Purityscan

Overview

Adware:Win32/Purityscan is an older, highly aggressive adware and spyware family that paved the way for modern Potentially Unwanted Programs (PUPs). Masquerading as a 'pornography blocker' or 'image scanner' (hence 'Purity'), its actual function is to aggressively hijack the user's browser, serve a massive volume of intrusive pop-up advertisements, and track browsing habits for affiliate revenue (`T1189`).

Understanding Purityscan (Aggressive Adware)
To an end-user, Purityscan was notorious for rendering a computer almost unusable due to the sheer volume of pop-up ads it generated. For IT security, it represents the deceptive nature of early adware, tricking users into installing a 'security' tool that is actually the malware itself.

Execution and Hijacking Mechanics
Purityscan was heavily distributed via deceptive advertising, bundled software, and sometimes ActiveX drive-by downloads. Upon execution, it entrenched itself deeply into the operating system. It established persistence by modifying Registry Run keys and creating Scheduled Tasks (`T1547.001`). Crucially, it injected its DLLs into the `explorer.exe` and `iexplore.exe` processes (`T1055`), allowing it to monitor all web traffic, intercept search queries, and force the browser to open new windows displaying advertisements from its affiliate networks.

Indicators of Compromise & Impact
The primary impact is severe system degradation, loss of privacy, and an unusable web browsing experience. Host-based IoCs include the presence of the `purityscan.exe` executable, unauthorized DLL injection into browser processes, and extensive modifications to Internet Explorer's registry settings (BHOs, Start Page). Network IoCs involve constant HTTP traffic to known adware affiliate networks, even when the user is not actively browsing.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PURITYSCAN_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Purityscan"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "purityscan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Purityscan (Advanced Threat) Execution & Triage
id: efa95bef-b832-50e3-9294-98f4fd98bbcb
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Purityscan malware family. Detects proxy execution, reflective DLL loading,
  and remote command injection associated with modular enterprise backdoors.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/purityscan
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.advanced-threat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1547_001
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \rundll32.exe
    - \regsvr32.exe
    CommandLine|contains:
    - DownloadString
    - IEX(
    - '/s /n /u /i:'
    - sc create
    - start-process
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_PURITYSCAN_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Purityscan tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "purityscan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use a robust anti-malware and Adware removal tool to identify and strip out the deeply entrenched registry keys and injected DLLs.
2. Use the standard Windows removal tools to uninstall the primary application, though it often leaves remnants behind.
3. Reset all web browsers to their factory defaults to eliminate hijacked settings and malicious Browser Helper Objects (BHOs).
4. Ensure endpoint Application Control is enabled to prevent users from installing unvetted 'security' tools.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the application's built-in uninstaller, as it frequently fails to remove the core adware components.
2. Avoid clicking on pop-up ads promising to 'clean' or 'secure' your PC, as this is a common delivery vector for this type of threat.

References & External Analysis

• Search "purityscan" on VirusTotal (External Analysis)
• Search "purityscan" on Any.Run (Sandbox Sandbox)
• Search "purityscan" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Advanced Threat)

Explore other documented threats in the same operational category:

• Simplified
• Silentinstall
• Torrenteasy
• Turla
• Popwin
• Forcestartpage
• Iwin
• Tiklog

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/purityscan.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.