2

I recently created a Windows 10 installation stick via the official media creation tool. Presumably, there was no malware on my host system on which I created the stick. It's a pretty fresh install as well, and was only used shortly on my home network for nothing interesting.

Then installed Win10 Pro on another laptop. Language/Region set to US.

Right after installation, everything is fine. Sadly, I need to use Edge for parental safety controls.

After the typical Windows Updates, however, the startpage of Edge is set to yandex.ru. That startpage then calls some links like yandex.ru/.../install and suddenly the default search engine is Yandex as well.

I know Microsoft partnered with Yandex in 2015 as default search in several Eastern countries, and while I am in Europe, I am not in Eastern Europe, and even then this should be a No-Go.

I reinstalled with region and language set to German, and everything was fine until the Windows 11 upgrade. Now Yandex is back.

What is happening here? I installed nothing (not even Firefox), didn't open any websites, only the Windows Updates seem to cause this.

It's an HP ProBook 650 G4, and some Intel and HP stuff gets installed via Windows Updates as well.

I formatted and overwrote the hard drive with random data between two installs.

Microsoft support isn't doing anything to help me.

If the root cause of this can't be fixed, what would be a good way to mitigate any danger/keep the system safe? I'm a Linux user, so I know very little about Windows Security. I figured the internal Windows Security was good enough by now and that one wouldn't need 3rd party virus scanners anymore.

https://sso.ya.ru/install?uuid=6fe0a793-49d3-4103-b1bc-5346dff46d37

2
  • How exactly did you get the original Windows installation files?
    – schroeder
    Jun 30 at 13:07
  • I downloaded the Installation Media Creation tool from the Microsoft website (checked the URL), which then continued to download and create the medium. I was on my home network during this, and I'm pretty certain no one else was on this network for some kind of MITM. Jul 1 at 20:04

1 Answer 1

2

It's possible that your Windows installation might have been compromised or tampered with. To address this issue and mitigate any potential danger, here are some steps you can take:

  • Perform a malware scan using reputable antivirus software. This will help detect and remove any malicious programs that may have been installed on your system. I recommend Malwarebytes!
  • Use a tool like TronScript. TronScript is an open-source tool that can perform malware scans using a lot of different anti-viruses. Please read the documentation here
  • Always check the integrity of any software or OS installers with checksums. You can find checksums on the same website where you download a file.
2
  • Thanks a lot, I will do this. Didn't realize Microsoft offered checksums, I will have to check that out. Jul 1 at 20:05
  • So it turns out Microsoft doesn't offer checksums anymore. You can only download their Media Creation Tool and trust that it uses checksums for its own downloads and media creations. Haven't found a checksum for the tool itself either. Somewhat disappointing. Jul 1 at 20:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .