The desktop is managed by then explorer.exe and dwm.exe (Desktop Window Manager) processes. The code is contained in the process exe and the many DLLs they load. This is all very complex.
As to where the ad is ultimately pointing to, this is something the adware developers really don't want you to know and have devoted considerable effort to ensure you don't. There are many ways of doing this.
Hi simonc8,
You said you ran various malware detection programmes. Which ones did you run?
Could you grab a screen shot of this ad that pops up that includes the link and attach in reply?
1. I attach a screen grab showing the ad (I reduced the image size and pixelated my email programme) but you can see where the ad is - this one was for something to do with mis-selling by Barclays bank.
2. The programmes I've tried are Microsoft Security Essentials, Malwarebytes (free edition) and RogueKiller.
However thanks to running Process Manager as suggested by WinDozeUser at #2 I may have isolated the problem. The ad disappeared shortly after a call to wpscenter.exe which is something installed with KingSoft WPS Office which I have on my machine although I rarely use it. I've set up a Windows firewall block on that programme, so let's see what happens...
Fascinating that because an ad appeared on my screen relating to Bitcoin people immediately assume I'm a Bitcoin user!
The answer is: I had installed WPS Office, a free alternative to Microsoft Office, on my system. It turns out it generates ads and puts them on your desktop. By disabling one of the installed programmes, called wpscloudsvr.exe which will be found somewhere in C:\Users\your user name\AppData\Local\Kingsoft\WPS Office I stopped these ads appearing.
Sorry about that - Spammer got to post as I was dealing with them, as soon as you mention a "popular" subject these days, they appear, but we normally get them before members see them
Quote