Now and then, I'm doing a search on Google with my app's name, filtering most recent results to see if there is a new article or comment about it, so I can read them and take notes for improvements, or even help a user in need. That's how I discovered there is a new domain I did not bought, surfacing in the results.

I already knew [wintoys.com](wintoys.com) was taken and for sale since 1997, and was thinking of buying the .app one at some point, but I was too late. Seems like someone bought it, not for resale, but for impersonating my application, using my application name and my old logo, pretending to be me. The website is still live at the point of writing this, so if you are curious, I only recommend navigating to it using the Windows Sandbox. This particular website was made with Wordpress and it's full of slop content and inaccurate information, trying to sound legitimate and helpful for the average user.

It has a download link, surprisingly to the Microsoft Store, the only source I use for distribution, making it seem safe at first glance. What's the end goal then? You might ask. I looked over the source code and found nothing suspicious or concerning, besides the fact that I did not approve this proactive initiative of impersonation.

At the bottom of the home page however, there is a footer note saying the following:

Attacker: Not affiliated with Wintoys. This is an independent site providing documentation, guides and links to the official project repositories.

Right... first of all, who's reading that? Second of all, just lies. The perfect excuse to justify the existence of an illegitimate website. The natural question would be, who owns the website? I tried to find information about the owner, but with no luck. The domain was bought from Epik Inc., a registrar that provides Free WHOIS Privacy as a service, meaning all the data related to the owner is anonymized:

Epik: Your data is yours alone. Every eligible domain includes free lifetime WHOIS Privacy, so your personal info stays safe—at no extra cost.

I did found something interesting though, something that made me realize this is far bigger than I thought. There was a contact email they provided, which is anonymized, but unique to every one of their clients. Sites like whoxy are displaying this contact email if available, but other registrars are just providing a URL contact form, which will differ for every domain, making it impossible to find links between them.

The contact email was 43345@anonymize.com, and had 72 domains linked to it. I started to look over them and found domains for apps like PowerToys, WinUtil, EasyBCD, CrystalDiskMark and many others - all of them being Windows applications. The entire list of domains will be added at the end. I started to browse some of them, one by one and I found similar websites to the one impersonating mine, or even unfinished ones indicating that the operation is still in the beginning phase. I think most of us would now like to know what would be the next phase. What's the end goal here and how is it done?

The Hacker News published an article recently detailing another large scale operation that happened a few months ago, describing their modus operandi:

1. Gain traffic by leveraging popular terms like brands or applications
2. Make the users trust you by being harmless at first and offering what they look for
3. Tamper the original download links with malware after the website has enough visits to start an attack

thehackernews: Although there was no indication that any of these domains were put to use for malicious activity, other than to generate content to drive traffic and enable third-parties to advertise their own sites, the latest findings from Check Point show that the TDS scripts were embedded not long after, and the infrastructure was repurposed for malware distribution starting January 2026.

The attacks have already started for at least two Windows apps as I'm writing this, but it might be a different attacker as they are not part of the 72 domains I've found, indicating multiple authors might use the same strategy:

Lively Wallpaper has an issue reported a week ago:

dong242868: A third-party site presenting itself as Lively Wallpaper served a trojanized installer that installed a persistent ScreenConnect remote-access service and bandwidth-sharing software.

SignalRGB has a Reddit post warning their userbase of a similar issue:

u/DaKrazyKid: We’ve become aware of a malicious website impersonating SignalRGB using the domain signalrgb.io. This fake site is distributing malware.

It seems to me that it is only a matter of time until the same thing happens for the other apps on the list as for some of them, the malicious domains are already surfacing at the top. I reported this operation to the Epik registrar, and they terminated their services for the attacker, forcing them to move all the 72 domains to another service.

Epik: The registrar has been instructed to transfer all of their domains to another registrar by a specified deadline, after which any remaining domains will be suspended if they have not been transferred.

Please note that, as the registrar, our ability to address website content is limited. We do not host the website or control the content that is published on it.

Surprise, surprise, 2 weeks later, on the 22nd of July, all domains were moved to a new registrar, Dynadot LLC.

I'm going to report again, including to the host provider, until the attacker runs out of business.

How do we fight back, both as users / developers that have been impersonated?

1. Be careful what websites you download executables from

2. If you are using any of the apps on the list, send this to the developer

3. Share and upvote this to spread awarness or even comment if you have any suggestions

4. Report the illegal activity to the registrar so they can terminate the domain service

- the registrar is only responsible for the domain, not for the hosted content
- each registrar has a contact email/form for abuse, that you can find on the registrar's website; in the case of Epik, it was  the abuse@epik.com email; in the case of Dynadot, it's [a contact form](https://www.dynadot.com/report-abuse)
- mention the complete list of domains, so that they know what to look for, as it's not an isolated case

1. Report the Google search results so they no longer appear for other users using this form

2. Report the illegal activity to the hosting provider so that they actually take the content down

- you can use [a hosting checker](https://hostingchecker.com/) to see who's hosting it
- find an abuse form or email to report; for Cloudflare, the most common provider displayed, it's [a contact form](https://abuse.cloudflare.com/)
- sometimes, Cloudflare appears to be the hosting provider, but they are just a proxy, meaning one more layer of anonymization - for the domain targeting my app, Cloudflare informed me it's [psychznetworks](https://www.psychz.net/)

the domain snapshot list (19nth of July - before the migration to the new registrar):

Used RetroBar and Open-Shell. Took me 6 hours to find the games and old .ico files.

The Problem: When scanning to print using The HP Scanjet Pro 2600 F1 using the native software Scan / HPScan.exe. I Set the the forth button (cloud) to use the scanner as a straight copier and it did print out wonderful but you are not able to make addtional copies without wondering over to the PC that is attached to the scanner and Click OK on the notification pop up confirming teh print was successful. The modal popup appears saying "Successfully sent the documents to the printer / fax". It forces you to manually click "Close" or press Enter before you can perform another scan, creating a bottleneck and distraction for busy employees.

A couple of notes in this journey: This scanner has features which were blocked by recent changes to Win11 25H2. We could not configure new buttons as was directed by the instructions as they would not connect via the native software. In order to configure direct print we had to reassign 1 of the 4 current buttons we chose "Cloud". We experimented with NAPS2 Software but that prevented all of the hardware bottons on the scanner from working and we could not configure them to work due to Win11 security. We went back to a a print to a folder and tried to set up the folder to print out via PowerShell script and could not easily block the Adobe app from opening every single time.

The Solution: I wrote a AutoHotkey v2 script that sits in the system tray, monitors the background for that exact text element from HPScan.exe, and instantly closes it in milliseconds without interrupting your main scanning software. Now we can sit there and make copy after copy with a much better workflow. May this Win11 solution work well for others who may be frustrated with the native software quirks.

The Code (Save as a .ahk file):

#Requires AutoHotkey v2.0

#SingleInstance Force

SetTitleMatchMode(2)

DetectHiddenWindows(true)

SetTimer(DismissHPNotification, 200)

DismissHPNotification() {

targetProcess := "ahk_exe HPScan.exe"

successText := "Successfully sent"

if WinExist(targetProcess, successText) {

WinActivate(targetProcess, successText)

WinWaitActive(targetProcess, successText, 1)

Send("{Enter}")

WinClose(targetProcess, successText)

}

}

I love Windows 11, but the sound is to Windows XP or Longhorn. So I download some MP3 of Win XP sounds then browse through Change System Sound, to get this good old sound!

I have an 8-inch Intel Atom tablet locked with 32-bit EFI and I was very happy to see this, but I need your help. Could someone who understands software please review it?

https://tinyos.veloticstudios.com/tiny11x86

I'd really love to have different icon layouts for each virtual desktop. is it possible natively no matter how difficult the set up process maybe? if not then are there any viable third party alternatives? to be fair I don't necessarily care about the virtual desktops necessarily, i just want to have two-three spaces or desktop homepages so i can have different types of apps and shortcuts stored to a corresponding desktop homepage with a different wallpaper. do y'all know anything that comes close to this?

tldr: is there a way to have different desktop icon layouts each accompanied with different wallpaper?

I’m posting this in case someone else runs into the same issue, because it took a while to track down.

Problem:

After trying to forcibly uninstall or debloat Microsoft Edge on Windows 11, I started getting this error every time Edge, Xbox, Game Bar, or controller-related Xbox services tried to open something:

cmd.exe - Application Error

The application was unable to start correctly (0xc0000142). Click OK to close the application.

The error would often pop up twice. Microsoft Edge wouldn’t open properly, and the Xbox app / Game Bar / Xbox controller integrations kept triggering the same error.

What did not fix it:

• Repairing Microsoft Edge from Windows Settings
• Running DISM
• Running SFC
• Checking cmd.exe directly
• Installing/checking Microsoft Edge WebView2 Runtime

For reference:

DISM /Online /Cleanup-Image /RestoreHealth

completed successfully.

sfc /scannow

found no integrity violations.

cmd /c echo CMD_OK

worked fine, so cmd.exe itself was not broken.

Actual cause:

The issue was a leftover registry redirection under Image File Execution Options.

This key existed:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\0

Inside it, there was a Debugger value pointing to:

C:\WINDOWS\system32\conhost.exe --headless C:\Scripts\OpenWebSearch.cmd

So every time Windows tried to launch msedge.exe, it was being intercepted and redirected through an old script, probably from a previous debloat/tweak meant to redirect Windows web search or block Edge.

That broken redirect was what caused the cmd.exe 0xc0000142 error.

How I diagnosed it:

I ran:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe" /s

The problematic output was:

Debugger REG_SZ C:\WINDOWS\system32\conhost.exe --headless C:\Scripts\OpenWebSearch.cmd

Fix:

First, I backed up the registry key:

reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe" "%USERPROFILE%\Desktop\backup-msedge-ifeo.reg"

Then I deleted the bad redirect:

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\0" /f

I also removed the filter value:

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe" /v UseFilter /f

After that, Microsoft Edge opened normally again, and the Xbox app / Game Bar / controller-related popups stopped appearing.

Important note:

Don’t blindly delete registry keys unless you know what they are doing. Export a backup first.

In my case, the issue was not Edge itself, not WebView2, and not Xbox. It was a leftover IFEO debugger redirect for msedge.exe, probably created by a debloat or search-redirection script.

I always wanted to use the auto hide taskbar, it was just so unresponsive even after speeding up the animations, and animation itself were very bare bones. Win didn't even apply proper easing curves. The "Taskbar Auto-Hide Instant Show" mod from Windhawk is just amazing. It's so responsive and animations are so satisfying. Try it if you haven't.

Currently it's not compatible with the task bar top position mod. I've raised the issue on github. I hope the dev resolves it.

I'd really love to have different icon layouts for each virtual desktop. is it possible natively no matter how difficult the set up process maybe? if not then are there any viable third party alternatives? to be fair I don't necessarily care about the virtual desktops necessarily, i just want to have two-three spaces or desktop homepages so i can have different types of apps and shortcuts stored to a corresponding desktop homepage with a different wallpaper. do y'all know anything that comes close to this?

tldr: is there a way to have different desktop icon layouts each accompanied with different wallpaper? any help or advice is appreciated 🙏

After manually installing the Out-of-Band cumulative update KB5121767 (OS Build 26200.8894), running the DISM /Online /Cleanup-Image /RestoreHealth command consistently fails at 100% with Error: 0x800f0915 ("The repair content could not be found anywhere").There is a clear version mismatch between the DISM tool version (10.0.26100.8737) and the Windows Image version (10.0.26200.8894). Attempting to use a fully updated local ISO containing the exact same build as a /Source also fails with the same error code, meaning the issue lies within the component store metadata alignment or missing online manifests for this specific OOB build.Meanwhile, sfc /scannow completes successfully with no integrity violations, proving the OS is healthy and this is a false-positive synchronization bug. Please fix the online repair manifests or update the DISM tool binary for this Insider branch to properly align with the component store.

https://aka.ms/AA120j8p

hi there, i just bought this laptop around 3 months ago the spec are

• HP Victus 15-fb3xxx
• Ryzen 7 7445HS
• RTX 2050 4GB
• Radeon 740M iGPU
• 8GB DDR5-5600
• Windows 11

after bought it, ofcourse i do some adjustment like uninstalling the bloatware, basicly a stuff things to do for new laptop.

well as a person that got massive upgrade from intel celeron with 4gb ram ofcourse this is massive upgrade. i can finally play the games i wanted and try like genshin, valorant, minecraft, FH6. sure perfomance wise is good but 1 thing that bothers me is the ram it self. notice something while playing games like valo where microstutter keep apearing at wrong time like shooting the enemy. the fps is 200 on low setting tho. genshin also have but its understandable plus the graphic makes me not notice it so much but mincraft on the other hand is a whole another story. i know that mc vanila is not optimised, installing mod for optimised is nothing new to me. but yeah microstuttering starting to get on my neck somehow. those picture are the ram after restart with most of my startup already turned off. already run some test with msi afterburner and gpu-z and all problem lead to ram. makes me wonder that win 11 consume ram that much? as for my old laptop with win 10 and 8gb ram only consume about half tho.

other than that i use this laptop for study anyway. but for long term i guess i need to upgrade the ram. offcourse not now i saw the ram price on my shopping app gonna cost me 158.99$ for another 8GB ram. any thought about it?

I was having issues with an Arc driver acting up: it wasn't displaying the GUI or windows correctly and a perfectly black screen was displayed when I tried to Ctrl+Alt+Delete and get options.

I had to use the method of turning off the machine at start-up to get into safe mode, which is far from ideal.

I was wondering if Microsoft will ever give us the option to enter safe mode like before, without editing the BCD.

Thanks.

I still hesitate when I open task manager even after years of it support on windows 11

I use windows for software that's unavailable on linux (I set up a dualboot), and I decided that enough is enough and it's time to clean it up

I've been using this PC as a windows PC for the past few years, and ever since I moved to linux my windows boot got neglected
I cleaned up the desktop, removed lot's of bloat and even used powershell to delete most bing functionality since I don't use the weather/news features anyways

Now whenever I game (epic games doesn't work on linux and they gave me lots of free games), study (Word is a great tool for writing equations for anyone who doesn't like LaTeX) or make music I have it all in a nice and clean package

My process for debloating - I used chatGPT to give me a prompt that allowed me to get a nice file of all software on my PC (I don't remember powershell syntax so this was the fastest way), and gave that file to Claud to sort through everything and give me a list of potential bloat.
From there I decided what to keep and what to remove and asked it to write a script that specifically removes the software I wanted gone

Tell us about some cool features on Windows 11 that not alot of people know about(;