Examkin

Question

Difficulty: MediumWeb Browser Security and Pop-Up/Redirect Troubleshooting

A technician is troubleshooting a Windows 11 workstation. The user reports receiving frequent pop-up advertisements styled to resemble legitimate operating system security alerts in the bottom-right corner of the desktop, even when all web browser windows are closed. Full system antivirus and anti-malware scans complete with zero infected files detected. Which of the following is the MOST likely cause of these pop-ups?

  1. The user granted website notification permissions to a malicious domain within the web browser settings.Answer
  2. B
    A Trojan has modified the Windows hosts file to point common system update URLs to an ad-serving IP address.
  3. C
    The local system account has been compromised by ransomware executing scripts via Task Scheduler.
  4. D
    The browser's Proxy Auto-Configuration (PAC) script setting was directed to a rogue remote server.

Answer

The user granted website notification permissions to a malicious domain within the web browser settings.
The correct answer identifies that modern browsers utilize Web Push APIs integrated into the operating system notification framework. Websites frequently prompt users to allow notifications; if granted to a malicious or rogue site, advertisements formatted like system security warnings will appear on the desktop even when browser windows are closed, and antivirus scans will come up clean because no local malicious executable is installed.

Step-by-Step Solution

1
Analyze the reported symptoms and diagnostic findings.
Pop-ups resemble OS notifications, appear in the bottom-right corner, occur while browsers are closed, and anti-malware scans show clean results.
This indicates a legitimate system feature is being exploited rather than file-based malware residing on the local disk.
2
Evaluate browser push notification mechanisms.
Web browsers use background service workers to deliver push notifications registered under site permissions, displaying them using native OS notification UI even when the browser application interface is closed.
Deceptive websites often trick users into clicking 'Allow' on notification prompts under the guise of CAPTCHA verification or video playback.
3
Determine the remediation steps.
Navigate to the browser's privacy and security settings under 'Site Configuration / Notifications' and revoke permission for all untrusted or suspicious domains.
Revoking the domain's notification permission immediately stops the background push notifications without needing OS reinstallations or malware removal tools.

Key Concept

Browser Site Permissions and Web Push Notification Security
Rate this question

Topics

Web Browser Security and Pop-Up/Redirect Troubleshooting

More questions from this topic