• Detection: MEM:Trojan.Win64.Kryptik.gen

• Location shown: pmem:\C:\Windows\SysWOW64\calc.exe

• Product: Kaspersky Premium

The warning returns after disinfection and restart. Could anyone help determine whether this is a recurring infection, a detection issue, or a false positive, and advise what steps I should take?

Kaspersky classifies my website hxxps://citron.lol/ as Phishing (the verdict shows on VirusTotal). I believe this is a false positive. I requested a reanalysis through OpenTIP on 4 October but have not heard back, so I am asking here as well.

is the official website of Citron, a third-party client for Minecraft: Bedrock Edition. The site does not imitate any brand or company. Its footer and terms state that it is not affiliated with Mojang Studios or Microsoft. The sign-in form is only for Citron customer accounts. The Discord sign-in button uses the official Discord OAuth flow on discord.com, so the site never asks for a Discord password. Card payments go through Stripe, so the site never sees card numbers. No credentials for any other service are requested anywhere on the site.

This week CRDF accepted the same false-positive report and removed its entry, and Bitdefender and G DATA confirmed they do not block the domain.

Could you please review the domain and remove the Phishing verdict?

Thank you,

Jakob Rudolph

HEUR:Trojan.BAT.Alien.gen

Neither one of them can be removed in kaspersky basic. And Malewarebytes can't touch them either...But the madness doesn't end there, because a couple of days ago I started to notice that my browser windows and all windows icons got all locked up. They only get unlucked if I push ctrl + alt + delete. So I have to sitt and do that after a couple of minutes, so this is a real big pain in the butt...

I've never had these problems before, so this is all new to me. So I would be really happy if someone could help me out with this problem.

backupsec.com

www.backupsec.com

kb.backupsec.com

software.backupsec.com

OpenTIP reports backupsec.com as Dangerous, categorised Botnet C&C (CnC.Win32.Generic) and Malware, with Hits ~10 and URL count ~10.

Why we think it is inherited, not earned. We re-registered this domain on 17 August 2025 through Cloudflare. Before that it was a dropped domain hosted elsewhere — 34.102.136.180 during 2023 and 3.33.130.190 during 2024, neither of which was ours. The verdict appears to date from that period.

What the hosts actually are. BackupSec is a backup-security vendor. backupsec.com and www.backupsec.com are product and company pages. kb.backupsec.com is our knowledge base and serves technical articles only. software.backupsec.com redirects to a sign-in form; behind authentication, licensed customers download our own product images (a monitoring appliance distributed as an OVA). There is no third-party content, no user-generated content and no advertising on any of the four.

Evidence that the current sites are clean. VirusTotal is 1/89 for backupsec.com, with Kaspersky the only malware verdict: https://www.virustotal.com/gui/domain/backupsec.com — every other vendor that flagged it has cleared it since 5 September 2026, including Sophos, Fortinet, alphaMountain, Lionic, Forcepoint, ADMINUSLabs and Chong Lua Dao. Cloudflare's own domain intelligence ended its historical Malware categorisation on 8 September 2026 and now categorises the domain as Information Security. Google Safe Browsing is clean, 1.1.1.2 and Quad9 both resolve it, and the hosts serve a valid Google Trust Services certificate (SAN backupsec.com, *.backupsec.com).

What we have already done. We submitted through the Threat Intelligence Portal, and a request has been open with the virus lab since 11 September 2026 with no verdict yet. Today we resubmitted all four hosts through the portal while signed in, with a comment and a contact email.

Two questions. First, could this be escalated to the Virus Lab for a verdict on all four hosts? Second, which URLs carry the detection, and when were they first and last seen? If they predate 17 August 2025 they belong to the previous registrant and no longer resolve to anything of ours — with the list I can demonstrate that rather than simply assert it.

Why Kaspersky is treading my Phenix accounting program as virus, it detect and then disconnect my server from the internet and i being out for 25 minutes then it enable the internet connection again. how to prevent the Kaspersky from doing this.

I am the owner of dajiye[.]net. Since 18/09/2026 Kaspersky Plus blocks the whole site:

Web address: https://dajiye[.]net/

Blocked by: Safe Browsing

Reason: dangerous web address

Detection method: Cloud Protection

Detected: 18/09/2026 15:16:30

OpenTip shows the domain as Dangerous, category Malware. I already submitted a reanalysis request through OpenTip today.

The site is a free personal web app (FastAPI + static HTML/CSS/JS). A visitor pastes a public video link (YouTube, TikTok, Instagram, Facebook, X, Snapchat) and downloads that video. No ads, no ad networks, no third-party redirects, no tracking, no accounts, no payment forms, no obfuscated JavaScript. Files are deleted from the server after 10 minutes.

I believe the domain verdict came from a file, not from the site content: until today the site also offered the Windows build of the same app (PyInstaller, UPX-compressed, unsigned, 97.5 MB). Kaspersky detected it on 15/09/2026 as Trojan.Win32.Agent.xcfshv, and OpenTip shows that detection name was created on 18/09/2026 15:35 - the same day the domain was blocked. I believe both are false positives.

installer exe SHA256 c9f124444b86e9714f244d1cced92dfc467a1270767d6275cdce486276988771

installer zip SHA256 ff0dd69cbe02d31cac805159c96004de9ebfd27ea8521ef58d97a92892589632

I have now removed every executable from the website. It currently serves only HTML, CSS, JavaScript, fonts, images and JSON. I also checked the server: no intrusion, no unexpected files or processes.

Could you please have the domain and the file re-analysed? I can provide the full source code or the installer for analysis.

Thank you.

Is the OkayFreedom VPN program harmful or potentially dangerous? Could you analyze it and let me know ?

https://www.okayfreedom.com/software/okayfreedom-vpn-for-free-software-download.exe

Setup Analyze Report:

https://hybrid-analysis.com/sample/8cf80f756117188fe21cf28c404f28b520c318742fdaffb76f225945e90eedcf

our site virtugf.com has been flagged as phishing by Kaspersky. We are not sure why, we also verified that there is no malicious code. We would appreciate if someone from the Kaspersky team could take a look at this and if there are any issues could also tell us what specifically needs to be fixed. We assume that this is just a false positive.

Thanks in advance!

We are the provider of the application/informatioin portal running on this address for our client Honor. They use this application for distribution of information about their new products (mobile phones, tablets, wearables etc.). Usually those are PDFs, videos but also media assets. Access to the system is limited by registration and its approval as only sales network of Honor is allowed to access the information. We have no idea why we are being listed on your list as we are a legitimate site providing valuable service to its users. We would therefor kindly ask you to delist us. Thank you in advance

I am not sure if you are aware of the problem, but I have noticed a few topics for ongoing false positive for the Division Resurgence game on Reddit. The detection is triggered by the System Watcher:

https://www.reddit.com/r/thedivisionresurgence/comments/1szoh59/deen_has_anyone_else_seen_kaspersky_flag_ubisoft/

https://www.reddit.com/r/thedivisionresurgence/comments/1syjfw8/this_happened_after_installing_it_on_pc_via/

https://www.reddit.com/r/KasperskyLabs/comments/1uaew7h/what_is_causing_kaspersky_to_quarantine_zcode/

Any thoughts?

Thanks!

I am the webmaster of https://cayecaulkercasita.com.

The website was compromised in the past, but it has since been fully cleaned, secured, and restored. We believe Kaspersky is still classifying the domain as Phishing/Dangerous based on the old compromise.

I attempted to submit the domain for reanalysis using the Kaspersky Threat Intelligence Portal, but every attempt fails with the message:

"Failed to send object for reanalysis."

I have tried using different browsers (Chrome and Safari), but the result is always the same.

Could someone please:

1. Advise why the reanalysis request cannot be submitted.
2. Review the domain manually if possible.
3. Update its reputation if no current phishing or malicious content is found.

Domain: https://cayecaulkercasita.com

Thank you for your assistance.

Our website https://gcianetwork.com/ is currently being blocked by Kaspersky Endpoint Security.

The reported reason is “threat of data loss”, with detection method “databases”.

The website experienced a security incident in the past, but it has since been completely cleaned and secured. The previous malicious content has been removed and the website is currently legitimate and operating normally.

We believe this is an outdated reputation entry remaining from the previous incident.

We have tried submitting both the URL and the domain through Kaspersky OpenTIP using “Submit to reanalyze”, but the portal repeatedly returns:

“Failed to send object for reanalysis.”

Could you please submit gcianetwork.com to the Kaspersky analysts for reanalysis and, if confirmed clean, remove the outdated entry from the Data Loss Threat Protection databases?

Thank you very much for your assistance.

I use the XYPlorer file manager program on my Windows.
When I copy or move several folders from one tab to another, Kaspersky detects all files in that folder as viruses and deletes all files.
Then I install XYPlorer again, but this time when I transfer a file, Kaspersky doesn't detect false positives for an unknown amount of time and 
Kaspersky and XYPlorer work well together.

Kapersky Free 21.26.4.406

Windows 11 Pro x64 Build 26200

In our company a ransomware lock all files on Vcenter. It add "babyk" suffix to our database files.

I attached a sample with "infected" password in bellow link.

WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free

Can anyone help us to decrypt them?

 I´m not an engineer y have a user with a problem, may I can help me?

Site:  https://www.thewellnessoutlet.store

Specific page that is getting flagged in a scan: https://www.thewellnessoutlet.store/myaccount.asp

It is an online store that has restricted user access (must have a code to create an account) that is hosted through the Shift4Shop vendor.

Please remove this site from your international database of blocked sites, ASAP.

Thank you.

We reviewed the site files, database, server logs, scheduled tasks, and download system. We did not find malicious code, executable files, or unauthorized changes.

I want to check whether Kaspersky has any detection or reputation record for the domain. What is the correct tool or review process for a website owner?

Screenshot attached.