scheduled tasks Archives

Tech Optimizer

July 26, 2026

How to Stop McAfee from Running on Windows

McAfee offers features such as file scanning, network traffic filtering, VPN services, and browser warnings to protect users. Users can pause Real-Time Scanning by opening the McAfee app, selecting Real-Time Scanning under My Protection Widgets, and turning it off. To disable the Advanced Firewall, users must access the Advanced Firewall section in the app and turn it off. Scheduled scans can be stopped by navigating to Scheduled Scans in the app and clicking Turn off. To prevent Secure VPN from reconnecting, users can toggle it off in the Home tab and set Auto Connect to Never connect automatically. Browser protection features can be managed by toggling off McAfee WebAdvisor in Chrome, Edge, and Firefox. Users can block fake McAfee popups by adjusting notification settings in their browsers. To prevent McAfee startup helpers from opening, users can manage startup settings in Windows. To completely remove McAfee, users should uninstall it through Settings or Control Panel and follow the prompts. If remnants remain, the MCPR tool can be used for complete removal. Microsoft Defender will reactivate automatically after McAfee is uninstalled.

Winsage

July 25, 2026

It’s impossible to recommend paid Windows cleanup utilities when Windows Sysinternals does everything for free

Many utility suites for Windows maintenance require a yearly subscription but often only aggregate basic tools. Users can achieve similar results without costs, as Windows manages routine maintenance effectively. Microsoft's Sysinternals suite offers advanced tools like Autoruns, which provides a comprehensive view of startup entries, and Process Explorer, which offers detailed process monitoring. SDelete securely deletes files beyond recovery, while RAMMap provides insights into memory usage without the risks of third-party applications. Although Sysinternals tools may lack polished interfaces, they deliver substantial functionality for users willing to learn how to use them.

Winsage

July 25, 2026

It’s impossible to recommend paid Windows cleanup utilities when Windows Sysinternals does everything for free

Windows utility suites often charge a yearly subscription fee but frequently provide only basic functionalities like startup managers and process monitors. Many features can be accessed for free through Windows' built-in capabilities. Microsoft's Sysinternals suite offers powerful alternatives, such as Autoruns, which provides a comprehensive view of all startup locations, including registry keys and scheduled tasks. Process Explorer offers detailed insights into running processes, surpassing the standard Task Manager by displaying process trees and resource usage. SDelete securely deletes files by overwriting data multiple times, making recovery nearly impossible. While Sysinternals tools are powerful, they require a learning curve and deeper engagement compared to the polished interfaces of paid utilities. Sysinternals emphasizes functionality over marketing, proving that free tools can deliver exceptional performance without compromising quality.

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

Winsage

July 8, 2026

Trojanized LetsVPN installer gives attackers remote access to Windows PCs

A malware campaign has been discovered that exploits the VPN service LetsVPN. Researchers from ThreatLocker found a malicious Windows installer that pretends to be the legitimate LetsVPN application while deploying a remote access trojan (RAT) called GoodPersonRAT. The malware allows attackers to control infected systems using stealth techniques. The malicious installer first deploys the RAT and then installs the authentic LetsVPN application, creating an illusion of legitimacy. The package identified as Kuailian_win-setup.86.msi contains the legitimate LetsVPN installer, a loader, and an encrypted payload. GoodPersonRAT features include remote desktop control, file upload/download, command execution, proxying, keylogging, and clipboard monitoring. It specifically targets Telegram Desktop users by archiving critical account information and altering proxy settings. The malware ensures persistence through Windows services and scheduled tasks and can undermine security software. The LetsVPN installer is legitimate and signed, but the MSI package is unsigned and contains malicious components. Users are advised to download software only from official sources and verify digital signatures.

Winsage

June 19, 2026

Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2

Microsoft has identified a Windows-based cryptocurrency clipper campaign that has been active since February 2026. This campaign uses clipboard-intercepting malware with self-spreading capabilities and operates through the Tor network. The clipper malware employs Windows Script Host and ActiveX to launch a Tor proxy and connect to a hidden command-and-control server. It focuses on stealing clipboard data, particularly cryptocurrency wallet addresses, and can exfiltrate screenshots. The malware is distributed via malicious Windows Shortcut (LNK) files on USB drives, which activate a worm that checks for existing infections and fetches the payload from a remote server. The clipper monitors the clipboard every 500 milliseconds for sensitive information and can replace copied wallet addresses with those controlled by attackers. Microsoft recommends behavioral detections, disabling AutoRun for removable media, blocking LNK execution from drives, and monitoring clipboard-related activities as mitigations against this threat.

Winsage

June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.

Tech Optimizer

June 8, 2026

What Is OneLaunch.exe? Pros, Cons, and How to Remove It

OneLaunch is a software application that creates a personalized dock and desktop environment on Windows computers, often pre-installed or bundled with other software. It has received mixed reviews, with concerns about system slowdowns and its legitimacy. OneLaunch.exe is a background process supporting the OneLaunch application, which provides quick access to applications and updates but can consume system resources. The OneLaunch browser, installed alongside the main application, can alter browser settings and redirect searches, potentially leading to unwanted advertisements. While OneLaunch is not classified as traditional malware, it is often categorized as a Potentially Unwanted Program (PUP) due to its bundled installation and ability to modify system settings. It can monitor browsing habits and share data with third-party advertisers. Users report intrusive behavior, such as altering default browser settings, and it can negatively impact system performance. To remove OneLaunch, users should end the running process, uninstall the application, delete leftover folders, remove startup entries, and reset browser settings. OneLaunch may reappear due to accidental reinstallations, active browser extensions, lingering scheduled tasks, or hidden companion programs. Preventative measures include downloading from official sources, reading installation screens carefully, keeping systems updated, and performing regular system checks.

Winsage

June 2, 2026

PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems

PHANTOMPULSE is a remote access trojan (RAT) used as a final payload in multi-stage attacks targeting Windows environments. It employs advanced post-exploitation techniques, including process injection, User Account Control (UAC) bypass, and a decentralized blockchain-based command-and-control (C2) mechanism. The malware utilizes three process injection techniques: module stomping, manual DLL mapping, and debug-driven execution. It avoids detection by using direct system calls instead of standard Windows APIs and incorporates a hardware breakpoint mechanism to disable security protections like AMSI and ETW. PHANTOMPULSE retrieves its C2 server address from Ethereum-based transaction data but has a vulnerability that allows defenders to hijack communication. It achieves persistence through scheduled tasks and supports self-healing capabilities. Privilege escalation is done using the "schuac" UAC bypass technique. The malware conducts system reconnaissance focusing on cryptocurrency wallets and messaging apps but does not directly steal credentials. It shows signs of AI-assisted development and shares tactics with DPRK-aligned threat groups, particularly in targeting cryptocurrency platforms.