Microsoft backports data slurp to Windows 7 and 8 via patches (Win 10 spyware comes to 7, 8.1)

The Register ^ | Sep 1, 2015 | Andrew Orlowski

[dayglored]

We recently mused, half seriously, whether the entire point of the Windows 10 upgrade was to harvest your personal information. With Microsoft suffering from a serious case of Google envy, perhaps it felt it had some catching up to do.

Now Microsoft is revamping the user-tracking tools in Windows 7 and 8 to harvest more data, via some new patches.

All the updates can be removed post-installation – but all ensure the OS reports data to Microsoft even when asked not to, bypassing the hosts file and (hence) third-party privacy tools. This data can include how long you use apps, and which features you use the most, snapshots of memory to investigate crashes, and so on.

The updates are KB3068708 ("Update for customer experience and diagnostic telemetry" and mandatory) KB3075249 ("Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7") and KB3080149 (also an "Update for customer experience and diagnostic telemetry", both optional).

The notes explain that diagnostic telemetry data is sent to settings-win.data.microsoft.com (64.4.54.253) over SSL. Privacy advocates note that the OS is hardwired to use that hostname, so trying to override the IP address it resolves to using your PC's hosts file won't work.

The tools relate to Microsoft's CEIP ('customer experience improvement program')...

[lysie]

Bkmk

[SauronOfMordor]

Will Windows stop working if you set your router or corporate firewall to block traffic to that IP address?

[knarf]

I always clear my history after a day's computing and it was always easy (chrome).... upper right a three bar thingy, click history, click clear

This morning I noticed the 'history' line has been replaced with 'history and recent tabs' with no seeable way to delete my history

[fruser1]

Might be better off just going back to paper.

[redfreedom]

catnipman,

Thanks for the removal advice, I searched for the first one and it’s there. After this post I will find and remove all of them.

Question: (for you or anyone that can answer)

I do manual backups via copy and paste. When the back up is done, I check the properties of the copied and the pasted to make certain that the total files, folders and file size match.

With this property check I’ve discovered hidden files that do not copy and do not get pasted to the backup. Since they are hidden, I have no way of knowing what they are.

Under Folder Options, View, I have Show hidden files and folders checked.

I delete these hidden files by creating a new folder, copying all the files from the old and pasting in the new folder. Now this old folder should have zero files in it, but still has that one file I cannot see. So I delete that folder and the hidden file goes away.

The next time I back up, more hidden files are found. This is on a combination CAD drawing and photo editing project of mine.

Any idea what these files could be, how to make them visible? I suspect they are something someone put there to mine data. I’m running W7 64 bit.

[trebb]

Checked my Win7 system and all are listed in the "Optional" screen - none have been automatically pushed (so far).

I allow mandatory updates but anything else is chosen on a case-by-case standard.

[Dalberg-Acton]

Bump

[zeugma]

I’m not sure I’d trust MS to actually uninstall it.

That’s ok. I have a win 7 VM that has a very specific purpose in life. I might just block all microsoft ip address blocks from my firewall and forgo additional updates.

[rarestia]

Run the following from an administrative command prompt:

wusa /uninstall /kb:[kbNumber]

It took less than a minute to uninstall all 5 updates.

These are considered optional updates and do not install automatically unless you have automatic updates turned on to not require any user interaction.

Blocking the endpoint IP address in a hardware firewall does NOT cause an issue with the OS.

[ShadowAce]

...Microsoft has apparently decided it is more important to gather their users' information, secretly, and lie about it, than it is to provide a worthwhile product that simply does what the user needs.

That is due solely to the fact that the user is NOT their customer. The user is the product. Just like for Google.

[Skooz]

bfl

[dayglored]

> ...the user is NOT their customer. The user is the product. Just like for Google.

Yah, mon. *sigh*

Another reason my workstation at work is CentOS. As a Sysadmin I can't be constantly worrying about data leakage from my tools.

[GOPJ]

Bookmarked.

[daniel1212]

I hope they see that I

Set Windows View to Details (though that will not carry over to all folder types even if you choose Apply to.. in FolderOptions).

Changed the Win key +E shortcut to launch File (Windows) Explorer), not Quick Access. (Run: control.exe /name Microsoft.FolderOptions)

While there, chose to show everything and hide nothing.

Added the buried Quick Launch bar ("C:\Users\type user name here\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch" or run, %UserProfile%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch) to the Task bar

Made shortcuts to the Send To (%UserProfile%\AppData\Roaming\Microsoft\Windows\SendTo ) folder, and place one in it, so i can send other shortcuts to it, like the Quick Launch. And made one to the largely unknown Start up folder (Main one is in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp), and to others, which are placed in the Quick Launch. Including to the hidden Libraries %UserProfile%\AppData\Roaming\Roaming\Microsoft\Windows\Libraries

Copied many profile folders from my old Windows user folder (which if you installed over a previous Windows Hard Drive, (even if you choose not to keep files, should be in your C drive marked Windows.old) into my new user folder %UserProfile%\AppData\Roaming

Installed Firefox with multiple profiles, which were on another saved partition, and changed the shortcut to "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -no-remote -p

Replaced the Start Menu with Classic Shell

Turned off Indexing, and and installed Unlocker and thus renamed SearchUi.exe (hope it stays that way), and nuked many shortcuts that Windows includes that are dead (like to Printhood)

Turned off Windows Defender via reg file (Reboot to effect)

Among many other changes. Thank God.

[catnipman]

“I might just block all microsoft ip address blocks from my firewall “

You’ll have to do that from your router; multiple reports say these telemetry programs have hard-coded IPs AND they bypass both the OS firewall and the hosts file.

[catnipman]

“Too much work.”

yeah, but that crap is still running in the background consuming resources, not to mention the 12GB installer and KB3035583 constantly exhorting you to go ahead and install W10; one slip of the finger there by you or someone else WILL install W10.

[catnipman]

yes, here’s a crude script to do that:

@echo off

wusa /uninstall /kb:3035583 /norestart

wusa /uninstall /kb:3022345 /norestart

wusa /uninstall /kb:3068708 /norestart

wusa /uninstall /kb:3075249 /norestart

wusa /uninstall /kb:3080149 /norestart

still need to manually check autoupdates and remove W10 installer directory

[rarestia]

Only one of them requires a restart.

[EnigmaticAnomaly]

Thank you. I appreciate the info.

[OldMissileer]

Bump for later.