Internet disconnected when VPN is connected

There are times when you see a message in Windows Defender saying, “The Threat Services has stopped, Restart it now” when you try to use it. This kind of error is usually fixed by simply clicking on the Restart now button. However, if the error still appears even after you restart your computer and you see another message that says, “Unexpected error, Sorry, we ran into a problem”, then continue reading as this post will guide you in resolving this issue in Windows Defender. Before you proceed with the given fixes below, you have to create a System Restore point first. This way, you can always undo any changes you’ve made in case something goes wrong.

Option 1 – Make sure that the Windows Defender Services are started

The Windows Defender Advanced Threat Protection service is the one that protects your computer from advanced threats by monitoring and reporting security events that happen on your computer. This is why you have to make sure that this, as well as other required services in Windows Defender, are set to their default values and are started. To do so, follow these steps:

• In the Cortana search box, type “services” and click on the Services icon to open the Services Manager. Alternatively, you can also tap the Win + R keys to launch the Run prompt and then type “services.msc” in the field and hit Enter to open the Services Manager
• After opening the Services Manager, look for the following services and make sure that their Startup type is set to their default values:
  • Windows Defender Advanced Threat Protection Service – Manual
  • Windows Defender Antivirus Network Inspection Service – Manual
  • Windows Defender Antivirus Service – Manual
  • Windows Defender Firewall Service – Automatic
• You can right-click on each one of the listed services and then select Start to start them.
• And if some of the services don’t have their default values, just double-click on the Services to change the Startup types and select the correct option from the drop-down menu of the Startup type under the Properties box.
• Next, set up the Startup type of these services to Automatic and then click on the Start button if the services are not running yet.
• Now click on the Apply and OK buttons to save the changes made and then see if it fixed the problem or not.

Option 2 – Try modifying some entries in the Windows Registry

If the first option didn’t work in fixing the problem, you can try to alter some entries in the Windows Registry using the Registry Editor.

• First, tap Win + R keys to open the Run dialog box.
• Then type “Regedit” in the field and hit Enter to open the Registry Editor.
• Next, navigate to this registry path: HKLMSoftwarePoliciesMicrosoftWindows Defender
• From there, look for the “DisabledAntivirus” and “DisableAntiSpyware” DWORDS from the right pane and change each one of their values to “0”. On the other hand, if you don’t see any of these DWORDS, you can create them instead and give each one of them a 0 value.
• To create a DWORD, simply right-click on any empty space and select New > DWORD. Then name them both as “DisabledAntivirus” and “DisableAntiSpyware”.
• Afterward, set the value of the newly-created DWORDS to 0.
• Now exit the Registry Editor and reboot your PC to apply the changes made and then check if it has fixed the error in Windows Defender or not.

If a program tried and failed to use the Graphics rendering capabilities of a computer, Windows 10 will most likely throw a Blue Screen error that says, “ THREAD_STUCK_IN_DEVICE_DRIVER ”. 0x000000EA is the Stop code for this particular Blue Screen error and could be caused by a bad display driver or bad video card. Whatever the cause is, here are some suggestions you need to check out to resolve this Blue Screen error.

Option 1 – Try to rollback, update, or disable the Graphics card drivers

Since the THREAD_STUCK_IN_DEVICE_DRIVER Blue Screen error has something to do with Graphics card drivers, you can either roll back, update or disable them depending on your preference in order to resolve the error.

• First, boot your computer into Safe Mode.
• After that, tap the Win + R keys to launch Run.
• Type in devmgmt.msc into the box and tap Enter or click OK to open the Device Manager.
• After that, a list of device drivers will be displayed. From there, look for the Display Adapters and click on them.
• After that, right-click on each entry under the Display Adapters and select the “Uninstall Device” option from the menu.
• Now restart your computer.
• After restarting your computer, go to the Settings app and Check for Updates in the Windows Update section.

Note: You also have the option to go directly to the website of your graphics card manufacturers like NVIDIA, Intel, or AMD and go to the section called Drivers then check if there’s a new available update – if there is, download and install it.

Option 2 – Try removing hardware or drivers that you’ve installed recently

If you have recently installed some hardware or drivers, you might want to disable or remove them since external devices are proven to be one of the factors that trigger Blue Screen errors like THREAD_STUCK_IN_DEVICE_DRIVER. All you have to do is physically disconnect any external devices that are connected to your computer and then check if it fixes the BSOD error or not.

Option 3 – Run System File Checker at boot time

• Once you get to the Welcome Screen part, click on Next.
• Afterward, click on the Repair your computer option located on the bottom-left part of the window.
• Then click on Troubleshoot.
• Next, select the Advanced Options and then Command Prompt.
• After opening Command Prompt, type the “sfc /scannow” command and hit Enter to run the System File Checker scan.
• Wait until the process is completed and type “exit” to close Command Prompt and then restart your computer to successfully apply the changes made.

Option 4 – Try to run the Blue Screen Troubleshooter

As you know, the Blue Screen troubleshooter is a built-in tool in Windows 10 that helps users in fixing BSOD errors like the THREAD_STUCK_IN_DEVICE_DRIVER error. It can be found in the Settings Troubleshooters page. To use it, refer to these steps:

• Tap the Win + I keys to open the Settings panel.
• Then go to Update & Security > Troubleshoot.
• After that, look for the option called “Blue Screen” on your right-hand side and then click the “Run the troubleshooter” button to run the Blue Screen Troubleshooter and then follow the next on-screen options. Note that you might have to boot your PC into Safe Mode.

Option 5 – Try to manually check the Graphics Card hardware

You might also want to check the physical status of your Graphics card and you can do this by disconnecting the Graphics card or any other external device connected to your computer. Once you’ve removed the external device, check it for any damages. If there’s none, connect it back to your computer and check if the THREAD_STUCK_IN_DEVICE_DRIVER Blue Screen error is fixed or not.

Option 6 – Uninstall any faulty drivers

You can also uninstall any faulty drivers via Device Manager. How? Refer to these steps:

• Tap the Win + R keys to launch the Run dialog box.
• Then type “devmgmt.msc” in the field and tap Enter to open the Device Manager.
• From there, look for any faulty drivers. You can identify them easily as they will be marked with a yellow exclamation point. And then check which entries would not affect the normal functioning of your PC.
• Now click on the entries of every faulty driver and click on the Uninstall option.
• Once you’ve uninstalled them, restart your computer to allow your computer to reinstall the faulty drivers you’ve just removed.

Error 0x80070003 - What is it?

Error 0x80070003 is a type of Windows file backup and restore error code. This error occurs when you copy files or try to create backup and restore files and folders by using Windows Backup and Restore. This error stops you from using browse for files or folders. It hampers your ability to browse and restore files in the File Restore Wizard on your PC.

Solution

Error Causes

Error 0x80070003 may occur due to numerous reasons such as:

• Registry files are corrupted and damaged
• Missing directories
• Boot sector corrupted
• Outdated drivers
• Faulty software installation
• Malware infection
• Improper maintenance and incomplete installation

Further Information and Manual Repair

Here are some manual and easy do-it-yourself methods that you can try at home and resolve the issue on your own and save hundreds of dollars that you would be otherwise spending to hire a professional for the job.

Method 1 - Use Search Functionality in the File Restore Wizard to restore files

To work out and resolve error 0x80070003 on your system simply use the search functionality in the File Restore Wizard to locate and restore the files. This can be done by going to the start menu and then click on search. Now enter the keywords in the search for box and then click search again. Click to select the files that you want to restore from the list and then click OK. This will help you restore the files and resolve the issue.

Method 2 - Recreate the Missing Directory

If the re-parse point is deleted, then you will have to recreate the missing directory. The deletion of the re-parse point can be identified if the error code is displayed in this format ‘Filename: C:\Myfolder\11111.txt, Error: the system cannot find the path specified (0x80070003)’. To resolve, simply follow the path that is pointed out in the error and create the corresponding folder. Create the folder Myfolder in Drive C. Then try the restore operation again. Now click to clear the Restore the files to their original subfolders check box and then run the File Restore Wizard. This is most likely going to resolve the issue.

Method 3 - Scan for Viruses

Sometimes error 0x80070003 may occur due to malware. This stops you from creating file backup and restore files. If this is the cause then simply download and run an antivirus to remove malware programs on your PC.

Method 4 - Clean and Repair the Corrupted Registry

Error 0x80070003 can be triggered due to registry corruption. If this is the cause then simply download Restoro. This is a user-friendly and powerful multi-functional PC Fixer integrated with a registry cleaner. The registry cleaner scans for all registry-related errors, wipe out all unnecessary and junk files, and also cleans and repairs the damaged registry in seconds. Click here to download Restoro and resolve error 0x80070003 today!

Error Fmod.dll - What is it?

This is a type of DLL error code. DLL is the abbreviation of Dynamic Link Library. DLL files contain small programs which are similar to executable files. One DLL file may be used to load and run several programs. Fmod.dll is created by Electronic Arts Inc. and associated with Crysis. This file is developed for the Windows OS. This error code occurs when you are unable to access, run and load programs supported by Crysis on your PC. Fmod.dll error code message is displayed in different formats such as:

• "Fmod_event.dll not found."
• "The file fmod_event.dll is missing."
• "This application failed to start because fmod_event.dll was not found. Re-installing the application may fix this problem."
• "Cannot start Crysis. A required component is missing: fmod_event.dll. Please install Crysis again."
• "Fmod_event.dll Access Violation."
• "Cannot register fmod_event.dll."
• "Cannot find C:\Windows\System32\fmod_event.dll."

Error Fmod.dll may pop up when you start-up or shut down the PC or even during the installation of a program.

Solution

Error Causes

Narrowing down to one cause for Fmod.dll error code is impossible virtually because this error may result due to different reasons on your system. Some of the common causes associated with this error code are:

• Viral Infection
• Hardware failure
• Missing, Corrupt, or Deleted Fmod.dll file
• Improper program installation
• Registry issues

No matter what the underlying cause of the reason may be, it is recommended to resolve the issue immediately to avoid serious PC threats.

Further Information and Manual Repair

To resolve this error on your system, try the methods discussed below:

Method 1 - Check the Recycle Bin

As mentioned above, Fmod.dll is a DLL file that is used to run and load a variety of programs on your system. There is a possibility that you uninstalled a program that was supported by the Fmod.dll file and accidentally deleted it. In such a scenario, the easiest way to resolve the Fmod.dll error code is to re-install the deleted file from the recycle bin. For this, go to the recycle bin and search for the file. If you find it reinstall if you can’t then simply download the Fmod.dll file from a reliable website.

Method 2 - Scan for Malware

Malware usually enters through phishing emails and downloads. These malicious programs then hide in your system disguising as either DLL or EXE files. The occurrence of fmod.dll file error may be due to malicious programs hiding in your system. Therefore scan your entire PC with a powerful anti-virus. An antivirus detects and removes all malicious software programs such as viruses, malware, Trojans, spyware, and adware. Try this, to resolve error code Fmod.dll and see the results.

Method 3 - Fix Hardware Problems

Fmod.dll file error may also pop on your screen due to hardware failure. If this is the reason, then we advise you to use the Device Manager an in-built tool in Windows 7 and 8 to fix hardware failures. For this go to the start menu then control panel. Now click on the ‘hardware and sound link’ and then click on the Device Manager. If you find any devices in red exclamation point, then this means this device is problematic. Uninstall the driver for that hardware device and then update the driver. Install the latest version to resolve. Remember, hardware problems are mostly related to outdated drivers.

Method 4 - Restore Points

Use System Restore, an in-built utility also known as the recovery tool, to restore points and ensure your PC is back to its previous working condition before the error code occurred. Simply put, it helps undo recent changes. You can find the System Restore tool in the System Tools folder.

Method 5 - Clean and Repair the Registry

The registry is that part of your PC that stores all the information, activities performed, and files including the junk files, invalid keys, bad entries, and cookies. When these files accumulate on your PC, they take up all the registry space and corrupt the important system and DLL files also stored in the registry, thereby generating such errors. Now you can clean the registry manually. But this process can be time-consuming and slightly technical, hence we advise you to download Restoro. This is a PC Fixer integrated with a registry cleaner. It is easy to use deployed with an intuitive interface. The registry cleaner scans the entire PC and removes all registry errors. It wipes out all the obsolete files and repairs the damaged DLL and system files. Click here to download Restoro.

One of the most common ways cybercriminals use to inject suspicious code into devices is by tricking users into installing a malicious program on a targeted device. Oblivious users are vulnerable to such tricks, which is why Microsoft has been working hard in the background to address this issue. Recently, Microsoft announced the availability of a sandboxed version of Windows 10 that runs inside Windows 10 in order to isolate suspected software to run inside it and protect the system from potential threats. This Windows Sandbox feature is a new feature that keeps your computer secure. It is a virtual disposable environment that you can enable. So if suspect any software of being malicious, you can run this software in an environment and ensure that it won’t interfere with any normal processes and would not jeopardize files on your computer. To simply put it, “Windows Sandbox is a new lightweight desktop environment tailored for safely running applications in isolation”. So if the Sandbox is closed, all the residual files, software, and other data are deleted permanently. To enable Windows Sandbox, refer to the instructions provided below. Step 1: You have to make sure that you are running either Windows 10 Enterprise Editions or Windows 10 Pro and that your computer is running build 18305 or newer. Step 2: After that, you have to enable Virtualization to let another instance of Windows 10 running in Sandbox mode. Step 3: Next, search for Windows Features on and off in the search box and then select the appropriate entry. Step 4: From the list, go to the mini window and check the Windows Sandbox and then click on OK. Step 5: Afterwards, in the Cortana Search box, search for “Windows Sandbox” and select the related entry to run it in an elevated window. Step 6: Then from your main computer (host), copy the executable file and paste it inside the Windows Sandbox environment. Step 7: Now run the executable file in the Sandbox environment and use it as you normally do. Step 8: Once you’re done, close the Windows Sandbox application and as mentioned, every data regarding the executable file and the temporary environment will be deleted. Step 9: And for the sake of safety, ensure that there are no modifications made to the host because of the executions in the Sandbox environment. You have the option to contact Microsoft for feedback related to Windows Sandbox. You can use the traditional Feedback Hub if you have any suggestions or any issues. Just fill in the appropriate details and select Windows Sandbox for the feature category under the Security and Privacy section. And if you have any issues related to the execution of and within Windows Sandbox, simply choose “Recreate my problem” then select Start capture to reproduce the issue, and once you’re done, select Stop capture.

Hello and welcome everyone. In today's article, you will learn how to lock folder and content in it. Please be aware of few things:

1. The method is shown here works, but you need to be careful and follow step by step or you will damage your files permanently,
2. If you forget your password, you can not access your files anymore
3. Your files altho protected can still show up in recent files of some applications

All of that being said, let us start with locking the local folder on the computer with the password. Go to the folder where you have files that you would like to hide and lock with a password. Enter the folder and create the new text file inside it. Skip the name for now and go inside it. Copy and paste the following code inside the file:

---

cls @ECHO OFF title Folder Locker if EXIST "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" goto UNLOCK if NOT EXIST Locker goto MDLOCKER :CONFIRM echo Are you sure u want to Lock the folder(Y/N) set/p "cho=>" if %cho%==Y goto LOCK if %cho%==y goto LOCK if %cho%==n goto END if %cho%==N goto END echo Invalid choice. goto CONFIRM :LOCK ren Locker "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" attrib +h +s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" echo Folder locked goto End :UNLOCK echo Enter password to Unlock folder set/p "pass=>" if NOT %pass%==Your-Password-Here goto FAIL attrib -h -s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" ren "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" Locker echo Folder Unlocked successfully goto End :FAIL echo Invalid password goto end :MDLOCKER md Locker echo Locker created successfully goto End :End

---

Now locate this line of code in the document: if NOT %pass%==Your-Password-Here goto FAIL and replace Your-Password-Here with your password. !!! Write down somewhere your password, if you lose it you will lock the folder even for you !!! Save the file as FolderLocker.bat and double-click on it to execute it. If everything was done correctly, a new folder with the name: Locker Move files that you want to hide and protect inside that folder. Double click again on FolderLocker.bat The command prompt will appear with the question do you want to lock the folder, press Y, and press ENTER. The command prompt will close and the Locker folder will disappear. In order to unhide and access the folder, you will need to double click on FolderLocker.bat again but this time command prompt with ENTER your password will appear. Type in your chosen password and the folder is back. If you wish to hide and lock it again just double click on FolderLocker.bat again, confirm with Y and it is hidden again.

Recently, several users reported an issue on their Windows 10 computers where the taskbar is not visible when they tried to connect to a computer via Remote Desktop Protocol or RDP. The Remote Desktop Connection feature uses the RDP which allows users to access a computer remotely. This is actually different from the taskbar being hidden automatically until the pointer hovers on it since, in this scenario, the taskbar is completely not accessible which makes using the remote computer entirely difficult, if not impossible. There are several suggestions you can check out to resolve this problem, you can try to restart the process of Windows Explorer via Task Manager or you could clear the cache for multiple processes. You could also try to reinstall the Shell Experience components or show the local taskbar in the Remote desktop. Moreover, you could also try to update, uninstall or roll back the display driver/graphics card driver. For more details, refer to each one of the options given below.

Option 1 – Try to restart the Windows Explorer process

The first option you have to try to fix the problem with the taskbar is to simply restart the Windows Explorer process in the Task Manager.

• Tap the Ctrl + Shift + Esc keys to open the Task Manager.
• Next, go to the Processes tab and find the process of Windows Explorer.
• Once you find it, right-click on it and select Restart to restart its process.
• After that, restart your computer and see if you can now see the Taskbar.

Option 2 – Try clearing the cache of multiple processes

The next thing you can do to resolve the problem is to clear the cache of many processes in your computer. To do so, follow these steps:

• Open the Notepad app and paste the following content in the text area:

@echo off taskkill /f /im explorer.exe taskkill /f /im shellexperiencehost.exe timeout /t 3 /NOBREAK > nul del %localappdata%PackagesMicrosoft.Windows.ShellExperienceHost_cw5n1h2txyewyTempState* /q timeout /t 2 /NOBREAK > nul start explorer @echo on

• After that, tap the Ctrl + S keys to save the changes you’ve made in Notepad and select the “All files” as its file type, and then name it “CacheClearTWC.bat”.
• Next, go to the location where you saved the file using File Explorer and then run it. This will run a couple of batch scripts which will clear the cache of multiple processes in the system.
• Tap the Win + X keys and select the “Windows PowerShell (Admin)” option to open PowerShell as admin.
• Next, execute this command in the command line: Get-appxpackage -all *shellexperience* -packagetype bundle |% {add-appxpackage -register -disabledevelopmentmode ($_.installlocation + “appxmetadataappxbundlemanifest.xml”)}
• After the command has been executed, this will reinstall the Shell Experience components and should fix the problem with the taskbar.

Option 4 – Update, uninstall or rollback the Graphics card drivers

• First, boot your computer into Safe Mode.
• After that, tap the Win + R keys to launch Run.
• Type in MSC into the box and tap Enter or click OK to open the Device Manager.
• After that, a list of device drivers will be displayed. From there, look for the Display Adapters and click on them.
• After that, right-click on each entry under the Display Adapters and select the “Uninstall Device” option from the menu.
• Now restart your computer.
• After restarting your computer, go to the Settings app and Check for Updates in the Windows Update section.

Note: You also have the option to go directly to the website of your graphics card manufacturers like NVIDIA, Intel, or AMD and go to the section called Drivers then check if there’s a new available update – if there is, download and install it.

Error Code 7 - What is it?

This is a typical system error that occurs during Windows setup. To be precise, this error may pop on your computer screen during the text mode portion of Windows setup. The setup hangs and stops responding and the error message is displayed in either one of the following formats:

‘The file I386Ntkrnlmp.exe could not be loaded. The error code is 7.’ or ‘The file I386L_intl.nlf could not be loaded. The error code is 7.’

Solution

Error Causes

Error 7 may be triggered due to several reasons but the 2 most common causes for this error code are:

• Incorrect settings of the BIOS
• Faulty RAM modules
• Registry corruption

Further Information and Manual Repair

To resolve this error on your system, here are some easy and effective DIY methods that you can try.

Method 1 - Change Back the BIOS to its Default Settings

If the underlying cause of error code 7 is related to incorrect BIOS settings, then it is recommended to restore default settings to resolve. You can reset your computer’s BIOS (basic input and output system) settings to factory defaults by selecting the restore defaults option within BIOS or by removing CMOS ( Complementary Metal Oxide Semi-Conductor) battery from your unplugged computer for about five minutes. The battery removal method requires opening the computer case, so only attempt it if you are unable to access BIOS. To reset BIOS follow these steps, reboot your PC and then press the key assigned to loading BIOS during your computer boot splash screen. The key assigned to load and access BIOS varies from manufacturer to manufacturer but usually, it's F1, F2, or F12. Once you enter the BIOS, select the ‘Restore Defaults’ option listed in the menu.  I t may be a keyboard shortcut or be under the Advanced settings menu. Confirm settings and then exit BIOS. Hopefully, this will resolve Error 7.

Method 2 - Remove the Faulty RAM

When error code 7 is triggered by faulty RAM modules, then to resolve it simply remove the memory modules that are installed in the computer. If the error code is displayed again after you remove the memory module, remove a different memory module. This procedure requires you to reboot your PC several times to identify the specific memory module that is not working properly.

Method 3 - Repair the Corrupted Registry

Error code 7 is sometimes also linked with registry issues. If the reason for the error occurrence is a damaged or corrupted registry, then simply download Restoro. This is a powerful PC Fixer embedded with a registry cleaner. It is easy to operate and user-friendly. The registry cleaner detects and removes all errors in seconds. It cleans the registry and repairs the damages in no time. Click here to download Restoro.

In this post, you will be guided on how you can turn on or turn off the Tailored Experiences feature in Windows 10 using three methods – via Settings, Registry Editor, and Group Policy Editor. The Tailored Experiences feature in Windows 10 helps Microsoft in delivering recommendations about Microsoft Products. The diagnostic data that comes with it allows Microsoft to know about its consumers’ experiences as well as collect feedback. To simply put it, tailored experiences are personalized tips, ads, and recommendations that enhance Microsoft products and services for consumer needs. And when you enable this feature, Windows will collect information from your browser, apps, features, and many more. After collecting information, it will offer contents that are tailored based on the data gathered on the lock screen of your computer, Windows tips, and other related functions. On the other hand, the diagnostic data is the one that allows Microsoft to get feedback from the customer. So if you’ve noticed some prompts when you use Windows that ask you about the experience, that’s actually a part of the diagnostic data. A lot of users find this feature useful. However, there are also skeptical ones that don’t share the same sentiments. If you are one of the skeptical ones, you actually have the option to turn this feature off if you do not want Microsoft to show ads, recommendations, and so on. It is also recommended that you enable the Diagnostic Data collection as you can choose to delete any collected data, as well as control the feedback frequency from Automatic to Once a day, or once a week, or to never. As mentioned, there are three methods you can choose from to either turn on or turn off Tailored Experiences. You can do it via Settings, Registry Editor, and the Group Policy Editor. To get started, follow the options provided below.

Option 1 – via Settings

To turn on or off Tailored Experiences using Settings, refer to these steps:

• Go to Settings and here, click on Privacy.
• Next, go to Diagnostic and Feedback.
• From there, toggle off the control under the Tailored experiences option to turn it off or toggle it on, if you want to turn it on.

Option 2 – via Registry Editor

To turn on or off Tailored Experiences via Registry Editor, follow the steps below.

• Tap the Win + R keys to open the Run dialog box and type “Regedit” in the field and then tap Enter to open the Registry Editor.
• Next, navigate to this registry path: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPrivacy
• After that, look for the DWORD named “TailoredExperiencesWithDiagnosticDataEnabled” and change its value to 0 if you want to turn it off or 1 if you want to turn it on.

Option 3 – via Group Policy Editor

To turn on or off Tailored Experiences using the Group Policy Editor, here’s what you have to do:

• Tap the Win + R keys to open the Run prompt and type “gpedit.msc” in the field and hit Enter to open the Group Policy Editor.
• Next, navigate to this policy setting: User ConfigurationAdminstrative TemplatesWindows ComponentsCloud Content
• Here, double click on the “Do not use diagnostic data for tailored experiences” option and select Enabled. Once you do that, you will see the following description:

“This policy setting lets you prevent Windows from using diagnostic data to provide tailored experiences to the user. If you enable this policy setting, Windows will not use diagnostic data from this device (this data may include browser, app, and feature usage, depending on the “diagnostic data” setting value) to customize the content shown on the lock screen, Windows tips, Microsoft consumer features, and other related features. If these features are enabled, users will still see recommendations, tips, and offers, but they may be less relevant. If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user’s needs and make it work better for them. This setting does not control Cortana tailored experiences, since there are separate policies to configure it.”

New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated. The spyware can only be installed as a 'System Update' app available via third-party Android app stores as it was never available on Google's Play Store. This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place. The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities. However, when it comes to stealing your data, this remote access trojan (RAT) can collect and exfiltrate an extensive array of information to its command-and-control server. Zimperium researchers who spotted it observed it while "stealing data, messages, images and taking control of Android phones."

What happens when malicious software is installed

"Once in control, hackers can record audio and phone calls, take photos, review browser history, access WhatsApp messages, and more," they added. Zimperium said its extensive range of data theft capabilities includes:

• Stealing instant messenger messages;
• Stealing instant messenger database files (if the root is available);
• Inspecting the default browser's bookmarks and searches;
• Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser;
• Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx);
• Inspecting the clipboard data;
• Inspecting the content of the notifications;
• Recording audio;
• Recording phone calls;
• Periodically take pictures (either through the front or back cameras);
• Listing of the installed applications;
• Stealing images and videos;
• Monitoring the GPS location;
• Stealing SMS messages;
• Stealing phone contacts;
• Stealing call logs;
• Exfiltrating device information (e.g., installed applications, device name, storage stats).

How does it work?

Once installed on an Android device, the malware will send several pieces of info to its Firebase command-and-control (C2) server, including storage stats, the internet connection type, and the presence of various apps such as WhatsApp. The spyware harvests data directly if it has root access or will use Accessibility Services after tricking the victims into enabling the feature on the compromised device. It will also scan the external storage for any stored or cached data, harvest it, and deliver it to the C2 servers when the user connects to a Wi-Fi network. Unlike other malware designed to steal data, this one will get triggered using Android's contentObserver and Broadcast receivers only when some conditions are met, like the addition of a new contact, new text messages, or new apps being installed. "Commands received through the Firebase messaging service initiate actions such as recording of audio from the microphone and exfiltration of data such as SMS messages," Zimperium said. "The Firebase communication is only used to issue the commands, and a dedicated C&C server is used to collect the stolen data by using a POST request."

Camouflage

The malware will also display fake "Searching for the update.." system update notifications when it receives new commands from its masters to camouflage its malicious activity. The spyware also conceals its presence on infected Android devices by hiding the icon from the drawer/menu. To further evade detection, it will only steal thumbnails of videos and images it finds, thus reducing the victims' bandwidth consumption to avoid drawing their attention to the background data exfiltration activity. Unlike other malware that harvests data in bulk, this one will also make sure that it exfiltrates only the most recent data, collecting location data created and photos taken within the last few minutes. If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.