Registry Archives

Winsage

August 17, 2026

This hidden Windows 11 setting runs Defender scans you missed

Windows Security includes a Defender antivirus component that performs quick and full scans of files at regular intervals. If the computer is powered down during a scheduled scan, it misses the opportunity for a virus check. Users can configure a grace period in the registry to automatically initiate a forced quick scan after a specified number of days without a scan. To adjust this setting, users need to open the Registry Editor and navigate to HKEYLOCALMACHINESOFTWAREPoliciesWindowsWindows Security.

Tech Optimizer

August 17, 2026

Best Malware Removal Tools of 2026: Tested on Infected PC

A hands-on evaluation was conducted to assess the effectiveness of various malware removal tools by deliberately infecting a PC and running six different cleanup tools. The recommended steps for users suspecting malware infection include disconnecting from the internet, installing an on-demand scanner, removing detected threats, rebooting the system, and changing passwords. The top malware removal tools identified were: 1. Malwarebytes Free: Quick scan in 2 minutes and 20 seconds; complete removal with no remnants. 2. Bitdefender: Quick scan in 1 minute and 4 seconds; complete removal confirmed. 3. Norton 360: Quick scan in 58 seconds; effective for severely compromised devices. 4. Avast One Free: Quick scan in 1 minute and 12 seconds; complete removal with ongoing protection. 5. McAfee: Full system scan took 16 minutes and 47 seconds; complete removal but slower than others. 6. NordVPN Threat Protection Pro: Focuses on preventing reinfection, does not remove existing malware. Signs of infection include unexpected pop-ups, altered homepage settings, and sluggish performance. For Windows, Safe Mode with Networking is recommended for removal, while Mac users should use Activity Monitor to identify suspicious processes. Android users can utilize Safe Mode and Play Protect for scanning. A factory reset may be necessary if infections persist. Malwarebytes Free and Avast One Free are highlighted as effective free options for malware removal.

Winsage

August 14, 2026

Windows has a secret database that makes your old games

Microsoft's Windows operating system has developed intricate compatibility mechanisms over decades to ensure that older games can run on modern machines. It maintains compatibility databases that recognize software with known issues and applies specific fixes, known as shims, which adjust the OS's responses to meet the game's expectations without modifying the game's executable. Users can also manually apply fixes through Compatibility settings, allowing them to emulate earlier operating system behaviors and address specific issues. The compatibility shims can modify interactions with APIs, file handling, system privileges, and display scaling. Microsoft provides AppHelp warnings for applications with known compatibility issues and maintains a comprehensive compatibility database located at C:WindowsAppPatch. Users can access this database and explore compatibility settings using the Windows ADK and the Compatibility Administrator tool.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

Winsage

August 7, 2026

Permanently disable Microsoft’s hidden tracker on all Windows 11 versions with this script

Microsoft's Global Device Identifier (GDID) is an internal marker that uniquely identifies each Windows installation across Microsoft services. It is a persistent device-level identifier that remains constant across supported services, and there is no option to disable or regenerate it manually. Windscribe has developed a free utility called deGDID to permanently remove the GDID from Windows systems and prevent its recreation. This tool operates by blocking Microsoft registration pathways and wiping local GDID-related states without altering system files. While it can remove the GDID from the local system, it cannot erase historical records linked to the device. Windscribe provides instructions for using the tool, which is compatible with Windows 10 version 22H2 and all versions of Windows 11 from 21H2 to 25H2. Users should be aware that disabling GDID generation may impact Microsoft services that rely on device identification, but the tool includes an undo feature to revert changes.

Winsage

August 7, 2026

This ‘classic’ decades-old SQL injection flaw could let hackers take over entire Windows servers, thanks to a nifty database trick

Security researchers from Huntress discovered a sophisticated SQL Injection (SQLi) attack that led to the deployment of a rare toolkit called Khunt. The attackers exploited a public-facing application backed by an Oracle database by failing to validate user input, allowing malicious SQL commands to be executed. The Khunt toolkit enabled activities such as executing operating system commands, stealing credentials, and exfiltrating registry hive data. Experts recommend robust defense mechanisms, including input sanitation, regular security audits, and the implementation of web application firewalls to protect against such attacks.

Winsage

August 6, 2026

Microsoft is updating even more parts of the Windows 11 UI with modern designs: Here’s what’s next on the list of overhauls

Windows has faced user dissatisfaction due to inconsistent user interface designs since Windows 8, which worsened with Windows 10. Windows 11, launched in 2021, introduced a consistent design language through the WinUI framework, modernizing various UI components and replacing older elements. Enhancements included a more consistent dark mode and updates to features like volume controls and context menus. Microsoft is revamping the File Properties dialog and the Start menu for improved speed and responsiveness while optimizing resource consumption. Context menus are also being redesigned for better customization and quicker access. Ongoing efforts aim to modernize legacy components of the OS, with a focus on performance and reduced memory usage.

Winsage

August 5, 2026

How to Disable Windows Recall in Windows 11 Home and Pro

Microsoft's Windows Recall feature captures periodic snapshots of user screens on Copilot+ PCs with Neural Processing Units (NPUs) to create a visual timeline of digital activities. Users can pause, disable, or remove Windows Recall on Windows 11 Home or Pro, but system updates may reactivate it. Methods to disable Windows Recall include: 1. Settings Toggle: Users can turn off snapshot collection through the Privacy & Security settings and reset recorded history. 2. Windows Optional Features: Users can uninstall the Recall feature via the optional features menu. 3. Group Policy Management: Windows 11 Pro users can block Recall through the Group Policy Editor. 4. Registry Editor Modification: Windows 11 Home users can modify the registry to disable Recall, though this method carries risks. Each method requires specific steps and may necessitate a system restart to take effect.

Winsage

August 5, 2026

This free Windows 11 tool can rescue your PC when things go wrong

System Restore is a recovery feature in Windows that allows users to revert their systems to a previous state by creating snapshots of the current configuration. It captures crucial system components such as Windows system files, Registry settings, device drivers, and installed applications, but does not back up personal files. Windows automatically generates restore points during significant events or after a week without new points, and users can manually create them before making substantial changes. Restore points occupy hard drive space, and the oldest points are deleted when storage is full. To use System Restore, users can configure it in the System Properties window, create restore points, view and select restore points, preview changes, and initiate the restoration process. After restoration, the PC reboots, and users should check if issues are resolved.