investigation Archives

Winsage

September 22, 2026

Microsoft admits Windows 11’s emergency update still breaks audio, and a fix may not arrive until October

Windows 11 is facing ongoing challenges with audio functionality following recent updates, particularly with the emergency update KB5129195 released on September 14. This update aimed to fix issues from the September Patch Tuesday update (KB5124008) but has led to new problems, including compromised audio output on some devices and disruptions in secure trust relationships for enterprise systems. Users have reported error messages like “This device cannot start (Code 10)” in Device Manager, and issues with USB audio devices. Microsoft is investigating these audio problems but has not provided a timeline for resolution. Additionally, there are reports of GPU issues on AMD systems, including driver timeouts and black screens, affecting various Radeon models such as RX 6600, RX 7700 XT, RX 7800 XT, RX 7900 GRE, RX 7900 XTX, and RX 9070 XT. Some users found that uninstalling the September update alleviated these problems, but the emergency update KB5129195 does not address the GPU errors.

Tech Optimizer

September 21, 2026

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

On September 17, researchers from LastPass and Delphos Labs discovered a counterfeit LastPass Authenticator installer on GitHub that installs a malicious Windows kernel driver designed to disable antivirus and steal passwords. The driver, named Alinubx.sys, was signed through Microsoft's hardware compatibility program and initially scored zero detections on VirusTotal. The fake installer is hosted on a fraudulent GitHub page that mimics a legitimate LastPass product page. When executed, the installer uses DLL side-loading to gain SYSTEM-level access and terminates security processes, allowing it to harvest saved passwords from various browsers and applications. The driver is a renamed variant of a known malicious driver, evading detection due to its new file hash. Delphos reported the driver to Microsoft, but it was not considered a security vulnerability. Users who executed the fake installer should treat their passwords and sensitive data as compromised and change them from a secure device. The malicious server has been linked to impersonation pages for multiple brands, and the loader was likely created using a specific crypter tool.

AppWizard

September 21, 2026

When Memory Becomes a Release Metric: Preparing Android Apps for Google Play’s New Limits

In August 2026, Google Play announced new performance requirements for memory management that will be enforced starting February 2027. These requirements include metrics for dynamic memory usage, bitmap memory, and DEX code optimization. Applications that exceed these thresholds may face reduced visibility and publishing capabilities on the platform. Dynamic memory usage is defined as the sum of anonymous RSS and swap, excluding file-backed data. Google is focused on whether applications retain non-visible bitmaps and requires at least 25% coverage in DEX optimization. Memory issues can be difficult to reproduce, and developers are encouraged to use Android Studio’s Memory Profiler to investigate memory growth. A thorough investigation involves monitoring memory changes, taking heap dumps, and understanding reference paths. Bitmap memory should be carefully managed, as the runtime cost of images can exceed their file size. Google will provide real-world memory metrics through the Play Console, and teams are advised to establish memory budgets and perform pre-release checks to identify potential issues before they lead to out-of-memory (OOM) crashes.

Tech Optimizer

September 20, 2026

How to Remove a Keylogger: 12 Steps, 60 Min [2026]

A keylogger captures every keystroke made on a device and sends that information to an external source. In 2025, infostealer malware, including keyloggers, resulted in the theft of 642.4 million credentials from 13.2 million infections globally. In Australia, approximately 30,000 banking passwords were compromised between 2021 and 2025 due to this malware. The Australian Cyber Security Centre reported over 42,500 calls related to credential theft in one year, a 16% increase. Four main malware families dominate the landscape, with LummaC2 accounting for nearly 60% of credentials linked to infostealers in 2026. Keyloggers can be detected through signs such as typing lag, unexpected antivirus notifications, new browser extensions, and unexplained spikes in outbound data usage. Detection and removal steps include checking running processes, auditing startup programs, reviewing installed programs, running antivirus scans, and resetting passwords from a clean device. Keyloggers can infiltrate systems via phishing emails, malicious attachments, or compromised software downloads. Mobile devices can also be targeted by keyloggers disguised as legitimate apps.

AppWizard

September 20, 2026

Gemini’s rough patch with smart home controls has spread to Android Auto

Recent reports indicate that the Gemini smart home control feature in Android Auto has stopped functioning for many users, similar to issues previously experienced by Wear OS users. Despite Google announcing a fix for Wear OS, the cause of the Android Auto malfunction remains unclear. Users have reported that commands for smart home devices, such as turning on air conditioning, are not working, with Gemini providing a message that it "cannot control smart home devices through Google Maps while driving." Some users have reverted to Google Assistant for reliability, as commands still work within the Gemini app. The exact cause of the disruptions is under investigation, with speculation about a potential server-side bug or unannounced changes in functionality. Efforts to obtain a statement from Google are ongoing.

AppWizard

September 19, 2026

Russia’s national messenger app Max found to contain backdoor capable of secret screen captures

Researchers have found that Max, a messaging app mandated by the Russian government, can secretly capture screenshots, access sensitive information, impersonate users, and inject code into other applications. Developed by VK, the app integrates messaging, banking, and government services. Since September 1 of last year, it has been preinstalled on new smartphones, following the blocking of WhatsApp and Telegram. Despite its reach, it is not widely used in political circles, with insiders indicating that compliance with its use is performative.

Winsage

September 17, 2026

Windows Search’s default indexing mode could be writing gigabytes to your SSD every day for a feature almost nobody uses

The search index on Windows 11 can contribute to storage bloat, with reported sizes varying significantly among users. The search index database, named Windows.db, is crucial for delivering quick search results and can grow dramatically, with some users experiencing sizes exceeding 200GB. A PowerShell script can be used to check the size of the Windows.db file. If the file size is unusually large, users can rebuild the search index through the Indexing Options in the Control Panel. Windows 11 has two indexing modes: Classic and Enhanced, which affect the size and number of indexed items. Classic mode indexes specific folders, while Enhanced mode indexes the entire PC. Excluding certain directories can help manage index size. Performance issues may arise on PCs with over 400,000 indexed items.

Tech Optimizer

September 16, 2026

AI helps scammers build convincing antivirus renewal pages

Antivirus renewal scams often begin with messages claiming automatic subscription renewals, leading victims to counterfeit pages designed to collect personal information. These scams impersonate well-known brands and do not indicate that the sender has accessed the recipient's device. Responding to such messages can provide scammers with valuable data, including names and phone numbers, which can be sold or used for further scams. A specific scam site impersonating Avast targeted users in Belgium, falsely claiming a subscription renewal for €129.99. The site appeared polished and requested basic contact information without asking for sensitive data. It contained notes suggesting AI involvement in its creation, indicating it was a half-finished project. To identify antivirus renewal scams, individuals should verify any claimed charges directly with their bank, check subscriptions through official channels, be cautious of cancellation forms requesting phone numbers, treat follow-up calls as potential threats, and avoid installing remote access software. If engagement with a scam occurs, disconnect from the internet, remove any installed software, and change passwords. Tools like Malwarebytes Browser Guard can help block malicious sites, and Scam Guard can analyze suspicious communications.

AppWizard

September 16, 2026

Time-loop horror action adventure game Noroi Ayashi: The ∞th Oddity announced for Switch 2, Switch, and PC

Game Source Entertainment, in collaboration with SuperNiche and Clover Lab, is set to release a game titled Noroi Ayashi: The ∞th Oddity in 2027. It is a "time-loop horror RTA stealth action adventure" available on Switch 2, Switch, and PC via Steam, supporting English, Japanese, Traditional Chinese, and Simplified Chinese. The protagonist, Seira, explores her school at night, facing seven mysteries and the curse of a doll named Aya. The narrative is told through Yuriko, a member of the U High School News Club, who investigates the urban legend of the Cursed Doll Aya. Key characters include Seira, Hime, and Tae, each with distinct traits and backgrounds. Gameplay involves navigating the school, avoiding and sealing the Seven Mysteries, and learning from repeated deaths to develop survival strategies. The development team includes Rensuke Oshikiri, known for his work in manga, and Sohei Niikawa, a former Nippon Ichi Software contributor. An announcement trailer has been released.

AppWizard

September 12, 2026

Why the Google Maps Speedometer “Disappeared” From Android Auto

A speedometer feature was introduced for Android Auto users but later disappeared. Google explained that the speedometer and speed limit display only appear during active navigation. The rollout of the ability to show these features without a destination set is ongoing, and not all users have access yet. Mishaal Rahman from Google confirmed this is a misunderstanding, not a bug. Additionally, users have reported issues with colored traffic lines in Google Maps on Android Auto, which have not been restored for some. Users are advised to keep their apps updated for the latest features.