Looking at MS' track record I'm confused why anyone would assume a malicious 3rd party first while Microsoft has been "trying to turn it off and on" again for hours.