Registry Archives

Winsage

September 7, 2026

Windows 11 hack unlocks animated profile pictures Microsoft has been hiding from you

Windows 11 typically converts profile pictures into static, resized versions for display on the Start menu, Settings page, or lock screen. A registry tweak allows users to link these entries to the original image file, enabling animated profile pictures. This method supports transparent PNGs and animated GIFs, although Microsoft does not officially support animated account pictures. Windows generates resized copies of the profile picture and stores their paths in the registry. Users can automate the process using a PowerShell tool from GitHub or manually edit the registry with elevated permissions. Users must ensure the GIF is stored in a permanent location, as moving or deleting it will break the profile picture. The workaround modifies local account settings, not Microsoft account avatars, and users with sync enabled should be cautious.

Tech Optimizer

September 7, 2026

Top 10 Best Endpoint Detection & Response (EDR) Solutions in 2026

Endpoint detection and response (EDR) continuously records process, file, registry, and network activity on endpoints, applying behavioral analytics to identify attacker techniques while providing tools for investigation and containment. Several EDR platforms have emerged, each catering to different organizational needs: 1. CrowdStrike: Best overall for its rich telemetry and elite threat intelligence. 2. SentinelOne: Best for autonomous response, featuring strong containment and rollback capabilities. 3. Microsoft Defender for Endpoint: Best value for organizations already using Microsoft 365 E5. 4. Palo Alto Cortex XDR: Best for native data fusion across endpoint, network, and cloud telemetry. 5. Sophos: Best for generalist IT teams due to its user-friendly interface. 6. Trend Micro: Best for server and workload coverage, focusing on cloud and hybrid environments. 7. Bitdefender: Best mid-market value with strong detection capabilities at an accessible price. 8. Trellix: Best for organizations already using Trellix products, offering integrated solutions. 9. Huntress Managed EDR: Best for managed endpoint security, ideal for teams lacking full staffing. 10. Cisco Secure Endpoint: Best for Cisco environments, integrating well with Cisco security solutions. Key differentiators among these platforms include the analyst burden, alert management efficiency, and the impact of retention policies on investigation quality. The evaluation of EDR solutions should consider detection depth, response capabilities, operational costs, and the specific needs of the organization.

Winsage

September 6, 2026

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has identified four previously undocumented programs associated with REVSTEALER, a Windows information stealer that persists on infected machines after self-deletion. The programs are ProManager, WinUpdate, SoftManager, and LockAppHost, each with distinct functionalities. ProManager steals wallet files and logs passwords, WinUpdate monitors the clipboard for cryptocurrency addresses, SoftManager acts as a reverse proxy, and LockAppHost executes a cryptocurrency miner after disabling Windows Update and Microsoft Defender. REVSTEALER has been marketed as a commercial infostealer since February 2026, exfiltrating sensitive data such as browser passwords, cookies, and cryptocurrency wallet information. It deletes itself after reporting its activities but leaves the four programs installed for persistence. These programs share build tradecraft with REVSTEALER, including the use of identical packers and runtime function resolutions. REVSTEALER primarily spreads through game-cheat lures and disguises itself as pirated software. It employs evasion techniques to resist analysis, including checking for sandbox environments and using indirect system calls. Users are advised to avoid unofficial software and to follow specific steps if infected, such as re-enabling Windows Update services and changing passwords. Indicators of compromise include SHA-256 hashes for REVSTEALER and its associated programs, as well as domains linked to their command and control servers.

Winsage

September 6, 2026

I gave Windows 11 an old-school makeover by restoring its classic icons

Users can customize icons in Windows 11 by following different methods depending on the type of icon. For folders and shortcuts, right-clicking the item and selecting Properties allows users to change icons easily. Taskbar items require pressing Shift while right-clicking the closed app. Desktop icons like "This PC" and the Recycle Bin can be modified through Settings > Personalization > Themes > Desktop icon settings. More complex changes, such as altering icons for file types or drives, involve editing the Windows registry. Windows retains a selection of classic icons within DLL files, including moricons.dll, pifmgr.dll, and netshell.dll. Users can also access the Windows Icon Archive project for a repository of icons from various Windows versions, though .png files need conversion to .ico format for use. Limitations include the inability to change icons for new folders automatically, modifications not reflecting in Quick Access for special folders, and restrictions on altering application icons. Programs like OpenShell can help modify taskbar and Start menu icons, but achieving a perfect replica of older versions is not possible.

Winsage

September 4, 2026

There are two kinds of Windows users—and one of them is unknowingly making the OS worse

There is a divide between casual Windows users and engaged enthusiasts, with passive users often accepting default settings that contribute to system bloat. Passive users enable telemetry and promotional content by not customizing their installations, while active users take steps to enhance privacy and performance. Microsoft interprets user inaction as approval for unwanted features, leading to an accumulation of bloatware and unnecessary updates. The Connected User Experiences and Telemetry service collects user data, justifying the inclusion of features like Copilot, which many users may not want. Users face challenges in maintaining control over their systems, often needing technical knowledge to opt out of unwanted features. Microsoft's feedback system is inadequate, interpreting silence as consent rather than a lack of interest, making it difficult for users to effect meaningful change.

Winsage

September 4, 2026

Are Vibe-Coding and AI-Slop the cause of Windows 11 issues (desktop background, mouse pointer, etc.)?

The preview update KB5120998 for Windows 11 versions 24H2 and 25H2, released on August 27, 2026, has caused issues such as erratic mouse pointer behavior and disappearing desktop backgrounds, particularly in non-English versions. Microsoft has acknowledged these problems, indicating that they stem from coding practices that fail to load certain settings correctly. Specific issues include a "black desktop background" due to desktop settings not loading and mouse customization resetting to default configurations. The problems may be related to translation issues within the registry, as registry keys have been altered post-update. Users have suggested that manually adjusting these registry keys could restore normal functionality.

Tech Optimizer

September 3, 2026

Avast Antivirus Zero-Day PoC Lets Attackers Dump SAM Database and Gain SYSTEM Shell

A public proof-of-concept (PoC) repository has revealed a local privilege escalation zero-day vulnerability in GenDigital's Avast Antivirus, allowing attackers with local execution access to extract the Windows Security Account Manager (SAM) database and execute a shell with NT AUTHORITYSYSTEM privileges. The flaw is located in the Avast Sandbox component and could enable a complete local takeover of the system. The PoC is compatible with any version of Avast Antivirus and has been tested on fully patched versions of Avast and Windows 11 25H2. The repository does not provide a formal release, CVE identifier, or patch details. The vulnerability may also affect other GenDigital products like AVG and Norton. Security teams are advised to monitor for suspicious activities related to Avast services and restrict local administrator access. Organizations should inventory their deployed versions and apply vendor-provided updates as they become available.

Winsage

September 3, 2026

Microsoft is auto-enabling Memory Integrity on Windows 11 PCs from October. Why you shouldn’t turn it off

Starting in October 2026, Microsoft will automatically activate memory integrity for eligible Windows 11 devices through the Patch Tuesday update on October 13. Memory integrity, or Hypervisor-protected Code Integrity (HVCI), protects the core of Windows by ensuring that kernel-mode drivers are verified before execution, preventing malware from exploiting vulnerable drivers. Eligible devices must have an Intel 8th-generation processor or newer, AMD Zen 2 or newer, Qualcomm Snapdragon 8180 or newer, at least 8GB of RAM, a 64GB SSD, virtualization enabled in firmware, and compatible drivers. Secured-core PCs already have this feature enabled. Windows will assess device readiness before activation and will respect user settings if memory integrity has been intentionally disabled. Users can check memory integrity status in Windows Security under Device security. Incompatible drivers may cause issues, and conflicts will be logged in the Event Viewer. Microsoft is pushing this update due to increased security threats and aims to protect users who have upgraded their systems without performing clean installs. If issues arise with memory integrity enabled, users can identify problematic drivers in the CodeIntegrity event log.

AppWizard

September 2, 2026

Minecraft 26.3 Pre-Release 1 patch notes: Number system overhaul, bug fixes and more

Mojang has launched the pre-release phase for Minecraft Java Edition 26.3, introducing the Wilderness Drop. The pre-release includes extensive bug fixes and a technical upgrade to the Number Provider system, which has been restructured into separate registries for integer and float calculations. Key changes include new integer-specific providers and float-specific providers, as well as mandatory cooking times for recipes. Block State Providers can now be defined as standalone types. Notable bug fixes address issues with Blast Furnaces, Endermen, Drowned, music events, ore generation, and more. Players can download the pre-release to explore the new features.

Tech Optimizer

August 31, 2026

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox is linked to the distribution of a backdoor malware called ValleyRAT, disguised as the legitimate QN Wallpaper adware application. Once installed, ValleyRAT provides complete control over the compromised machine. The malware uses DLL sideloading to operate under the guise of a legitimate process, bypassing security measures. It disables Windows Defender and adds itself to autorun entries, and can mark its process as critical, causing system crashes if terminated. Kaspersky has identified specific indicators of compromise (IoCs) including hashes, command-and-control servers, and associated domains. In 2026, Kaspersky recorded over 100,000 detections of ValleyRAT affecting more than 1,500 unique users, mainly in China and India.