PC Manager Archives

Winsage

June 22, 2026

I tested Microsoft PC Manager’s RAM-freeing tool and learned why high memory usage isn’t always a problem

Users of Windows 11 often report high RAM usage, with figures reaching 70-90 percent, leading to concerns about system performance and the need for memory upgrades. Microsoft has introduced the PC Manager application with a "Boost" option to help free up memory. High memory usage can be normal when Windows 11 caches files, but excessive consumption by poorly optimized applications may indicate a resource issue. The impact of memory usage varies by system; for example, 90 percent usage may be acceptable on a system with 96GB of RAM, while it could be problematic on an 8GB system. Context matters, as high memory usage on high-end machines often represents normal caching, whereas it may signal struggles on lower-end systems. The PC Manager's Boost feature can be useful before resource-intensive tasks but may reinforce misconceptions about high memory usage being inherently negative. Ultimately, performance issues, rather than memory percentage alone, should guide decisions about upgrading RAM.

Winsage

June 19, 2026

I tried Microsoft’s region-locked PC Manager and now I wish everyone could use it

Microsoft PC Manager is a free application for Windows 11 that optimizes system performance by consolidating various tools and options into a cohesive interface. It has been in development for over two years and is set for general release in 2024, but it remains limited to a select audience and is not officially available in all regions. Users have found workarounds to access the app despite these regional restrictions.

Winsage

April 24, 2026

Stop installing these 4 apps—Windows does it all now

Windows has evolved to integrate functionalities that were once reliant on third-party applications, such as native support for ZIP files introduced in Windows ME in 2000, and the ability to open and create RAR, TAR, and 7z formats directly from File Explorer. Features like Storage Sense have replaced the need for tools like CCleaner by allowing users to manage temporary files more easily, and the effectiveness of Windows Defender has reduced the necessity for third-party antivirus solutions. Additionally, modern Windows can mount ISO files directly, eliminating the need for applications like Daemon Tools. The trend of operating systems adopting features from third-party applications, known as "Sherlocking," reflects a response to user demands while still allowing for optional third-party solutions.

Winsage

April 1, 2026

Windows might be hiding some of your PC’s storage by default – here’s how to reclaim it

Windows' Reserved Storage feature allocates 5GB to 10GB of SSD space for system files, updates, and temporary data, impacting the usable storage capacity. Users can clear cache and utilize Windows PC Manager to free up space. To disable Reserved Storage, navigate to Settings > System > Storage > System & Reserved, and use the command: DISM.exe /Online /Set-ReservedStorageState /State:Disabled. For SSDs of 512GB or more, the impact is minimal, but for smaller SSDs, reclaiming this space can be beneficial. It is recommended to re-enable Reserved Storage before system updates using the command: DISM.exe /Online /Set-ReservedStorageState /State:Enabled. A minimum SSD capacity of 512GB is advised for a seamless experience, and upgrading or using external storage solutions is suggested for enhanced capacity. Caution is advised with budget SSDs due to potential reliability issues.

Winsage

January 7, 2026

5 Apps That Can Breathe New Life Into Your Old Windows PC

Windows PCs can become slow due to digital clutter from uninstalled applications, unused registry entries, and background processes. This software bloat can often be optimized using lightweight, free tools instead of upgrading hardware. Microsoft PC Manager is a user-friendly utility that enhances performance by clearing temporary files and freeing up RAM, featuring sections for System Protection, Storage Management, and App Management. The Everything app provides rapid file search results by reading the Master File Table, conserving system resources and allowing customization of search preferences. Chris Titus Tech's Windows Utility is a powerful debloater tool that can remove telemetry and bloatware, with options for tweaking system settings to improve performance, though caution is advised to avoid instability. The Thorium Browser is a lightweight alternative to resource-intensive browsers, built on the Chromium framework, providing speed and efficiency while maintaining compatibility with older hardware. Bulk Crap Uninstaller offers a thorough uninstallation process, removing all traces of software and allowing for bulk uninstalls, with features like color-coded categorization and the option to create restore points.

Tech Optimizer

November 17, 2025

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The threat actor Dragon Breath, also known as APT-Q-27 and Golden Eye, has been observed using a multi-stage loader called RONINGLOADER to deploy a modified variant of the remote access trojan Gh0st RAT, primarily targeting Chinese-speaking users. The campaign employs trojanized NSIS installers disguised as legitimate applications, such as Google Chrome and Microsoft Teams. The infection chain utilizes various evasion techniques, including a legitimately signed driver, custom Windows Defender Application Control policies, and manipulation of the Microsoft Defender binary. RONINGLOADER's attack chain involves delivering a DLL and an encrypted file labeled "tp.png," which contains shellcode. It attempts to neutralize security products by terminating processes associated with popular antivirus solutions in the region. Specific actions are taken against Qihoo 360 Total Security, including blocking network communication, injecting shellcode into the Volume Shadow Copy service, and restoring firewall settings. For other security processes, RONINGLOADER directly writes a driver to disk to perform process termination. The malware aims to inject a rogue DLL into "regsvr32.exe" to conceal its activities and launch a next-stage payload into high-privilege system processes. The final payload is a modified version of Gh0st RAT, capable of communicating with a remote server, configuring Windows Registry keys, clearing Windows Event logs, and capturing keystrokes and clipboard contents. Additionally, two interconnected malware campaigns identified by Palo Alto Networks Unit 42 employed brand impersonation to deliver Gh0st RAT to Chinese-speaking users. The first campaign, Campaign Trio, occurred between February and March 2025, while the second, Campaign Chorus, detected in May 2025, impersonated over 40 applications. Both campaigns utilized complex infection chains and trojanized installers hosted on domains that circumvented network filters. The second campaign also involved an embedded Visual Basic Script for launching the final payload through DLL side-loading.

Tech Optimizer

November 15, 2025

RONINGLOADER Weaponizes Signed Drivers to Disable Defender and Evade EDR Tools

A new malware called RONINGLOADER specifically targets Chinese users and can disable security tools. It operates as a multi-stage loader that spreads a modified version of gh0st RAT and bypasses antivirus protections. RONINGLOADER infiltrates systems through fake software installers that mimic legitimate applications like Google Chrome and Microsoft Teams. Once inside, it disables Windows Defender and Chinese security solutions such as Qihoo 360 Total Security and Huorong. The malware uses a signed driver that appears legitimate to Windows but is designed to terminate security processes. If one method of disabling security fails, RONINGLOADER has multiple fallback strategies. The Dragon Breath APT group is behind this campaign, having refined their techniques based on previous operations. The infection begins with a trojanized NSIS installer that drops components onto the victim's system. One installer deploys genuine software, while the other initiates the attack chain. RONINGLOADER creates a directory at C:Program FilesSnieoatwtregoable and deposits two files: Snieoatwtregoable.dll and an encrypted file named tp.png. The DLL decrypts tp.png using XOR encryption and a rotation operation, then loads new system libraries to eliminate security hooks. It elevates privileges using the runas command and scans for active security software, specifically targeting Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, and Qihoo 360 Total Security. To terminate these processes, it uses a signed driver named ollama.sys, which is digitally signed by Kunming Wuqi E-commerce Co., Ltd. This driver can terminate processes using kernel-level APIs that standard security tools cannot intercept. Additionally, RONINGLOADER blocks network connections for Qihoo 360 before injecting code into the Volume Shadow Copy service process, utilizing Windows thread pools with file write triggers to evade detection.

Tech Optimizer

April 12, 2025

I abandoned third-party antivirus tools, and here’s what I do instead

The author has transitioned from using third-party antivirus solutions to relying on Windows Security, which is built into Windows 10 and 11, due to its effectiveness and lack of cost. They emphasize the importance of keeping Windows Security updated and performing regular virus scans for added peace of mind. Ransomware protection features, such as Controlled Folder Access, are highlighted as essential. The Microsoft PC Manager app is recommended for optimizing system performance and security. The author advocates for good security hygiene, including avoiding suspicious emails and enabling two-factor authentication, as effective practices to maintain security without third-party antivirus software.

Tech Optimizer

April 10, 2025

6 overlooked security practices I implemented at home and I regret not using sooner

- Safeguarding technology is crucial in the digital age due to potential threats from various devices. - Two-factor authentication (2FA) enhances online account security by requiring a second code sent to a phone, email, or authentication app. - Biometric verification methods and hardware authentication devices like YubiKeys can further enhance security. - Backup codes should be printed when setting up 2FA, and passkeys offer a passwordless solution for securing accounts. - Ransomware can lock users out of data until a ransom is paid, and Windows 10 and 11 have a feature called Controlled Folder Access (CFA) to protect essential folders. - Windows Security provides baseline protection for PCs, and users should regularly check for updates and conduct manual scans. - Microsoft's PC Manager utility enhances system security by offering features for storage and app management alongside virus scanning. - Securing web browsers is vital, with unique settings available in browsers like Microsoft Edge, Firefox, and Chrome to improve privacy and security. - Regularly clearing browsing history and keeping browsers updated helps mitigate risks from malware and phishing attacks. - Securing Wi-Fi routers involves changing the default admin password and SSID, using strong encryption like WPA3, and regularly updating firmware. - Custom firmware like DD-WRT or OpenWrt can enhance router security and functionality.

Winsage

March 10, 2025

4 things holding Microsoft PC Manager back from being a great app

Microsoft PC Manager includes a Deep cleanup feature that can slow down system performance by deleting Windows Prefetch files, which are intended to improve application loading times. The System protection feature focuses on restoring default settings rather than providing robust security options, which may not appeal to users who prefer customization. The PC Boost feature offers only temporary relief from memory usage, with results quickly reverting back to previous levels. Additionally, the app promotes Microsoft Edge, often ignoring users' default browser settings, which can be intrusive and detracts from its overall utility.