system monitoring Archives

Tech Optimizer

June 1, 2026

Avast Free Antivirus for Windows: Features, Limits, and US Use

Avast Free Antivirus for Windows is a free malware protection software designed for American home users, operating under Gen Digital, which also includes Norton. It provides essential security features such as real-time scanning, on-demand scans, and regular updates, but has limitations compared to paid versions, including the absence of features like VPN and advanced ransomware protection. The software is intended for home PC use and is available for download on Windows PCs. While it serves as a basic defense against common malware threats, it is not suitable for small businesses needing comprehensive security solutions. Users are advised to maintain safe browsing habits even with the antivirus installed.

Winsage

May 11, 2026

Omnissa adds Windows Server management to Workspace ONE

Omnissa has integrated Windows Server management into its Workspace ONE Unified Endpoint Management (UEM) platform, allowing organizations to manage Windows Server alongside various endpoints from a single cloud-based system. This integration aims to address challenges faced by IT teams that rely on separate tools for server management, which can increase costs and complicate operations. The inclusion of Windows Server enables IT teams to apply policies, automate tasks, and maintain visibility across devices. Hemant Sahani, Vice President of Product Management at Omnissa, noted that this approach offers cost benefits compared to traditional solutions like Microsoft System Centre Configuration Manager, enhancing security and streamlining server lifecycle management. The new support includes over-the-air configuration management, allowing enforcement of security policies and automation of patching. Administrators will have access to remote inventory data and insights into system performance and security issues, leveraging AI and machine learning. The integration allows for the consolidation of management tools, reducing the number of consoles IT staff must navigate. CDW has endorsed this launch, highlighting its potential to simplify operations and improve security for customers. Omnissa currently serves 26,000 customers globally in various domains, including unified endpoint management and security compliance.

Winsage

November 19, 2025

Sysmon – Go-to Tool for IT Admins, Security Pros, and Threat Hunters Coming to Windows

Microsoft will integrate native System Monitor (Sysmon) functionality into Windows 11 and Windows Server 2025, enhancing security operations for IT teams. This integration will provide instant threat visibility, automate compliance through Windows Update, and include features such as process monitoring, network connection tracking, credential access detection, file system monitoring, process tampering detection, WMI persistence tracking, and custom configuration support. It will also offer official customer service support and allow seamless access to events through Windows Event Logs or Security Information and Event Management (SIEM) systems. Administrators can enable Sysmon using the command "sysmon -i." Future plans include expanding Sysmon’s capabilities with enterprise-scale management and AI-powered detection.

Winsage

November 18, 2025

Microsoft Finally Makes Sysmon Native To Windows

Sysmon is a system monitoring tool that traditionally requires users to download and install it from Microsoft's Sysinternals page, often leading to its deployment only after issues arise. Pre-installing Sysmon can enhance proactive monitoring and issue diagnosis. Its effectiveness can be improved through tailored configurations, with resources available from Bleeping Computer for specific use cases like monitoring DNS queries. Additionally, Sysmon can now be installed on Linux systems via the Windows Subsystem for Linux (WSL), increasing its accessibility and versatility for users familiar with Sysmon.

Winsage

November 17, 2025

Custom Windows Event Viewer log notifications upped my debugging game

Windows Task Scheduler can be configured to monitor system events and send notifications for anomalies, allowing users to proactively address issues before they escalate. Users can set up custom notifications by specifying Event IDs in the Task Scheduler. Common Event IDs for debugging include: - Application crash: Event ID 1000 (Application Error) - Application hang: Event ID 1002 (Application Hang) - Service failure: Event ID 7000 (Service Control Manager) - Service stopped: Event ID 7036 (Service Control Manager) - Disk/I/O issues: Event ID 129 (Disk or NTFS) - Group policy failure: Event ID 1058 (Microsoft-Windows-GroupPolicy) - Driver error: Event ID 7023 (Service Control Manager or Kernel-PnP) - Failed logon: Event ID 4625 (Microsoft-Windows-Security-Auditing) - User account locked out: Event ID 4740 (Microsoft-Windows-Security-Auditing) - Audit log cleared: Event ID 1102 (EventLog) - Unexpected system shutdown: Event ID 41 (Kernel-Power) To set up notifications, users can create a PowerShell script that performs specific actions based on the event type, such as sending an email for critical alerts or displaying on-screen messages for less critical events. This setup enables effective monitoring without the need for third-party applications.

Tech Optimizer

November 13, 2025

Hackers Using RMM Tools LogMeIn and PDQ Connect to Deploy Malware as Legitimate Software

Cybersecurity researchers at AhnLab Security Intelligence Center (ASEC) have discovered an attack campaign that uses legitimate Remote Monitoring and Management (RMM) tools, specifically LogMeIn Resolve and PDQ Connect, to deploy backdoor malware on users' systems. Attackers lure victims to fake download sites that mimic legitimate software pages for utilities like Notepad++, 7-Zip, and VLC Media Player, delivering modified versions of LogMeIn Resolve. The malicious installers are disguised with filenames such as "notepad++.exe" and "chatgpt.exe." Once executed, these files install the RMM tool and additional malware capable of stealing sensitive information. ASEC has identified three CompanyId values associated with the attacks: 8347338797131280000, 1995653637248070000, and 4586548334491120000. The malware, known as PatoRAT, is a Delphi-developed backdoor that gathers system information and has extensive malicious capabilities, including keylogging and remote desktop access. Users are advised to download software only from official websites and verify digital signatures, while organizations should monitor for unauthorized RMM installations and the identified indicators of compromise.

AppWizard

October 20, 2025

Massive AWS outage took down the internet for several hours impacting Reddit, Fortnite, and more

On October 20, a significant internet disruption occurred due to an outage at Amazon Web Services (AWS), affecting platforms like Reddit, Fortnite, Snapchat, Canva, and Apple TV, as well as global government services. The issues began around midnight ET, peaking at 3 AM ET, with over 13,000 users reporting disruptions between 4 AM and noon ET. The outage was caused by a flaw in an internal system monitoring network load balancers within AWS's EC2 network, leading to increased error rates and latency. This incident has raised concerns about the reliance on a single cloud provider for essential internet functions and prompted discussions on the need for multi-region or multi-cloud strategies. Elon Musk criticized AWS, emphasizing the importance of diversification in cloud service providers.

Tech Optimizer

September 20, 2025

Cyberattackers Leverage Trusted Drivers to Disable Antivirus Software and Bypass Security Protocols

A cyberattack on a Brazilian enterprise involved the use of legitimate, digitally signed drivers to disable antivirus solutions and deploy MedusaLocker ransomware. The attackers executed a Bring Your Own Vulnerable Driver (BYOVD) attack by exploiting the ThrottleStop.sys driver, which has a critical vulnerability (CVE-2025-7771) allowing unauthorized memory access. They compromised an SMTP server using valid RDP credentials, extracted user credentials with Mimikatz, and moved laterally across the network. The attackers uploaded and executed an AV killer program and a renamed version of the driver, terminating antivirus processes to facilitate ransomware deployment. The malware targeted major antivirus vendors and employed kernel-level commands to eliminate security processes. Recommendations for defense include multi-factor authentication, hardening RDP access, and implementing layered security measures.

Winsage

July 7, 2025

Oh dear – Microsoft Windows Firewall was found to be complaining about…Microsoft code?

Microsoft has acknowledged an issue with Windows Firewall following the June 2025 preview update of Windows 11 24H2 (KB5060829, OS Build 26100.4484). Users may encounter an error event labeled 'Config Read Failed' with the message 'More data is available' each time they restart their device. Microsoft assures that this does not indicate a malfunction within Windows Firewall and can be disregarded. The issue is linked to a feature under development, and no timeline for a fix has been provided. Additionally, there is another issue affecting the display of Chinese, Japanese, and Korean characters at 96 DPI in Chromium-based browsers, which Microsoft is working on with Google.