[Guide]Way to Disable Keylogger/ Telemetry v3.55

Discussion in 'Windows 10' started by LiteOS, Oct 9, 2014.

Thread Status:
Not open for further replies.
  1. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    #101 murphy78, Oct 14, 2014
    Last edited by a moderator: Apr 20, 2017

    Attached Files:

  2. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    #102 Smorgan, Oct 14, 2014
    Last edited by a moderator: Apr 20, 2017
  3. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    I'm not actually sure how to restart explorer without elevating it...
    Since the script needs to be elevated to run, it will elevate any programs you run as well...
     
  4. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    Use the following command:

    Taskkill /im Explorer.exe

    (Kills all instances of Explorer) And the handy part is that you just need to type "start explorer.exe" afterwards

    You probably do need to elevate the script :/ either way
     
  5. KNARZ

    KNARZ MDL Addicted

    Oct 9, 2012
    895
    482
    30
    #105 KNARZ, Oct 14, 2014
    Last edited: Oct 14, 2014
    Don't get me wrong guys but this is an another example to get things more complicated than needed or it get's more attention that it's worth in my opinion. Do we really need a script?

    murphy you could have done this way better with much less redundant lines / info.
    at least to started to work with call commands... (but normaly you exit call with goto: eof and not exit /b.)
    ...but I don't want to bother with details.

    Offtopic: The quality of most current Threads are just ridiculous that I also nearly lost any interessed in reading them. Always the same boring stuff... from Watermark remover to Glass to AIO.... it's annoys me to death. Same Discussions since Vista for every release... and I'm not talking about even RTM releases.
     
  6. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    #106 Smorgan, Oct 14, 2014
    Last edited: Oct 14, 2014
    We need a back plate to use to apply the changes to the OS. This can be done any maner of ways but scripting it makes it quick n dirty. We want to test the changes fast so that we can see the results.

    @Offtopic: I find them dull as well as they are just all the same thing. I did Repo's for a bit but even they simply got copied n redone. I'm gonna continue making the Security Repository as that takes a direction that is more interesting.
     
  7. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    For Tech Preview? it's overkill.
    For learning how to do things in preparation for RTM? not overkill.
     
  8. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    It's not worth applying to a WIM at this point so we just need to test it out and iron out the kinks in preparation for the next preview.

    I'm bringing a test VM online now that will be clean for purposes of testing. The other one I have has all the Reversing and Network Analysis tools on it.
     
  9. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    I wouldn't be surprised if the keylogger had an Internet Explorer plugin type thing... We'll have to keep knocking down the pins till none are left up, in the most future-proof way possible I guess.
    So, there may be some attention required there. Right now it's like this thing that we know is there, but we're still trying to figure out how to deal with it.
     
  10. KNARZ

    KNARZ MDL Addicted

    Oct 9, 2012
    895
    482
    30
    I understand the concept of quick and dirty. I just saw the script and PS and thought... seriously.... are "we" now creating "powerfull" automated solutions with errorhandling for some minor regfile that doesn't have the need of any flexible value/date? Yes I understand that scripting is nice (do it all the time for business) but importing a reg file for a Evaluation should be just enough... I think a Menu and many echo's aren't work the workload. All I'm saysing: I don't see the effort for this and wouldn't investigate/waste more time (also if I'm talking about 5min)

    Of course.... if this would be in RTM this is no overkill. But from my understanding thoose are services that are only for Eval/Previews.
     
  11. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
  12. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    65.55.108.23 ----------vortex.data.microsoft.com
    65.39.117.230
    134.170.30.202
    134.170.51.253--------statsfe2.ws.microsoft.com
    131.253.34.30----------settings-sandbox.data.microsoft.com
    131.253.34.23----------vortex-sandbox.data.microsoft.com
    137.116.81.24----------(used to store search from start menu)
    204.152.141.35---------ntwk.msn.net (pass through for start menu IP)
    204.79.197.200---------a-0001.a-msedge.net


    Revised list of the IPs to block at this point I'm still working on getting a complete list.
     
  13. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    How would we go about blocking the numerical ip addresses? net route?
     
  14. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    #115 Smorgan, Oct 14, 2014
    Last edited: Oct 14, 2014
    I would wager a guess that our search is running through searchui.exe

    From this directory:

    C:\Program files\WindowsApps\Microsoft.Cortana_1.2.0.0_x64__(Some characters)\searchui.exe

    At the moment I am not sure on blocking such an IP.
     
  15. dsbig

    dsbig MDL Senior Member

    Aug 3, 2009
    303
    47
    10
    Im sorry.

    that is waaaaaaaaay too much to read.
     
  16. TONSCHUH

    TONSCHUH MDL Addicted

    Jun 11, 2012
    816
    287
    30
    There are several options:

    - educate yourself a bit in the IT-field
    - don't try to install new software on your WW1-Computer
    - don't buy s*** hardware from s*** brands
    - go back to Windows 3.1
    - stay off the internet
    - stay off computers

    :eek:
     
  17. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    My EYES!!! The goggles, they do nothing!
    There could be some really insightful stuff in there, but I'm not going to read that wall of text.
     
  18. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,219
    84,895
    340
  19. Mr Jinje

    Mr Jinje MDL Expert

    Aug 19, 2009
    1,770
    1,101
    60