Replies

[TJ]

New Microsoft Outlook is sharing user data with 772 advertisers according to
https://www.ghacks.net/2024/01/12/proton-mail-says-that-the-new-outlook-app-for-windows-is-microsofts-new-data-collection-service/

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

• This reply was modified 1 year, 4 months ago by TJ. Reason: Added Exchange

3 users thanked author for this post.

Bookman, Cybertooth, windbg

[TJ]

This is indeed alarming.

Here’s the link to the G.translatation of the said C’t article to English https://www-heise-de.translate.goog/select/ct/2023/28/2331715395648017635?seite=all&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

• This reply was modified 1 year, 5 months ago by TJ. Reason: typo

2 users thanked author for this post.

Cybertooth, windbg

The updated Master Patch List shows KB5031356 as being the Windows 10 22H2 November cumulative update, but isn’t that the October cum.update and shouldn’t KB5032189 be the correct November cum.update?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Installed KB5028166 without any problems. It wanted one reboot – I did three to make sure.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

[TJ]

Am I correct to assume that the problems caused by KB5028166 only effect Windows 10 Home 22H2, and not (my) Windows 10 Pro 22H2?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

• This reply was modified 1 year, 10 months ago by TJ. Reason: underlined Home and Pro to emphasize difference

defenderbootstrapper.exe tried again just now. Different process id, different source ports, same destinations. See screen print.

In case you’re interested in the times: I’m on GMT +2 (Daylight Saving Time)

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

1 user thanked author for this post.

geekdom

I’m using Microsoft 365 C2R Personal, with Defender as only av.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Malwarebytes AND Defender turned off sounds quite dangerous and unusual. I never experienced that. I would check the logs.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Thanks, but that’s a bit too technical for me.

Maybe I should rephrase my question:

Is the registry fix effective [enough] to ward off malicious executables, or is formentioned user ‘cakruege’ right in saying it is not?

 

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

I read the article on Bleepingcomputer and saw that user ‘cakruege’ commented that the fix does not work (properly) https://www.bleepingcomputer.com/news/microsoft/10-year-old-windows-bug-with-opt-in-fix-exploited-in-3cx-attack/#cid26696.
For proof he provides a link to https://github.com/mtrojnar/osslsigncode but I don’t know how to interpret all that.
Anyone care to look into this and translate it to layman’s wording?

 

And I’m curious why nobody reacted to this topic yet?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

I’m using a vpn yes.
But to my shame I must confess I didn’t read the rule information correct: there never was an established connection to ip 66.198.240.5 – that ip was shown only as an example how to check Local and Remote ip addresses. Ports is same story….

These are the destination addresses according to the log:
20.189.173.6 (once), 13.107.228.50 (twice), 13.107.229.50 (twice) which are all MS Domains.
Those are from today only. Don’t have logs from before because most logs are cleared before backup.

For all four the Process ID is 9188, source ports: 49709, 49710 and 49711, the destination port is 443 for all four.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

defenderbootstrapper.exe was trying to phone home again just now.
Different port this time: 4792.
https://www.adminsub.net/tcp-udp-port-finder/4792

Before it was port 320 https://www.adminsub.net/tcp-udp-port-finder/320

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Well, my comment was directed at you. Your stance made me realize this should be investigated further, and therefore I reopened this topic. And I thank you for your it.

(And @Alex5723 also gave the impression that the topic is not resolved yet)

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Thank you. Considering your arguments I will revert the status of this topic back to “Unanswered”.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

If you mean this is MS’ way to also check C2R users, then why does/did it run more than once?

* Why I marked this topic as resolved, is because we now know it is a MS signed….. something. See b’s #2547830 answer.
And although I still find it a sneaky operator, it is for 99% certainty no malware.

If you would keep this topic open: why?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

1 user thanked author for this post.

Alex5723