Registry Archives

Winsage

September 27, 2026

I finally figured out why Windows 11’s menus feel so slow—and the fixes that take seconds

Windows 11 users experience delays in right-click menus and context options due to a combination of factors, including the MenuShowDelay registry setting, UI transition animations, and the hybrid shell architecture. The MenuShowDelay setting introduces a default pause of 400 milliseconds before submenus appear. Users can improve performance by modifying this setting to a range of 0 to 100 milliseconds, disabling animation effects and transparency, and adjusting the power mode to "Best performance." Additional tweaks include using the Performance Options panel, enabling Task Manager's Efficiency Mode, auditing startup programs, and ensuring graphics drivers are up to date. These adjustments can enhance responsiveness without requiring advanced technical skills or third-party software.

Winsage

September 27, 2026

Google researcher explains why Windows NT “puts Linux to shame,” and imagines an alternate history where it won

Laurie Kirk, a Google researcher and former Microsoft reverse engineer, argues that the Windows NT kernel is superior to Linux in several aspects, particularly in its architecture for managing resources and access permissions. She emphasizes that her critique focuses on the system architecture rather than the user interface of Windows 11. Kirk raises concerns about Linux's suitability for AI agents due to its complex security model, while praising NT's object-based design and security framework. She speculates on an alternate history where Microsoft had created an "Open NT," allowing for customizable components, but acknowledges the challenges of maintaining forks in operating systems. Critics of NT highlight its performance and reliability issues, while Linux's open-source nature has contributed to its dominance in servers and cloud computing. Kirk suggests that future operating systems may need to balance the defined resource types of NT with the flexibility of Linux, especially as AI technology evolves.

Winsage

September 26, 2026

Microsoft just rethought its entire AI strategy: What the new Copilot means for Windows & your everyday workflows

Microsoft is evolving its offerings in artificial intelligence, particularly with updates announced at its Copilot event, which signify a shift towards a more integrated Microsoft 365 experience. The latest version of Copilot aims to create a cohesive workspace that connects documents, conversations, data, and tasks, making AI more accessible for everyday users and enterprise customers. CEO Satya Nadella emphasized the importance of keeping humans "in the flow of work" and creating systems that learn continuously. Key features include Autopilot, a digital teammate that manages tasks across Microsoft Teams, Outlook, and other applications, allowing users to focus on strategic initiatives. At the core of these advancements is Microsoft IQ, a unified intelligence layer that connects data and workflows throughout the Microsoft ecosystem. Microsoft is also introducing a plugin registry for custom integrations and implementing FinOps for AI to optimize spending. Regular consumers can access these features based on their M365 Premium or Pro subscriptions, with further developments expected at Microsoft Ignite in November.

Winsage

September 26, 2026

Windows finally let me rip Bing out of my desktop. The speed boost is undeniable

Windows 11 users previously experienced a dual-search environment where local and web results were mixed, often leading to cluttered searches. Many resorted to registry edits to disable web results, but these workarounds were not fully effective. The search interface was complicated by irrelevant web links, making it difficult to find local files. With the introduction of version 26H2, Microsoft added a toggle in Settings that allows users to manage web searches independently, improving the search experience by prioritizing local files. This feature began rolling out after the September 2026 Patch Tuesday update. Disabling web results streamlines the search panel but removes the Copilot entry and may not be immediately available to all users.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

Winsage

September 22, 2026

Lock down your Windows 11 taskbar so no one else can change it

Administrators can manage taskbar settings in Windows by either freezing current configurations or restricting user modifications through the Registry or Group Policy. The Group Policy Editor is available in Windows Professional, Education, and Business editions. To lock down taskbar changes via the Registry, access the Registry Editor, navigate to HKEYCURRENTUSERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer, create a new DWORD (32-bit) value named TaskbarLockAll, set its value to 1, and confirm. This will grey out certain options in the Taskbar settings. In the Group Policy Editor, navigate to User Configuration → Administrative Templates → Start Menu and Taskbar, enable "Lock all Taskbar Settings," and confirm. To prevent standard users from altering taskbar settings, navigate to HKEYCURRENTUSERSoftwarePoliciesMicrosoftWindowsExplorer in the Registry and create a new DWORD (32-bit) value.

Winsage

September 22, 2026

Microsoft engineer explains what made Windows 7 take 30 seconds to show the desktop

Changing the desktop wallpaper to a solid color in Windows 7 caused a 30-second delay on the Welcome screen after entering a password. This issue arose because the system waited for a signal from the wallpaper component, which only sent its "I'm ready" signal when an image file was used. When a solid color was selected, this signal was not sent, leading to unnecessary waiting. The problem was acknowledged by Microsoft for both Windows 7 and Windows Server 2008 R2, and it was resolved with a Hotfix update in November 2009. Users found workarounds, such as switching to an image or creating a small solid-color image, to eliminate the delay.

Winsage

September 22, 2026

Microsoft Defender is causing slow VLC startups. Here’s the fix

Recent investigations have shown that a specific update to Microsoft Defender has caused performance issues for VLC Media Player, particularly a slowdown in startup times. Jean-Baptiste Kempf, a VideoLAN developer, attributed this sluggishness to a bug in the Microsoft Defender update, which quarantined VLC's plug-in cache. The problematic Defender signature update is version 1.455.50.0, linked to Windows Update KB5121003 released on August 11th. Users can reset the plug-in cache to improve performance by either reinstalling VLC or using the built-in functionality to regenerate the cache with vlc-cache-gen.exe. Alternatively, users can reset preferences and cache files by searching for "VLC" and selecting the reset option. Microsoft has not yet provided a fix for these issues, and users may need to set an exclusion in Microsoft Defender for VLC Media Player to prevent unnecessary scans, enhancing its performance.

Winsage

September 20, 2026

Microsoft Patches Windows Defender Bug That Kept Saying Your Antivirus Was Off

Microsoft resolved an issue in its Windows Security framework that incorrectly indicated Microsoft Defender Antivirus was disabled. This fix was implemented through Defender platform update 4.18.26080.4, released on September 17. The update installs automatically unless users have blocked mandatory security updates. Users had been receiving false alerts during system boot and intermittently afterward, which redirected them to the Windows Security home tab where settings appeared normal. Microsoft acknowledged the issue on August 28, affecting all supported versions of Windows and Windows Server with the latest Defender updates, but did not specify the triggering update. Users in the Windows Insider program reported similar warnings as early as June.