disable Archives

Tech Optimizer

September 23, 2026

BigDiskBuster PoC Blocks Windows Defender Updates

A new tool named BigDiskBuster has been released on GitHub, which disrupts Microsoft Defender Antivirus by preventing it from installing updates. It does this by consuming available disk space during the update process, causing Defender to remain on its current version and unable to receive new platform or signature updates. BigDiskBuster operates as a local denial-of-service technique and requires prior access to the target machine to execute. The tool was created by researcher Abdelhamid Naceri, known as Nightmare Eclipse, who has previously worked on similar projects. As of now, there is no CVE identifier, patch, or advisory from Microsoft regarding this issue.

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

Winsage

September 22, 2026

Windows has been so buggy I paused monthly updates, and now I wait for reports before installing anything

Users frequently express frustration with Windows updates due to unexpected restarts and frequent breakdowns, leading to a perception of being beta testers for Microsoft. Problems often arise with updates, including significant disruptions from routine maintenance updates. Recent issues included difficulties with the Windows Subsystem for Linux and copy-paste functionality in Microsoft Excel. In July, Microsoft paused an update due to unexpected shutdowns on some Dell PCs. Users are increasingly adopting a wait-and-see approach before installing updates, utilizing Windows 11's ability to pause updates for several weeks. Historically, Windows lacked robust update management, but recent changes have extended the pause period. There is a significant concern regarding the limited control users have over updates and the need for improved quality control from Microsoft.

Tech Optimizer

September 21, 2026

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

On September 17, researchers from LastPass and Delphos Labs discovered a counterfeit LastPass Authenticator installer on GitHub that installs a malicious Windows kernel driver designed to disable antivirus and steal passwords. The driver, named Alinubx.sys, was signed through Microsoft's hardware compatibility program and initially scored zero detections on VirusTotal. The fake installer is hosted on a fraudulent GitHub page that mimics a legitimate LastPass product page. When executed, the installer uses DLL side-loading to gain SYSTEM-level access and terminates security processes, allowing it to harvest saved passwords from various browsers and applications. The driver is a renamed variant of a known malicious driver, evading detection due to its new file hash. Delphos reported the driver to Microsoft, but it was not considered a security vulnerability. Users who executed the fake installer should treat their passwords and sensitive data as compromised and change them from a secure device. The malicious server has been linked to impersonation pages for multiple brands, and the loader was likely created using a specific crypter tool.

Winsage

September 21, 2026

7 Windows features I disabled after realizing nobody needs to use them

Windows 11 allows users to optimize their experience by disabling or uninstalling various features. 1. OneDrive: Users can unlink or uninstall OneDrive through File Explorer or the Settings app. 2. Copilot: Copilot can be uninstalled via the Settings app, and its keyboard shortcut can be customized. 3. Widgets: The Widgets board can be disabled or removed through the Settings app under Personalization. 4. Start Menu: Users can streamline the Start Menu by turning off pinned apps, recent items, and account notifications in the Settings app. 5. Phone Link: This feature can be minimized or uninstalled using the Settings app or Windows PowerShell. 6. Xbox Features: Xbox and Xbox Live can be uninstalled through the Settings app, and Game Mode can be toggled off. The Xbox Game Bar can be removed via PowerShell. 7. Search Results: To improve search efficiency, users can disable Bing and web results using Windows PowerShell.

Winsage

September 20, 2026

The hidden Windows feature quietly filling up your SSD—and how to rein it in

Microsoft introduced a feature called point-in-time restore in Windows 11, which creates snapshots of the system every 24 hours to enhance recovery options. This feature began rolling out in late June 2026 and is typically enabled by default for boot drives of 200GB or larger. It uses the Volume Shadow Copy Service to generate restore points that are available for 72 hours before being purged. The feature can consume significant storage space, initially occupying 3.9GB and potentially increasing to over 18GB within two months, reaching a maximum of 2% of the total disk space. Users can adjust the storage usage settings or disable the feature entirely to reclaim space. The default maximum usage can be modified to as low as 0.2%. There are concerns that this feature should have been opt-in rather than opt-out due to its storage implications.

Tech Optimizer

September 19, 2026

Windows 11’s Defender kept falsely saying your antivirus was off, and Microsoft just fixed it

For nearly two months, Windows 11 users received persistent notifications from the Windows Security app falsely indicating that Microsoft Defender was disabled, despite it functioning properly. This issue, which began in early August, has been addressed with a security update from Microsoft. The false alerts affected all versions of Windows 11, Windows Server, and Windows 10, and were linked to a bug introduced with a recent Defender security update. Microsoft confirmed that no manual action is required from users to resolve the issue, as the fix will be automatically deployed to all PCs with mandatory security updates enabled. The problem was resolved in the Microsoft Defender Antivirus update (version 4.18.26080.4), released on September 17, 2026. Users can verify the status of Defender by checking Windows Security or using a PowerShell command.

Winsage

September 19, 2026

Microsoft’s research boss reveals why Windows 11 features don’t show up, and his fix half works

Windows 11 has introduced new features such as a resizable Start menu, a movable taskbar, and the option to remove Bing from Windows Search. Users report not seeing significant changes after updates, leading to frustration. Marcus Ash, the design and research lead for Windows & Devices, acknowledged this issue, explaining that features may not appear immediately due to gradual rollouts. Users can enable the “Get the latest updates as soon as they’re available” option, but this does not guarantee instant access to new features. The September 2026 update includes a movable taskbar, a smaller taskbar option, and the ability to disable Bing results in Windows Search, though immediate visibility of these changes is not assured. Microsoft is also testing new features with Windows Insiders, including a customization tool for the context menu, enhanced File Explorer performance, a reduction in memory footprint for devices with 8GB RAM and above, a new WinUI-based Run dialog, a revamped Properties dialog, a redesigned pop-up for connected drives, the ability to remap the Copilot key, and improvements to Bluetooth connections and headset calls.

Tech Optimizer

September 19, 2026

Set Up Bitdefender Antivirus Free: 13 Steps [2026]

Bitdefender Antivirus Free was upgraded to version 27.0.62.355 on September 11, 2026, introducing a new Advanced Threat Defense driver that enhances behavioral monitoring capabilities. The free version is designed for Windows only and promises to remain free indefinitely, lacking features found in paid versions such as anti-tracking tools and a full vulnerability scanner. The installation requires Windows 10 or 11, at least 2GB of free disk space, a local administrator account, an active internet connection, and a Bitdefender Central account. Users must remove any existing antivirus software before installation, and the installation process typically takes 60 to 75 minutes. Bitdefender Free covers one Windows device and offers robust malware detection capabilities, particularly with the Advanced Threat Defense layer. It is recommended to schedule regular scans and check the Notification Center for quarantined items. If uninstalled, the dedicated uninstall tool should be used to avoid leftovers that could interfere with future installations.