NewApp Digest
search bot

Windows Startup

Microsoft shares details of a clever old Windows trick it no longer needs
Winsage
August 12, 2026

Microsoft shares details of a clever old Windows trick it no longer needs

Microsoft's WINSTART.BAT file is a batch file that predates Windows 95 and was documented in the Windows 3.1 Resource Kit. Its primary function is to load terminate-and-stay-resident (TSR) programs for use by Windows applications, while these TSRs are not accessible to individual MS-DOS virtual machines. WINSTART.BAT is executed after the virtual machine manager (VMM) initializes, giving it an advantage over AUTOEXEC.BAT, which runs during the MS-DOS startup phase. TSRs loaded via AUTOEXEC.BAT are available to both Windows and MS-DOS environments, while those loaded through WINSTART.BAT are limited to Windows applications only.
LG Monitors Spotted Installing Adware-Like App on Windows PCs
Winsage
July 20, 2026

LG Monitors Spotted Installing Adware-Like App on Windows PCs

LG monitors connected to Windows PCs can trigger the automatic installation of the LG Monitor App Installer, which promotes paid subscriptions to McAfee antivirus software without user consent. This app appears shortly after Windows Update installs relevant LG packages, displaying McAfee promotions frequently. The app is designed to launch at startup and operates outside the Windows App Sandbox, raising cybersecurity concerns. Reports indicate that this issue affects both newer and older LG monitor models. Microsoft allows manufacturers to link Store applications with device metadata, enabling such installations without clear user choice. Users can remove the app through Windows Settings, but doing so may block other useful applications. LG and Microsoft have not publicly addressed these concerns.
Windows and Linux users: The deadline to update Secure Boot keys is near
Winsage
June 17, 2026

Windows and Linux users: The deadline to update Secure Boot keys is near

In 2012, a novel bootkit targeting Mac OS X systems emerged, infiltrating the EFI firmware. A basic bootkit for Windows 8 also appeared, compromising the UEFI bootkit. By 2013, a more sophisticated UEFI bootkit named Dreamboat was introduced for Windows. The first documented real-world UEFI attack occurred in 2018 with the malware LoJax, linked to a Kremlin-backed hacking group. In 2020, the second known UEFI malware, MosaicRegressor, was discovered, which verified the presence of a malicious file upon each reboot. New UEFI bootkits like ESpecter, FinSpy, and MoonBounce have since emerged. In response to the threat of UEFI bootkits, Microsoft collaborated with manufacturers to implement Secure Boot, a protocol that uses cryptographic signatures to ensure the integrity of firmware during startup.
Fake Claude site installs malware that gives attackers access to your computer
Tech Optimizer
April 13, 2026

Fake Claude site installs malware that gives attackers access to your computer

Claude, an AI tool developed by Anthropic, receives nearly 290 million web visits monthly and has become a target for cybercriminals. A fake website has been found that impersonates Claude, distributing a trojanized installer named Claude-Pro-windows-x64.zip. This installer, while appearing legitimate, deploys PlugX malware, granting attackers remote access to users' systems. The fraudulent site mimics the official download page and uses passive DNS records linked to commercial bulk-email platforms, indicating active maintenance by the operators. The ZIP file contains an MSI installer that incorrectly spells "Claude" as "Cluade" and creates a desktop shortcut that launches a VBScript dropper. This script runs the legitimate claude.exe while executing malicious activities in the background, including copying files to the Windows Startup folder to ensure persistence after reboot. The attack utilizes a DLL sideloading technique recognized by MITRE as T1574.002, where a legitimate G DATA antivirus updater is exploited with a malicious DLL. Within 22 seconds of execution, the malware establishes a connection to an IP address associated with Alibaba Cloud, indicating control over the compromised system. The dropper script also employs anti-forensic measures to delete itself and the VBScript after deployment. Indicators of compromise include the filenames Claude-Pro-windows-x64.zip, NOVUpdate.exe, avk.dll, and NOVUpdate.exe.dat, along with the network indicator 8.217.190.58:443 (TCP) as the command and control destination. Users are advised to download Claude only from the official site and to remain vigilant against potential compromises.
Microsoft's Secure Boot certificates expire in June 2026, but older PCs may never get the fix
Winsage
March 7, 2026

Microsoft’s Secure Boot certificates expire in June 2026, but older PCs may never get the fix

Every Secure Boot-enabled Windows PC relies on cryptographic certificates issued by Microsoft in 2011, embedded in the motherboard's firmware, to ensure a secure boot process. The first of these certificates will expire on June 24, 2026, which will affect the ability to receive future security updates for critical components of the Windows startup process. Microsoft is rolling out replacement certificates through Windows Update, marking a significant security maintenance effort. Secure Boot operates as a chain of trust with certificates stored in the motherboard's UEFI firmware, validating software before the operating system loads. The Platform Key (PK) is at the top of this chain, followed by the Key Exchange Key (KEK) and the Signature Database (DB). The replacement certificates introduced in 2023 restructure certificate management, separating responsibilities among different certificate authorities to enhance the trust model. Not all PCs are affected by the upcoming expiration; newer devices manufactured since 2024 already have the new certificates. Windows 10 users face challenges as support for this version ends in October 2025, and they will not receive the new certificates unless enrolled in Extended Security Updates. Home users should ensure their PCs are set to receive updates automatically, while enterprise environments require coordination for firmware updates before the Windows certificate update.
silver Android smartphone
Winsage
March 6, 2026

Microsoft’s Secure Boot certificates expire in June 2026, but older PCs may never get the fix

Every Secure Boot-enabled Windows PC relies on cryptographic certificates issued by Microsoft in 2011 for boot process integrity. The first of these certificates will expire on June 24, 2026, impacting the ability to receive future security updates. Microsoft is rolling out replacement certificates through Windows Update, requiring collaboration between Microsoft, PC manufacturers, and users. Three critical certificates will expire: the Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 in June 2026, and the Microsoft Windows Production PCA 2011 in October 2026. The new certificates introduced in 2023 have a restructured functionality to enhance security. Not all PCs are affected; newer devices manufactured since 2024 come with the new certificates. Windows 10 users face challenges as support ends in October 2025, and unsupported devices will not receive updates. Home users should ensure automatic Windows updates and check for firmware updates, while enterprise environments must verify firmware updates before applying certificate updates. The first certificate expiration is on June 27, 2026.
Speed Up Your Windows 11 Launch Time in a Snap. Here's How to Do It
Winsage
January 15, 2026

Speed Up Your Windows 11 Launch Time in a Snap. Here’s How to Do It

The delay in booting up a Windows 11 laptop can be caused by multiple applications that automatically launch at startup, which can hinder system performance. Common applications that may launch include antivirus programs, Microsoft OneDrive, Slack, gaming applications, backup tools, and webcam software. Users can manage these startup applications through three methods: Task Manager, Settings, or File Explorer. In Task Manager, users can view and disable startup applications by right-clicking on entries in the Startup apps menu. The impact of each application on startup time is categorized as high, medium, low, none, or not measured. In the Settings app, users can navigate to Apps and then Startup to toggle off applications they do not want to launch automatically. File Explorer can also be used to manage startup applications by accessing the shell:appsfolder and shell:startup or shell:common startup commands to view and modify the applications set to launch at sign-in. Users are advised to disable applications they rarely use while keeping essential security software enabled. Third-party startup managers like Autoruns and Startup Delayer can provide additional insights into startup applications. Similar management methods apply to previous Windows versions.
Search