[Guide]Way to Disable Keylogger/ Telemetry v3.55

Don't bother attempting to reason with or make an idiot understand why they are an idiot. It never works. Anyone dumb enough to not understand after "breaking" one device with a pre-alpha OS and experimental script that trying it again, seeing the same thing, then STILL trying it a THIRD time clearly isn't someone to be worrying about. You can't defend these people from themselves sadly.

As with conspiracy fantasists, there are more important things to be getting on with than them.

 

I won't be using Windows anymore from version 8 onwards, you just don't know what sort of underhand stuff will be going on under it's hood.

 

Cosy there is a saying that goes with this.

Trust but verify. Do not make blanket statements without proof. I'm not disagreeing with what your saying just merely saying trust by verify.

 

Ok we need to test this script then add version scanning into it which I've commented in to do.

We will test for a version higher than Windows Vista. This will allow us to do smart scanning of the versions so that we don't apply Windows 10 stuff to Windows 7.

Code:

#Version 0.14 Tracking Wiz Controller Script
#GUI by Mr. Jinjie
#Script by Smorgan and Murphy78
#With help from KnowledgeableNewbie and Lite8

$winver = (gwmi win32_OperatingSystem).Version
$arc = $ENV:PROCESSOR_ARCHITECTURE

function COMMANDER-JIN-JAY {

#region Import the Assemblies
[reflection.assembly]::loadwithpartialname("System.Windows.Forms") | Out-Null
[reflection.assembly]::loadwithpartialname("System.Drawing") | Out-Null
#endregion

#region Generated Form Objects
$form1 = New-Object System.Windows.Forms.Form
$button5 = New-Object System.Windows.Forms.Button
$button4 = New-Object System.Windows.Forms.Button
$button3 = New-Object System.Windows.Forms.Button
$button2 = New-Object System.Windows.Forms.Button
$button1 = New-Object System.Windows.Forms.Button
$InitialFormWindowState = New-Object System.Windows.Forms.FormWindowState
#endregion Generated Form Objects

#----------------------------------------------
#Generated Event Script Blocks
#----------------------------------------------



$handler_form1_Load= 
{

}



$handler_button1_Click= 
{

###########################################################################################################
#          Button 1 commands                                                                              #
###########################################################################################################

Write-Host Disable Full Telemetry

Write-Host Disable Windows Error Reporting
Disable-WindowsErrorReporting
Write-Host Clear the Event Cache
wevtutil el | Foreach-Object {wevtutil cl "$_"}

write-host Certificate Section

certutil -addstore "Disallowed" "$PWD/msitwww2.crt"
certutil -addstore "Disallowed" "$PWD/MicSecSerCA2011_2011-10-18.crt"

write-host Hosts Modification

copy-item "C:\Windows\System32\Drivers\etc\hosts" "C:\Windows\System32\Drivers\etc\hosts.backup" 

Function Route_Table_Updaterer (){

$b = Get-Content $PWD\ip_addy_list.txt

ForEach ($i in $b) {
route add -host $i reject
}}
Route_Table_Updaterer

write-host Disable DiagTracking

#Not Present in Windows 8.1
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows" -Name "CEIPEnable" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "DisableAutomaticTelemetryKeywordReporting" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "Disabled" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "TelemetryServiceDisabled" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\TestHooks" -Name "DisableAsimovUpload" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\PerfTrack" -Name "Disabled" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener" -Name "Start" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}" -Name "Enabled" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" -Name "Enabled" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{44345799-E748-4607-9ACF-35306808422C}" -Name "Enabled" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{96F4A050-7E31-453C-88BE-9634F4E02139}" -Name "Enabled" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" -Name "Enabled" -Type "DWord" -Value "0x00000000"

Write-Host Services

Write-Host Stop Services
net stop DiagTrack
net stop dmwappushsvc

#Services Prsent in Windows 8.1
net stop Wecsvc
net stop Eventlog

Set-Service DiagTrack -startupType disabled
Set-Service dmwappushsvc -startupType disabled

#Service Settings Present in Windows 8.1
Set-Service Wecsvc -startupType disabled
Set-Service Eventlog -startupType disabled

Write-Host DNS API section
if ($arc -eq "AMD64"){

} else {

}

}

$handler_button2_Click= 
{

###########################################################################################################
#          Button 2 commands                                                                              #
###########################################################################################################

write-host Enable Full Telemetry
Enable-WindowsErrorReporting

write-host Allow Certificates
certutil -delstore "Disallowed" "$PWD/msitwww2.crt"
certutil -delstore "Disallowed" "$PWD/MicSecSerCA2011_2011-10-18.crt"

write-host Restore Original Hosts File
If (Test-Path "C:\Windows\System32\Drivers\etc\hosts.backup"){Remove-Item "C:\Windows\System32\Drivers\etc\hosts";Rename-Item "C:\Windows\System32\Drivers\etc\hosts.backup" "C:\Windows\System32\Drivers\etc\hosts"}else{write "No Backup"}

write-host Enable Diagtracker
#Not Present in Windows 8.1
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows" -Name "CEIPEnable" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "DisableAutomaticTelemetryKeywordReporting" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "Disabled" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" -Name "TelemetryServiceDisabled" -Type "DWord" -Value "0x00000000"
New-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\TestHooks" -Name "DisableAsimovUpload" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\PerfTrack" -Name "Disabled" -Type "DWord" -Value "0x00000000"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener" -Name "Start" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}" -Name "Enabled" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" -Name "Enabled" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{44345799-E748-4607-9ACF-35306808422C}" -Name "Enabled" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{96F4A050-7E31-453C-88BE-9634F4E02139}" -Name "Enabled" -Type "DWord" -Value "0x00000001"
Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener\{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" -Name "Enabled" -Type "DWord" -Value "0x00000001"Write-Host

Write-Host Services

Write-Host Start Services
net start DiagTrack
net start dmwappushsvc

#Services Present in Windows 8.1
net start Wecsvc
net start Eventlog
Set-Service DiagTrack -startupType delayed-auto
Set-Service dmwappushsvc -startupType delayed-auto

#Service Settings Present in Windows 8.1
Set-Service Wecsvc -startupType delayed-auto
Set-Service Eventlog -startupType delayed-auto

Write-Host DNS API section
if ($arc -eq "AMD64"){

} else {

}

}

$handler_button3_Click= 
{

###########################################################################################################
#          Button 3 command - Exit                                                                        #
###########################################################################################################

$form1.close()
#Exit

}

$handler_button4_Click= 
{

###########################################################################################################
#          Button 4 commands                                                                              #
###########################################################################################################
Write-Host Disable Tracking - Lite Install

net stop DiagTrack
net stop dmwappushsvc

#Present in Windows 8.1
net stop Wecsvc
net stop Eventlog

Set-Service dmwappushsvc -startupType disabled
Set-Service DiagTrack -startupType disabled

#Present in Windows 8.1
Set-Service Wecsvc -startupType disabled
Set-Service Eventlog -startupType disabled
}

$handler_button5_Click= 
{

###########################################################################################################
#          Button 5 commands -                                                                          #
###########################################################################################################
Write-Host Enable Tracking - Lite uninstall

Write-Host Start Services
net start DiagTrack
net start dmwappushsvc

#Present in Windows 8.1
net start Wecsvc
net start Eventlog

Set-Service DiagTrack -startupType delayed-auto
Set-Service dmwappushsvc -startupType delayed-auto

#Present in Windows 8.1
Set-Service Wecsvc -startupType delayed-auto
Set-Service Eventlog -startupType delayed-auto
}

$OnLoadForm_StateCorrection=
{#Correct the initial state of the form to prevent the .Net maximized form issue
    $form1.WindowState = $InitialFormWindowState
}

#----------------------------------------------
#region Generated Form Code
$form1.Text = "Tracking Control"
$form1.Name = "form1"
$form1.DataBindings.DefaultDataSourceUpdateMode = 0
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Width = 380
$System_Drawing_Size.Height = 175
$form1.FormBorderStyle = 'Fixed3D'
$form1.MaximizeBox = $false
$form1.ClientSize = $System_Drawing_Size
$form1.add_Load($handler_form1_Load)

# =======================================================

$button5.TabIndex = 3
$button5.Name = "button5"
$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Size.Width = 140
$System_Drawing_Size.Height = 35
$button5.Size = $System_Drawing_Size
$button5.UseVisualStyleBackColor = $True
$button5.Text = "Lite - Enable Tracking"

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 200
$System_Drawing_Point.Y = 71
$button5.Location = $System_Drawing_Point
$button5.DataBindings.DefaultDataSourceUpdateMode = 0
$button5.add_Click($handler_button5_Click)

$form1.Controls.Add($button5)

# =======================================================

$button4.TabIndex = 3
$button4.Name = "button4"
$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Size.Width = 140
$System_Drawing_Size.Height = 35
$button4.Size = $System_Drawing_Size
$button4.UseVisualStyleBackColor = $True
$button4.Text = "Lite - Disable Tracking"

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 200
$System_Drawing_Point.Y = 28
$button4.Location = $System_Drawing_Point
$button4.DataBindings.DefaultDataSourceUpdateMode = 0
$button4.add_Click($handler_button4_Click)

$form1.Controls.Add($button4)

# =======================================================

$button3.TabIndex = 2
$button3.Name = "button"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Width = 140
$System_Drawing_Size.Height = 35
$button3.Size = $System_Drawing_Size
$button3.UseVisualStyleBackColor = $True
$button3.Text = "Exit"

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 110
$System_Drawing_Point.Y = 120
$button3.Location = $System_Drawing_Point
$button3.DataBindings.DefaultDataSourceUpdateMode = 0
$button3.add_Click($handler_button3_Click)

$form1.Controls.Add($button3)

# =======================================================

$button2.TabIndex = 1
$button2.Name = "button2"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Width = 140
$System_Drawing_Size.Height = 35
$button2.Size = $System_Drawing_Size
$button2.UseVisualStyleBackColor = $True
$button2.Text = "Full - Enable Tracking"

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 36
$System_Drawing_Point.Y = 71
$button2.Location = $System_Drawing_Point
$button2.DataBindings.DefaultDataSourceUpdateMode = 0
$button2.add_Click($handler_button2_Click)

$form1.Controls.Add($button2)

# =======================================================

$button1.TabIndex = 0
$button1.Name = "button1"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Width = 140
$System_Drawing_Size.Height = 35
$button1.Size = $System_Drawing_Size
$button1.UseVisualStyleBackColor = $True
$button1.Text = "Full - Disable Tracking"

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 36
$System_Drawing_Point.Y = 28
$button1.Location = $System_Drawing_Point
$button1.DataBindings.DefaultDataSourceUpdateMode = 0
$button1.add_Click($handler_button1_Click)

$form1.Controls.Add($button1)

# =======================================================
#endregion Generated Form Code

#Save the initial state of the form
$InitialFormWindowState = $form1.WindowState
#Init the OnLoad event to correct the initial state of the form
$form1.add_Load($OnLoadForm_StateCorrection)
#Show the Form
$form1.ShowDialog()| Out-Null

} #End Function

#Check the Windows Version Here
if ($winver -ge "6.3.9600") {
    COMMANDER-JIN-JAY
} else { 
#if not true exit the script after 3 seconds
Write-Host "Wrong Windows Version Detected - Exiting Now"
Start-Sleep -s 3
exit
}

It was a long week and I'm doing a disk defrag to start things off then I'll move on to reloading my desktop to fix my boot partition and we will just move on from there.

 

You need to login to view this posts content.

 

This script is aimed for 9860. On 9879 some services aren't running by default .

And yes without an actual IP list script errors when trying to add the IPs to Hosts file.

 

Where can I find the script files

 

You need to login to view this posts content.

 

Does this disable Win10TP from updating to new builds? I'm stuck on 9841 and it's not finding any new builds when I check in pc settings...

 

Sorry busy couple of weeks.

I just saw that 9901 dropped and was leaked. I've seen a couple screen shots.

I'm going to be honest... I am considering dropping Windows 10 stuff because of how messy the UI is until the look is not crap.

I've been able to do things with Windows 7, 8.1 and Server but dang this just looks bad. It is like piping a command prompt call through bash to copy a file from a Mac to Windows.

 

I wonder if they will disable this keylogging technology in their final release..

 

If they don't, they will lose a lot of customer and not private users only, also a lot of corporate customers!

 

Exactly, if this "product improvement" keylogger stays even after RTM...no government/Business would ever want to use Windows 10....let's hope that MS removes it from the final product.

 

Let them add it so linux will get more life

 

Michael I'll be entirely honest.

Windows is a piece of crap compared to linux.

The Hard Drive Space management for Windows 7, Windows 8, Windows 8.1, and Windows 10 is abysmal. To name an example I'm going to point out the page file, hibernation file, and Windows Installer Folder. I just spent the time to clean up the SSD I'm which is a 256 msata. The total size of all those files / folders combined is around 25 GB on a 64 bit system out of 86 GB used on the Drive. This means those files are eating up nearly 30% of the OS Footprint on the disk. This size is akin to Linux distribution that has been installed. The best solution to this would be to use compression on it or make it its own partition that is expandable. Hell you could have the System Files on their own Partition with compress in a virtual disk and it would be smaller. Overall the system file management of Windows as a whole has gone down hill with Windows Simply eating space like Godzilla. Microsoft needs to get its act together.

Also the Graphic User Interface is just poorly done as the design crew should have just gone back to the drawing board after the mess called Windows 8. I do not support the metro interface and never have as it is not intuitive. The other issue is that it creates a learning curve which simply should not be required to use an Operating System such as Windows. Also the Windows store is basically comparable to Apple in terms of the degree it is locked down.

All of that being said I will probably stop doing stuff for Windows as a whole if they continue to waste space on my hard drive with depreciated programs installed. Along with the interface being a pile of crap. Linux has a much cleaner approach then the spaghetti of code seen in Windows.

 

Ok I keep an open mind at the aesthetics of an operating system which is why I use windows 8.1 with a good amount of tinkering down.

That being said I feel we should take apart the upcoming Windows 10 customer preview with a fine tooth comb. We need to locate the aspects of the operating system that phone home. I don't like how Windows is become more like diablo 3 with aspects always needing to be online in terms of connectivity. I want to see what parts of the operating system are used like cookies for an Internet Browser along with LSO cookies that may be embedded into Windows. This will mean as always the Reverse Engineering Tools are brought out again to pull it apart.

We will need to update the scripting necessary to put a kill switch into the operating system in terms of feedback. However the question is when this should be done... as the preview will contain more stuff that will be in the final version.

What are the thoughts on this?

 

You need to login to view this posts content.

 

Thanks for exposing MS and their data mining. I was trying to get that OS previewed for myself, but now I know what to expect. Was this technical preview version only expected to be used by Microsoft in house? I know that someone grabbed a copy and posted on torrent sites. But it is scary that the key logger function appears to be bundled into the OS/Kernel.

 

MSFT haven't been exposed, they have said all along that they included it.
You just needed to read the agreement that you agree to (including the logger) when using those builds.