Security Incident Report
Report Reference: ACE-SEC-2026-0331
Date: 31 March 2026
Prepared for: Ace Portables

### ALL SYSTEMS VERIFIED CLEAN

Both workstations have been scanned, verified, and are actively protected by enterprise-grade endpoint security. No active threats detected.

Executive Summary

Ace Portables contacted AZ Computer Guru LLC after their financial institution requested verification that company workstations were free of malware. Upon investigation, we determined that the previously installed antivirus software (McAfee) had silently expired, leaving the machines unprotected.

We removed the expired McAfee installation and deployed Bitdefender GravityZone, an enterprise-grade Endpoint Detection and Response (EDR) platform, across both company workstations. During the initial security scan, Bitdefender detected and automatically deleted a malicious browser extension containing a Trojan on one machine. Both machines have been fully scanned and are confirmed clean with no active threats.

Incident Timeline
Prior to Engagement
McAfee antivirus subscription silently expired, leaving workstations without active endpoint protection.
Engagement Initiated
Ace Portables contacted AZ Computer Guru LLC at the request of their bank to verify workstation security.
Remediation
Expired McAfee software removed. Bitdefender GravityZone EDR deployed on both workstations (DESKTOP-DV7I10S, DESKTOP-U317856).
25 March 2026, 11:15
Bitdefender detected and automatically deleted a Trojan (Trojan.GenericKD.77292516) within a malicious Microsoft Edge browser extension on one workstation.
31 March 2026
Full scans completed on both machines. Both verified clean. This report issued.
Threat Details
Threat Classification
Trojan.GenericKD.77292516
Threat Type
Malware (Trojan)
Detection Date
25 March 2026, 11:15
Action Taken
Automatically Deleted
Affected Component
Microsoft Edge Browser Extension (background.js)
Extension ID
cfacibcmkcdppnkgennk...blmp
File SHA-256 Hash
B3F83B5EC4CFED5D93561B86B5A124FA88D2EA35491011D32CCDA3E385C036E1
Workstation Scan Results

Both Ace Portables workstations were enrolled in Bitdefender GravityZone and scanned. Current status as of 31 March 2026:

Machine Name | Type | Management | Security Status
--- | --- | --- | ---
DESKTOP-DV7I10S | Physical Machine | Managed | No Issues
DESKTOP-U317856 | Physical Machine | Managed | No Issues

Remediation Actions Taken

- Removed expired antivirus software — McAfee, which had silently expired, was fully uninstalled from both workstations.
- Deployed enterprise endpoint protection — Bitdefender GravityZone EDR was installed and configured on both machines, providing real-time threat monitoring, behavioral analysis, and automated response.
- Malicious extension deleted — The Trojan-infected browser extension was automatically detected and removed by Bitdefender during the initial scan.
- Extension blocked globally — The malicious extension has been added to our managed blocklist, preventing it from being installed on any endpoint under our management.
- Full system scans completed — Comprehensive antimalware scans were run on both workstations. Both returned clean results with no further threats detected.
- Password reset recommended — The affected user was advised to change passwords for all accounts accessed via the browser, prioritising financial and email accounts.

Ongoing Protection

Both Ace Portables workstations are now continuously protected by Bitdefender GravityZone, which provides:

- Real-time file system protection — On-access scanning of all files as they are opened, created, or modified.
- Advanced Threat Control — Behavioral monitoring that detects suspicious process activity in real time.
- Network Attack Defense — Protection against network-based exploits and lateral movement attempts.
- Web Threat Protection — Blocks access to known malicious, phishing, and fraudulent websites.
- Anti-Exploit Technology — Detects and prevents exploitation of software vulnerabilities.
- Centralised Management — All endpoints are monitored and managed through the GravityZone console by AZ Computer Guru LLC, ensuring policies and definitions remain current.

Both Ace Portables workstations have been verified clean and are now actively protected by enterprise-grade endpoint security. The previously unprotected state caused by the expired McAfee subscription has been fully resolved. The detected Trojan was automatically removed before any confirmed data exfiltration occurred, and preventative measures are in place to block future threats.

Should the bank require any additional information, technical logs, or further clarification, please do not hesitate to contact us using the details below.