Virus and Ransomware related questions

How are you, friends? I have a problem. A ransomware hacker entered my account and encrypted my files, and they're all now .BS82tAHwp. Has anyone found a way to decrypt these files? Please help me.

I have an .exe file infected with the UDS:Trojan.Win32.GenericML.xnet virus. I am using Kaspersky Premium version 21.25.7.504(b) on Windows 10 Pro 22H2 64-bit. From the default settings, I changed the following configuration: ● File Anti-Virus settings - Action on threat detection - Block ● System Watcher settings: - Exploit Prevention - On threat detection - Block action - Application Activity Control - Action on detection of malicious or other activity - Terminate the application ● Exclusions and actions on object detection - UNCHECKED 'Delete malicious tools, adware, auto-dialers and suspicious packers.' When I ran the file, Kaspersky automatically …

When I try to open the web.telegram.org page, HEUR:Trojan.Script.Miner.gen is attempting to infect my computer with malware.

Hello, our company has developed a sales statistics product that helps customers determine how many devices they have sold, in which regions the sales were successful, and how many units of which model were sold. Currently, Kaspersky has classified our product as malicious software. After investigation, we found that the code with the attribute "os.android.version.sure.b" is defined as malicious. The function of this code is only to determine whether our sales statistics are unique values in the device. Could you please help explain why our product is classified as malicious software, and what steps we should take next?

Our Clients / Contractors using Kaspersky are having issues downloading their documents on https://sender1.zohoinsights.com.au which redirects to https://workdrive.zohopublic.com.au/. Please can you remove thsse sites from your block .

Hello, Your engine has flagged our website, thoughtshifttherapy.com, as a phishing site. There was previously a file injection on our site, which has now been successfully resolved. Could you please review thoughtshifttherapy.com and, if appropriate, remove it from your phishing database? Thank you for your time and assistance.

Hello, our website has been marked as malicious, despite having operated legitimately for several years. The domain is certisend.com. The landing page for this product only publicly presents a login screen. We serve private, manually reviewed customers, so we are quite confused about why this happened. We do not pretend to be anything other than what we are. We fear this might be potentially damaging to us, and it currently makes the website only show a white page, even after telling Kaspersky to enter anyways. We request you please review this. If there's anything I need to know please contact me privately when possible. Thank you.

URL: https://dropgems.xyz/ This is a false positive. dropgems.xyz is my own legitimate personal web application — an airdrop/crypto portfolio management tool. It does not have any login/password fields collecting third-party credentials, does not impersonate any bank, exchange, or wallet provider, and does not request private keys or seed phrases. Domain details: - Registered: 9 Jul 2026 via P.A. Viet Nam Company Limited - Hosting: Vercel (frontend), Render (.NET Core backend) - OpenTIP report: https://opentip.kaspersky.com/https%3A%2F%2Fdropgems.xyz%2F/?tab=lookup I have already submitted this URL for reanalysis via OpenTIP multiple times over the pa…

Hello Kaspersky Team, Our website has been mistakenly flagged as malicious. We have thoroughly reviewed our website and server infrastructure and found no malware, phishing content, or malicious code. The site is a legitimate social media scheduling platform and does not impersonate or attempt to deceive users. Website: https://www.post2all.com I have already submitted a reanalysis request through your website around a month ago, but unfortunately I haven't received a response and the domain is still being flagged. If there is a specific reason or detection that led to this classification, I'd greatly appreciate it if you could share the details s…

system： Windows 11 25H2 Kaspersky version standard edition ：21.23.6.614 (a) Last night, Kaspersky's background scan detected a virus User Type: Active User Component: Virus Scanning Result: Detected Result description: Detected Type: Trojan Name: MEM:Trojan.Win32.SEPEH.gen Precision: Accurate Threat Level: High Object type: File Object Name: System Object path: pmem:\ Reason: Expert Analysis Database Release Date: Today, 2026/7/4 15:06:00 I then began the cleanup process for the virus. Kaspersky Standard Edition couldn't handle it, while other antivirus software failed to detect the virus. After disabling various startup items, the virus al…

hello there i removed a game from my PC using revo uninstaller to remove every related file to the game, then i redownloaded the game again and while downloading i got this trojan Spoiler Event: Object deleted User: User type: Initiator Application name: steam.exe Application path: C:\Program Files (x86)\Steam Component: File Anti-Virus Result description: Deleted Type: Trojan Name: HEUR:Trojan.Win64.Patched.gen Precision: Heuristic analysis Threat level: High Object type: File Object name: EpicWebHelper.exe Object path: D:\SteamLibrary\steamapps\downloading\376210\Engine\Binaries\Win64

URL: https://incoso.co.za/ This is a false positive. incoso.co.za is the legitimate website of INCOSO (Inhouse Conference Solutions), an established South African event-management company operating since 2007, based in Bellville, Western Cape. The site contains standard business content only: company profile, services, portfolio, testimonials, and a basic name/email contact form. It has no login area, no password fields, and no payment processing, so there is no phishing surface. We believe the detection originated from Avast Web Shield running on the machine of the web administrator who deployed the site. During go-live there was a brief w…

Hi, I downloaded Parrot Security OS yesterday to install it on my virtual machine, but when I tried to scan it with Kaspersky, it found a lot of viruses, exactly 28 of them. Is this normal? I downloaded it from the official website (https://parrot.sh/download) and I remember the SHA 256 match. Here are a few of the threats it detected. UDS:Trojan.Win64.Agent not-a-virus:HEUR:NetTool.Linux.NBTscan.gen HEUR:HackTool.Linux.InviteFlood.a HEUR:Trojan.Linux.Vilers.b HEUR:Trojan-Proxy.Multi.godoh.a not-a-virus:UDS:Server-Proxy.Linux.chisel.gen HackTool.Win32.CreDump.hb Trojan-PSW.Win32.PPLDump.ew HandleKatz pypykatz.gen UDS:…

Event: Visit to a website was prevented User: PRIVATE\Private User type: Initiator Application name: chrome.exe Application path: C:\Program Files\Google\Chrome\Application Component: Safe Browsing Result description: Blocked Type: Malicious link Name: u-language.com Precision: Exactly Threat level: High Object type: Web page Object name: u-language.com Reason: Databases Databases release date: Yesterday, 24/06/2026 900 PM

Site https://brokerhunter.academy, bloqueado pela Kasperski. Já aparentemente desbloqueado mas continua não acessando, tentei adicionar a lista de exceção, tentei desligar a ação do antivirus por um tempo, mas continuou o problema. Preciso liberar o meu curso, pois tenho prazo para acabar.

I suddenly got a notification from kaspersky telling me that i got a virus. When i checked, it was in the chrome application file. I just recently factory resetted my laptop and downloaded all the essentials like google, discord, etc. I did not get any extensions then how come this trojan is in my computer? Is this a false positive? Sự kiện: Đã phát hiện đối tượng độc hại Người dùng: ASUS\Admin Kiểu người dùng: Người khởi tạo Tên ứng dụng: chrome.exe Đường dẫn ứng dụng: C:\Program Files\Google\Chrome\Application Thành phần: Duyệt mạng an toàn Mô tả kết quả: Đã phát hiện Loại: Trojan Tên: HEUR:Trojan.Script.Generic Độ…

I am actually building a billing platform under : https://my.hogionline.bi . I have been using KES for months and it never blocked the website till i open the URL tonight. There is no ransom ware, nor anything malicious on the website. Running on fresh server without any red flag. I would like to ask Kasperky monitors to remove my website from their blacklist since thereisn't anything wrong with it. Regards,

Hello, Kaspersky blocks https://bloxfit.ai as phishing — this is a false positive. bloxfit.ai is a legitimate SaaS (an AI clothing designer for Roblox players), operated by INPLANIS TECH LTD (Cyprus, reg. HE 477040). OpenTIP scan result: https://opentip.kaspersky.com/https%3A%2F%2Fbloxfit.ai/?tab=web bloxfit.ai is a LEGITIMATE website that is being incorrectly flagged as phishing/malicious. Please re-review and remove the classification. - Website: https://bloxfit.ai (blocked path users hit: https://bloxfit.ai/dashboard) - What it is: an AI tool that lets Roblox players design custom 2D clothing and upload it to Roblox using their OWN account. - Operator: INPLANIS TECH…

I've got and trojan alert from Kaspersky envolving my Windows PowerShell yesterday. He sad: He tried to exclude and he got: Can someone help me if this is a false or true alert? How can i check this in the future? Thank you so much for the help!

Just wondering if this is a false positive HEUR:Trojan-Downloader.Java.PoisonCraft. Its for a minecraft Mod client

This is the second time I've encountered a problem with a quick check, the first time, during a quick check, some red object was found that was simply ignored, not deleted, not quarantined, but simply ignored, subsequent quick scans and 2 full scans did not detect any viruses that day. Today, a quick scan detected two objects that were deleted. It's unclear what these objects were; there's no indication they were even detected in the history, and they weren't quarantined so I cannot see what objects kaspersky deleted, the full scan I ran afterwards found nothing. Moreover, this behavior of the antivirus began after a recent update; I had never had anything like …

I have a list false positives and false detection names comes from Kaspersky and other vendors but today I find another one which is interesting but it's not false positive. https://www.virustotal.com/gui/file/6fafebdff01bfb41062dbbc53f68530883e383896e87373dd336fa440d952c64/detection Probably triggering due to this: https://github.com/CroatiaSecurity/Sentinel/blob/4c5293ad19a4b224bb088f2455d1268208d53c9b/src/WindowsSentinel.Core/Rules.cs#L243 It's junkware program but it triggers almost every good product in dynamic. It contains suspicious strings so it triggers Kaspersky as excepted. Many detections happening on Virustotal if you look the dynamic. It's …

I often come to my laptop computer via wired ethernet(using starlink internet) and I see my mouse moving. I have to take back control, unplug ethernet, and then get back on. Sometimes they go away, sometimes not. It has been better since installing Kaspersky. I am hoping to get rid of this safety risk completely.

Hi my personal website has been blocked for the following reasons: https://alrabayah.com Reason: Databases Previously when I had used the website and setup all the plugins, themes, etc, it was done without an SSL certificate, but after installing the SSL certificate it started flagging the change for the plugins and themes files. Can this be reviewed? Thanks

Kindly assist on removing https://horizonpeaktours.com on the blacklist as its showing that people can lose data yet server and website is clean. Regards Anthony Kelly