There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

Windows 10 shows Linkedin Learning Ads on Login Screen

cross-posted from: infosec.pub/post/14206569

Hi all,

First off: Can’t switch to Linux, Windows is a work requirement. Please spare me.

With that out of the way, here’s my problem:

Since 2-3 days I’ve been seeing ads disguised as a minimized video player popup on my Windows 10 Login Screen image.

Initially I thought I might have been watching something on youtube and forgot to close the tab and it autoplayed in the background until reaching this stuff by chance; but that turned out not to be the case (I’m also using Firefox exclusively, which I thought wouldn’t integrate with Windows, but I wasn’t 100% sure on that end).

I tried to research this a bit, but the only similar case I found was in an old reddit thread saying that some Windows update installed the LinkedIn App for them, which is not the case here.

Antivirus (Bit Defender) and Malwarebytes both give me a clean report.

So I did some more digging and right click that thing with my firewall set to deny all to figure out where this is taking me, and surprise…

Image

There’s a total of 100 connection attempts from Windows Search to around 10 different IP addresses, all of which belong to Microsoft.

I have not installed any updates in the last 14 days, no new software, and have not changed any system settings.

What did change is that I am currently not in China, where I normally live, but am on a business trip to Malaysia, where a bunch of services that are blocked in China might be accessible, and are now splicing in those (somewhat disguised) ads.

Does this happen to anyone else, and if so, do you have an idea how to get rid of it?

Thanks a lot in advance!

send_me_your_mommy_milkers ,
@send_me_your_mommy_milkers@lemmy.world avatar

Whats stopping you from running windows in a VM?

viking OP ,
@viking@infosec.pub avatar

My employer. Who owns the laptop. And forbids me to fuck around with it…

send_me_your_mommy_milkers ,
@send_me_your_mommy_milkers@lemmy.world avatar

My condolences

BigTrout75 ,

There’s gpo and registry settings to turn that crap off. Sadly there’s a ton of it.

muntedcrocodile ,

Have u tried tiny 11. And Chris Titus debloater can kill a lot of crap with those as it removes most of the shit.

Have u considered running windows in a vm or using github.com/casualsnek/cassowary

viking OP ,
@viking@infosec.pub avatar

I haven’t heard of either, let me check if I can run those with my user profile and not break anything I need to log on to our corporate network in the process.

Lost_My_Mind ,

Oh, Windows 10? I wouldn’t know…

Not that I understand linux. I’m actually using an older computer. That’s right…Windows 3.1 baybee! Have you guys heard of this program called…MSPaint??? I can draw a cow!

Toes ,

I’m pretty impressed you got Lemmy to work in Netscape.

Ziglin ,

That doesn’t sound safe. I hope you sent this message with your phone. If you did it from the old computer and happen to have valuable data please feel free to share your IP address, someone might appreciate it…

Lost_My_Mind ,

My IP address is…192.168.1.1

Ziglin ,

Ahaha we’ve got you now!

swayevenly ,

Did you configure your windows 10 lockscreen to include the spotlight feature or other items?

viking OP ,
@viking@infosec.pub avatar

Not that I’m aware of, but I’ll double check.

yamaonan ,

I have noticed a similar behavior on one of my machines recently. Usually it’s a video (or recently played Spotify song) that gets ‘stuck’ there. Have you tried opening a new instance of Firefox, playing a video, then lock the computer (win + L) to see if it- at the very least- changes/updates to the newly opened video?

viking OP ,
@viking@infosec.pub avatar

I tried and it doesn’t update, even after a clean reboot with no browser open whatsoever. However I did find another entry in the Firewall that comes up right on boot, which is a service called MS.Edge.Webview2, which seems to be triggered through the Teams App. I’ve now completely uninstalled Teams, and after a fresh boot the ad (or “media control”) seems to be gone now. Guess I’ll be using Teams from my phone or via browser in the future.

yamaonan ,

Good to know, thanks for sharingn Glad to hear you’ve found a solution.

dalakkin ,

Most likely it’s an ad from one of your open Firefox tabs. Try exiting all your web browsers and see if that fixes it.

viking OP ,
@viking@infosec.pub avatar

Thought of that as well, but all ads are blocked and I get this popup even with the browser closed and after a full reboot (not just suspend and reactivate), so it must happen on system level, I assume. Checked my run on startup applications and services, and they appear to be clean as well.

systemglitch ,

I’ve never seen ff do that for anyone.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •