Original title: Microsoft is installing SPYWARE thru Windows Updates? Windows updates installed something called "Diagnostics Tracking Service" in my Windows 8.1 Pro. Take a look at THIS website. http://thepcwhisperer.blogspot.in/2014/10/microsofts-windows-10-preview-has-built.html It says what this service does in Windows 10 TP. Data We Collect When you acquire, install and use the Program, Microsoft collects information about you, your devices, applications and networks, and your use of those devices, applications and networks. Examples of data we collect include your name, email address, preferences and interests; browsing, search and file history; phone call and SMS data ; device configuration and sensor data; and application usage. For example, when you: install the Program, we may collect information about your device and applications and use it for purposes such as determining or improving compatibility, use voice input features like speech-to-text, we may collect voice information and use it for purposes such as improving speech processing, open a file, we may collect information about the file, the application used to open the file, and how long it takes and use it for purposes such as improving performance, or enter text, we may collect typed characters and use them for purposes such as improving auto complete and spell check features. While this might make some sense in a TP (although I consider collecting so much personal information as email addresses and keystrokes to be extreme), it makes no sense in a released Windows version. It's not like I have downloaded it myself from their website as a loving gesture and I want to share whatever I do in my personal life with Microsoft. They slipped it in as an "update" to Windows 8.1 This is definitely spyware behavior in some sense. It's collecting too much personal data. I don't want to share ANYTHING with Microsoft. I have NOT turned on the customer improvement program thing in Windows. WHY IS MICROSOFT DOING THIS? WHICH KB DO I NEED TO UNINSTALL AND BLOCK IN ORDER TO GET RID OF THIS? WHY IS MY ANTIVIRUS NOT REMOVING THIS? HAS MS PAID THE ANTIVIRUS VENDORS? SHOULD I DISABLE AUTOMATIC UPDATES? I'M LOSING TRUST ON MICROSOFT. THEY CAN INSTALL SPYWARE ANY MOMENT, I CANNOT INDIVIDUALLY CHECK THE KB ARTICLE ON EVERY UPDATE JUST TO MAKE SURE IT'S NOT SOMETHING THAT'LL SEND PERSONAL INFORMATION BACK TO MS. I'm really upset about this. :(

You don't have to uninstall the update. It is sufficient to disable the service: Run Services.msc Right-click " Diagnostics Tracking Service " Properties Set Startup Type to Manual or Disabled The service itself is relatively harmless in terms of privacy. However Microsoft should provide a UI setting to disable it (opt-out) like they do for the error reports (WER).

Major problem with the " Diagnostics Tracking Service " on my 8.1 desktops. Disabled service, but have no resolution. utcsvc (Diagnostics Tracking Service) flooding Microsoft IPs with SSL/443 traffic. T noticed Saturday a suspicious URLs: •settings.data.glbdns2.microsoft.com - 65.55.44.108 •settings-win.data.microsoft.com •onesettings-db5.metron.live.com.nsatc.net nslookup settings.data.glbdns2.microsoft.com Non-authoritative answer: Name: OneSettings-bn2.metron.live.com.nsatc.net Address: 65.55.44.108 Aliases: settings.data.glbdns2.microsoft.com nslookup settings-win.data.microsoft.com (Monday morning) Non-authoritative answer: Name: OneSettings-bn2.metron.live.com.nsatc.net Address: 65.55.44.108 Aliases: settings-win.data.microsoft.com settings.data.glbdns2.microsoft.com nslookup settings-win.data.microsoft.com (Sunday afternoon) Non-authoritative answer: Name: settings-win.data.microsoft.com Addresses: 67.215.65.131 67.215.65.131 --------------------------- WS649 Microsoft Windows [Version 6.3.9600] (c) 2013 Microsoft Corporation. All rights reserved. C:\Windows\system32>SFC /SCANNOW Beginning system scan. This process will take some time. Beginning verification phase of system scan. Verification 100% complete. Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not supported in offline servicing scenarios. utcsvc (Diagnostics Tracking Service) 65.55.44.108, Thursday the 4th : <log><time>1433439487</time><orig>216.184.76.74</orig><src>192.168.5.47</src><dst>65.55.44.108</d st><s_port>52167</s_port><d_port>443</d_port><action>HTTPS Bypass</action><proto>tcp</proto><i_f_dir>inbound</i_f_dir><i_f_name>eth1</i_f_name><product>HTTP S Inspection</product><state filename='fw.log' fileid='1433376394' position='1387714' /></log> 67.215.65.131 started Saturday night, first entry: <log><time>1433640795</time><orig>216.184.76.74</orig><src>192.168.40.23</src><dst>67.215.65.131< /dst><s_port>49814</s_port><d_port>443</d_port><action>HTTPS Bypass</action><proto>tcp</proto><i_f_dir>inbound</i_f_dir><i_f_name>eth1</i_f_name><product>HTTP S Inspection</product><state filename='fw.log' fileid='1433635498' position='42326' /></log>

The above has to be causing Microsoft a DoS storm condition with worldwide 8.1 desktops. Anyone have information? June 8, 2015 20:12 EDT

William, try this: 1>Disable Automatic Windows Updates temporarily. 2>Connect to the internet. 3>Open an elevated command prompt. 4>Type this command and press enter:- Dism /Online /Cleanup-Image /RestoreHealth 5>On completion, it should display something like "Component store corruption was successfully repaired". If it shows an error, recheck your internet connection and execute the command again. 6>Run SFC/SCANNOW, it should now be able to repair successfully. After SFC completes, restart the computer. Run SFC again and verify that SFC says no integrity violations are detected. 7>Open PROGRAMS AND FEATURES, click on VIEW INSTALLED UPDATES, type KB3068708 and UNINSTALL this update. 8>Open Windows Updates and check for updates again. It should display KB3068708 as an available (important) update. Blacklist this update (right click and click "hide update"). Check for updates again, it should say NO UPDATES AVAILABLE. 9>Re-enable Automatic Windows Updates. Let us know if this works. I have this Diagtrackrunner.exe randomly trying to connect to Microsoft. I don't have the customer experience improvement program checked, but yet it's constantly phoning home. No idea why Microsoft is screwing with us. WE DON'T WANT TRACKERS OF ANY KIND, if we have a problem we will contact Microsoft or our laptop manufacturer, or our administrator on our own, we don't want constant tracking, no matter how noble your intentions are. :( By most chances, this tracker will be integrated into Windows 10 when it releases, it won't be an "Update", and we won't even have a way of uninstalling it. Good job.

See also: http://www.eightforums.com/tutorials/48338-verbose-status-messages-enable-disable-windows-8-a.html When you enable VerboseStatus in Windows by entering this reg key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "VerboseStatus"=dword:00000001 you can see what Windows is doing during shutdown and you will see the Diagnostics Tracking Service running during shutdown when it is enabled.

What is Diagnostics Tracking Service which was installed from Windows Updates?

Anonymous

Original title: Microsoft is installing SPYWARE thru Windows Updates?

Windows updates installed something called "Diagnostics Tracking Service" in my Windows 8.1 Pro.

Take a look at THIS website.

http://thepcwhisperer.blogspot.in/2014/10/microsofts-windows-10-preview-has-built.html

It says what this service does in Windows 10 TP.

Data We Collect

When you acquire, install and use the Program, Microsoft collects information about you, your devices, applications and networks, and your use of those devices, applications and networks. Examples of data we collect include your name, email address, preferences and interests; browsing, search and file history; phone call and SMS data; device configuration and sensor data; and application usage. For example, when you:

install the Program, we may collect information about your device and applications and use it for purposes such as determining or improving compatibility,
use voice input features like speech-to-text, we may collect voice information and use it for purposes such as improving speech processing,
open a file, we may collect information about the file, the application used to open the file, and how long it takes and use it for purposes such as improving performance, or
enter text, we may collect typed characters and use them for purposes such as improving auto complete and spell check features.

While this might make some sense in a TP (although I consider collecting so much personal information as email addresses and keystrokes to be extreme), it makes no sense in a released Windows version.

It's not like I have downloaded it myself from their website as a loving gesture and I want to share whatever I do in my personal life with Microsoft. They slipped it in as an "update" to Windows 8.1

This is definitely spyware behavior in some sense. It's collecting too much personal data.

I don't want to share ANYTHING with Microsoft. I have NOT turned on the customer improvement program thing in Windows.

WHY IS MICROSOFT DOING THIS?

WHICH KB DO I NEED TO UNINSTALL AND BLOCK IN ORDER TO GET RID OF THIS?

WHY IS MY ANTIVIRUS NOT REMOVING THIS? HAS MS PAID THE ANTIVIRUS VENDORS?

SHOULD I DISABLE AUTOMATIC UPDATES? I'M LOSING TRUST ON MICROSOFT. THEY CAN INSTALL SPYWARE ANY MOMENT, I CANNOT INDIVIDUALLY CHECK THE KB ARTICLE ON EVERY UPDATE JUST TO MAKE SURE IT'S NOT SOMETHING THAT'LL SEND PERSONAL INFORMATION BACK TO MS.

I'm really upset about this. :(

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

51 answers

Anonymous

2015-05-21T00:19:56+00:00
You don't have to uninstall the update. It is sufficient to disable the service:
- Run
- Services.msc
- Right-click "Diagnostics Tracking Service"
- Properties
- Set Startup Type to Manual or Disabled
The service itself is relatively harmless in terms of privacy. However Microsoft should provide a UI setting to disable it (opt-out) like they do for the error reports (WER).
Was this answer helpful?

3 people found this answer helpful.

0 comments No comments
Anonymous

2015-06-09T00:09:22+00:00

Major problem with the "Diagnostics Tracking Service" on my 8.1 desktops.

Disabled service, but have no resolution.

utcsvc (Diagnostics Tracking Service) flooding Microsoft IPs with SSL/443 traffic.

T noticed Saturday a suspicious URLs:

•settings.data.glbdns2.microsoft.com - 65.55.44.108

•settings-win.data.microsoft.com

•onesettings-db5.metron.live.com.nsatc.net

nslookup settings.data.glbdns2.microsoft.com

Non-authoritative answer:

Name:    OneSettings-bn2.metron.live.com.nsatc.net

Address: 65.55.44.108

Aliases: settings.data.glbdns2.microsoft.com

nslookup settings-win.data.microsoft.com (Monday morning)

Non-authoritative answer:

Name:    OneSettings-bn2.metron.live.com.nsatc.net

Address: 65.55.44.108

Aliases: settings-win.data.microsoft.com

          settings.data.glbdns2.microsoft.com

nslookup settings-win.data.microsoft.com (Sunday afternoon)

Non-authoritative answer:

Name:    settings-win.data.microsoft.com

Addresses: 67.215.65.131

          67.215.65.131

--------------------------- WS649

Microsoft Windows [Version 6.3.9600]

(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SFC /SCANNOW

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.

Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some

of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For

example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not

supported in offline servicing scenarios.

utcsvc (Diagnostics Tracking Service)

65.55.44.108, Thursday the 4th :

<log><time>1433439487</time><orig>216.184.76.74</orig><src>192.168.5.47</src><dst>65.55.44.108</d

st><s_port>52167</s_port><d_port>443</d_port><action>HTTPS

Bypass</action><proto>tcp</proto><i_f_dir>inbound</i_f_dir><i_f_name>eth1</i_f_name><product>HTTP

S Inspection</product><state filename='fw.log' fileid='1433376394' position='1387714' /></log>

67.215.65.131 started Saturday night, first entry:

<log><time>1433640795</time><orig>216.184.76.74</orig><src>192.168.40.23</src><dst>67.215.65.131<

/dst><s_port>49814</s_port><d_port>443</d_port><action>HTTPS

Bypass</action><proto>tcp</proto><i_f_dir>inbound</i_f_dir><i_f_name>eth1</i_f_name><product>HTTP

S Inspection</product><state filename='fw.log' fileid='1433635498' position='42326' /></log>
Was this answer helpful?

0 comments No comments
Anonymous

2015-06-09T00:12:19+00:00

The above has to be causing Microsoft a DoS storm condition with worldwide 8.1 desktops.

Anyone have information?

June 8, 2015 20:12 EDT
Was this answer helpful?

0 comments No comments
Anonymous

2015-06-09T13:20:41+00:00

William, try this:

1>Disable Automatic Windows Updates temporarily.

2>Connect to the internet.

3>Open an elevated command prompt.

4>Type this command and press enter:-

Dism /Online /Cleanup-Image /RestoreHealth

5>On completion, it should display something like "Component store corruption was successfully repaired". If it shows an error, recheck your internet connection and execute the command again.

6>Run SFC/SCANNOW, it should now be able to repair successfully. After SFC completes, restart the computer. Run SFC again and verify that SFC says no integrity violations are detected.

7>Open PROGRAMS AND FEATURES, click on VIEW INSTALLED UPDATES, type KB3068708 and UNINSTALL this update.

8>Open Windows Updates and check for updates again. It should display KB3068708 as an available (important) update. Blacklist this update (right click and click "hide update"). Check for updates again, it should say NO UPDATES AVAILABLE.

9>Re-enable Automatic Windows Updates.

Let us know if this works.

I have this Diagtrackrunner.exe randomly trying to connect to Microsoft. I don't have the customer experience improvement program checked, but yet it's constantly phoning home. No idea why Microsoft is screwing with us. WE DON'T WANT TRACKERS OF ANY KIND, if we have a problem we will contact Microsoft or our laptop manufacturer, or our administrator on our own, we don't want constant tracking, no matter how noble your intentions are. :(

By most chances, this tracker will be integrated into Windows 10 when it releases, it won't be an "Update", and we won't even have a way of uninstalling it. Good job.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Anonymous

2015-06-18T23:29:59+00:00

See also:

http://www.eightforums.com/tutorials/48338-verbose-status-messages-enable-disable-windows-8-a.html

When you enable VerboseStatus in Windows by entering this reg key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

"VerboseStatus"=dword:00000001

you can see what Windows is doing during shutdown and you will see the Diagnostics Tracking Service running during shutdown when it is enabled.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments