A user reported that weird popups appear at random times in the lower right corner of her Windows 10 Enterprise desktop. Malwarebytes found no infection. From her browsing history, I see that she visited config.hdocumentconverters.com, then “Documents Converter” in the Chrome Web Store, but there are no related plugins installed in Chrome. So where are these popups coming from?
She sent me this screen shot of a popup:
So it’s definitely from documentconverter.app, but Chrome isn’t even running.
Then today when I logged on, before I started Chrome, I saw this as a native Windows notification:
Oh, I get it now: Chrome is authorized to use Windows 10 native notifications. That’s not bad in itself, but I do wonder how it makes the popup “stick”—most Windows notifications disappear after a few seconds.
One way to temporarily hide the popup is to click on the notification icon (with the small “2” in the first screenshot above) to open all notifications in a sidebar, click Clear all notifications, then click outside the sidebar to close it.
You could disable all Windows 10 notifications from Chrome by pasting this into Chrome and choosing Disable:
chrome://flags/#enable-native-notifications
But what we really want to do is disable notifications from the documentconverter.app. In Chrome, go to Settings > Advanced > Site Settings > Notifications, or just put this in the address bar:
chrome://settings/content/notifications
If you click on the small right-arrow next to https://documentconverter.app here, you’ll see its permissions. Click on Clear Data and Reset permissions:
Now when you go back to the main Notifications list, you should find that documentconverter.app has been removed from the list.
For good measure, I decided to go to https://documentconverter.app and explicitly block its notifications:
That page offers to take you to their Chrome web store app:
https://chrome.google.com/webstore/detail/documents-converter/gfmjegapdkjglhibplipeojcpgadgdie
where I used the Report abuse link to say, “https://documentconverter.app, which leads to this app, hijacks notifications for spam popups.“
