[German]Quite a crude story that a German blog reader pointed out to me. Windows 10 behavior as a malware? On his Windows 10, entries for Microsoft Office apps like Excel, Outlook, PowerPoint and Word suddenly appear, even though he said that he didn't installed anything. After my initial post within my German blog, the darkness is slowly fading away – the nasty surprise has something to do with the new Chromium based Edge browser.
A reader reported his observation
German blog reader Hans Thölen contacted me yesterday by mail, reporting a strange observation. I've translated, what he has told me in his email.
Today I noticed that I have the programs Outlook, Excel, Word and PowerPoint installed on my [Windows 10] PC. I don't know where they come from either. I have nothing installed.
Hans has send my the following screenshot showing the installed programs under Windows 10. There you will find entries for Excel, Outlook, PowerPoint and Word. Did you noticed another strange thing? The publisher (column Herausgeber) isn't 'Microsoft Coporation' – Windows 10 lists 'Excel', 'Word', 'Outlook', 'Power Point' as the publisher for this programs. What the fuck is that? What a mess!
All entries are from 'installation date' October 10, 2020, and now the user's statement, that he has knowingly not installed anything, is left in the room. I asked within my German blog post: Has anyone else observed this behavior?
I only remember one strange thing I read on the web a few weeks ago. There, an Office was temporarily converted into an Office 365 subscription (see e.g. here). After a few days the old Office version was displayed again.
On my test computer with Windows 10 20H2 I did not find these apps. However, strangely enough, after logging in to the user account today I was suddenly greeted with a setup page and I had to go through several query pages. There they wanted to cheer me on my Android smartphone with Windows 10 and to test or buy a Microsoft Office 365.
Entries are connected to the Edge
After publishing the German article, German blog readers confirmed this strange observation (thanks to blog reader Charles for confirmation). And blog reader Birkuli pointed out in this comment, that the new Office program entries are connected to the new Chromium based Edge browser:
Apparently this has something to do with the Microsoft Edge. When uninstalling the modules, the uninstaller asks if Excel etc. should be removed from Microsoft Edge and these apps are probably this WEB-Office stuff (Microsoft Office WEB 365) or something like that.
They are constantly installed although I have Microsoft Office 365, apparently Microsoft is not able to detect the presence of MS-Office products in any version.
Blog-reader Hans Thölen took up the issue and tried to uninstall the modules from the program list. This dialog box was displayed to him.
(Office app uninstall message)
So it's a confirmation that the new entries has something to do with the new Edge Browser. Could be related to the Microsoft Edge Add-Ons, which were updated in the store on October 12, 2020 (the user reviews are interesting, by the way). I'm not going to rant here, but I'm wondering seriously what Microsoft is trying to do – and to trick people in that way? Some German blog readers are suspected, that the new entries has been added by ransomware … well, that's 'Windows as a surprise', I guess. Any thoughts about that topic revealed above?
Addendum: A/B Test with Edge
After the blog post here, some websites have taken up the topic. The colleagues at deskmodder.de pointed out in this German article that they had Office PWA entries in the start menu. The entries refer to:
C:\Program Files (x86)\Microsoft\Edge\Application
The PWAs are called via the new module msedge_proxy.exe. The PWAs can be used to open the corresponding Office online apps for displaying Office documents. The PWA icons appear in the Start menu and can be pinned to the taskbar.
Lawrence Abrams, whom I informed via Twitter, writes in this post at Bleeping Computer, that the Office PWAs are rolled out to different users as part of an A/B test. The PWA entries can be found in the control panel, under Settings – Apps and can also be uninstalled via edge://apps.
Cookies helps to fund this blog: Cookie settings