I always appreciate good to my original question - because of the rest below. maybe in scheduled tasks.hmmm.Īnyway, thanks for the insight. But this issue becomes a problem very soon after depoyment from image. I admit, I am not the brightest light on the xmas tree, which is why I reach out here to the other is the learning curve like for HijackThis Adam? I just assumed it was for root kit viri - and, in this manufacturing environment, it is more expedient to just blow away a PC and load the image than to deal with a root kit. That is why they are my primary suspect.Īnyway, take a look at what I have eliminated and tell me what you think if you like. Typically Microsoft likes to call home behind the scenes for licensing or whatever. (I am sure someone will point out that I am probably wrong in that assumption as well) People used to make jokeware in the 90's but those days are over and now hackers just want money or information that leads to money. I can't picture anyone making malware these days that only did that one silly thing. No, I haven't done Hijack this but we do have Trend Micro installed.
Because it is a production reporting PC, we can't have screen savers kicking in and locking the users out etc.
There are no policies being pushed as this group of devices is in a policy-free OU. In this production environment, I wear most of the hats. And I am just guessing at some of these because I don't have time to research every HKEY. and using Autoruns by Sysinternals, IĮverything in the red rectangles that I thought might be unnecessary. I verified Edge is not even installed on these thin am very turn-of-the-century when frustrated. Turning on Write filter protection is not going to cure this because it is already baked into the system somehow and will rear it's ugly head every time. I have disabled all kinds of settings, removed Bing search engine, disabled IE, removed all extensions. So, at startup, something nasty insists on calling home to MS. This anomaly only occurs on autologin/startup.
(Because), The settings in the startup folder shortcut are as follows:įiles\Google\Chrome\Application\chrome.exe" -kiosk " If I launch the shortcut manually, directly in the startup folder, it works as expected. How do I figure out what is making the call to MSN? Wireshark? ProcMon? So I can stop it and get back to a normal kiosk? I have come to the conclusion that Microsoft IS the virus. However, I am left with a non-standard - non-kiosk Chrome instance. Fortunately, the Barracuda blocks the page, as it was supposed to do. This takes the browser out of kiosk mode. Recently, some of our thin clients started opening an extra tab which tries to reach msn.com. This has been working without a hitch for the last year-ish. I have an HP Windows 10 thin client which runs Google Chrome to open an on-prem web site in kiosk mode (On boot up).
0 kommentar(er)
