Spam Popups in Windows 10 Notifications

A user reported that weird popups appear at random times in the lower right corner of her Windows 10 Enterprise desktop. Malwarebytes found no infection. From her browsing history, I see that she visited config.hdocumentconverters.com, then “Documents Converter” in the Chrome Web Store, but there are no related plugins installed in Chrome. So where are these popups coming from?

She sent me this screen shot of a popup:

Spam popup 1

So it’s definitely from documentconverter.app, but Chrome isn’t even running.

Then today when I logged on, before I started Chrome, I saw this as a native Windows notification:

Spam popup 2

Oh, I get it now:  Chrome is authorized to use Windows 10 native notifications. That’s not bad in itself, but I do wonder how it makes the popup “stick”—most Windows notifications disappear after a few seconds.

One way to temporarily hide the popup is to click on the notification icon (with the small “2” in the first screenshot above) to open all notifications in a sidebar, click Clear all notifications, then click outside the sidebar to close it.

You could disable all Windows 10 notifications from Chrome by pasting this into Chrome and choosing Disable:

chrome://flags/#enable-native-notifications

But what we really want to do is disable notifications from the documentconverter.app. In Chrome, go to Settings > Advanced > Site Settings > Notifications, or just put this in the address bar:

chrome://settings/content/notifications

If you click on the small right-arrow next to https://documentconverter.app here, you’ll see its permissions. Click on Clear Data and Reset permissions:

Spam popup 3

Now when you go back to the main Notifications list, you should find that documentconverter.app has been removed from the list.

For good measure, I decided to go to https://documentconverter.app and explicitly block its notifications:

Spam popup 4

Spam popup 5

That page offers to take you to their Chrome web store app:

https://chrome.google.com/webstore/detail/documents-converter/gfmjegapdkjglhibplipeojcpgadgdie

where I used the Report abuse link to say, “https://documentconverter.app, which leads to this app, hijacks notifications for spam popups.“

Spam popup 6

8 thoughts on “Spam Popups in Windows 10 Notifications

  1. Jason Brooks

    I hate the fact that Chrome is allowed to intrude your space with Windows notifications. I just turn on Focus Assist as a quick fix, but then I don’t get potential windows notifications that I might want.

  2. Mark Berry Post author

    @Jason, haven’t seen this kind of spam since I wrote this. I do find one Chrome notification helpful in the Windows notification tab, when I get a Google Voice text message. If you don’t want any Chrome notifications, try going to chrome://flags/#enable-native-notifications and choosing Disable.

  3. Bill

    Mark – thanks for posting this. I just had the same issue on a windows machine, from “2solo.biz” Your instructions allowed me to clear it all up.

    Thanks

  4. Sue

    Appreciate this post. I followed it step by step, as I was receiving notification of ads and spam from gateinchatopen.com.
    It was found in the allowed websites.
    It worked, and removed all the notifications automatically.
    Thank you.

  5. martin

    Thanks for this, nice and simple (“In Chrome, go to Settings > Advanced > Site Settings > Notifications, or just put this in the address bar:

    chrome://settings/content/notifications” – scrolled down, found the bugger. Dealt with it)

  6. Peter Been

    Within my organization we receive many calls about spam popups; we work with Windows 10 plus own images; do the pop ups appear irrespective the kind of images used or what?

  7. Mark Berry Post author

    @Peter, I don’t understand the part about working with your “own images.” Are you saying that images you have created are appearing in the popups? If the source of your popups is a Google Chrome notification, the process for eliminating the popups should be the same: 1) Determine from the popup which app is creating the popup. 2) In Chrome, delete that app’s data and block notifications.

    It’s certainly possible that some other app or malware is creating popups. Hopefully the popup itself will tell you its source (like in the first image above, it says, “Google Chrome – documentconverter.app”.

  8. helen andre

    Thank you so much, I had messages about a virus which luckily I knew I didnt have but I did not now where to look to try and switch it off. I had 35 messages in less than an hour and when I clicked close it set off an alarm and the newly opened window wouldnt close either The site was shown as www2-news-back.org, I’d seen this on one of the messages. Followed your instructions and blocked it. All 35 messages went and no further incidents, plus I may manage easier if it happens again, very grateful

Leave a Reply

Your email address will not be published. Required fields are marked *

Notify me of followup comments via e-mail. You can also subscribe without commenting.

This site uses Akismet to reduce spam. Learn how your comment data is processed.