88
submitted 5 months ago* (last edited 5 months ago) by viking@infosec.pub to c/privacy@lemmy.ml

Hi all,

First off: Can't switch to Linux, Windows is a work requirement. Please spare me.

With that out of the way, here's my problem:

Since 2-3 days I've been seeing ads disguised as a minimized video player popup on my Windows 10 Login Screen image.

Initially I thought I might have been watching something on youtube and forgot to close the tab and it autoplayed in the background until reaching this stuff by chance; but that turned out not to be the case (I'm also using Firefox exclusively, which I thought wouldn't integrate with Windows, but I wasn't 100% sure on that end).

I tried to research this a bit, but the only similar case I found was in an old reddit thread saying that some Windows update installed the LinkedIn App for them, which is not the case here.

Antivirus (Bit Defender) and Malwarebytes both give me a clean report.

So I did some more digging and right click that thing with my firewall set to deny all to figure out where this is taking me, and surprise...

Image

There's a total of 100 connection attempts from Windows Search to around 10 different IP addresses, all of which belong to Microsoft.

I have not installed any updates in the last 14 days, no new software, and have not changed any system settings.

What did change is that I am currently not in China, where I normally live, but am on a business trip to Malaysia, where a bunch of services that are blocked in China might be accessible, and are now splicing in those (somewhat disguised) ads.

Does this happen to anyone else, and if so, do you have an idea how to get rid of it?

Thanks a lot in advance!

you are viewing a single comment's thread
view the rest of the comments
[-] krellor@fedia.io 27 points 5 months ago

Windows detects media being played and shows you that inlay with controls. It must be detecting that stream somewhere being played, even if it isn't obviously playing in a browser tab. You should be able to control whether it shows media controls on the lock screen.

[-] viking@infosec.pub 11 points 5 months ago

Been poking around a bit more, and found another entry in the Firewall that comes up right on boot, which is a service called MS.Edge.Webview2, which seems to be triggered through the Teams App (that I did have on autostart). I've now completely uninstalled Teams, and after a fresh boot the ad (or "media control") seems to be gone now. Guess I'll be using Teams from my phone or via browser in the future. No idea how that happened though, I never played any video through Teams.

[-] krellor@fedia.io 3 points 5 months ago

Glad you got it sorted. Weird about teams though. Have a good one!

[-] viking@infosec.pub 1 points 5 months ago

Yeah it's very weird, no idea what happened there. Maybe someone had somehow sent me a link and it was looping in the background? No clue. I gave up trying how teams and teams groups work a long time ago, the implementation is a major shitshow.

this post was submitted on 28 Jun 2024
88 points (94.0% liked)

Privacy

32159 readers
229 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS