steps Archives

Winsage

September 6, 2026

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has identified four previously undocumented programs associated with REVSTEALER, a Windows information stealer that persists on infected machines after self-deletion. The programs are ProManager, WinUpdate, SoftManager, and LockAppHost, each with distinct functionalities. ProManager steals wallet files and logs passwords, WinUpdate monitors the clipboard for cryptocurrency addresses, SoftManager acts as a reverse proxy, and LockAppHost executes a cryptocurrency miner after disabling Windows Update and Microsoft Defender. REVSTEALER has been marketed as a commercial infostealer since February 2026, exfiltrating sensitive data such as browser passwords, cookies, and cryptocurrency wallet information. It deletes itself after reporting its activities but leaves the four programs installed for persistence. These programs share build tradecraft with REVSTEALER, including the use of identical packers and runtime function resolutions. REVSTEALER primarily spreads through game-cheat lures and disguises itself as pirated software. It employs evasion techniques to resist analysis, including checking for sandbox environments and using indirect system calls. Users are advised to avoid unofficial software and to follow specific steps if infected, such as re-enabling Windows Update services and changing passwords. Indicators of compromise include SHA-256 hashes for REVSTEALER and its associated programs, as well as domains linked to their command and control servers.

AppWizard

September 6, 2026

Google orders Android apps to cut RAM use amid memory crunch

Google has introduced new performance standards for applications on Google Play to improve user experience and device efficiency by reducing memory consumption. Key areas of focus include dynamic memory management, efficient bitmap data utilization, and DEX code optimization. These standards aim to prevent system slowdowns and forced app closures due to insufficient memory. Google will provide tools within the Play Console for developers to monitor memory issues and access analytics through Android Vitals. The new performance thresholds will take effect in February 2027, with non-compliant applications facing publication restrictions. Additionally, all applications with login systems must support a zero-tap sign-in feature for enhanced user convenience and security.

AppWizard

September 6, 2026

How to sideload apps onto Android Auto

Android Auto was designed for simplicity, but users want more functionality like streaming YouTube or screen mirroring. Sideloading allows users to install unapproved apps, unlocking additional features, though it poses risks to security, reliability, and safety. To sideload apps, users must enable Developer Mode on their phone and Android Auto, then install the Android Auto Apps Downloader (AAAD) and explore open-source apps like CarStream and AAMirror. Risks of sideloading include safety concerns with video streaming while driving and increased exposure to malware, as sideloaded apps bypass Google’s security checks. Google plans to introduce new verification requirements for developers starting in late 2026 to mitigate these risks. Most drivers find the standard Android Auto experience sufficient, and sideloading should be approached cautiously.

AppWizard

September 6, 2026

beautiful terrain with holes that wanna swallow me up in Minecraft Hardcore

Video-sharing platforms are implementing passive sign-in features to enhance user experience by minimizing barriers to access content. This initiative aims to reduce friction in the login process, allowing users to engage with content more readily, leading to increased viewership and improved user retention. Companies recognize that a smooth onboarding process is critical for maintaining a loyal user base in a competitive digital landscape.

AppWizard

September 6, 2026

Pterodactyl Multi-Game Cloud Server: 13 Steps [2026]

In 2026, hosting game servers has become more efficient, allowing multiple game servers to run on a single cloud VPS using Pterodactyl Panel, which utilizes Docker containers for isolation. Pterodactyl is a free, open-source game server management panel that gained popularity due to its user-friendly interface and robust architecture. The latest stable release, v1.12.0, was launched in January 2026, with newer deployment templates available as of August 2026. To set up Pterodactyl, prerequisites include a cloud VPS with specific CPU and RAM requirements, Ubuntu 24.04 LTS, PHP 8.3, MariaDB 11.8.8 or newer, Redis 8.10.0 or newer, Docker Engine, a registered domain for SSL, SteamCMD dependencies, and at least 80 GB SSD storage. The installation process involves provisioning the VPS, installing necessary software, configuring Pterodactyl, setting up Nginx with SSL, and deploying game servers. Common pitfalls include under-provisioning RAM for resource-intensive games, neglecting firewall settings, and allowing backup retention to grow uncontrollably. Troubleshooting may involve addressing PHP-FPM issues, connection problems, and ensuring proper resource allocation. Advanced scaling may require multiple VPS nodes, and security measures like two-factor authentication can help protect the server. Pterodactyl is free to use commercially and can run multiple game containers on a single node.

Winsage

September 6, 2026

I gave Windows 11 an old-school makeover by restoring its classic icons

Users can customize icons in Windows 11 by following different methods depending on the type of icon. For folders and shortcuts, right-clicking the item and selecting Properties allows users to change icons easily. Taskbar items require pressing Shift while right-clicking the closed app. Desktop icons like "This PC" and the Recycle Bin can be modified through Settings > Personalization > Themes > Desktop icon settings. More complex changes, such as altering icons for file types or drives, involve editing the Windows registry. Windows retains a selection of classic icons within DLL files, including moricons.dll, pifmgr.dll, and netshell.dll. Users can also access the Windows Icon Archive project for a repository of icons from various Windows versions, though .png files need conversion to .ico format for use. Limitations include the inability to change icons for new folders automatically, modifications not reflecting in Quick Access for special folders, and restrictions on altering application icons. Programs like OpenShell can help modify taskbar and Start menu icons, but achieving a perfect replica of older versions is not possible.

Tech Optimizer

September 5, 2026

Silver Fox uses adware to distribute ValleyRAT backdoor

The cyber threat group Silver Fox is distributing the ValleyRAT backdoor disguised as a legitimate signed Chinese adware application, specifically bundled with the QN Wallpaper tool. This malware allows attackers to gain comprehensive control over infected machines, enabling them to collect sensitive information, capture screenshots, and deploy additional malicious modules. The attack utilizes DLL sideloading, where a modified version of QN Wallpaper loads a malicious DLL from the same directory, circumventing signature-based security measures. The installer disables Windows Defender, adds itself to autorun entries, and uses the "runas" command to elevate privileges if the user lacks administrator rights. ValleyRAT also marks its process as critical, potentially causing a blue screen of death if terminated. Kaspersky has identified Silver Fox as the likely perpetrator of this campaign, known for similar techniques.

BetaBeacon

September 5, 2026

Google Play Games PC vs GameLoop vs Genymotion [2026]

Google Play Games for PC officially launched on September 23, 2025, after more than three years of testing.

Winsage

September 4, 2026

There are two kinds of Windows users—and one of them is unknowingly making the OS worse

There is a divide between casual Windows users and engaged enthusiasts, with passive users often accepting default settings that contribute to system bloat. Passive users enable telemetry and promotional content by not customizing their installations, while active users take steps to enhance privacy and performance. Microsoft interprets user inaction as approval for unwanted features, leading to an accumulation of bloatware and unnecessary updates. The Connected User Experiences and Telemetry service collects user data, justifying the inclusion of features like Copilot, which many users may not want. Users face challenges in maintaining control over their systems, often needing technical knowledge to opt out of unwanted features. Microsoft's feedback system is inadequate, interpreting silence as consent rather than a lack of interest, making it difficult for users to effect meaningful change.

Winsage

September 4, 2026

Microsoft says some users can’t open the Teams desktop client

Microsoft is addressing an issue (TM1466820) causing delays or preventing some users from accessing the Microsoft Teams desktop client on Windows systems, acknowledged on Thursday at 16:45 EDT. Affected users may experience loading failures or delays of up to two minutes and are advised to use the web or mobile versions of Teams as a temporary workaround. Microsoft is analyzing service logs and telemetry data to identify the root cause and has contacted some affected users for more information. Additionally, there is a separate issue (TM1466659) affecting Mac users, preventing them from joining Teams calls and meetings, confirmed on Sunday at 08:32 EDT. Microsoft is reassessing the cause of this disruption. Earlier this year, Microsoft resolved an issue blocking some Teams Free users from chats and calls. The company also confirmed a bug causing crashes and launch failures for Teams and New Outlook users after recent Windows security updates. Furthermore, there is an ongoing Exchange Online issue affecting multiple mailboxes, resulting in "Server busy" errors and delays in email communications with external domains.