deletion Archives

AppWizard

October 16, 2026

Malware Found Pre-Installed In Thousands Of Budget Android Phones – Here’s What We Know

A report from Bitdefender reveals a malware campaign named "Midnight Mimosa" affecting budget and midrange Android smartphones, particularly those using low-energy MediaTek chipsets. This malware, embedded in devices marketed under various labels like Cubot and Doogee, operates through an application called "System" (package name com.android.system.lite) that displays hidden ads and can allow hackers to control the devices. Thousands of devices have been tracked with this malware, with 13% of affected devices located in Mexico, 8% in the United States, and less than 3% in Canada. The malware's source traces back to Android ODM Shenzhen Zediel. Additionally, Bitdefender identified 13 other ad fraud-related apps signed by the same entity that were previously available on the Google Play Store. Major manufacturers like Google, Motorola, and Samsung have security protocols to protect their firmware, unlike the affected budget brands.

Tech Optimizer

October 16, 2026

Switch Antivirus Software: 13 Steps, Zero Gaps [2026]

ESET rebranded its home security lineup in 2026, introducing ESET HOME Security Essential and Premium, and updated its NOD32 engine to version 19.2 on August 27, 2026. IPVanish launched a next-generation antivirus product on October 7, 2026, built on the VIPRE engine and integrated into its VPN application. Many Australians are reconsidering their antivirus solutions due to discrepancies between their current software and available offerings, with 84 percent of users making no changes in the previous year. Financial factors influence decisions, with 54 percent of third-party antivirus users opting for paid versions. ESET's new features include a Website Security Inspector and a Microphone Monitor, while IPVanish's antivirus received an Advanced+ rating from AV-Comparatives. The comparison of antivirus options highlights that the best choice depends on individual needs, with ESET's Ultimate tier offering ransomware backup. A comprehensive 13-step process is outlined for safely transitioning between antivirus solutions, emphasizing the importance of proper uninstallation and installation procedures to avoid conflicts and maintain protection.

Winsage

October 11, 2026

Microsoft is giving Windows 11’s legacy UI dark mode instead of killing it, now in Hyper-V

Windows 11 is introducing dark mode support for various applications and features, including file-operation dialogs and the Hyper-V Manager tool. Recent updates have applied dark mode to several key dialogs within Hyper-V Manager, such as the New Virtual Machine, Export Virtual Machine, Import Virtual Machine, New Virtual Hard Disk, Edit Virtual Hard Disk, and the virtual machine settings page. The Virtual Switch Manager and Virtual SAN Manager also now support dark mode. These features are currently available in Windows Server and Windows 11 preview builds but are not yet in the production channel. Hyper-V Manager allows users to choose between light and dark themes, although switching requires a restart of the application. Microsoft plans to extend dark mode to more legacy areas of Windows and is working on rebuilding certain dialogs using WinUI, with dark mode support already appearing in preview builds for various components.

Tech Optimizer

October 10, 2026

30-year Microsoft veteran explains why you shouldn’t run two antivirus apps on Windows 11

Raymond Chen, a Microsoft veteran, advises against installing multiple antivirus solutions on the same system due to conflicts that arise, such as each program attempting to quarantine the other's processes. This can lead to significant performance issues and erratic behavior in Windows. Microsoft has stated that Windows Defender is sufficient for most users, highlighting its comprehensive security features in Windows 11. The company warns that running multiple real-time antivirus programs can increase resource consumption and conflict likelihood. Independent testing has shown that Microsoft Defender ranks highly among antivirus solutions.

Winsage

October 3, 2026

Windows 11 Spotted Keeping Thumbnails of Deleted Photos

Windows 11 uses a thumbnail caching mechanism to store previews of images in specific databases located in %LocalAppData%MicrosoftWindowsExplorer, such as thumbcache32.db and thumbcache1024.db. When a user deletes an image, the corresponding thumbnail may remain in the cache, as deletion does not automatically remove it from the thumbnail database. The cache retains only reduced versions of images, not the original files, which is significant in digital forensics where thumbnails can provide insights even when original files are missing. Users can manage their thumbnail cache using the cleanmgr tool to clear saved thumbnails or disable thumbnail caching through the Local Group Policy Editor or File Explorer settings.

AppWizard

September 30, 2026

Google Photos could soon give you a fresh start with Ask Photos

Google Photos is introducing a “Delete all” button in its Remember List feature, allowing users to remove all previously shared entries at once. This feature, found in the top-right corner of the Remember List interface, will include a confirmation prompt before data is permanently erased. Currently, users can only delete individual entries. Additionally, a “Regenerate Image” option is being developed for the AI wardrobe tool. The introduction of these features aims to enhance user control and experience.

Winsage

September 28, 2026

Windows 11 can keep thumbnails of photos you deleted. Here’s how to remove them

Windows retains thumbnails in a cache file named thumbcache_256.db, but it does not save a thumbnail of every deleted photo. Other operating systems, including macOS and Linux, also use thumbnail caching. Users can access their thumbnail cache by navigating to %LOCALAPPDATA%MicrosoftWindowsExplorer, but this will not show deleted images. Thumbnails are created only when images are displayed in Explorer’s thumbnail view. Windows allows users to clear the thumbnail cache using the Disk Cleanup tool, and there is an option to disable thumbnail caching in Windows 11 Pro and higher. The cached thumbnails do not guarantee persistence and do not represent original files. Windows also keeps records of application launches in Prefetch, maintains entries for USB devices in the USBSTOR registry key, saves Wi-Fi networks and passwords, and can keep clipboard history and recent file shortcuts.

Winsage

September 28, 2026

Windows 11 can keep thumbnails of photos you deleted. Here’s how to remove them

A recent post on X claims that Windows retains a thumbnail of every deleted photo in a file named thumbcache_256.db, which has raised privacy concerns among users. While Windows does maintain a thumbnail cache for efficiency, this practice is not unique to Windows, as other operating systems like macOS, Linux, and Android also use similar systems. Users can inspect or clear their thumbnail cache by accessing specific database files in the Windows Explorer directory. The claim that Windows retains "every photo you’ve ever deleted" is misleading, as thumbnails are only created when images are viewed in thumbnail mode. Windows does not cache every file, and thumbnails must exist before they can be cached. Additionally, Windows keeps app launch records in Prefetch files for performance optimization, maintains entries for USB devices in the USBSTOR registry key, retains records of Wi-Fi networks and passwords (which are encrypted), and can keep clipboard history and recent file shortcuts. Caching previews is common across various operating systems, and Microsoft is focused on user consent and privacy as it enhances Windows 11 with AI functionalities.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

Winsage

September 24, 2026

How to Use Point-in-Time Restore in Windows 11

The Point-in-Time Restore feature in Windows 11 allows users to revert their system to a previous state, but it may result in the loss of recently created files. This feature captures the system's state, including Windows system files, installed applications, and local settings. Restore points are generated automatically every 24 hours, but users can create them manually. However, restoring can erase new documents, recently installed applications, and any settings changes made since the last restore point. Files stored in OneDrive remain unaffected. To verify Point-in-Time Restore settings, users must access the Settings application, select System, and then Recovery. Restore points are retained for up to 72 hours and may be deleted sooner if storage is limited. Windows 11 version 26H2 enables this feature by default for devices with an OS volume of at least 200 GB. Before restoring, users should back up recent work to an external drive. To initiate the restore, access the Windows Recovery Environment, select Troubleshoot, and then Point-in-Time Restore. If files are lost after a restore, 4DDiG Data Recovery Software can help recover deleted files. It scans local drives for files deleted during a rollback or accidental deletion. A robust recovery plan should include using Point-in-Time Restore, OneDrive for daily file protection, and separate backups before significant system changes.