Registry Archives

Winsage

September 30, 2026

WSL containers is now generally available

WSL has introduced a new feature called WSL containers, enabling users to build, run, and deploy Linux containers on Windows. Users can access this feature by executing wsl --update or downloading the latest release from GitHub. Key capabilities include: - WSL containers CLI (PLACEHOLDER8a7e9b6f37799ba2 and PLACEHOLDERcff917ded0a54dfd) for managing Linux containers. - WSL containers API for programmatic execution of Linux containers within Windows applications. New commands and enhancements include: - PLACEHOLDER9a5ce8c0763b7886, PLACEHOLDER3ee1e1334fe287fb, PLACEHOLDER4860ddbd841eef41, PLACEHOLDERe699cb1a0eaadb6e, wslc network disconnect, and support for container health checks. - Integration of Microsoft Intune and Microsoft Defender for Endpoint for security and governance in container workflows. - New settings in Intune for managing WSL container access and registry controls. Community integrations include support for VS Code dev containers and various tools for managing WSL containers. Future plans involve adding wslc compose support and improving core platform capabilities for WSL, including networking and cross-OS file performance.

Tech Optimizer

September 29, 2026

Why Endpoint Detection and Response Is No Longer Optional

Traditional antivirus software relies on a signature-based model that compares files against a database of known malware, which limits its effectiveness against modern threats. Cybercriminals have adapted by using polymorphic malware and fileless techniques that evade detection. Endpoint Detection and Response (EDR) continuously monitors device activities, tracking process activity, network connections, and file changes to detect behavioral patterns indicative of attacks. EDR also enables rapid response actions, such as isolating affected devices and terminating malicious processes. Small and medium businesses are increasingly targeted by attackers who exploit the limitations of traditional antivirus solutions. Relying solely on antivirus software creates vulnerabilities, making it essential for organizations to incorporate EDR for enhanced security.

Winsage

September 28, 2026

Windows 11 can keep thumbnails of photos you deleted. Here’s how to remove them

Windows retains thumbnails in a cache file named thumbcache_256.db, but it does not save a thumbnail of every deleted photo. Other operating systems, including macOS and Linux, also use thumbnail caching. Users can access their thumbnail cache by navigating to %LOCALAPPDATA%MicrosoftWindowsExplorer, but this will not show deleted images. Thumbnails are created only when images are displayed in Explorer’s thumbnail view. Windows allows users to clear the thumbnail cache using the Disk Cleanup tool, and there is an option to disable thumbnail caching in Windows 11 Pro and higher. The cached thumbnails do not guarantee persistence and do not represent original files. Windows also keeps records of application launches in Prefetch, maintains entries for USB devices in the USBSTOR registry key, saves Wi-Fi networks and passwords, and can keep clipboard history and recent file shortcuts.

Winsage

September 28, 2026

Windows 11 can keep thumbnails of photos you deleted. Here’s how to remove them

A recent post on X claims that Windows retains a thumbnail of every deleted photo in a file named thumbcache_256.db, which has raised privacy concerns among users. While Windows does maintain a thumbnail cache for efficiency, this practice is not unique to Windows, as other operating systems like macOS, Linux, and Android also use similar systems. Users can inspect or clear their thumbnail cache by accessing specific database files in the Windows Explorer directory. The claim that Windows retains "every photo you’ve ever deleted" is misleading, as thumbnails are only created when images are viewed in thumbnail mode. Windows does not cache every file, and thumbnails must exist before they can be cached. Additionally, Windows keeps app launch records in Prefetch files for performance optimization, maintains entries for USB devices in the USBSTOR registry key, retains records of Wi-Fi networks and passwords (which are encrypted), and can keep clipboard history and recent file shortcuts. Caching previews is common across various operating systems, and Microsoft is focused on user consent and privacy as it enhances Windows 11 with AI functionalities.

Winsage

September 27, 2026

I finally figured out why Windows 11’s menus feel so slow—and the fixes that take seconds

Windows 11 users experience delays in right-click menus and context options due to a combination of factors, including the MenuShowDelay registry setting, UI transition animations, and the hybrid shell architecture. The MenuShowDelay setting introduces a default pause of 400 milliseconds before submenus appear. Users can improve performance by modifying this setting to a range of 0 to 100 milliseconds, disabling animation effects and transparency, and adjusting the power mode to "Best performance." Additional tweaks include using the Performance Options panel, enabling Task Manager's Efficiency Mode, auditing startup programs, and ensuring graphics drivers are up to date. These adjustments can enhance responsiveness without requiring advanced technical skills or third-party software.

Winsage

September 27, 2026

Google researcher explains why Windows NT “puts Linux to shame,” and imagines an alternate history where it won

Laurie Kirk, a Google researcher and former Microsoft reverse engineer, argues that the Windows NT kernel is superior to Linux in several aspects, particularly in its architecture for managing resources and access permissions. She emphasizes that her critique focuses on the system architecture rather than the user interface of Windows 11. Kirk raises concerns about Linux's suitability for AI agents due to its complex security model, while praising NT's object-based design and security framework. She speculates on an alternate history where Microsoft had created an "Open NT," allowing for customizable components, but acknowledges the challenges of maintaining forks in operating systems. Critics of NT highlight its performance and reliability issues, while Linux's open-source nature has contributed to its dominance in servers and cloud computing. Kirk suggests that future operating systems may need to balance the defined resource types of NT with the flexibility of Linux, especially as AI technology evolves.

Winsage

September 26, 2026

Microsoft just rethought its entire AI strategy: What the new Copilot means for Windows & your everyday workflows

Microsoft is evolving its offerings in artificial intelligence, particularly with updates announced at its Copilot event, which signify a shift towards a more integrated Microsoft 365 experience. The latest version of Copilot aims to create a cohesive workspace that connects documents, conversations, data, and tasks, making AI more accessible for everyday users and enterprise customers. CEO Satya Nadella emphasized the importance of keeping humans "in the flow of work" and creating systems that learn continuously. Key features include Autopilot, a digital teammate that manages tasks across Microsoft Teams, Outlook, and other applications, allowing users to focus on strategic initiatives. At the core of these advancements is Microsoft IQ, a unified intelligence layer that connects data and workflows throughout the Microsoft ecosystem. Microsoft is also introducing a plugin registry for custom integrations and implementing FinOps for AI to optimize spending. Regular consumers can access these features based on their M365 Premium or Pro subscriptions, with further developments expected at Microsoft Ignite in November.

Winsage

September 26, 2026

Windows finally let me rip Bing out of my desktop. The speed boost is undeniable

Windows 11 users previously experienced a dual-search environment where local and web results were mixed, often leading to cluttered searches. Many resorted to registry edits to disable web results, but these workarounds were not fully effective. The search interface was complicated by irrelevant web links, making it difficult to find local files. With the introduction of version 26H2, Microsoft added a toggle in Settings that allows users to manage web searches independently, improving the search experience by prioritizing local files. This feature began rolling out after the September 2026 Patch Tuesday update. Disabling web results streamlines the search panel but removes the Copilot entry and may not be immediately available to all users.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.