Windows 10: Telemetry & Application Data List

Discussion in 'Windows 10' started by Smorgan, Oct 8, 2014.

  1. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    I'll poke around the network area port wise. I'll be a bit delayed as I have to reload the OS on my desktop to start doing it.

    I picked up a Samsung 850 pro 512 GB the other day. It should make remote control of VM's easier lol now I just need to decide on a OS.

    We will also have to avoid impairing the functionality of the search function in the start menu.
     
  2. Mr Jinje

    Mr Jinje MDL Expert

    Aug 19, 2009
    1,770
    1,101
    60
    #82 Mr Jinje, Oct 15, 2014
    Last edited by a moderator: Apr 20, 2017
  3. Zardoc

    Zardoc MDL Addicted

    Feb 7, 2008
    590
    276
    30
  4. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    #84 murphy78, Oct 15, 2014
    Last edited by a moderator: Apr 20, 2017
    Hmm... we could try it...
    or you know what?
    Do you remember when we did the "net route" thing for the tunmirror stuff on kms v6 activation when we first started it?
    Hmm... lemme see if I can find the command...

    Hmm actually our line was:
    Code:
    for /f "tokens=1 delims=. " %%i in ('route print ^| find /i "TAP-Windows Adapter V9"') do (netsh interface ip set address %%i static 10.3.0.1 255.255.255.0) >nul 2>&1
    ahh netsh ip set address...
    Hmm we might need to change the finding %%i part of that to find whatever current adapter id to use for the netsh command.
    I believe it was set to 0901 in this case but we used the route print | find /i "TAP-Windows Adapter V9" and the tokens / delims to locate the number if someone modified the .ini to change the numbers around.
    We didn't know at the time, but changing the 0901 would require re-signing the cert; so we never did that.

    but yah... I think this netsh interface set ip stuff might be used to re-direct the numerical addresses to 0.0.0.0 much the way the hosts file would; except that MS wouldn't likely be able to bypass it like the hosts file in any scenario.
     
  5. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    #85 Smorgan, Oct 15, 2014
    Last edited by a moderator: Apr 20, 2017
    (OP)
    There is an alternative.

    We can do a stealth trace on the IP address using Nmap which will give us the main IP in which it passes through. That means we will block the main before it gets to the actual IP along the chain. Thus we have our block even if the IP is not being blocked by the hosts file.

    If you know networking you will know what I mean. :)
     
  6. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    Here is the current scripting for Powershell

    Privacy.ps1

    @echo off
    Title Privacy
    echo.
    echo Disable Windows Error Reporting
    Disable-WindowsErrorReporting
    echo Clear the Event Cache
    wevtutil el | Foreach-Object {wevtutil cl "$_"}
    exit​

    Now we need to merge this with the Host adding.
     
  7. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    Speaking of which, it's fairly easy to add things to the hosts file, but how do you remove them from the hosts file?
    I recently did some hosts file addition thing for an activation thing in camtasia I did on TPB, but how does one re-create the file and exclude all the lines that we want to remove?

    We need to have an enable/restore defaults (disable) version of whatever scripts we are using because people will not understand how to undo things themselves and one of these things could potentially block a vital update or something.
     
  8. Smorgan

    Smorgan Glitcher

    Mar 25, 2010
    1,855
    1,051
    60
    We should be able to simply delete the host file then pipe the original back into it.

    Aka:

    # Copyright (c) 1993-2009 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a '#' symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    # localhost name resolution is handled within DNS itself.
    #127.0.0.1 localhost
    #::1 localhost
     
  9. TONSCHUH

    TONSCHUH MDL Addicted

    Jun 11, 2012
    816
    287
    30
    Script-1 = backup and rename original hosts
    Script-2 = modify the hosts
    Script-3 = overwrite modified hosts with the backup of the original hosts

    Or maybe just one script with all 3 functions and a little menu.

    :)
     
  10. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    Guess it never hurts having an original, but is there no way we can remove lines that we previously added?
    Some people use ad blocking plugins that fill up these hosts files and if we restore them to default, the user will have to go back and re-install them.
     
  11. TONSCHUH

    TONSCHUH MDL Addicted

    Jun 11, 2012
    816
    287
    30
    Good Luck !

    :good3:
     
  12. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    #96 murphy78, Oct 15, 2014
    Last edited by a moderator: Apr 20, 2017
    OK I've got a hosts file enable/disable framework like 75% complete, but I'm having problems.

    1) It doesn't copy all previous lines. It seems to only copy the commented out lines. It probably has something to do with the for /f eol stuff
    2) It inserts an echo status into the result hosts file

    Someone who is familiar with scripting, can you please help me debug this?

    Code:
    @echo off
    
    
    call :Add-Hosts-Line-Function 0.0.0.0 someip.address.com
    pause
    call :Remove-Hosts-Line-Function 0.0.0.0 someip.address.com
    pause
    goto :EOF
    
    
    :Add-Hosts-Line-Function
    IF %1 EQU "" echo :Add-Hosts-Line-Function missing 1st parameter&pause&exit
    IF %2 EQU "" echo :Add-Hosts-Line-Function missing 2nd parameter&pause&exit
    
    
    :make copy to work with since system won't let you directly edit hosts file
    attrib -h -s "%WinDir%\System32\drivers\etc\hosts" >nul
    xcopy /cy "%WinDir%\System32\drivers\etc\hosts" "%TMP%" >nul
    
    
    for /f "delims=" %%h in ('type "%TMP%\hosts" ^| find /c /i "%2"') do (
        set "result=%%h" >nul
        )
    
    
    if "%result%"=="0" (
        >>"%TMP%\hosts" echo %1 %2
        echo %1 %2 added to hosts file
        del /q/f "%WinDir%\System32\drivers\etc\hosts" >nul
        move /y "%TMP%\hosts" "%WinDir%\System32\drivers\etc\hosts" >nul
        attrib +h "%WinDir%\System32\drivers\etc\hosts" >nul
        exit /b
        ) else (
        echo %2 already exists in hosts file
        del /q/f "%TMP%\hosts" >nul
        exit /b
        )
    ::end function
    
    
    :Remove-Hosts-Line-Function
    IF %1 EQU "" echo :Remove-Hosts-Line-Function missing 1st parameter&pause&exit
    IF %2 EQU "" echo :Remove-Hosts-Line-Function missing 2nd parameter&pause&exit
    
    
    :make copy to work with since system won't let you directly edit hosts file
    attrib -h -s "%WinDir%\System32\drivers\etc\hosts" >nul
    xcopy /cy "%WinDir%\System32\drivers\etc\hosts" "%TMP%" >nul
    
    for /f "delims=" %%h in ('type "%TMP%\hosts" ^| find /c /i "%2"') do (
        set "result=%%h" >nul
        )
    if "%result%" geq "1" (
        for /f "tokens=*" %%a in ('findstr /in ".*" "%TMP%\hosts"') do (
            echo %%a>>"%TMP%\l_1.x"
            )
        for /f "eol=# tokens=1,2 delims=:" %%a in ('findstr /i ".*%1.*" "%TMP%\l_1.x"') do (
            set stringlines=%%a
            )
        setlocal enabledelayedexpansion
        set /a "beforelines=stringlines-3"
        set /a "afterlines=stringlines+1"
        for /f "eol=# tokens=2* delims=:" %%a in ('findstr /in ".*" "%TMP%\l_1.x"') do (
            if %%a leq !beforelines! echo %%b>>"%TMP%\l_2.x"
            if %%a geq !afterlines! echo %%b>>"%TMP%\l_2.x"
            )
        endlocal
        del /q/f "%WinDir%\System32\drivers\etc\hosts" >nul
        move /y "%TMP%\l_2.x" "%WinDir%\System32\drivers\etc\hosts" >nul
        attrib +h "%WinDir%\System32\drivers\etc\hosts" >nul
        del /q/f "%TMP%\hosts" >nul
        del /q/f "%TMP%\*.x" >nul
        echo %2 successfully removed from hosts file
        ) else (
        echo %2 does not exist in hosts file
        del /q/f "%TMP%\hosts" >nul
        del /q/f "%TMP%\*.x" >nul
        exit /b
        )
    ::end function
    
    
    :flushdns
    call ipconfig /flushdns >nul
    The echo status line seems to occur only in the remove-hosts function part of the parsing, so that's where I need the help, along with the missing other entries that are not eol'd out.
    It seems to add the lines fine without any errors.
     
  13. KnowledgeableNewbie

    KnowledgeableNewbie MDL Member

    Sep 30, 2014
    178
    28
    10
    nice work. i'm working on win7 and went to check on some xcopy paramameters. lol, xcopy can't be found. don't know where it went. don't use it anyways. since xcopy is kinda outdated. what about using robocopy, more parameters if you need it in the future.
     
  14. KnowledgeableNewbie

    KnowledgeableNewbie MDL Member

    Sep 30, 2014
    178
    28
    10
    tried out the script and it did some weird things to my hosts file. the add part went as planned, but when i pressed the key to continue, on the deletion part it deleted the last two lines of the hosts file instead of the last one. also it changed this:

    127.0.0.1 localhost

    ::1 localhost #[IPv6]


    to this:

    ECHO is off.
    127.0.0.1 localhost
    ECHO is off.
    1 localhost #[IPv6]
    ECHO is off.

    gonna play around and see what i can learn.
     
  15. TONSCHUH

    TONSCHUH MDL Addicted

    Jun 11, 2012
    816
    287
    30
    #100 TONSCHUH, Oct 16, 2014
    Last edited by a moderator: Apr 20, 2017
    Can't we just add a custom start and end comment, which we could search for and use as a start and end-tag for our modifications.

    Like SpyBot Search & Destroy:

    Code:
    # Start of entries inserted by Spybot - Search & Destroy
    
    blablabla
    
    # End of entries inserted by Spybot - Search & Destroy
    
    A bit like:

    Code:
    read line 
    if line is equal "# Start MDL" then jump to %delete
    
    %delete
    read line
    if line is equal "# End MDL" then jump to %finish
    
    delete line
    go to %delete
    
    %finish
    
    Echo on
    
    Host-File-Entries got removed
    
    Echo off
    
    wait
    
    PS: That are fictive commands, as I had no time yet to look into the scripting commands, but I think you get what I try to explain.

    ;)