Windows 10 TP Contains Keylogger

You are correct nice find

 

You need to login to view this posts content.

 

You are kidding, right?

 

..............

 

Lol... I am not. It is a rhetorical question though. I am pointing to the date. That there is something we might learn about why Microsoft didn't update it. Mine is different without the DNS part(line 22 to 29) though.

 

Regardless of the Date being used in the host file. The host file is very much still relevant and can be used regardless.

 

Mine doesn't have everything that is in abbodi1406's post. Maybe I need to add some files.

 

C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl


use by the system ,permistion cant be changed

i think its basically in the kernel

edit
also coremessaging disabled make os stuck on starting up

 

i dont have that file or any file on that directory

and yes, i have "show all files..." selected and "hide protected files..." disabled

 

I have an idea... Try copying the file to the desktop. If that doesn't work we could live boot with linux to see what's going on with it.

 

well edb.log is interesting to see. Nothing relevant

 

But now I know what exactly is being reported to Microsoft.

 

And what is it? LOL

 

You need to login to view this posts content.

 

Ok, missed that. Thank you.

 

You need to login to view this posts content.

 

Windows Server 10 have it too :\ cant compere

it can be deleted but when refreshing its coming back

its really build in the kernel or something

edit

i did same compere to windows server 2012 r2
found same files
coremessageing and cloud related ....

edit:

after delete 2 services and deny system from accessing autologger-....etl file

i think there no more keylogger

 

I have deleted both dmwappushsvc, diagtrack files from System32. Now both services has stopped running . Now I wanna know whether I am free of tracking or not