Windows 10 as MALWARE!?!?

smuggler.ie

This afternoon I got several popups while try to open new tab in Mozilla browser. What a shame - mimicking malware.

Wonzy

Is MSN your default homepage? I doubt MSN just popped up after opening a tab

smuggler.ie

It is NOT and it still poppet in 3 different instances.

GerardKeating

Wonzy wrote: »

Is MSN your default homepage? I doubt MSN just popped up after opening a tab

I have started to get this on a few different MS Servers the past few days.

smuggler.ie

Again this morning, this time it was first thing that open when i clicked Mozilla's icon like it would be my homepage. I double checked settings - no, google is still homepage. So what a.. is going on?

STB.

The pop up is not in firefox. Its a notification generated by Windows.

Right in the bottom left hand corner to the right of the time and date. Choose properties. Customise Notification Icons. Under GWX, choose Hide Icons and notifications.

smuggler.ie

STB. wrote: »

The pop up is not in firefox. Its a notification generated by Windows.

Right in the bottom left hand corner to the right of the time and date. Choose properties. Customise Notification Icons. Under GWX, choose Hide Icons and notifications.

WIN8.1Enterprice
I have no GWX, as any Enterprise version should not have this as much i know(Volume licenses not getting free upgrades under that schema)
As you can see in original snip MSN website in background, I DIDN'T OPEN IT , IT POPPED ITSELF instead of new tab I intend to open. I do not use MSN as home page, I newer use MSN at all.
Thanks

maki

The notification isn't from Windows itself, but rather from JavaScript, as it's only dimming the browser content pane and not the toolbars at the top.

If you look at the URL parameters at the top, you can see ocid=wispr.

I'm not sure why exactly the popup is happening (do you have in-browser authentication for your network?), but it's related to Microsoft NCSI, which checks network connectivity. Basically something on your network isn't allowing access to msftncsi.com. You can either allow it, or disable active probing by modifying the below registry value to 0:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing

Note that if you choose the latter you'll lose network status indicators and Windows will always say you're connected to the internet even if you're not.

smuggler.ie

maki wrote: »

The notification isn't from Windows itself, but rather from JavaScript, as it's only dimming the browser content pane and not the toolbars at the top.

If you look at the URL parameters at the top, you can see ocid=wispr.

I'm not sure why exactly the popup is happening (do you have in-browser authentication for your network?), but it's related to Microsoft NCSI, which checks network connectivity. Basically something on your network isn't allowing access to msftncsi.com. You can either allow it, or disable active probing by modifying the below registry value to 0:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing

Note that if you choose the latter you'll lose network status indicators and Windows will always say you're connected to the internet even if you're not.

Got you .
Sounds convincing. I had second router(lab environment, separate network, no internet connection, first tab on screenshot "B593s-22") connected to PC on second NIC. That could trigger NCSI .
If I am right it should only prompt me to log in to routers interface.
Instead it redirect(as browser hijacker) me to MSN web page what trigger ads to pop(as adware). So it act like malware:D. Funny or not, but that is what you get along with most freeware.
Check this link, specifically at the very end:
http://answers.microsoft.com/en-us/newmsn/forum/newmsn_browse-newmsn_homepage/remove-ocid-wispr-website-and-msn-when-signing-on/4fdc5a42-811f-4ce5-a756-4f3cab3f6b29
Thanks for info

smuggler.ie

Some more reading about NCSI
http://blog.superuser.com/2011/05/16/windows-7-network-awareness/