats like phishing and ransomware. The need for antivirus solutions has evolved to include comprehensive protection and recovery options. Basic threat prevention is often insufficient for home users and remote workers, who risk losing important files. Microsoft Defender offers a solid foundation, but products like Acronis True Image combine anti-malware capabilities with backup and recovery features. Antivirus software is essential for Windows 11 users, protecting against various malicious software. Modern antivirus programs offer real-time protection, web protection, and identity theft protection. Users must consider free versus paid solutions, as premium options typically provide advanced features. Top antivirus picks for Windows 11 in 2026 include Acronis True Image, Bitdefender Total Security, McAfee Total Protection, Norton 360 Deluxe, and Microsoft Defender Antivirus. Acronis True Image stands out for its dual functionality of prevention and recovery, utilizing AI-driven analysis to monitor unauthorized changes. Backup-focused alternatives like EaseUS Todo Backup Home and Macrium Reflect Home specialize in recovery but lack comprehensive antivirus protection. The choice between paid and free antivirus depends on whether Microsoft Defender meets users' needs. Paid suites generally offer deeper protection and advanced features. The best antivirus should provide robust protection while minimizing system impact, tailored to users' specific needs for prevention or recovery.

Winsage

April 2, 2026

Malwarebytes highlights Microsoft findings on WhatsApp attachments used in Windows attacks

A campaign targeting Windows users exploits WhatsApp attachments to execute a malicious .vbs script. Victims receive what appears to be a harmless attachment, which, when opened, duplicates legitimate Windows tools into a hidden folder and renames them to avoid detection. These tools are then used to download additional malware from reputable cloud services, disguising the malicious activity. The malware seeks administrator privileges by altering User Account Control settings and registry entries for persistence. It ultimately installs remote-access software and other payloads to maintain control over the compromised device. Malwarebytes recommends safety measures such as avoiding unsolicited attachments, enabling file extensions, using updated anti-malware tools, downloading software from official sites, being cautious of unexpected UAC prompts, and keeping systems updated.

Winsage

April 1, 2026

WhatsApp on Windows users targeted in new campaign, warns Microsoft

Microsoft researchers have identified a campaign that exploits WhatsApp attachments to infiltrate Windows machines, allowing attackers remote control. The attack uses social engineering tactics, where users receive a seemingly benign .vbs (Visual Basic Script) file that can be executed on Windows. This method does not rely on software vulnerabilities but on persuading victims to execute the malicious file. Attackers manipulate built-in Windows tools to download further malware, employing a technique known as living off the land (LOTL) to avoid detection. The malware seeks to elevate its privileges to administrator status, modifying User Account Control (UAC) prompts and registry settings for persistence. An unsigned MSI (Microsoft Installer) is deployed to establish remote-access software, granting continuous access to the compromised machine.