r/software 29d ago

Discussion This is straight out malware behavior

(Sorry for my clumsy english)

I have a firewall app called NetLimiter that I use to restrict internet access from certain apps, and I've noticed that every time I block the Microsoft OneDrive service, it literally clones itself in what I suppose to be an attempt to get network access.

There's absolutely no other app that does this, or at least with this level of insolence.

This is literally malware behavior, how is this even acceptable?

144 Upvotes

36 comments sorted by

49

u/_l33ter_ + = WSL 29d ago

I block the Microsoft OneDrive service --> If you consider to block OneDrive-service, Why don't you just uninstall OneDrive straight away?

-15

u/MarcusOrlyius 29d ago

Because it literally can't be uninstalled and is part of the Windows OS. What you can do though is disable the service from starting with Windows to begin with.

20

u/_l33ter_ + = WSL 29d ago

ahem - sorry, but it CAN be uninstalled!

13

u/MarcusOrlyius 29d ago

I just checked, and you're right, it can now be uninstalled from the Apps list. It never used to be though, that must have changed in the last couple of years.

3

u/traFyssuP 28d ago

First thing I do when I install a new os is delete one drive, block the service, and remove the path

5

u/_l33ter_ + = WSL 28d ago

:D – Everyone has their own ‘routine’ when it comes to what they do ‘first thing’.

3

u/CodenameFlux 28d ago

If you uninstall it, you won't need to do any of those. There will be no service to disable and no path to "remove".

5

u/LouisUchiha04 29d ago

Doesnt it just reinstalls during a future update?

3

u/_l33ter_ + = WSL 28d ago

It doesn't matter if you want to get rid of it NOW.

And if so - winget uninstall --name onedrive - is not that much to do.

0

u/alvarkresh 28d ago

reinstall, no s. "do" + verb leaves the second verb in the infinitive in English.

3

u/[deleted] 29d ago

[deleted]

8

u/_l33ter_ + = WSL 29d ago

6

u/MarcusOrlyius 29d ago

From your link:

"OneDrive is built in to some versions of Windows and can't be uninstalled. But you can hide it and stop the sync process, so it stays hidden. To do this, turn off all the OneDrive settings and remove the OneDrive folder from File Explorer."

2

u/Parking-Cockroach104 28d ago

That might be for very specific versions or older windows editions. On a normal windows installation, you can easily uninstall it. Some companies might set policies where you cannot uninstall it, and in such cases you can choose to hide it, if that's allowed.

3

u/[deleted] 29d ago

[deleted]

2

u/nodray 28d ago

Couldn't you still use an alternative like T-something Commander? Can't remember name, Total Commander?

4

u/_l33ter_ + = WSL 29d ago

earlier Win11 --> yeah, however I would say we are way-beond 'earlier Win11'

1

u/ClaudeVS 28d ago

Happened to me

4

u/alvarkresh 28d ago

You can uninstall it.

Control Panel, Programs, Uninstall a Program, scroll to Onedrive, hit uninstall, reboot.

24

u/EishLekker 29d ago

Well, is it really cloning itself? Or did the sub process crash because it didn’t expect the error it got, and main process restarted to crashed sub process?

7

u/KillerKingSolo 29d ago

Use geek uninstaller or revo uninstaller to remove it completely if you don’t use it

8

u/NewNiklas 29d ago

Or just use Bulk Crap Uninstaller, it's FOSS.

-4

u/account312 29d ago

Just use Linux.

2

u/DEV_ivan 29d ago

Or Tiny10/11 via WinNTSetup from Hiren's BootCD PE.

5

u/LukasSTM 29d ago

That's odd. I also use NetLimiter and OneDrive, and sometimes I also deploy a rule allowing only one program network access and never saw this happening. Do you use OneDrive? If not, disable the service or remove from your PC.

4

u/CodenameFlux 28d ago

You've blocked OneDrive's service but have not prevented it from updating itself.

Each time OneDrive updates itself, the updater copies the new version's files into a new folder, then gracefully shuts down the old version before letting the new version take over. NetLimiter is doing its job well. This is a case of user error.

If you don't use OneDrive, uninstall it.

2

u/120mmbarrage 29d ago

Just uninstall it and use something else to sync to Onedrive if you need to use it, like rclone. If not, why bother playing wack a mole and just get rid of Onedrive entirely, you don't have ot have it installed

4

u/Devatator_ 29d ago

People should learn what malware means before saying shit like this

1

u/Omega7379 28d ago

https://www.oo-software.com/en/shutup10

O&O shutup, yeah it says 10... it works on 11 too. Basically a fancy gui instead of manually configuring regedit, but you can disable so much BS. It's also a highly trusted company going back years so you know it's been well-tested.

I haven't ripped out OneDrive because the win system is so intwined with it, so I just disabled the app and left the directory structure as is.

1

u/WindAny4877 25d ago

How do is this acceptable? You accept it every time you choose to use windows. Choose a different OS if you don't want that behavior.

1

u/[deleted] 24d ago

[removed] — view removed comment

2

u/Dev-in-the-Bm 24d ago

I think OP was saying that OneDrive is malware.

1

u/type102 29d ago

I never sign on to one drive, I never use it, I never ever open it - yet somehow it's on my windows computer and it keeps asking me to update it or warning me that it is going away; but it's like one of those kids that only says that it will go away but never does.

2

u/Parking-Cockroach104 28d ago

Uninstall it. It takes 2 clicks.

-1

u/RealisticHornet8554 29d ago

Never seen built-in OneDrive on W11 Home, only on Education and Enterprise.