DLL Archives

Winsage

September 1, 2026

TerminalFix Attacks Use Fake CAPTCHAs To Secretly Hack Windows PCs

Microsoft Threat Intelligence has identified a new variant of the ClickFix malware campaign called "TerminalFix." This variant uses deceptive CAPTCHAs that mimic trusted services like Cloudflare and directs users to PowerShell or a command prompt, allowing for the execution of complex scripts. TerminalFix aims to orchestrate a multi-stage attack that provides attackers with persistent, network-level proxy access through the compromised host, potentially leading to significant data theft and malware propagation within unsecured enterprise networks. Recommendations for defense against TerminalFix include restricting access to PowerShell and Windows Run dialogs, monitoring for DLL sideloading indicators, blocking Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The attacks primarily target enterprise environments rather than individual consumers.

Tech Optimizer

August 31, 2026

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox is linked to the distribution of a backdoor malware called ValleyRAT, disguised as the legitimate QN Wallpaper adware application. Once installed, ValleyRAT provides complete control over the compromised machine. The malware uses DLL sideloading to operate under the guise of a legitimate process, bypassing security measures. It disables Windows Defender and adds itself to autorun entries, and can mark its process as critical, causing system crashes if terminated. Kaspersky has identified specific indicators of compromise (IoCs) including hashes, command-and-control servers, and associated domains. In 2026, Kaspersky recorded over 100,000 detections of ValleyRAT affecting more than 1,500 unique users, mainly in China and India.

Winsage

August 28, 2026

Windows 11 Deletes ASUS GPU Drivers After Extended Eco Mode Usage

An ASUS ROG Zephyrus G14 owner reported that after using Eco Mode for several weeks, Windows 11 removed the NVIDIA GeForce RTX 5070 Ti GPU driver when switching back to performance mode. This behavior is expected due to Windows 11's automatic driver removal for inactive GPUs, managed by a maintenance task called pnpclean.dll, which cleans up drivers for devices not connected for 15 to 30 days. After the driver was deleted, the GPU was recognized as a generic display adapter, requiring reinstallation of the driver. The user found a workaround by disabling the Disk Cleanup handler in PowerShell to prevent automatic deletion, but this increased storage usage as Windows would no longer purge old driver packages.

Winsage

August 25, 2026

Spent Two Weeks in Eco Mode? Windows Might Have Quietly Purged Your Nvidia Driver

An Asus ROG Zephyrus G14 owner experienced the disappearance of their RTX GPU due to the Windows maintenance task pnpclean.dll, which removed the Nvidia driver package after the GPU had been in Eco mode for approximately 15 days. Eco mode disconnects the discrete GPU from the PCIe bus, causing Windows to register it as missing hardware. The pnpclean.dll routine removes drivers for devices absent beyond a timeout, which is reportedly 30 days by default but observed at 15 days in this case. Switching back to Normal or Hybrid mode makes the GPU reappear, but it is recognized only via the Microsoft Basic Display Adapter, requiring a full Nvidia driver reinstall. To check if a system was affected, users can run a specific PowerShell command. A registry fix involves setting the DWORD Autorun from 1 to 0 to prevent automatic cleanup. This issue is considered rare, requiring extended use of Eco mode, and while no hardware is harmed, the silent removal of the GPU driver raises concerns about automated OS processes. Neither Microsoft nor Asus has publicly addressed the issue as of late August 2026.

Winsage

August 24, 2026

You don’t want this Sleepwalker backdoor on your Windows machine

Malware researcher Dominik Reichel has discovered a sophisticated Windows backdoor named Sleepwalker, which remains dormant in memory until activated by a specially crafted network packet. Sleepwalker uses a 23-instruction command language to execute tasks, including running code in memory and exfiltrating data. It activates through a proprietary activation packet that does not contain readable commands. The malware targets a VMware VMCI and disguises itself as Microsoft's dpapi.dll, mimicking its functions while redirecting calls to a non-existent file. Once it confirms its host process as ERAAgent.exe, it enters a dormant state to evade detection. Sleepwalker monitors for a specific pattern known as a magic packet to decrypt and interpret commands. Commands sent to it are encrypted with AES-256-CCM and must be read in a specific order. The backdoor includes functionalities for sending and concealing data, receiving tasks, and executing programs. Reichel has developed a toolkit to decode Sleepwalker’s bytecode and a mitigation guide for affected users. However, there are significant gaps in knowledge regarding the initial access method, victim identification, and the malware's operator.

Winsage

August 22, 2026

Someone discovered that Windows 11 nukes your GPU drivers if you leave your laptop in eco mode

A user on the Zephyrus G14 subreddit discovered that using the eco power mode on Windows 11 for 15 consecutive days leads to the automatic deletion of GPU drivers. The eco mode power-gates the discrete GPU off the PCIe bus, causing Windows to treat it as disconnected. After 15 days of inactivity, Windows performs a cleanup and removes the GPU driver package. When switching back to standard power mode, the GPU is identified as a "Basic Display Adapter." Users can check if their GPU drivers have been removed using specific command prompt commands. To prevent driver cleanup, users can either switch to a non-eco power plan occasionally or modify the registry to set Autorun (DWORD) = 0.

Winsage

August 22, 2026

Researchers find way to weaponize Windows Defender’s own driver

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.

AppWizard

August 21, 2026

Are your PC games crashing after the latest Windows 11 update? Microsoft is investigating whether a nasty new bug is the cause

Windows 11's latest update has caused significant issues for various PC games, with Microsoft acknowledging that some games have become unresponsive following the August patch. Affected titles include Arc Raiders, Marvel Tokon: Fighting Souls, and The Finals. Microsoft is investigating potential links to peripherals or internal components with RGB lighting, which may have problematic drivers like inpoutx64. Discussions suggest that tightened kernel handle validation in the update has exposed driver glitches, leading to game crashes. Players who have not installed the August update may remain unaffected. Suggested workarounds include removing the inpoutx64 driver file by using Command Prompt commands to stop and delete the driver, followed by deleting any instances of the file in the system directory. Many gamers are expressing frustration on social media, with some suggesting alternatives like Linux for a more stable gaming experience. Microsoft is currently investigating the situation.

Tech Optimizer

August 20, 2026

Hackers Are Using a Fake Roblox Cheat To Access Your Webcam and Steal Data

Roblox is facing privacy concerns due to spyware disguised as an "undetected" version of the Xeno Roblox cheat tool. This malware can access screens, record keystrokes, and activate webcams, allowing attackers to execute remote commands. The infection begins when users download a file resembling a legitimate Xeno installation, often shared on platforms like Discord. The malware, previously known as Powercat, has evolved and operates in three stages: 1. The user executes a file named Xeno.exe, which checks for Java and extracts it if necessary. 2. The malware runs a JAR file disguised as decompiler.exe, performing checks to avoid detection. 3. It masquerades as a legitimate Windows DLL file, logging activities and attempting to escalate privileges. If successful, the malware can control the victim's system, access webcams, log keystrokes, and steal sensitive information, including cryptocurrency wallet credentials. To protect against this spyware, users are advised to avoid unofficial cheats, use antivirus software, refrain from clicking unsolicited links, enable two-factor authentication, inspect User Account Control prompts, and consider identity theft protection services.

Winsage

August 18, 2026

CISA: Windows Task Host flaw now exploited by ransomware gangs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs are exploiting a significant vulnerability in the Windows Task Host system, tracked as CVE-2025-60710. This high-severity flaw, affecting Windows 11 and Windows Server 2025, allows local attackers with basic user permissions to escalate their privileges to SYSTEM level. Microsoft patched this vulnerability in November 2025, but it poses a threat to unpatched devices. CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and provided Federal Civilian Executive Branch agencies with a two-week window to secure their systems. CISA warns that such vulnerabilities are frequent attack vectors for malicious actors and urges organizations to apply mitigations or discontinue the use of affected products. Additionally, CISA noted that ransomware groups are also exploiting a Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659), confirmed to be actively exploited in early July. Since November 2021, CISA has identified 383 actively exploited vulnerabilities across various Microsoft products, with 112 being used in ransomware attacks.