NewApp Digest
search bot

Windows Startup

Microsoft was better at software in the '90s, and these still-useful Windows utilities prove it
Winsage
September 28, 2026

Microsoft was better at software in the ’90s, and these still-useful Windows utilities prove it

Microsoft PowerToys originated during the development of Windows 95 as small programs created by engineers to test concepts and ease workloads. The first collection of PowerToys included tools like FindX, Send To X, and Tweak UI. System Configuration (MSConfig) helps isolate configuration and startup issues by allowing selective loading of services and startup components, remaining useful despite modern management shifting to Task Manager. Disk Cleanup was launched with Windows 98 to help users reclaim disk space, featuring commands that allow saving cleanup profiles, a functionality that persists in Windows 11. Task Scheduler, introduced in 1995 as System Agent in the Microsoft Plus! pack for Windows 95, automates tasks based on specific triggers. System File Checker (SFC), dating back to Windows 98, scans and repairs protected Windows resources, evolving from a graphical utility to a command-line tool. Device Manager provides an expandable tree of hardware components and reflects advancements in Microsoft's Plug and Play system from Windows 95, continuing to assist users in hardware inspection and troubleshooting. The DirectX Diagnostic Tool (DxDiag) was created for gamers in the late '90s to examine hardware and software configurations related to DirectX and remains available in Windows 11.
Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts
Winsage
September 19, 2026

Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts

Microsoft resolved an issue that caused misleading alerts indicating that Defender Antivirus was disabled after recent updates. This fix was confirmed in an update to the Windows release health dashboard and was implemented in the Microsoft Defender Antivirus update (version 4.18.26080.4) rolled out on September 17. The bug, acknowledged by Microsoft in late August, affected users in the Release Preview Channel of the Windows Insider program since at least June and impacted all supported versions of Windows clients and servers. Users received erroneous notifications in the Windows Security app prompting them to activate Microsoft Defender Antivirus, despite it functioning correctly. Misleading alerts could appear upon Windows startup and intermittently thereafter, even when notification settings were disabled.
Microsoft shares details of a clever old Windows trick it no longer needs
Winsage
August 12, 2026

Microsoft shares details of a clever old Windows trick it no longer needs

Microsoft's WINSTART.BAT file is a batch file that predates Windows 95 and was documented in the Windows 3.1 Resource Kit. Its primary function is to load terminate-and-stay-resident (TSR) programs for use by Windows applications, while these TSRs are not accessible to individual MS-DOS virtual machines. WINSTART.BAT is executed after the virtual machine manager (VMM) initializes, giving it an advantage over AUTOEXEC.BAT, which runs during the MS-DOS startup phase. TSRs loaded via AUTOEXEC.BAT are available to both Windows and MS-DOS environments, while those loaded through WINSTART.BAT are limited to Windows applications only.
LG Monitors Spotted Installing Adware-Like App on Windows PCs
Winsage
July 20, 2026

LG Monitors Spotted Installing Adware-Like App on Windows PCs

LG monitors connected to Windows PCs can trigger the automatic installation of the LG Monitor App Installer, which promotes paid subscriptions to McAfee antivirus software without user consent. This app appears shortly after Windows Update installs relevant LG packages, displaying McAfee promotions frequently. The app is designed to launch at startup and operates outside the Windows App Sandbox, raising cybersecurity concerns. Reports indicate that this issue affects both newer and older LG monitor models. Microsoft allows manufacturers to link Store applications with device metadata, enabling such installations without clear user choice. Users can remove the app through Windows Settings, but doing so may block other useful applications. LG and Microsoft have not publicly addressed these concerns.
Windows and Linux users: The deadline to update Secure Boot keys is near
Winsage
June 17, 2026

Windows and Linux users: The deadline to update Secure Boot keys is near

In 2012, a novel bootkit targeting Mac OS X systems emerged, infiltrating the EFI firmware. A basic bootkit for Windows 8 also appeared, compromising the UEFI bootkit. By 2013, a more sophisticated UEFI bootkit named Dreamboat was introduced for Windows. The first documented real-world UEFI attack occurred in 2018 with the malware LoJax, linked to a Kremlin-backed hacking group. In 2020, the second known UEFI malware, MosaicRegressor, was discovered, which verified the presence of a malicious file upon each reboot. New UEFI bootkits like ESpecter, FinSpy, and MoonBounce have since emerged. In response to the threat of UEFI bootkits, Microsoft collaborated with manufacturers to implement Secure Boot, a protocol that uses cryptographic signatures to ensure the integrity of firmware during startup.
Fake Claude site installs malware that gives attackers access to your computer
Tech Optimizer
April 13, 2026

Fake Claude site installs malware that gives attackers access to your computer

Claude, an AI tool developed by Anthropic, receives nearly 290 million web visits monthly and has become a target for cybercriminals. A fake website has been found that impersonates Claude, distributing a trojanized installer named Claude-Pro-windows-x64.zip. This installer, while appearing legitimate, deploys PlugX malware, granting attackers remote access to users' systems. The fraudulent site mimics the official download page and uses passive DNS records linked to commercial bulk-email platforms, indicating active maintenance by the operators. The ZIP file contains an MSI installer that incorrectly spells "Claude" as "Cluade" and creates a desktop shortcut that launches a VBScript dropper. This script runs the legitimate claude.exe while executing malicious activities in the background, including copying files to the Windows Startup folder to ensure persistence after reboot. The attack utilizes a DLL sideloading technique recognized by MITRE as T1574.002, where a legitimate G DATA antivirus updater is exploited with a malicious DLL. Within 22 seconds of execution, the malware establishes a connection to an IP address associated with Alibaba Cloud, indicating control over the compromised system. The dropper script also employs anti-forensic measures to delete itself and the VBScript after deployment. Indicators of compromise include the filenames Claude-Pro-windows-x64.zip, NOVUpdate.exe, avk.dll, and NOVUpdate.exe.dat, along with the network indicator 8.217.190.58:443 (TCP) as the command and control destination. Users are advised to download Claude only from the official site and to remain vigilant against potential compromises.
Microsoft's Secure Boot certificates expire in June 2026, but older PCs may never get the fix
Winsage
March 7, 2026

Microsoft’s Secure Boot certificates expire in June 2026, but older PCs may never get the fix

Every Secure Boot-enabled Windows PC relies on cryptographic certificates issued by Microsoft in 2011, embedded in the motherboard's firmware, to ensure a secure boot process. The first of these certificates will expire on June 24, 2026, which will affect the ability to receive future security updates for critical components of the Windows startup process. Microsoft is rolling out replacement certificates through Windows Update, marking a significant security maintenance effort. Secure Boot operates as a chain of trust with certificates stored in the motherboard's UEFI firmware, validating software before the operating system loads. The Platform Key (PK) is at the top of this chain, followed by the Key Exchange Key (KEK) and the Signature Database (DB). The replacement certificates introduced in 2023 restructure certificate management, separating responsibilities among different certificate authorities to enhance the trust model. Not all PCs are affected by the upcoming expiration; newer devices manufactured since 2024 already have the new certificates. Windows 10 users face challenges as support for this version ends in October 2025, and they will not receive the new certificates unless enrolled in Extended Security Updates. Home users should ensure their PCs are set to receive updates automatically, while enterprise environments require coordination for firmware updates before the Windows certificate update.
Search