10se1ucgo / disablewintracking Goto Github PK

View Code? Open in Web Editor NEW

5.0K 280.0 369.0 251 KB

Uses some known methods that attempt to minimize tracking in Windows 10

License: GNU Lesser General Public License v3.0

Python 100.00%

disablewintracking's Introduction

DO NOT SUBMIT NEW ISSUES OR PULL REQUESTS

THIS REPOSITORY IS HERE FOR ARCHIVAL PURPOSES ONLY. THIS SOFTWARE RECEIVED IT'S LAST RELEASE ON 01/2019 AND LAST COMMIT ON 12/2020.

Someone has forked and continued the project here: https://github.com/bitlog2/DisableWinTracking

As with any fork of a project, we cannot verify the integrity of their code, so report any issues with their fork to THAT repository, not this one.

--------------------------

DisableWinTracking

A tool that I created to use some of the known methods of disabling tracking in Windows 10.

CYRILLIC LANGUAGES WARNING

ПРЕДУПРЕЖДЕНИЕ ДЛЯ КИРИЛЛИЧЕСКИХ ЯЗЫКОВ

Slavic languages: Belarusian, Bulgarian, Macedonian, Russian, Rusyn, Serbo-Croatian (for Standard Serbian, Bosnian, and Montenegrin), Ukrainian.

Славянские языки: белорусский, болгарский, македонский, русский, русинский, сербохорватский (для стандартного сербского, боснийского и черногорского), украинский.

This program cannot run correctly from a file path that contains Cyrillic characters. Make sure to run it from your root folder (usually C:/ ) so that you don't get runtime errors.

Эта программа не может работать корректно, если в пути к файлу есть кириллические символы. Обязательно запустите его из корневой папки ( обычно C:/ ), чтобы вы не получали ошибок во время выполнения.

DOWNLOAD

DOWNLOAD EXE HERE

Note: Windows Defender may report the EXE as a trojan (Win32/Pocyx.C!cl), and may therefore prevent you from extracting the EXE to anywhere on your computer. Set up an exclusion in Settings > Update & Security > Windows Defender > Exclusions by adding the folder you intend to extract the EXE to.

How to Use

You can either:

A. Run the binary uploaded to the Release tab as an Administrator and select which options you'd like

B. Install Python and the dependencies listed below and run the script from an elevated command prompt and select which options you'd like

Silent

Either can be run with the -silent argument as of v3.1. This will perform all available options of the version you're using.

You still need to run it as administrator.

Dependencies

This is only to run the script from source, download the exe here

Tested on Python 3.7.2 since DisableWinTracking 3.2.4 (commit 9f1d2aa)
wxPython
PyWin32
Windows 10 (Duh)

Methods Used

Telemetry

Set the AllowTelemetry string in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection to 0

DiagTrack Log

Clears and disables writing to the log located in C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger

Services

You can delete or disable the 2 services below:

DiagTrack (aka. Connected User Experiences and Telemetry) Diagnostics Tracking Service
dmwappushsvc WAP Push Message Routing Service

Action:

Delete: Remove both services
Disable: Set the Start registry key for both services to 4 (Disabled) Located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

HOSTS

Append known tracking domains to the HOSTS file located in C:\Windows\System32\drivers\etc

IP Blocking

Blocks known tracking IPs with the Windows Firewall. The rules are named TrackingIPX, replacing X with the IP numbers.

Windows Defender

Disables the following:

Automatic Sample Submission
Delivery Optimization Download Mode

WifiSense

Disables the following:

Credential Share
Open-ness

OneDrive

Runs C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall (64 bit) or
C:\Windows\System32\OneDriveSetup.exe /uninstall (32 bit)

Also disables registry entries that keep the OneDrive Icon pinned to your Windows Explorer list:

Xbox DVR

Action:

Disable: Set the GameDVR_Enabled registry key for both services to 0 (Disabled) Located at HKEY_CURRENT_USER\System\GameConfigStore
Disable: Set the AllowGameDVR registry key for both services to 0 (Disabled) Located at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\GameDVR

This action requires reboot computer for completely applying.

Delete Services vs Disable Services?

Selecting "Disable" will simply stop the services from being able to run. Selecting the "Delete" choice will completely delete the tracking services.

License

Copyright (C) 10se1ucgo 2016

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.

disablewintracking's People

Contributors

Stargazers

Watchers

Forkers

drmaq virustotalop sjmcallister shingenko lestums arhatlohan gbiagomba hstbhse dotnetinaction asd55 talandrius goofwear devplanete qgustavor drdeano lyrl splitice thenite orinocoz bpennypacker dragon788 urras lshalimov-handy robin-- galek aneeshdivakaran paveltresnak tatoalo appius alexanderpi temna-net amelos shadow9346 drooids olegchir songshawn irungentootoo elgolondrino r0mk1n ara0 9kopb devlato zet-web cka3kuh soosunknown mdamaged iursevla unhombremuyhonrado doadin dd2repo yuuwork zy26 johnjohnsp1 trex22 temych ahvonenj usaukel balcangsm giuppi secava albertalbs noscripter digitaldevgit iced-tea am0oma sagaienet encapsulate jonniex7 zhangf911 yixf-self 215m7w slamj1 saibotc d-mitchell zinbers dvor85 sfordinc victorino80 corujaobr tmmc yaroslavb guidex pathway27 shww crazykid199 techpub angriloveprojects allquixotic stasonhub ironted wolfflow danaronoff cryzin dipsec speedcoder5 mpmendespt byzer0 usinss tamiral kurtdegreeff

disablewintracking's Issues

Blocking IP addresses?

Blocking MS hostnames by using the "hosts" file is ok, but how to block this MS IP addresses?

2.22.61.43
2.22.61.66
157.56.106.189

IP's/Domains are not added to hosts file - error log attached

Hello, the last rev prior to the latest release would work correctly (as in edit the host file) however the newer version does not. This is a win 10 64-BIT machine. Thanks for working on a cool tool :) Here are the errors:

23:46:44 ERROR: Registry: Unable to modify Service dmwappushsvc key.
Traceback (most recent call last):
  File "<string>", line 474, in modifyregistry
WindowsError: [Error 2] The system cannot find the file specified

23:46:44 ERROR: Registry: Unable to modify Service DiagTrack key.
Traceback (most recent call last):
  File "<string>", line 474, in modifyregistry
WindowsError: [Error 2] The system cannot find the file specified

23:46:44 ERROR: Services: dmwappushsvc unable to be stopped.
Traceback (most recent call last):
  File "<string>", line 358, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

23:46:44 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
  File "<string>", line 358, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

23:46:44 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
  File "<string>", line 358, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

23:46:44 ERROR: DiagTrack Log: Unable to clear/lock
Traceback (most recent call last):
  File "<string>", line 339, in cleardiagtracklog
IOError: [Errno 13] Permission denied: 'C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl'

The gif in the readme seems to be outdated

DiagTrack log and service.

The short name for "Diagnostics Tracking Service" is actually "DiagTrack".

The problem happens on the first run and when selecting everything. It tries to clear and lock the "DiagTrack" log before it stops and disables the "DiagTrack" service. So it fails to clear the log because it's still in use. You have to stop the "DiagTrack" service before clearing the log.

Also, you may want to look into stopping and disabling the Geolocation Service (lhsvc is the short name)

Does not seem to work with french OS (v2.4)

Hi there!

I have a French laptop and here is what happens when I try to use your program v2.4:

16:17:40 ERROR: Registry: Unable to modify Service dmwappushsvc key.
Traceback (most recent call last):
File "", line 474, in modifyregistry
WindowsError: [Error 2] Le fichier spécifié est introuvable

last line means : the specified file is missing

16:17:40 ERROR: Services: dmwappushsvc unable to be stopped.
Traceback (most recent call last):
File "", line 358, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'Le service n\x92a pas \xe9t\xe9 d\xe9marr\xe9.')

last line means: the service has not been launched

16:17:40 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
File "", line 358, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 318, in ControlService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'Le service sp\xe9cifi\xe9 n\x92existe pas en tant que service >install\xe9.')

last line means: the specified service does not exist as an installed service

16:17:40 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
File "", line 358, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 318, in ControlService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'Le service sp\xe9cifi\xe9 n\x92existe pas en tant que service >install\xe9.')

last line means: the specified service does not exist as an installed service

16:17:40 ERROR: DiagTrack Log: Unable to clear/lock
Traceback (most recent call last):
File "", line 339, in cleardiagtracklog
IOError: [Errno 13] Permission >denied: 'C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack->Listener.etl'

It works well with my English desktop. I believe it did not work with my laptop because it checks my location when it boots into Windows 10.

I don't mind to set my laptop in English if I have to.

Thanks for your help

AllowTelemetry can't be disabled in non-server OS

From Microsoft's Policy CSP at https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx

This isn't necessarily an issue with your software as it's not something you can fix due to how MS designed it, but you may want to update wording so people are a bit more aware.

[Idea] Clean removal of system apps (bypass error 0x80073CFA)

Hi,

I would like to share my findings. The error 0x80073CFA can be bypassed by toggling the "IsInbox" column for the system package in the Package table in %ProgramData%\Microsoft\Windows\AppRepository\StateRepository-Machine.srd. It is an SQLite database that can be viewed and edited with any SQLite tool after stopping the StateRepository service and taking over the file ownership.

I managed to remove Microsoft Edge from the Start menu using Remove-AppxPackage afterwards, but there were no changes to the package list exported from the install_wim_tweak tool (http://www.msfn.org/board/topic/152688-win6x-registry-tweak/) so further cleanup maybe necessary.

Best of luck.

Remove-AppxPackage : Deployment failed with HRESULT: 0x80073CFA, Removal failed. Please contact your software vendor. (Exception from HRESULT: 0x80073CFA)
error 0x80070032: AppX Deployment Remove operation on package xxx from:
xxx failed. This app is part of Windows and cannot be uninstalled on a per-user basis. An administrator can attempt to remove the app from the computer using Turn Windows Features on or off. However, it may not be possible to uninstall the app.

IPs blocking 0.0.0.0 reverse resolving blocked hostnames in place of local hostname

on further testing 0.0.0.0 returns quicker an error of host not found

same works with 0.0.0.1 and process explorer functionality remains OK :)

HOSTS file getting messed up with 2.2

When I ran 2.2, it appeared to delete existing lines in my HOSTS file!

Like a lot of people I get my HOSTS file from here: http://winhelp2002.mvps.org/hosts.htm (it blocks loads of adverts etc).

After running your run.exe, all the hundreds of lines from the MVPS HOSTS file are now deleted!

e.g.

# [1&1 Internet][AS8560][195.20.243.0 - 195.20.255.255]
0.0.0.0 madclient.uimserv.net

has now become just this:

# [1&1 Internet][AS8560][195.20.243.0 - 195.20.255.255]

Win 10 Updates

I have been following your development and am impressed with it. I have closed all of Win10's privacy, sharing etc... settings that are wide open to default and have shut down auto updating. Is there any evidence that their updates also patch the issues your scripts fix?

ELANTPCfg not working anymore

After installation and restarting the computer several times i get this message at start up,
ELANTPCfg not working anymore. I then close the message and the computer continues too load fine it seems.

Edit: This message also pops up when i wake up the laptop from sleeping !

Edit 2: Installation report, everything selected and used disable.

Telemetry key succesfully modified.
2nd Telemetry key succesfully modified.
Unable to clear DiagTrack log. Deleted, or is the program not elevated?
Domains successfully appended to HOSTS file.
Unable to modify dmwappushsvc key. Deleted, or is the program not elevated?
Diagnostics Tracking Service unable to be stopped. Deleted, or is the program not elevated?
dmwappushsvc unable to be stopped. Deleted, or is the program not elevated?
Done. You can close this window after reading the log.

(i checked if the dmwappushsvc.dll was present in win10 and it is).

Skype

Please be noted that disabling the trackers using the host file will cause issues with Skype. Symptoms are observable if your client states in a group chat that "instant messaging is not available. <something about updating skype bla bla bla".

To fix look for the *.skype entries in the hosts file and the *message.live entry. Commenting/removing them will fix the problem :)

Question.

Does this disable keyloggers as well? Thanks!

Trojan in your app

I find Trojan !!

https://www.virustotal.com/en/file/0aca5aaa66a8029d533415b104348cda0c45775567a371585c6b5596a965c168/analysis/

Request to revert changes back to Microsoft default

I applaud these efforts, and I do not want to diminish anything that you are doing. However, there may be unforseen cases that may be better handled by reverting these settings back to the Microsoft defaults.

Remove additional registry keys

These might be some extra registry keys to remove in addition to the current set.

ASP.NET IIS Service Issue?

I used your tool earlier today, and I was wondering if it had anything to do with Visual Studio not being able to connect to IIS services. Let me know if there are IIS settings related to your strategy being disabled. Thanks.

I'm getting this message "Unable to connect to the configured development Web Server"

Improve Hosts File error message

Because of the rewrite my pull requests got closed.
But i think this is quit important:

Some Anti virus programs are blocking access to the hosts file. It should be noted in case of an inaccessible host file to check the running anti virus programs in the error message, because users may not expect this.

Doing a similar thing

I started a similar project a few hours ago, you might want to have a look at it and see if you can scavenge some things.

https://github.com/W4RH4WK/Debloat-Windows-10

UI idea

Instead of checkboxes, why not make each setting a toggle, so that end users can clearly see which items have already been disabled, or are yet to be disabled. I realise this may require a lot of extra code in order to probe the condition(s) behind each setting, to see if they are already applied, but anyway I just wanted to put the idea out there and see what the author thinks.

Because at the moment, its not clear to the end user if running the same settings twice (i.e. when starting a new version of the program) will cause a build up of problems i.e. is the firewall or hosts file filling up with duplicate conditions if I run the program over and over? etc

Anyway, I appreciate that this program is perhaps still in its infancy to a degree, as all the evil things Win10 does still seem to be emerging. So perhaps it would be more logical to implement this when the program has reached a more mature stage. If at all.

more domains to block

http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-jde-o-pouhy-terminal-na-sber-informaci-o-uzivateli-jeho-prstech-ocich-a-hlasu/
and here http://habrahabr.ru/company/pt/blog/264763/
name some more webhosts to where windows 10 send info

Remove hosts file tweaking

While the inital reflex may be to block all of the above servers via HOSTS, it turns out this won't work: Microsoft has taken the care to hardcode certain IPs, meaning that there is no DNS lookup and no HOSTS consultation. However, if the above servers are blocked via HOSTS, Windows will pretend to be crippled by continuously throwing errors, while still maintaining data collection in the background. Other than an increase in errors, HOSTS blocking did not affect the volume, frequency, or rate of data being transmitted.

http://localghost.org/posts/a-traffic-analysis-of-windows-10

Search not working

After running the delete functionality search functionality is not working anymore.

ERROR: Registry: Unable to modify Service dmwappushsvc key

I got this from DisableWinTracking.log
I'm using v2.4.1

12:29:46 ERROR: Registry: Unable to modify Service dmwappushsvc key.
Traceback (most recent call last):
File "", line 473, in modifyregistry
WindowsError: [Error 2] The system cannot find the file specified

12:29:46 ERROR: Services: dmwappushsvc unable to be stopped.
Traceback (most recent call last):
File "", line 357, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'The service has not been started.')

12:29:46 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
File "", line 357, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1061, 'ControlService', 'The service cannot accept control messages at this time.')

Some complaints in DisableWinTracking.log

I cannot figure out how to attach a file. So here is DisableWinTracking.log, in line:

17:47:48 ERROR: Registry: Unable to modify Service dmwappushsvc key.
Traceback (most recent call last):
File "", line 473, in modifyregistry
WindowsError: [Error 2] The system cannot find the file specified

17:47:48 ERROR: Services: dmwappushsvc unable to be stopped.
Traceback (most recent call last):
File "", line 357, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'The service has not been started.')

17:47:48 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
File "", line 357, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1061, 'ControlService', 'The service cannot accept control messages at this time.')

Are you blocking all of these?

It is like the rabbit hole keeps getting deeper, make sure none of these have been missed, taken from Jimstone.is

Windows 10 BUSTED, AND IT IS CREEPY

Yeah, I guess HILLARY'S E-MAILS PROVED THE NSA AS A SOURCE IS NOT GOOD ENOUGH, because using them can land you in jail. THE NEW CONSULTEE IS (PROBABLY) MICROSOFT, why have your goons infiltrate an old outdated battleship like the NSA when that can backfire?

Why does Microsoft have a right to ALL text I type, the first 35 megabytes of video from a web cam every time it is turned on, and everything that gets picked up by the microphone? Ha, they don't BECAUSE I DO NOT USE THEIR PRODUCTS, if you have not woken up yet and still do, here is what now happens:

All text typed on the keyboard is stored in temporary files, and sent (once per 30 mins) to:

oca.telemetry.microsoft.com.nsatc.net
pre.footprintpredict.com
reports.wes.df.telemetry.microsoft.com
This will allow Microsoft to have a way to steal every joke, every poem, every intellectual endeavor you ever create and have it copyrighted before you even stop typing.

Telemetry is sent once per 5 minutes, to:

vortex.data.microsoft.com
vortex-win.data.microsoft.com
telecommand.telemetry.microsoft.com
telecommand.telemetry.microsoft.com.nsatc.net
oca.telemetry.microsoft.com
oca.telemetry.microsoft.com.nsatc.net
sqm.telemetry.microsoft.com
sqm.telemetry.microsoft.com.nsatc.net
This allows them to track you very accurately.

Typing the name of any popular movie into your local file search starts a telemetry process that indexes all media files on your computer and transmits them to:

df.telemetry.microsoft.com
reports.wes.df.telemetry.microsoft.com
cs1.wpc.v0cdn.net
vortex-sandbox.data.microsoft.com
pre.footprintpredict.com
This allows them to index any "unauthorized" content, and build a dossier on you that can be used in conjunction with their tracking data to stuff almost anyone in jail when needed.

When a webcam is first enabled, ~35mb of data gets immediately transmitted to:

oca.telemetry.microsoft.com
oca.telemetry.microsoft.com.nsatc.net
vortex-sandbox.data.microsoft.com
i1.services.social.microsoft.com
i1.services.social.microsoft.com.nsatc.net
This allows them to get a good layout of your home and surroundings, and a good look at YOU PERSONALLY so they know exactly who to go get and how to stage the attack when something you typed pissed them off.

Everything that is said into an enabled microphone is immediately transmitted to:

oca.telemetry.microsoft.com
oca.telemetry.microsoft.com.nsatc.net
vortex-sandbox.data.microsoft.com
pre.footprintpredict.com
i1.services.social.microsoft.com
i1.services.social.microsoft.com.nsatc.net
telemetry.appex.bing.net
telemetry.urs.microsoft.com
cs1.wpc.v0cdn.net
statsfe1.ws.microsoft.com
So even if you do not type anything, just talking in the room is gonna get you nailed, and if you say anything they don't like they will already have had a good look at you personally with your web cam, plus your surroundings, plus your exact location with that telemetry data, so they can PEG YOU GOOD. Yeah, I guess HILLARY'S E-MAILS PROVED THE NSA AS A SOURCE IS NOT GOOD ENOUGH, because using them can land you in jail. THE NEW CONSULTEE IS MICROSOFT, why use an old outdated battleship like the NSA when that can backfire?

If this weren't bad enough, this behaviour still happens when Cortana (microsoft's version of SIRI) is not installed is SO IT IS NOT ANY HELPFUL ASSISTANT DOING THIS, IT IS A DATA AND PRIVACY RAPE PURE AND SIMPLE.

Hosts file won't redirect the IP addresses in that telemetry list...

...Since it's only used for resolving hostnames. Just saying.

Errors in DisableWinTracking.log

I ran this tool previously not sure which version but its called RUN.exe

I have now tried the prerelease(?) 2.4 version and got errors in the log for almost everything with exception of skype/mail fix and another one, can remember which, but you can see it in log I am attaching.

https://drive.google.com/file/d/0ByYZ00Ome8NTdmM0b2ozeEZOcGM/view?usp=sharing

Good work btw.

Consquences of blocking some host names

I do a lot of work with tracking/advert blocking so would like to share my experiences.

atdmt.com
Sometimes used by web sites to serve their own internal links. This is third-party tracking without a doubt, but blocking view.atdmt.com may stop users from browsing a web site that employs this method. For this reason, I (begrudgingly) do not block view.atdmt.com. Ironically, the example I have recorded is within microsoft.com :-)

s0.2mdn.net
I have come across this host name being used in streaming video sites, blocking of which prevents the user from viewing the video at all.

fe2.update.microsoft.com.akadns.net
statsfe2.update.microsoft.com.akadns.net
statsfe2.update.microsoft.com.akadns.net
I would strongly recommend against blocking any host names with "update.microsoft.com" in them at all, as blocking any part of Windows Update's core functionality is a bad idea. Some of these do look statistics-related, but I am always very cautious about reducing the security of a customer's computer.

schemas.microsoft.akadns.net
This is a (CDN'd) host name used by various core parts of Microsoft's web site.

www.msftncsi.com
This is used (IME, exclusively) by a Windows machine to check to see if it's online, and adjust the systray's Network icon as appropriate.

watson.microsoft.com
reports.wes.df.telemetry.microsoft.com
services.wes.df.telemetry.microsoft.com
watson.telemetry.microsoft.com
watson.ppe.telemetry.microsoft.com
wes.df.telemetry.microsoft.com
survey.watson.microsoft.com
watson.telemetry.microsoft.com.nsatc.net
The "Watson" part of these host names refer to Microsoft's Windows Error Reporting system, where mis-behaving drivers, programs and part of Windows are recorded and, if permitted, sent to Microsoft for analysis. As a guy who fixes computers for a living, with 15 years experience, I can testify that WER is a Good Thing. It does not report to Microsoft without permission (Win10's ignorance of privacy settings not included). Without it I would have had a much more difficult life, and as a result, as would my customers! Of all the telemetry that a system can send back, I always try to enable this sort of reporting as I believe it genuinely makes a positive difference. Maybe it's worth having a "Extra paranoid" option that goes as far as disabling this sort of "important" telemetry? Especially with all the Windows 10 bugs!

A Trojan in .exe ?

https://www.virustotal.com/fr/file/0aca5aaa66a8029d533415b104348cda0c45775567a371585c6b5596a965c168/analysis/1439015508/

Add ssw.live.com to hosts blacklist?

Quote:

Windows 10 will periodically send data to a Microsoft server named ssw.live.com. This server seems to be used for OneDrive and some other Microsoft services. Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn't connected to a Microsoft Account. The exact nature of the information being sent isn't clear—it appears to be referencing telemetry settings—and again, it's not clear why any data is being sent at all. We disabled telemetry on our test machine using group policies.

Source: http://arstechnica.co.uk/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/

I have ideas...

http://someonewhocares.org/hosts/
https://www.youtube.com/watch?v=n9tYLBNX4z8

Could we combine everyone's best work into your code and really stick it to Microsoft?

http://winaero.com/blog/how-to-disable-telemetry-and-data-collection-in-windows-10/

Another great article with what looks like more to add, look at the comments section as well...

v2.4.3 shows v2.4.2 in application

Title

DisableWinTracking 2.1 shows 2.0 in 'About'

DisableWinTracking 2.1 shows 2.0 in 'About'. Which is the right version?:)

Offenders

I've noticed traffic to MS domains from all of the following. If not already included maybe you can add them to be blocked in some manner:

taskhostw.exe
CompatTelRunner.exe
SearchUI.exe
sihclient.exe
wermgr.exe
wsqmcons.exe

Also, does your app disable/delete all three of the following?

Diagnostics Tracking Service
Geolocation Service
Windows Error Reporting Service

Mail app/Outlook - Cannot add accounts

Thanks for your great work!

Start menu stopped working

First of all let me thank @10se1ucgo for making this software.

After restarting my computer the start menu and taskbar stopped working, any ideias why? And anyone know how to fix it?
Thanks

Will tracking IPs be imported by other firewalls?

Hi, thank you for doing this important work!

As I understand, the tracking IPs will be blocked only in Windows FW. But what happens when I install Comodo Internet Security? Is it usual that custom firewall would import settings from Windows FW, or it should be done manually?

adding IPs to hosts file is useless, did you know?

you can't remap an IP to IP in the hosts file, but I still saw your code try it. So it won't block those IPs, false hope.

Errors

22:50:12 ERROR: Registry: Unable to modify Service dmwappushsvc key.
Traceback (most recent call last):
  File "<string>", line 474, in modifyregistry
WindowsError: [Error 2] Le fichier spécifié est introuvable

22:50:12 ERROR: Services: dmwappushsvc unable to be stopped.
Traceback (most recent call last):
  File "<string>", line 358, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'Le service n\x92a pas \xe9t\xe9 d\xe9marr\xe9.')

22:50:12 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
  File "<string>", line 358, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'Le service sp\xe9cifi\xe9 n\x92existe pas en tant que service install\xe9.')

23:09:20 ERROR: Registry: Unable to modify Service dmwappushsvc key.
Traceback (most recent call last):
  File "<string>", line 474, in modifyregistry
WindowsError: [Error 2] Le fichier spécifié est introuvable

23:09:20 ERROR: Services: dmwappushsvc unable to be stopped.
Traceback (most recent call last):
  File "<string>", line 358, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'Le service n\x92a pas \xe9t\xe9 d\xe9marr\xe9.')

23:09:20 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
  File "<string>", line 358, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'Le service sp\xe9cifi\xe9 n\x92existe pas en tant que service install\xe9.')

IP blocking null routing (not hostname)

The tool tries to block IPs through hosts file which does not work.

The IPs can be blocked by routing them to On-Link "0.0.0.0" like this:

route -p add 65.55.108.23 MASK 255.255.255.255 0.0.0.0
route -p add 65.39.117.230 MASK 255.255.255.255 0.0.0.0
route -p add 23.218.212.69 MASK 255.255.255.255 0.0.0.0
route -p add 134.170.30.202 MASK 255.255.255.255 0.0.0.0
route -p add 137.116.81.24 MASK 255.255.255.255 0.0.0.0
route -p add 204.79.197.200 MASK 255.255.255.255 0.0.0.0

More ways to catch outgoing connections:

Windows Firewall Control or http://wfn.codeplex.com/releases
GlassWire

Regards.

Start menu search "threshold.appcache" is still being allowed

This sends a wealth of potential tracking info including a unqiue machine identifier. This occurs every time you search on the start menu, even with all privacy options set and DisableWinTracking run.

https://up1.ca/#Dpl7PlGX6DHUqQ8B9p9oAQ

Errors

Console Output

Registry: Unable to modify Service dmwappushsvc key.
Registry: Service DiagTrack key successfully modified.
Services: dmwappushsvc unable to be stopped.
Services: Diagnostics Tracking Service successfully stopped.
Services: Diagnostics Tracking Service unable to be stopped.
DiagTrack Log: Succesfully cleared and locked.
Done. It's recommended that you reboot as soon as possible for the full effect.
If any errors were found, please make a GitHub ticket with the contents of DisableWinTracking.log

DisableWinTracking.log

10:11:24 ERROR: Registry: Unable to modify Service dmwappushsvc key.
Traceback (most recent call last):
File "", line 474, in modifyregistry
WindowsError: [Error 2] The system cannot find the file specified

10:11:24 ERROR: Services: dmwappushsvc unable to be stopped.
Traceback (most recent call last):
File "", line 358, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'The service has not been started.')

10:11:24 ERROR: Services: Diagnostics Tracking Service unable to be stopped.
Traceback (most recent call last):
File "", line 358, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1061, 'ControlService', 'The service cannot accept control messages at this time.')

It's not reverseable...

So far from my tests in VMware (glad I tried it there and not on my main PC) this is not reverseable. Please add the ability to disable all the tracking and then to re-enable the tracking if needed.

certain parameters are managed by your company

i ran the program and i have this on my privacy notification :
certain parameters are managed by your company
how i can resoleve it ?

when i go to confidentiality > Comments and Diagnostics > diagnostic data and use i can't set it to "complete (recommanded)" because it don't save my changes
what i should modify in the registry to set it back ?

Question: is blocking of host names and IPs necessary if proceses are deleted?

Hi, I was asking related question before:

#64

Now I want to get it more clear. It is not very common situation that standard Windows FireWall is active - most likely people will use some different security solution.

In this case we have to maintain some type of list to make it easy to import in other FireWalls or routers. Importing host names is not easy in some solutions. It looks that this would be the list:

https://gist.github.com/10se1ucgo/fcb774d781a66ea9d31f

But if we know that processes that generate those activities are no longer active, is the blocking of domain names and IPs just a double protection that most likely is not really needed?

Thank you!

Request: hosts in raw form

Could you create a raw list of all the hosts blocked by your tool?
So the hosts could be merged with other sources as well (such as StevenBlack amalgamated hosts file).

Permission denied even with Run As Administrator

15:57:49 INFO: DisableWinTracking Version: 2.4.3

15:57:49 ERROR: Services: dmwappushsvc unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 373, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'The service has not been started.')

15:57:49 ERROR: Services: Diagnostics Tracking Service unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 373, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 320, in ControlService
error: (1062, 'ControlService', 'The service has not been started.')

15:57:50 ERROR: Registry: Unable to modify Windows Defender Spynet key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

15:57:50 ERROR: Registry: Unable to modify Windows Defender Sample Submission key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

22:50:10 INFO: DisableWinTracking Version: 2.4.3

22:50:10 ERROR: Services: Diagnostics Tracking Service unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 373, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 318, in ControlService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

22:50:12 ERROR: Registry: Unable to modify Windows Defender Spynet key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

22:50:12 ERROR: Registry: Unable to modify Windows Defender Sample Submission key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

22:50:56 INFO: DisableWinTracking Version: 2.4.3

22:50:56 ERROR: Services: dmwappushsvc unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 373, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 318, in ControlService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

22:50:56 ERROR: Services: Diagnostics Tracking Service unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 373, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 318, in ControlService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

22:50:57 ERROR: Registry: Unable to modify Windows Defender Spynet key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

22:50:57 ERROR: Registry: Unable to modify Windows Defender Sample Submission key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

22:51:01 INFO: DisableWinTracking Version: 2.4.3

22:51:01 ERROR: Services: dmwappushsvc unable to be deleted. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 363, in deleteservice
File "disablewintracking\win32serviceutil", line 302, in RemoveService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

22:51:01 ERROR: Services: Diagnostics Tracking Service unable to be deleted. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 363, in deleteservice
File "disablewintracking\win32serviceutil", line 302, in RemoveService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

22:51:01 ERROR: Services: Diagnostics Tracking Service unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
File "", line 373, in disableservice
File "disablewintracking\win32serviceutil", line 409, in StopService
File "disablewintracking\win32serviceutil", line 318, in ControlService
File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

22:51:02 ERROR: Registry: Unable to modify Windows Defender Spynet key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

22:51:02 ERROR: Registry: Unable to modify Windows Defender Sample Submission key.
Traceback (most recent call last):
File "", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

Test

INFORMATION:

Windows Edition (Home/Pro/Enterprise): Home
Architecture (32bit/64bit): 64bit
Options used: Services, Telemetry, Block domains.

LOG:

18:31:35 INFO: DisableWinTracking Version: v2.4.3

18:31:35 ERROR: Services: dmwappushsvc unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
  File "<string>", line 373, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

18:31:35 ERROR: Services: Diagnostics Tracking Service unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
  File "<string>", line 373, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

18:31:35 ERROR: Services: Diagnostics Tracking Service unable to be stopped. THIS IS ONLY AN ISSUE IF THIS IS YOUR FIRST TIME RUNNING THIS PROGRAM! Please DO NOT submit issues on GitHub otherwise.
Traceback (most recent call last):
  File "<string>", line 373, in disableservice
  File "disablewintracking\win32serviceutil", line 409, in StopService
  File "disablewintracking\win32serviceutil", line 318, in ControlService
  File "disablewintracking\win32serviceutil", line 80, in SmartOpenService
error: (1060, 'GetServiceKeyName', 'The specified service does not exist as an installed service.')

18:31:37 ERROR: Registry: Unable to modify Windows Defender Spynet key.
Traceback (most recent call last):
  File "<string>", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

18:31:37 ERROR: Registry: Unable to modify Windows Defender Sample Submission key.
Traceback (most recent call last):
  File "<string>", line 487, in modifyregistry
WindowsError: [Error 5] Access is denied

Blocking Akamai - false positives

One needs to exercise extreme care when blocking generic host names at Akamai. I have logs of fetching from a248.e.akamai.net for web content for the web site http://www.johnlewis.com/ , a UK retailer. It looks like Amazon, eBay and IMDB may also use it to serve content. I would be surprised if all of the other a[0-9].*akamai host names were not used elsewhere as well; the host names probably point at shared CDNs.

I would expect blocking these to cause subtle but frustrating problems such as thumbnail images, CSS and Javascript not working on seemingly-random web sites.