PowerShell Archives

Winsage

September 24, 2026

Microsoft force-installed three apps on Windows 11, and now you have to delete them yourself

In early 2025, Microsoft introduced three applications—“People,” “Files,” and “Calendar”—as part of its “Microsoft 365 companions” initiative to enhance productivity. These apps were integrated into the Windows 11 taskbar for managing Microsoft 365 features. Microsoft planned to automatically install these apps on eligible PCs starting in late October 2025, but later decided to discontinue them. The companion apps will be retired by December 16, 2026, and users must manually uninstall them as they will not be removed automatically. To uninstall, users can go to Windows Settings > Apps > Installed apps or use PowerShell commands.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

Winsage

September 21, 2026

7 Windows features I disabled after realizing nobody needs to use them

Windows 11 allows users to optimize their experience by disabling or uninstalling various features. 1. OneDrive: Users can unlink or uninstall OneDrive through File Explorer or the Settings app. 2. Copilot: Copilot can be uninstalled via the Settings app, and its keyboard shortcut can be customized. 3. Widgets: The Widgets board can be disabled or removed through the Settings app under Personalization. 4. Start Menu: Users can streamline the Start Menu by turning off pinned apps, recent items, and account notifications in the Settings app. 5. Phone Link: This feature can be minimized or uninstalled using the Settings app or Windows PowerShell. 6. Xbox Features: Xbox and Xbox Live can be uninstalled through the Settings app, and Game Mode can be toggled off. The Xbox Game Bar can be removed via PowerShell. 7. Search Results: To improve search efficiency, users can disable Bing and web results using Windows PowerShell.

Tech Optimizer

September 21, 2026

Thousands of hacked sites trick you into installing malware

More than 5,400 websites across over 2,200 organizations have been compromised to propagate malware, primarily affecting small businesses like clinics and online retailers. The attack mechanism involves malicious code that triggers a deceptive CAPTCHA, instructing users to execute commands that can download malware. Attackers are using the BNB Smart Chain test network to store instructions, making it harder for investigators to shut down operations. A newer variant of the attack uses WebRTC technology to establish encrypted connections for delivering additional malicious code. To protect against these threats, users should avoid pasting commands from websites, be suspicious of unusual CAPTCHA instructions, use strong antivirus protection, keep systems updated, take action if commands are executed, and small business owners should regularly verify their website's integrity.

Tech Optimizer

September 20, 2026

How to Remove a Keylogger: 12 Steps, 60 Min [2026]

A keylogger captures every keystroke made on a device and sends that information to an external source. In 2025, infostealer malware, including keyloggers, resulted in the theft of 642.4 million credentials from 13.2 million infections globally. In Australia, approximately 30,000 banking passwords were compromised between 2021 and 2025 due to this malware. The Australian Cyber Security Centre reported over 42,500 calls related to credential theft in one year, a 16% increase. Four main malware families dominate the landscape, with LummaC2 accounting for nearly 60% of credentials linked to infostealers in 2026. Keyloggers can be detected through signs such as typing lag, unexpected antivirus notifications, new browser extensions, and unexplained spikes in outbound data usage. Detection and removal steps include checking running processes, auditing startup programs, reviewing installed programs, running antivirus scans, and resetting passwords from a clean device. Keyloggers can infiltrate systems via phishing emails, malicious attachments, or compromised software downloads. Mobile devices can also be targeted by keyloggers disguised as legitimate apps.

Tech Optimizer

September 19, 2026

Windows 11’s Defender kept falsely saying your antivirus was off, and Microsoft just fixed it

For nearly two months, Windows 11 users received persistent notifications from the Windows Security app falsely indicating that Microsoft Defender was disabled, despite it functioning properly. This issue, which began in early August, has been addressed with a security update from Microsoft. The false alerts affected all versions of Windows 11, Windows Server, and Windows 10, and were linked to a bug introduced with a recent Defender security update. Microsoft confirmed that no manual action is required from users to resolve the issue, as the fix will be automatically deployed to all PCs with mandatory security updates enabled. The problem was resolved in the Microsoft Defender Antivirus update (version 4.18.26080.4), released on September 17, 2026. Users can verify the status of Defender by checking Windows Security or using a PowerShell command.

Tech Optimizer

September 19, 2026

Set Up Bitdefender Antivirus Free: 13 Steps [2026]

Bitdefender Antivirus Free was upgraded to version 27.0.62.355 on September 11, 2026, introducing a new Advanced Threat Defense driver that enhances behavioral monitoring capabilities. The free version is designed for Windows only and promises to remain free indefinitely, lacking features found in paid versions such as anti-tracking tools and a full vulnerability scanner. The installation requires Windows 10 or 11, at least 2GB of free disk space, a local administrator account, an active internet connection, and a Bitdefender Central account. Users must remove any existing antivirus software before installation, and the installation process typically takes 60 to 75 minutes. Bitdefender Free covers one Windows device and offers robust malware detection capabilities, particularly with the Advanced Threat Defense layer. It is recommended to schedule regular scans and check the Notification Center for quarantined items. If uninstalled, the dedicated uninstall tool should be used to avoid leftovers that could interfere with future installations.

Winsage

September 18, 2026

How to measure and shrink the Windows search index

The initial storage cost of the search index on a fresh installation of Windows 11 is minimal, only a few megabytes. When a sizable work folder is added, the index expands, but it does not revert to its original size after the folder is removed. The search index is stored in Windows.db for Windows 11 and Windows.edb for Windows 10. Windows 11 has two indexing modes: Classic (default) and Enhanced, with Classic indexing Documents, Pictures, Music folders, and the Desktop, while Enhanced scans the entire PC. The index includes file names and content, allowing keyword searches. Users can measure their index items through Settings without special permissions, while file size requires administrative access via PowerShell. An index under 30,000 items is acceptable for average users, while performance issues may arise beyond 400,000 items, with a technical ceiling of one million items. In an experiment, the index grew from 462 items and 6.71 MB to 3,466 items and 18.66 MB after adding 3,000 text files, but remained at 16.81 MB after deleting those files. To reclaim disk space, users can exclude specific folders from indexing and rebuild the index, which can significantly reduce its size while retaining the same number of items.

Winsage

September 17, 2026

Microsoft patch gives domain-joined Windows PCs trust issues

Microsoft acknowledged a significant issue affecting Windows 11 versions 24H2, 25H2, and 26H1 related to Active Directory domain logins as of September 16. This issue stems from changes made to Machine Identity Isolation in the September 2026 security update (KB5124008), which may cause Credential Guard-protected machine accounts to lose their secure channel with an on-premises Active Directory domain, preventing users from signing in with valid domain credentials. The update activates Machine Identity Isolation but does not enforce it immediately, and it is only compatible with environments linked to domain controllers operating at the Windows Server 2025 Domain Functional Level (DFL) or higher. Microsoft advised that devices not connected to Windows Server 2025 domain controllers will need to disable Machine Identity Isolation. A workaround involves disabling the feature through Intune, Group Policy, or the Windows Registry, followed by a device restart and repairing the secure channel using the Test-ComputerSecureChannel PowerShell command. Microsoft plans to address this issue in a future update by temporarily halting Machine Identity Isolation enforcement while enhancements are made.

Winsage

September 17, 2026

Windows Search’s default indexing mode could be writing gigabytes to your SSD every day for a feature almost nobody uses

The search index on Windows 11 can contribute to storage bloat, with reported sizes varying significantly among users. The search index database, named Windows.db, is crucial for delivering quick search results and can grow dramatically, with some users experiencing sizes exceeding 200GB. A PowerShell script can be used to check the size of the Windows.db file. If the file size is unusually large, users can rebuild the search index through the Indexing Options in the Control Panel. Windows 11 has two indexing modes: Classic and Enhanced, which affect the size and number of indexed items. Classic mode indexes specific folders, while Enhanced mode indexes the entire PC. Excluding certain directories can help manage index size. Performance issues may arise on PCs with over 400,000 indexed items.