Product

Windows Update

0 mentions in 7 days · 3 in 30 days · 3 total · first seen Sep 2, 2026 · last 8d ago

Timeline3 articles

Bill Gates tries to install MovieMaker (2003)

A newly surfaced 2003 internal email shows Bill Gates criticizing Microsoft.com's download flow, Windows Update, and overall Windows usability.

The January 15, 2003 email from Bill Gates to Jim Allchin details his failed attempts to install Movie Maker, citing repeated timeouts, a confusing download page, and a 17 MB Windows Update download with forced reboot. Gates called the experience a 'systematic degradation' of Windows usability and trashed the cluttered add/remove programs list. The newsletter publishes internal tech industry emails that have surfaced in public records.

Hacker News · AISep 7, 15:27 UTC · 8d agoOther HN 406↑ · 277 comments

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker NewsSep 6, 08:34 UTC · 9d agoMalware in the wild

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.

Microsoft says an active campaign uses counterfeit vendor websites on .com.cn and .hl.cn infrastructure with Chinese-language lures to deliver server-side generated installers that establish scheduled-task persistence, add Defender exclusions, delete shadow copies, and stop services including wuauserv, UsoSvc, uhssvc and WaaSMedicSvc. Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, primarily China-based operations of multinationals and Chinese-speaking users. Microsoft assesses with moderate confidence the activity matches the Silver Fox (Yinhu) cluster, historically tied to Gh0st RAT and ValleyRAT, with C2 over non-standard ports like 5090 and 7088-7090 via domains iualef[.]net and oijfwe[.]net. Kaspersky separately detailed a QN Wallpaper DLL-sideloading chain delivering ValleyRAT.

The Hacker NewsSep 2, 16:41 UTC · 13d agoMalware in the wild

Appears with

product Microsoft Defender 2 vendor Microsoft 2 threat actor Silver Fox 1 threat actor Yinhu 1 malware AuraStealer 1 malware ElevationKatz 1 malware Gh0st RAT 1 malware LockAppHost 1 malware Lumma Stealer 1 malware ProManager 1 malware REVSTEALER 1 malware Silver Fox trojan 1 malware SoftManager 1 malware ValleyRAT 1 malware VoidStealer 1 malware WinUpdate 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.