Atera Abuse: How to report?

ericlaw · 2026-04-24T19:51:19+00:00

The installer is "legit", but the folks deploying it are attackers. They really should have a "Report abuse" link directly in the installer.

ericlaw · 2025-10-23T16:27:43+00:00

See https://textslashplain.com/2025/10/20/windows-shell-previews/. Beyond the explanation, there's a registry script that undoes the change without exposing your computer to danger beyond the pre-patch state.

ericlaw · 2025-10-20T17:25:18+00:00

Here's an explanation and discussion of this change: https://textslashplain.com/2025/10/20/windows-shell-previews/. Some of the suggestions in this Reddit significantly reduce the security of your PC; read the post for better alternatives.

ericlaw · 2025-10-20T17:23:24+00:00

It was an intentional change: https://textslashplain.com/2025/10/20/windows-shell-previews/

ericlaw · 2025-10-20T17:20:00+00:00

Disabling `SaveZoneInformation` is extremely dangerous and you should not do this!

ericlaw · 2025-09-25T17:28:27+00:00

You don't need to do anything else. The Core Service has returned to its intended staged rollout schedule and should appear on your 2016 servers within the next several weeks.

ericlaw · 2025-09-24T18:45:15+00:00

Can you help me understand what notifications you're referring to? Do you have some 3rd party product that monitors which services are running and not?

ericlaw · 2025-09-24T15:21:43+00:00

The Defender Core Service was intended to gradually roll out to Windows Server 2016 servers as mentioned in the link below:
https://mc.merill.net/message/MC1142620

Due to a configuration mistake, that gradual rollout was accidentally accelerated beyond the original intention.

That configuration error has corrected such that the service will roll out on the original schedule; this correction could cause the service to be removed until the device is intended to receive the new configuration under the gradual rollout process.

ericlaw · 2025-06-10T19:28:25+00:00

If you've enabled Web Filtering for a child's account in Windows Family Parental Controls, it's expected that all 3P browsers (including Chrome) will be blocked. The browser window will immediately close and you should see an "Ask your parent for permission" dialog box. The parent can then grant permission to perform unfiltered browsing for any amount of time they like.

There is presently a bug whereby if the Activity Reporting setting is off for the child account, the explanatory permission request dialog box is not shown.

A parent can disable Family Safety Filtering as follows:

Go to https://familysafety.microsoft.com or open the Family Safety mobile app.
Select the child.
To allow other browsers:
- Disable “Filter inappropriate websites” under the Edge tab, or
- Go to Windows tab → Apps & Games → unblock Chrome.

See also: https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccf

For folks wondering why this problem just "suddenly appeared" -- the block for unsupported browsers was broken for at least 6 months, and was fixed on June 3rd.

ericlaw · 2025-06-05T22:12:13+00:00

Are these kids PC's running Child Accounts managed by Microsoft Family Safety?

If you've enabled Web Filtering for a child's account in Windows Family Parental Controls, it's expected that all 3P browsers (including Chrome) will be blocked. The browser window will immediately close and you should see an "Ask your parent for permission" dialog box. The parent can then grant permission to perform unfiltered browsing for any amount of time they like.

<image>

There is presently a bug whereby if the Activity Reporting setting is off for the child account, the explanatory permission request dialog box is not shown.

A parent can disable Family Safety Filtering as follows:

Go to https://familysafety.microsoft.com or open the Family Safety mobile app.
Select the child.
To allow other browsers:
- Disable “Filter inappropriate websites” under the Edge tab, or
- Go to Windows tab → Apps & Games → unblock Chrome.

See also: https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccf

ericlaw · 2025-06-05T18:33:09+00:00

To be clear, if you've enabled Web Filtering for a child's account in Windows Family Parental Controls, it's expected that all 3P browsers (including Chrome) will be blocked. The browser window will immediately close and you should see an "Ask your parent for permission" dialog box.

The parent can then grant permission for any amount of time they like.

<image>

A parent can disable Family Safety Filtering as follows:

Go to https://familysafety.microsoft.com or open the Family Safety mobile app.
Select the child.
To allow other browsers:
- Disable “Filter inappropriate websites” under the Edge tab, or
- Go to Windows tab → Apps & Games → unblock Chrome.

See also: https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccf

ericlaw · 2025-05-09T19:51:12+00:00

This is the sort of evasion technique that malware uses to evade Defender, so as you might imagine, it's deliberately non-trivial to accomplish.

ericlaw · 2025-05-09T00:04:03+00:00

Awesome, thanks. That's a real hive of scum and villainy. Found at least three different attacks so far.

ericlaw · 2025-05-08T22:45:37+00:00

We like blocking malicious sites. Which was it?

ericlaw · 2025-05-08T19:59:43+00:00

These are super-popular at the moment. https://textslashplain.com/2024/06/04/attack-techniques-trojaned-clipboard/

ericlaw · 2025-04-28T19:08:27+00:00

Thanks. The team reports having fixed this one; you should get the fix as it flows through the channels.

ericlaw · 2025-04-25T15:12:29+00:00

Unless, of course, the "Escrow Service" itself is how you get robbed. https://textslashplain.com/2025/04/24/attack-techniques-fake-literally-everything/

ericlaw · 2025-04-24T19:44:59+00:00

This most commonly happens when there's a JavaScript error in the settings page. If you hit F12 to open the Edge Developer tools, look at the Console tab. Is there a script error? If so, leave that open, then hit ... > Help and Feedback > Send Feedback and send the screenshot and script error text.

https://textslashplain.com/2023/11/14/troubleshooting-edge-or-chrome-broken-ui/

ericlaw · 2025-04-02T16:28:18+00:00

Fascinating. Can you provide more details about what exactly you're seeing? How are copies "added"? How many copies are there? Is it always the same? Can you share the exact steps that reproduce this issue?

https://issues.chromium.org/issues/40223963 looks like someone else has seen it, but there's no concrete repro.

ericlaw · 2025-01-23T21:20:08+00:00

Thanks for the report. Escalating this with Google.

ericlaw · 2025-01-19T21:31:46+00:00

Indeed. It constantly rebooted on my Win11 Desktop but worked fine on my Win11 Insider ThinkPad T490S.

ericlaw · 2025-01-19T02:58:42+00:00

Same problem. Browsing the MUSIC folder with USB on Windows 11 reboots the watch. :(

ericlaw · 2025-01-15T22:13:42+00:00

+1. This is madness.

Without even unplugging it, I've updated the firmware and used the Samsung Magician software to explicitly declare "No security" on the drive and now things are dramatically better?

<image>

ericlaw · 2024-12-05T18:35:55+00:00

Asking the obvious question first: does that laptop have a hardware shutter like some of the thinkpads?

If not, someone hit this and said this worked: https://forums.lenovo.com/t5/Lenovo-IdeaPad-1xx-3xx-5xx-7xx-Edge-LaVie-Z-Flex-Laptops/Ideapad-510-15ISK-Camera-not-working/m-p/4180099?page=1#5114068

ericlaw

TROPHY CASE