Purityscan

Overview

Adware:Win32/Purityscan is an older, highly aggressive adware and spyware family that paved the way for modern Potentially Unwanted Programs (PUPs). Masquerading as a 'pornography blocker' or 'image scanner' (hence 'Purity'), its actual function is to aggressively hijack the user's browser, serve a massive volume of intrusive pop-up advertisements, and track browsing habits for affiliate revenue (`T1189`).

Understanding Purityscan (Aggressive Adware)
To an end-user, Purityscan was notorious for rendering a computer almost unusable due to the sheer volume of pop-up ads it generated. For IT security, it represents the deceptive nature of early adware, tricking users into installing a 'security' tool that is actually the malware itself.

Execution and Hijacking Mechanics
Purityscan was heavily distributed via deceptive advertising, bundled software, and sometimes ActiveX drive-by downloads. Upon execution, it entrenched itself deeply into the operating system. It established persistence by modifying Registry Run keys and creating Scheduled Tasks (`T1547.001`). Crucially, it injected its DLLs into the `explorer.exe` and `iexplore.exe` processes (`T1055`), allowing it to monitor all web traffic, intercept search queries, and force the browser to open new windows displaying advertisements from its affiliate networks.

Indicators of Compromise & Impact
The primary impact is severe system degradation, loss of privacy, and an unusable web browsing experience. Host-based IoCs include the presence of the `purityscan.exe` executable, unauthorized DLL injection into browser processes, and extensive modifications to Internet Explorer's registry settings (BHOs, Start Page). Network IoCs involve constant HTTP traffic to known adware affiliate networks, even when the user is not actively browsing.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PURITYSCAN {
    meta:
        description = "Detects Purityscan (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "purityscan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Purityscan Activity
id: b08c494998439e8bba439b199367a050
status: experimental
description: Detects generic indicators of the purityscan malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*purityscan*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use a robust anti-malware and Adware removal tool to identify and strip out the deeply entrenched registry keys and injected DLLs.
2. Use the standard Windows removal tools to uninstall the primary application, though it often leaves remnants behind.
3. Reset all web browsers to their factory defaults to eliminate hijacked settings and malicious Browser Helper Objects (BHOs).
4. Ensure endpoint Application Control is enabled to prevent users from installing unvetted 'security' tools.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the application's built-in uninstaller, as it frequently fails to remove the core adware components.
2. Avoid clicking on pop-up ads promising to 'clean' or 'secure' your PC, as this is a common delivery vector for this type of threat.

References & External Analysis

• Search "purityscan" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Pikachu
• 2345Cn
• Snake
• Vkontaktedj
• Sciagnij

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/purityscan.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.