Windows Startup Archives

Tech Optimizer

May 18, 2025

Defendnot tool pitched as ‘an even funnier way’ to disable Windows Defender

A new tool called Defendnot, developed by es3n1n, allows users to disable Windows Defender by using an undocumented Windows Security Center (WSC) API to simulate the presence of another antivirus program. This tool is a successor to the no-defender tool, which was taken down due to legal issues. Defendnot does not use third-party antivirus code and aims for a clean implementation. It disables Microsoft Defender upon activation, leaving users vulnerable to malware as it does not provide real-time scanning. Defendnot is designed to run automatically at Windows startup. Microsoft classifies Defendnot as a Trojan, raising concerns about its potential misuse by malicious actors.

Winsage

April 10, 2025

Amy Winehouse, Elton John, and ‘Hamilton’ Added to Library of Congress’ National Recording Registry

The Library of Congress added 25 new sound recordings to its National Recording Registry, including notable entries such as Amy Winehouse’s "Back to Black," Elton John’s "Goodbye Yellow Brick Road," and the original cast album of "Hamilton." Other significant recordings include Tracy Chapman’s self-titled 1988 LP, Miles Davis’ "Bitches Brew," and Mary J. Blige’s "My Life." Iconic tracks featured are “Fly Like an Eagle” by the Steve Miller Band, Celine Dion’s “My Heart Will Go On,” and Helen Reddy’s “I Am Woman.” The selections reflect a range of musical evolution and cultural milestones, with recordings dating from 1913 to 2015. Key additions include a radio broadcast of the 1960 World Series Game 7, Keith Jarrett’s "The Kӧln Concert," the "Minecraft: Volume Alpha" soundtrack, and Brian Eno’s Microsoft Windows startup chime. The recordings span various genres and highlight significant moments in American music history.

Winsage

March 30, 2025

Microsoft Office apps will soon preload on Windows boot for faster launch

Microsoft has introduced a feature called Startup Boost for its Office applications on Windows, aimed at reducing launch times. This feature preloads essential components of apps like Word, Excel, and PowerPoint into memory upon Windows startup, keeping them in a paused state until needed. Startup Boost requires a minimum of 8GB of RAM and 5GB of free disk space to function effectively and will disable itself in Energy Saver mode. Users can disable Startup Boost through Office settings, but it will be automatically reactivated with the next Office update. The rollout is expected to begin in mid-May, starting with Word, followed by other Office apps.

Winsage

March 28, 2025

Office is too slow, so Microsoft is making it load at Windows startup

Microsoft is introducing a feature called "Startup Boost" for its Office suite, allowing applications like Word and Excel to launch automatically upon booting Windows. This feature will only be enabled on devices with a minimum of 8GB of RAM and 5GB of available disk space. The rollout will begin in mid-May, starting with Microsoft Word, and users can disable the feature in Word’s settings or through the Task Scheduler.

Winsage

March 3, 2025

How to make Microsoft Windows services work for you

Windows services are essential for the functionality of the operating system, and while many can be deactivated, caution is advised. Daemon Master is a tool that allows users to configure executables, shortcuts, or batch files as services that start automatically with Windows. To create a service with Daemon Master, users must launch the application, click “New,” assign a service name and display name, and optionally add a description. The default start type is “Automatic,” and users can specify the path to the desired EXE file. After saving, the service will appear as “stopped” and can be started by right-clicking and selecting “Start service.” Services run in the background, but users can access the program window temporarily by selecting “Start service on desktop.” Services can be managed by starting, pausing, resuming, or stopping them, and unnecessary third-party services can be disabled through the system configuration. Troubleshooting can involve restarting specific services, like the Print Spooler for printing issues. To delete a service, users must identify its name, stop it using the command prompt, and then delete it with the sc.exe tool. Tools like Autoruns can also be used for managing services. While deactivating services may not improve performance, it can reduce security vulnerabilities, and programs like Ashampoo Winoptimizer can help users assess the necessity of installed services.

Tech Optimizer

February 28, 2025

Evolving Snake Keylogger Variant Targets Windows Users

Cybersecurity researchers at Fortinet have identified a new variant of the Snake Keylogger malware, which has blocked over 280 million infection attempts globally. This malware captures sensitive user information, including credentials and browser data, and has the highest infection rates in China, Turkey, Indonesia, Taiwan, and Spain. The Snake Keylogger operates in three phases: distribution through phishing emails, data collection by capturing keystrokes and extracting credentials from browsers, and data transmission to command-and-control servers via encrypted channels. It employs advanced evasion techniques, such as process hollowing and persistence mechanisms, to operate stealthily. The malware uses obfuscation tools like AutoIt scripting to evade antivirus defenses and specifically targets browser-stored credentials. Security experts recommend caution with emails, using updated antivirus software, and regular patching of systems to mitigate risks.

Winsage

February 19, 2025

This high-risk keylogger malware is a growing threat to Windows users

Recent reports indicate a surge in the activity of the Snake keylogger, also known as the 404 Keylogger, linked to over 280 million attack attempts since the start of the year. At its peak, it was responsible for as many as 14 million infection attempts in a single day. The malware can log keystrokes and extract personally identifiable information, including geolocation data, transmitting this data back to its command server through channels like SMTP, Telegram bots, and HTTP post requests. The Snake keylogger operates on the AutoIT framework, creating a copy of itself in the Windows Startup folder to ensure execution upon every system restart. It employs advanced obfuscation techniques to evade detection by antivirus software, hiding its malicious code within processes recognized as legitimate by the operating system. The keylogger primarily spreads through sophisticated phishing attacks.

Winsage

February 19, 2025

Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots

Cybersecurity experts at FortiGuard Labs have identified a new variant of the Snake Keylogger, known as AutoIt/Injector.GTY!tr, which targets Windows users and has blocked over 280 million infection attempts worldwide, particularly in China, Turkey, Indonesia, Taiwan, and Spain. The malware spreads primarily through phishing emails with malicious attachments or links and focuses on popular web browsers to steal sensitive information by logging keystrokes, capturing credentials, and monitoring clipboard activity. It exfiltrates data to its command-and-control server via email and Telegram bots. The malware uses AutoIt scripting to create standalone executables that evade antivirus detection. It installs itself by dropping "ageless.exe" in the %Local_AppData%supergroup folder and "ageless.vbs" in the %Startup% folder to ensure persistence. The malware employs process hollowing to inject its payload into a legitimate .NET process, allowing it to hide from detection. Additionally, the Snake Keylogger can retrieve the victim’s geolocation and extract sensitive information from browser autofill systems, including credit card details. It utilizes various techniques for data collection, credential access, defense evasion, and exfiltration, posing a significant threat to Windows users.

Winsage

February 19, 2025

New Snake Keylogger infects Windows using AutoIt freeware

A new variant of the Snake Keylogger is targeting Windows users in Asia and Europe, utilizing the AutoIt scripting language for deployment to evade detection. This malware, built on the Microsoft .NET framework, infiltrates systems through spam email attachments, logging keystrokes, capturing screenshots, and collecting clipboard data to steal sensitive information like usernames, passwords, and credit card details from browsers such as Chrome, Edge, and Firefox. The keylogger transmits stolen data to its command-and-control server using methods like SMTP email, Telegram bots, and HTTP POST requests. The executable file is an AutoIt-compiled binary that unpacks and executes the keylogger upon opening. The keylogger replicates itself in the %Local_AppData%supergroup directory as ageless[.]exe and places a file named ageless[.]vbs in the Startup folder to ensure it runs automatically on system reboot. This persistence mechanism allows continued access to the infected machine without requiring administrative privileges. Once activated, the keylogger injects its payload into a legitimate .NET process, specifically targeting RegSvcs.exe through process hollowing. It logs keystrokes using the SetWindowsHookEx API with a low-level keyboard hook, capturing sensitive information. Additionally, it retrieves the victim's public IP address by pinging hxxp://checkip[.]dyndns[.]org for geolocation purposes.

Winsage

February 19, 2025

Hidden Microsoft Windows Threat Attacks When Your PC Restarts

A significant alert has been issued for Microsoft Windows users regarding the Snake Keylogger, an advanced keylogger capable of extracting sensitive information from web browsers like Chrome, Edge, and Firefox. It logs keystrokes, captures credentials, and monitors clipboard activity. The malware has already infiltrated millions of PCs and activates upon system restart, disguising itself among benign Windows processes. Fortinet reports that the Snake Keylogger has been circulating since 2020, infiltrating systems through malicious Office documents or PDFs attached to emails. If opened with macros enabled or using vulnerable software, the malware executes. It employs AutoIt scripting to obfuscate its operations and sets its attributes to hidden to complicate detection. The keylogger places a file in the Windows Startup folder to ensure it launches automatically with each restart, maintaining access to the compromised system. Once installed, it checks its environment to capture specific security credentials through keystrokes, clipboard data, or browser autofill information, transmitting this data to its handlers. Fortinet has observed the Snake Keylogger in various countries, including China, Turkey, Indonesia, Taiwan, and Spain. Users are advised to keep security software updated and exercise caution with email attachments from untrusted sources.