Hi all,

First off: Can’t switch to Linux, Windows is a work requirement. Please spare me.

With that out of the way, here’s my problem:

Since 2-3 days I’ve been seeing ads disguised as a minimized video player popup on my Windows 10 Login Screen image.

Initially I thought I might have been watching something on youtube and forgot to close the tab and it autoplayed in the background until reaching this stuff by chance; but that turned out not to be the case (I’m also using Firefox exclusively, which I thought wouldn’t integrate with Windows, but I wasn’t 100% sure on that end).

I tried to research this a bit, but the only similar case I found was in an old reddit thread saying that some Windows update installed the LinkedIn App for them, which is not the case here.

Antivirus (Bit Defender) and Malwarebytes both give me a clean report.

So I did some more digging and right click that thing with my firewall set to deny all to figure out where this is taking me, and surprise…

Image

There’s a total of 100 connection attempts from Windows Search to around 10 different IP addresses, all of which belong to Microsoft.

I have not installed any updates in the last 14 days, no new software, and have not changed any system settings.

What did change is that I am currently not in China, where I normally live, but am on a business trip to Malaysia, where a bunch of services that are blocked in China might be accessible, and are now splicing in those (somewhat disguised) ads.

Does this happen to anyone else, and if so, do you have an idea how to get rid of it?

Thanks a lot in advance!

  • nfh@lemmy.world
    6·
    5 months ago

    I haven’t had this happen personally, but are you allowed to edit your hosts file? I’m assuming those IP addresses are coming from DNS resolution, and if you hardcode those DNS entries to resolve to 127.0.0.1, it’ll stop the ads.

    nslookup <ip address> should give you the domain names, if not there’s DNS logs in Event Viewer that should tell you.

    • viking@infosec.pubOP
      6·
      5 months ago

      Yep I can access the hosts file, that’s a great idea. Will give it a shot. I just hope those aren’t IPs that MS is using for genuine requests of applications I have to use such as Teams or Outlook… But will give it a try, at least if anything else breaks, I know what to do to resolve that. Thanks for the tip!

      • youmaynotknow@lemmy.ml
        1·
        5 months ago

        I use the whole 365 suite, including cloud pc, provided by my work, on Fedora. I block a whole lot of stuff, and everything works, minus the annoying ads and pushy up sales.

        YMMV, but I strongly suggest you start blocking crap at the hosts level, if something breaks, start unblocking.