Spybot Anti-Beacon for Windows 10

This is list of Address people are block via router for all the telemetry in win 10
grabed from https://github.com/RMerl/asuswrt-mer...ws-10-tracking

IT it said some of the address are hardcoded and cant be block from system, but router can be told to drop it

Code:

---

a.ads1.msn.com
a.ads2.msads.net
a.ads2.msn.com
a.rad.msn.com
a-0001.a-msedge.net
a-0002.a-msedge.net
a-0003.a-msedge.net
a-0004.a-msedge.net
a-0005.a-msedge.net
a-0006.a-msedge.net
a-0007.a-msedge.net
a-0008.a-msedge.net
a-0009.a-msedge.net
ac3.msn.com
ad.doubleclick.net
adnexus.net
adnxs.com
ads.msn.com
ads1.msads.net
ads1.msn.com
aidps.atdmt.com
aka-cdn-ns.adtech.de
a-msedge.net
apps.skype.com
az361816.vo.msecnd.net
az512334.vo.msecnd.net
b.ads1.msn.com
b.ads2.msads.net
b.rad.msn.com
bs.serving-sys.com
c.atdmt.com
c.msn.com
cdn.atdmt.com
cds26.ams9.msecn.net
choice.microsoft.com
choice.microsoft.com.nsatc.net
compatexchange.cloudapp.net
corp.sts.microsoft.com
corpext.msitadfs.glbdns2.microsoft.com
cs1.wpc.v0cdn.net
db3aqu.atdmt.com
df.telemetry.microsoft.com
diagnostics.support.microsoft.com
ec.atdmt.com
fe2.update.microsoft.com.akadns.net
feedback.microsoft-hohm.com
feedback.search.microsoft.com
feedback.windows.com
flex.msn.com
g.msn.com
h1.msn.com
i1.services.social.microsoft.com
i1.services.social.microsoft.com.nsatc.net
lb1.www.ms.akadns.net
live.rads.msn.com
m.adnxs.com
m.hotmail.com
msedge.net
msftncsi.com
msnbot-65-55-108-23.search.msn.com
msntest.serving-sys.com
oca.telemetry.microsoft.com
oca.telemetry.microsoft.com.nsatc.net
pre.footprintpredict.com
preview.msn.com
pricelist.skype.com
rad.live.com
rad.msn.com
redir.metaservices.microsoft.com
reports.wes.df.telemetry.microsoft.com
s.gateway.messenger.live.com
s0.2mdn.net
schemas.microsoft.akadns.net
secure.adnxs.com
secure.flashtalking.com
services.wes.df.telemetry.microsoft.com
settings-sandbox.data.microsoft.com
settings-win.data.microsoft.com
sls.update.microsoft.com.akadns.net
sqm.df.telemetry.microsoft.com
sqm.telemetry.microsoft.com
sqm.telemetry.microsoft.com.nsatc.net
static.2mdn.net
statsfe1.ws.microsoft.com
statsfe2.update.microsoft.com.akadns.net
statsfe2.ws.microsoft.com
survey.watson.microsoft.com
telecommand.telemetry.microsoft.com
telecommand.telemetry.microsoft.com.nsatc.net
telemetry.appex.bing.net
telemetry.microsoft.com
telemetry.urs.microsoft.com
view.atdmt.com
vortex.data.microsoft.com
vortex-bn2.metron.live.com.nsatc.net
vortex-cy2.metron.live.com.nsatc.net
vortex-sandbox.data.microsoft.com
vortex-win.data.microsoft.com
watson.live.com
watson.microsoft.com
watson.ppe.telemetry.microsoft.com
watson.telemetry.microsoft.com
watson.telemetry.microsoft.com.nsatc.net
wes.df.telemetry.microsoft.com
www.msftncsi.com

---

Silent command not work

https://virusscan.jotti.org/en-GB/fi...job/fes43c9axe
https://www.virustotal.com/en/file/0...2b54/analysis/

@Billaboard: There's just one AV reporting something currently:
VirusTotal results
Mighte be bad heuristics, since this tool uses the hosts file, firewall and more.

@Kyzoku: Thanks for the reporting regarding Bing, I'll re-label this!

@tsumai2311: wow, thanks for the extensive list! The issue with lists like these is that it blocks not just MS stuff, but also some ad servers, for example (good for me, but not the purpose of the app), and complete apps like Skype. As for the hardcoded stuff - that might work around the DNS blocking via hosts file, but with 1.4, we've also started using the integrated Windows Firewall. Might be worth checking whether that can get passed as well.

@Mariovit: the About list of parameters is auto-generated, this one is indeed not implemented yet in 1.4. Will be in 1.5 (just tested, it's there now).

To sum up: thanks to all of you for helping finding what's up next for 1.5 :)

Hi PepiMK.

I got a chance to try out the latest version of your Spybot Anti-Beacon app (a Portable one) and ran it on a Win7 computer.
Found a minor bug in v1.4. After running it and clicking on the Minimize button to minimize the program window, it minimizes on the lower-left hand side of the screen and when I try to click on it (or click on the restore window icon), the spybot anti-beacon program window does not get restored. while it was minimized, I had to click on the close button [X] to close the program - that was my only option.

I've figured out what CEIP Scheduled Tasks that are being blocked by Spybot Anti-Beacon...almost all of them.
I opened Task Scheduler by running taskschd.msc, expand the Microsoft section, then expand the Windows section, and checked the following sections:

Application Experience > set the "ProgramData" task to Disable
Autochk > set the "Proxy" task to Disable
Customer Experience Improvement Program > set the "Consolidator" task to Disable
DiskDiagnostic > set the "Microsoft-Windows-DiskDiagnosticDataCollector" task to Disable

If you manually disable these specified Tasks in Task Scheduler, the Spybot Anti-Beacon app will see these CEIP based tasks as Blocked.

I am running version 1.4 on Windows 10 and have noticed 2 issues.

1. The check update functionality is not working. I get an error saying "An unknown error occured while trying to search for updates: SSL/TLS support is not compiled!"
2. The most important, the app has placed a file-write lock or changed some permission of the hosts file because now I can't edit it to add my own entries. I am used to adding entries used for web-deving, now I can't. Even if I disable the 'immunizations' I still can edit the host file, not even as an administrator.

I just installed Spybot Anti-Beacon v1.4.0.26 on my Win7SP1 x64 Ultimate PC. Install completed and return this pop-up window:

Attachment 12358

Clicking "OK", the program ran just fine. This happens on all subsequent launches.

request please don't use 127.0.0.1 but 0.0.0.0 or even 0 to block via the hosts file, it's faster because you don't have to wait for a timeout.

Quote:

---

Originally Posted by PepiMK

As for the hardcoded stuff - that might work around the DNS blocking via hosts file, but with 1.4, we've also started using the integrated Windows Firewall. Might be worth checking whether that can get passed as well.

---

Indeed, they've skipped the hosts, might as well jump the firewall too?

Thanks for the handy tool

@PepiMK

Yes it huge list I got from https://github.com/RMerl/asuswrt-mer...ws-10-tracking

I was gona just block all of it from my router I have not fiqure out how to do that yet. Block it from router is only way to stop it with 100% certainty. as for the "apps" i hate them all they should not be on windows desktop OS so i could care less about it that breaks things, I might switch to LTSB of enterpise win 10, just to not have any of the "apps" installed

Win7 and 8.1 have been infect with all this in recent updates too

Again many thanks for the valuable feedback everyone :)

@noel-pr7: the immunize bug will be fixed in 1.5 :)

You can find out what gets blocked by clicking the "Show details" button... we try to list it all there :)


@4ayo19: my apologies, I'll make sure the latest version of the necessary OpenSSL libraries are included in the installer!


Setting the hosts file read only is something we do in Spybot as well. Simply right-click it, open Properties, and remove the read-only flag.


There's now a group policy (call gpedit.msc, check Administrative.../Safer-Networking.../Spybot Anti-Beacon/Hosts/)


@MarkAtHome: as for 4ayo19, the issue is that Anti-Beacon should not depend on the SSL libraries to exist on the system. Will fix!


@OnePingOnly: I remember lengthy discussions about 127.0.0.1 vs. 0.0.0.0 from the early times of Spybots immunization. I've just noticed that while in Spybot, there's a registry tweak to change this, there is none in Anti-Beacon.


There's now a group policy for this as well in 1.5.