Look for a folder on the desktop or Start Menu containing optimization scripts.

These are custom, unauthorized ISOs created with tools like NTlite or MSMG Toolkit . They remove critical components: Windows Defender, firewall, update service, system restore, and sometimes even core drivers.

In 2024–2025, several "Windows MiniOS" variants were found to contain the Lumma Stealer malware, which extracts browser passwords and cryptocurrency wallets.