Windows Defender Archives

Tech Optimizer

August 27, 2026

Norton vs McAfee 2026: 8 Rounds, One Winner

Norton outperformed McAfee in several categories, including malware detection (99.8% vs. 99.71%), phishing blocking (95% vs. 94%), and speed of full scans (13:22 vs. 16:47). Norton also offers a cloud backup feature, while McAfee provides unlimited device coverage on two of its plans. In terms of support, McAfee has faster response times (40 seconds vs. 2 minutes). For households with more than three devices, McAfee's plans may be more economical, as Norton has a device limit of 10. Both brands significantly increase renewal prices, with Norton 360 Deluxe rising by 150% and McAfee's plans by 200%.

Tech Optimizer

August 26, 2026

Catch Of The Week: The ‘Security Scan’ That Wants You Defenseless

Researchers at Malwarebytes have identified a network of deceptive websites posing as a service called “SysScan,” which pretends to conduct Microsoft security checkups. Users encounter these sites through search results, browser hijacking pop-ups, or unsolicited emails. The sites use Microsoft branding and a fake progress bar to create the illusion of a scan, but they only collect harmless data like operating system and location, which are then manipulated into alarming fake alerts. The fabricated security score is predetermined and does not reflect the user's actual security status. The scam misleads users into believing that Windows no longer supports third-party antivirus software, prompting them to uninstall their protections, which increases their vulnerability. Users are then asked to provide personal and banking information through a form that sends data via a Telegram bot. Eleven fraudulent sites have been traced back to a single server. Indicators of the scam include requests to disable antivirus software, installation of remote-access software, and solicitation of sensitive information. Microsoft does not initiate cold calls or scan computers through web pages. If someone has engaged with the scam, they should disconnect from the internet, uninstall any remote-access tools, reinstall antivirus software, and report the incident to authorities.

Tech Optimizer

August 26, 2026

How to Protect Against Ransomware: 13 Steps [2026]

Global ransomware attacks increased by 0.8% quarter-over-quarter in Q2 2026. The group Qilin has 279 confirmed victims, maintaining its position as the leading threat actor for four consecutive quarters. The rival group The Gentlemen saw a 62% increase in victims, reaching 269. Checkpoint Research's report indicates a shift in the ransomware landscape, challenging the narrative of declining attacks. IBM's analysis shows breaches within supply chains and third-party vendors have quadrupled over the past five years. Effective ransomware protection requires administrative access to endpoints, firewalls, and backup systems, along with specific software versions and tools. The 3-2-1-1-0 backup strategy is recommended, emphasizing offline, immutable backups. Organizations should implement multi-factor authentication (MFA) across all access points and actively patch known vulnerabilities. Network segmentation is crucial to limit ransomware spread, and canary files can provide early warnings of attacks. Regular phishing simulations and a well-documented incident response plan are essential for preparedness.

Winsage

August 24, 2026

Windows Defender’s own driver can leave systems defenseless

The configuration reveals a sequence of actions including file and directory deletions, relocations, and registry operations, such as deleting and modifying registry keys and values. The file-move primitive can transform into an arbitrary file-write capability when directed to the System32 directory. The automation of these actions is achieved through a tool called BTRCLI, which extracts a legitimate driver from Windows Defender, constructs an encrypted transaction, and loads the driver, using the target machine's version of BTR.sys to avoid external drivers.

Tech Optimizer

August 22, 2026

Bitdefender vs McAfee: How to pick the right antivirus for you in 2026

Viruses and malware pose ongoing threats to personal computers and sensitive data. Windows Defender is a free antivirus option, but dedicated solutions like Bitdefender and McAfee offer enhanced security. Bitdefender was established in 2001 and McAfee in 1987. Bitdefender Premium Security has a rating of 4.5/5, offers various plans, and is user-friendly with minimal system impact. Its pricing includes £59.99 for the Premium Security plan, which features a password manager, unlimited VPN, and other protections. McAfee+ Premium also has a rating of 4.5/5, is visually appealing, and includes a smart scan feature. Its pricing starts at £49.99 for the Premium plan, which protects unlimited devices and includes various security features. Bitdefender's pros include an affordable standard plan and a basic VPN, while cons include a requirement for a family plan for more than five devices and significant price increases in subsequent years. McAfee's pros include unlimited device protection and excellent security monitoring, with cons being potential high costs. Both antivirus solutions offer significant first-year discounts, with Bitdefender's basic protection starting at £17.99 for one device and McAfee's basic package starting at £29.99 for one device. In terms of features, Bitdefender includes a comprehensive suite with a password manager, while McAfee offers scam detection and a social privacy manager. Bitdefender's dashboard is user-friendly but may feel cluttered, while McAfee's dashboard is visually appealing and organized. Both provide 24/7 support, but Bitdefender's phone support may incur charges. The evaluation criteria included ease of use, features, value for money, and performance.

Winsage

August 22, 2026

Researchers find way to weaponize Windows Defender’s own driver

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.

Tech Optimizer

August 20, 2026

Surfshark Antivirus Review 2026: Test Results and Costs

Surfshark offers a cybersecurity package called Surfshark One, which includes antivirus capabilities and a VPN service. The overall rating for Surfshark is 4.1/5, with specific ratings of 3.7/5 for protection, 4.5/5 for performance, 3.3/5 for features, 5.0/5 for support, and 4.5/5 for value. The antivirus component has a 93.44% malware detection rate and a 95% phishing detection rate with no false alarms. Surfshark One costs .79 per month and includes features like real-time protection, scheduled scans, breach alerts, a private search engine, and webcam protection. The One+ tier adds Incogni data removal and identity theft insurance. Surfshark Antivirus is not available as a standalone product and lacks features such as a firewall, password manager, and parental controls. It is compatible with Windows, macOS, and Android. Surfshark provides a 30-day money-back guarantee on all plans.

Winsage

August 20, 2026

ShieldBreak: The Windows Defender Zero-Day With No Patch — Detect It, Mitigate It, With Qualys

ShieldBreak, identified as CVE-2026-69414, is a zero-day vulnerability in the Microsoft Malware Protection Engine that allows low-privileged local attackers to escalate privileges to SYSTEM. The public proof of concept was released on August 12, 2026, and Microsoft recognized the CVE on August 14, 2026. No patch is currently available. ShieldBreak exploits an elevation-of-privilege vulnerability by manipulating file processing during the cloud-file hydration process in Microsoft Defender, allowing attackers to control processes with elevated privileges. The exploit is functional on Windows 11 25H2 and Windows Server 2025. Qualys VMDR can detect this vulnerability using a specific query, and organizations can use Qualys TruRisk™ Eliminate for mitigation until a patch is released.

Winsage

August 20, 2026

Is Microsoft Defender crashing on your PC? A bad update is breaking scans

Microsoft's built-in security tool in Windows 11 is considered sufficient for most users, but a recent issue has emerged where certain PCs are unable to complete security scans, potentially exposing them to vulnerabilities. Users on Reddit reported problems with Microsoft Defender, specifically with both Full Scan and Quick Scan functionalities failing. One user noted that a recent update may have caused the tool to crash shortly after scans begin, with offline scans stopping at 90-93% completion. The issue may be linked to a Microsoft Security Intelligence update, and some users have found that upgrading to Security Intelligence Update v1.457.236.0 resolved the problem for them.

Winsage

August 19, 2026

Is VLC taking an agonizingly long time to start up on Windows 11? Microsoft Defender is to blame

Users of VLC on Windows 11 have experienced delays of up to 33 seconds for MP3 playback due to a bug in Microsoft Defender that interferes with VLC's plugin cache. VideoLAN has clarified that this issue is not a reflection of VLC's reliability. Affected users can resolve the problem by adding the VLC folder as an exception in Windows Defender or by regenerating the plugin cache. Jonathan Blow, a game developer, highlighted the issue in a tweet, prompting discussions about the state of open-source software. Other users have reported similar delays, even on Windows 10. VideoLAN emphasized that the problem lies with Microsoft Defender, not with VLC itself.