{
  "family": "purityscan",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Purityscan is an older, highly aggressive adware and spyware family that paved the way for modern Potentially Unwanted Programs (PUPs). Masquerading as a 'pornography blocker' or 'image scanner' (hence 'Purity'), its actual function is to aggressively hijack the user's browser, serve a massive volume of intrusive pop-up advertisements, and track browsing habits for affiliate revenue (`T1189`).<br><br><b>Understanding Purityscan (Aggressive Adware)</b><br>To an end-user, Purityscan was notorious for rendering a computer almost unusable due to the sheer volume of pop-up ads it generated. For IT security, it represents the deceptive nature of early adware, tricking users into installing a 'security' tool that is actually the malware itself.<br><br><b>Execution and Hijacking Mechanics</b><br>Purityscan was heavily distributed via deceptive advertising, bundled software, and sometimes ActiveX drive-by downloads. Upon execution, it entrenched itself deeply into the operating system. It established persistence by modifying Registry Run keys and creating Scheduled Tasks (`T1547.001`). Crucially, it injected its DLLs into the `explorer.exe` and `iexplore.exe` processes (`T1055`), allowing it to monitor all web traffic, intercept search queries, and force the browser to open new windows displaying advertisements from its affiliate networks.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe system degradation, loss of privacy, and an unusable web browsing experience. Host-based IoCs include the presence of the `purityscan.exe` executable, unauthorized DLL injection into browser processes, and extensive modifications to Internet Explorer's registry settings (BHOs, Start Page). Network IoCs involve constant HTTP traffic to known adware affiliate networks, even when the user is not actively browsing.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1547.001",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Initial distribution via deceptive marketing and bundles)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting DLLs into browsers to monitor traffic and serve ads)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys (Persistence mechanism)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use a robust anti-malware and Adware removal tool to identify and strip out the deeply entrenched registry keys and injected DLLs.",
    "Use the standard Windows removal tools to uninstall the primary application, though it often leaves remnants behind.",
    "Reset all web browsers to their factory defaults to eliminate hijacked settings and malicious Browser Helper Objects (BHOs).",
    "Ensure endpoint Application Control is enabled to prevent users from installing unvetted 'security' tools."
  ],
  "what_to_avoid": [
    "Do not trust the application's built-in uninstaller, as it frequently fails to remove the core adware components.",
    "Avoid clicking on pop-up ads promising to 'clean' or 'secure' your PC, as this is a common delivery vector for this type of threat."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}