malware scan Archives

Winsage

January 4, 2026

Speed test pits six generations of Windows against each other — Windows 11 placed dead last across most benchmarks, 8.1 emerges as unexpected winner in this unscientific comparison

Windows 11 has been criticized for its high system requirements, increased overhead, and user interface regressions. A test by TrigrZolt compared six generations of Windows operating systems using six Lenovo ThinkPad X220 laptops, which were not officially supported for Windows 11. In startup time tests, Windows 11 was the slowest, while Windows 8.1 was the fastest. In audio file processing, Windows 11 ranked fifth, and in video rendering, it again placed last. It secured second place in file transfer speeds but was fourth in a malware scan test. Benchmark tests showed Windows 11 in fourth place for both single-threaded and multi-threaded CPU performance. In CrystalDiskMark, it tied for third place, and in Cinebench R10, it was fourth in single-core tests. The outdated hardware used for testing and the absence of an SSD may have skewed the results, which were deemed more historical than practical. A more suitable test would involve contemporary laptops to provide a fairer comparison.

Tech Optimizer

December 30, 2025

How to Run an iPhone Malware Scan: Find and Remove Viruses

iPhones do not support traditional antivirus applications due to iOS's app sandboxing feature, which limits apps' access to system-level data. Users can identify potential malware by monitoring for unusual behaviors, such as overheating, fast battery drain, unexpected data usage spikes, unwanted Safari pop-ups, unfamiliar apps, repeated login prompts, and strange messages sent from their accounts. To investigate for malware, users should check device performance, review storage and data usage, monitor battery usage, and look for jailbreak indicators. If malware is suspected, users can take steps such as updating iOS and apps, restarting the device, deleting suspicious apps, clearing Safari data, removing unknown profiles, resetting network settings, restoring from a clean backup, or performing a factory reset as a last resort. iOS includes built-in protections against malware, such as App Store reviews, sandboxing, code signing, and regular security updates. However, iPhones are not completely immune to threats, and jailbreaking increases vulnerability. To protect against malware, users should keep iOS and apps updated, use strong passcodes, avoid jailbreaking, be cautious with links and attachments, use secure browsers, and consider using a VPN on public Wi-Fi. CyberGhost VPN can provide additional security on unsecured networks by encrypting internet traffic. While iPhones do not have built-in malware scanners, they incorporate various protections to prevent malware from reaching the device. Signs of potential malware include overheating, rapid battery drain, unexpected data usage spikes, and unusual app behavior. Malicious apps can occasionally bypass App Store scrutiny, and users should take immediate action if they suspect an infection. Generally, iPhones are considered more secure than Android devices due to stricter app controls.

Tech Optimizer

November 17, 2025

EVALUSION Campaign Using ClickFix Technique to deploy Amatera Stealer and NetSupport RAT

In November 2025, a sophisticated malware campaign emerged, combining social engineering with advanced data theft tools. The attack begins with a tactic called ClickFix, where users are tricked into executing commands in the Windows Run window, leading to the installation of Amatera Stealer, which extracts sensitive information from browsers, cryptocurrency wallets, and password managers. Following this, attackers deploy NetSupport RAT for remote access to the compromised computer. Amatera Stealer employs advanced evasion techniques, including obfuscated PowerShell code and XOR encryption to mislead security efforts. It was originally marketed as ACR Stealer by a group named SheldIO. The infection process starts with a .NET-based downloader that retrieves payloads encrypted with RC2 from platforms like MediaFire. This downloader is packed with Agile.net, complicating analysis for cybersecurity teams. The malware disables AMSI by overwriting the "AmsiScanBuffer" string in memory, neutralizing Windows' security scanning. Amatera communicates with command servers through encrypted channels, using AES-256-CBC for traffic encryption, making inspection difficult. It aggregates stolen data into zip files and sends them to criminal servers, selectively executing additional payloads targeting high-value assets.

Winsage

September 26, 2025

LNK Malware Leverages Legit Windows Files to Slip Past Defenses

Threat actors from Israel have reintroduced the use of Windows shortcut (.LNK) files to deliver a Remote Access Trojan (RAT). Victims are lured to download a file named “cyber security.lnk” from a Discord channel, which opens a decoy PDF while executing a PowerShell script in the background. The script uses odbcconf.exe to register and execute a malicious DLL (Moq.dll) and its supporting libraries. The RAT can collect system metrics, capture screenshots, upload files via the Dropbox API, and execute commands from a command-and-control (C2) server. It ensures persistence by modifying a registry key to launch on user login. Mitigation strategies include monitoring the execution of legitimate binaries, enforcing application whitelisting, and educating users about the risks of downloading files from untrusted sources.

Tech Optimizer

September 25, 2025

LNK Malware Leverages Windows Binaries to Evade Security Tools and Run Malicious Code

Cybersecurity researchers have identified a malware campaign utilizing Windows shortcut (.LNK) files distributed via Discord to deploy a Remote Access Trojan (RAT). The malicious file, named “cyber security.lnk,” lures users with a fake job offer PDF while executing PowerShell commands in the background. It displays a decoy document titled “Cyber Security.pdf” to distract victims during the infection process. The malware exploits the legitimate Windows utility odbcconf.exe to execute a malicious DLL named Moq.dll without triggering security alerts. A PowerShell script extracts a ZIP file containing the payload and runs it using the command: odbcconf.exe /a {regsvr "C:UsersPublicNugetmoq.dll"}. This approach bypasses standard security measures by utilizing trusted binaries. Moq.dll employs advanced evasion techniques, including modifying the AmsiScanBuffer function to disable the Anti-Malware Scan Interface (AMSI) and altering the EtwEventWrite function in ntdll.dll to prevent monitoring through event logs. The malware ensures persistence by modifying the Windows registry to run with explorer.exe at user login and communicates with its command and control server at hotchickenfly.info. The RAT can capture screenshots, gather system information, and exfiltrate data via Dropbox’s API, using AES encryption for its communications. This threat was first observed in Israel and highlights the trend of malware authors leveraging legitimate Windows tools to evade detection. Security researchers from K7 Labs have identified the malware and recommend application whitelisting and monitoring of LOLBin usage as countermeasures. Indicators of Compromise (IOCs) include specific hash values associated with the Trojan.

Winsage

August 12, 2025

You should deep clean your Windows PC every year to keep it running smoothly — here’s how I do it

Maintaining a computer's performance requires regular software upkeep in addition to physical care. An annual deep clean is advisable, with more frequent maintenance being beneficial. 1. Uninstall unused applications using the built-in Settings app or a tool like BCUninstaller, which can bulk uninstall and identify leftover files. 2. Run debloat scripts, such as Chris Titus Tech's Windows Utility, to remove bloatware and manage privacy settings. 3. Disable unnecessary startup apps through the Task Manager to optimize boot times. 4. Check for driver updates manually under Advanced options > Optional updates, and visit manufacturer websites for graphics drivers. 5. Run a malware scan using MalwareBytes for periodic checks. 6. Delete temporary files via System > Storage > Temporary files in the Settings app, and manage cached files in web browsers.

Tech Optimizer

April 15, 2025

Steps to Scan Your Computer for Free and Check for Viruses and Malware

Windows Security, previously known as Windows Defender, is a built-in security tool in Windows 10 and 11 that provides comprehensive protection against viruses and malware without requiring additional software. Users can perform manual scans, including Quick, Full, and Custom scans, to identify and eliminate threats. To run a scan, users must open Windows Security, navigate to "Virus & threat protection," and select the desired scan option. Windows Security also includes features such as real-time protection, firewall and network protection, app and browser control, device security, and account protection. It is essential to keep Windows Security updated with the latest virus definitions for optimal protection. Users can also schedule automatic scans for regular checks.

Tech Optimizer

March 7, 2025

Webroot Premium

PCMag editors independently select and review products. Webroot Premium combines device-level protection with identity theft tracking and remediation, but its antivirus protection is limited compared to competitors. Webroot Premium costs .99 per year for five devices and one identity, with a family edition available for .99 covering ten devices and identities. Other competitors like Bitdefender Ultimate Security and Norton 360 With LifeLock offer more comprehensive features at similar price points. Webroot AntiVirus has been rebranded as Webroot Essentials, and older versions have been phased out. The installation process for Webroot Premium is straightforward, and it includes a firewall that monitors network activity. Webroot's antivirus effectively identifies malware, achieving a 100% detection rate in tests. It also offers a secure deletion tool and basic identity protection features, including credit monitoring, transaction monitoring, and dark web monitoring, though these features are less comprehensive than those of competitors. Webroot provides 24/7 support for identity restoration, with a monetary guarantee for remediation services up to million for ten family members. Overall, while Webroot Premium offers solid antivirus protection, its identity protection capabilities are limited compared to other security suites.

Winsage

February 23, 2025

How to Clear Cache on Windows 11 to Free Up System Resources

A cluttered computer desktop can lead to a decline in performance, indicating the need for system cleanup. Regular maintenance enhances speed, storage space, and overall functionality. Windows has built-in tools for optimization, starting with ensuring the latest updates are installed. Windows 11 features "Cleanup Recommendations" to identify large files and unused applications for deletion. The Disk Cleanup utility can remove unnecessary files like temporary internet files and system cache files, recovering disk space and improving speed. Clearing the location cache and flushing the DNS cache can also enhance performance. Additional maintenance tips include regularly emptying the Recycle Bin, organizing files, uninstalling unused applications, using external storage for large files, and running malware scans.

Tech Optimizer

February 11, 2025

Essential tips to protect your computer from malware

Malware includes various types of malicious software such as viruses, worms, Trojans, ransomware, and spyware. Email attachments and links are common methods for malware distribution, with cybercriminals often disguising malicious files as legitimate communications. Regular software updates are essential for protecting against security vulnerabilities. Pirated software frequently contains malware and poses risks to computer security. Installing antivirus and antimalware software is crucial for defense against attacks, with recommendations for programs like Windows Defender and Malwarebytes. Encrypting sensitive data can prevent unauthorized access, and maintaining cloud backups is vital for data recovery in case of ransomware attacks. Using a Virtual Private Network (VPN) is recommended when accessing the internet on public networks to protect personal information. Users should monitor their devices for suspicious activity, such as system slowdowns or unexpected pop-ups, and conduct malware scans if symptoms arise.