All kinds of weird stuff started to happen.

Issue #19 new
Ilja created an issue

Hi, so i am now about to do a third full clean install of Windows 7 Professional, because something alwas happens after running Ancile.

Bitdefender has issues updating, people say it's because of a firewall rule, since Ancile alters the rules i suspect it.

Also Windows message pops up on startup, that says, "Server Busy", i googled it and tried all the things they say, doesnt work, so i suspect that it also has to do with Ancile and Bitdefender trying to update.

BTW it's not a virus, i am pretty sure, as i said i did 2 clean installs with all the updates.

It takes a long time to establish Internet connection on startup and the system is pretty much useless while that happens.

I see a lot of error messages in event log.

Steam has says this for some reason "Error: Failed to add firewall exception for C:\Program Files (x86)\Steam\bin\steamwebhelper.exe"

Can you just give the most recent full list of all the telemetry updates? I will uninstall them by hand and set Update rules to only check for updates. There is a lot of those lists on the internet, but they all are dated.

Thanks!

Comments (13)

  1. Ilja reporter

    ![So, ok, third clean install of Win7Pro, Bitdefender on it, run Ancile 1.6, while running bitdefender says infected, desinfects the file "hosts". That probably happened the 2 times before as well and thats what causing problems?

    So i excludet the file from Bitdefender scan, rund Ancile again, everything is fine, i include the file in the scan again and do a quick scan, it sayis again that a trojan was detected and desinfects the file automaticaly.

    The file itself was 23kb before desinfection and 15 kb after, so quite a bit was removed. What was it exactly, just names of websites that Bitdefender recognizes as malicious?

    Can the author respond?](https://bitbucket.org/repo/Xxr84b/images/1764070010-Unbenannt.jpg)

  2. Matthew Linton

    I don't use Bitdefender so I can't say how it's interacting with Ancile.

    Bitdefender has issues updating, people say it's because of a firewall rule, since Ancile alters the rules i suspect it.

    This could be true. Ancile blocks a long list of IP addresses and domain names that have been associated with malware and telemetry related to Windows. Without knowing the server that Bitdefender is connecting to I can't say exactly if Ancile is interfering with it.

    Also Windows message pops up on startup, that says, "Server Busy"

    Without any more details it would be impossible to determine what is causing this. Again, Ancile could be blocking a server that a process is trying to reach, but without more details there is no way to tell what is happening.

    It takes a long time to establish Internet connection on startup and the system is pretty much useless while that happens. I see a lot of error messages in event log.

    If various processes are trying to connect to servers that are being blocked then this could be the issue, but there could also be a number of things that cause the same behavior.

    Steam has says this for some reason "Error: Failed to add firewall exception for C:\Program Files (x86)\Steam\bin\steamwebhelper.exe"

    This is something that wouldn't be caused by Ancile. Ancile does add a firewall rule to block specific hosts, but it does not modify the way the firewall behaves when other programs try to add exceptions.

    Can you just give the most recent full list of all the telemetry updates?

    All the updates that are uninstalled are locatedin "ancile\data\updates\uninstall\ancile_updateuninst.lst". "ancile_updateuninst.lst" is a text file that can be opened in any text editor.

    The file itself was 23kb before desinfection and 15 kb after, so quite a bit was removed. What was it exactly, just names of websites that Bitdefender recognizes as malicious?

    The "hosts" file is a Windows system file that stores a list of host name to IP address pairs. One method of blocking access hosts (servers) is to modify this file to point to a dead end. Ancile does this to block telemetry services and other unwanted communications. It looks like Bitdefender is creating a snapshot of your "hosts" file and reverting it every time any program makes changes to it. This doesn't break anything, but any hosts that Ancile tries to block won't get blocked (Through the hosts file). Everything that Ancile Adds to the "hosts" file is located in "ancile\data\hosts\dns\ancile_hostsdns.lst". It's a text file that can be opened in any text editor.

    It seems that you think most of your issues are related to Ancile blocking hosts in the hosts file, firewall, and routing table. If you want Ancile to skip modifyting those things, you can set the following options in the "config.ini" file. Make sure that the options below are only listed once. If there are multiple definitions, Ancile will take the last one.

    # MODHOSTS (Boolean) - Modify the hosts file
    #   Y   - Add blocked hosts to the hosts file (DEFAULT).
    #   N   - Do not make any modifications to the hosts file.
    MODHOSTS=N
    
    # MODROUTES (Boolean) - Modify the routing table
    #   Y   - Add blocked hosts to the routing table (DEFAULT).
    #   N   - Do not make any modifications to the routing table.
    MODROUTES=N
    
    # MODFIREWALL (Boolean) - Create a firewall rule to block hosts
    #   Y   - Add rule to Windows firewall(DEFAULT).
    #   N   - Do not make any modifications to the Windows firewall.
    MODFIREWALL=N
    

    If you've already updated the firewall, hosts file, and routing table you will need to manually revert them.

    If you want to continue manually uninstalling Windows updates as well, the following options are also available in "config.ini"

    # MODWINUPDATE (Boolean) - Disable modification of windows update behavior
    # This disables DISABLEWINUPDATE and UNINSTALLUPDATES options
    #   Y   - Switch Windows Update to check and notify but do not download (DEFAULT).
    #   N   - Do not change Windows Update Behavior.
    MODWINUPDATE=Y
    
    # DISABLEWINUPDATE (Boolean) - If MODWINUPDATE is enabled, Disable Windows Update.
    #   Y   - Disable Windows Update. Do not check, Do not Download, Do not install, disable update service.
    #   N   - Enable Windows Update to follow MODWINUPDATE behavior (DEFAULT).
    DISABLEWINUPDATE=N
    
    # UNINSTALLUPDATES (Boolean) - Disable the uninstall and hiding of Windows updates.
    # This will not unhide or install any updates that have been blocked in the past.
    # This will just stop Ancile from blocking any updates new to this version.
    #   Y   - Uninstall and hide the recommended updates (DEFAULT).
    #   N   - Do not uninstall or hide Windows updates.
    UNINSTALLUPDATES=Y
    

    Let me know how things work out

  3. Ilja reporter

    So, i decided, to give it a chance and go on, see if i will encounter errors again. Installed all my normal programms. So far so good, no messages pop up, everything runs fine. But what about the "hosts" file now, if Bitdefender erases some ip adresses, then that means that telemetry might be sent to those adresses right? So to ensure everything is blocked i have to exclude the hosts file from Bitdefender scans, right? But then i am affraid that in case of an infection this file gets edited and not me not Bitdefender will know. I googled and looks like people have the same problems with Bitdefender and Anti-Beacon. Spybot (This one is about Win10, but it should work the same) Bitdefender

    btw, i just saw, Bitdefender has it's own Firewall and Windows Firewall is disabled, do the applied rules still work then?

    About that \/

    Also Windows message pops up on startup, that says, "Server Busy"

    Without any more details it would be impossible to determine what is causing this. Again, Ancile could be blocking a server that a process is trying to reach, but without more details there is no way to tell what is happening.

    Thats the thing, there is no more infoormation, it's just a window, that started to pupup un startup sometimes, after running Ancile. out of 15 boots it would come up once or so. and i don't know why. On this third install and Ancile run, i haven't encoutered the message yet, if it happens again, i'll let you know.

    This is the message: Server Busy it's not my screenshot, my Windows is in german, but it's the same message.

    And if i clock on "Switch to" Windows start button presses, thats it, nothing more happens, if i click "Retry" it just goes away without any information. I saw on some forums people saying that either malware causes it or some other programm that tries to connect to internet, for an update or something, before the internet services even run on Windows. I defenitely can't be a virus, and the only thing i can think of is Ancile, causeing some kind of a problem there.

  4. Matthew Linton

    But what about the "hosts" file now, if Bitdefender erases some ip adresses, then that means that telemetry might be sent to those adresses right? So to ensure everything is blocked i have to exclude the hosts file from Bitdefender scans, right? But then i am affraid that in case of an infection this file gets edited and not me not Bitdefender will know.

    It seems that your two options here are to either permanently disable Bitdefender's hosts file scanning or not bother adding Ancile's block list. From the thread you pointed me towards, it seems that even if you temporarily disable Bitdefender while updating the hosts file it will still catch the change and revert back to the old hosts file. This is one of those situations where you're going to have to decide which is more important to you; protecting your hosts file against malicious editing or blocking telemetry data with the hosts file. There are pros and cons to both approaches, and I can't really tell you which is the best choice for you.

    Bitdefender has it's own Firewall and Windows Firewall is disabled, do the applied rules still work then?

    No. Ancile only modifies the Windows firewall. If the Windows firewall has been disabled, then the changes that Ancile makes won't affect your system. This also explains why you are getting the error from Steam ("Failed to add firewall exception").

    Thats the thing, there is no more infoormation, it's just a window, that started to pupup un startup sometimes, after running Ancile. out of 15 boots it would come up once or so. and i don't know why. On this third install and Ancile run, i haven't encoutered the message yet, if it happens again, i'll let you know.

    This is a very tricky issue to diagnose. since the warning pop up doesn't give you any real information on what's opening it, it's going to be extremely difficult to figure out what's causing it. I'm sure there are some utilities that would be able to figure that out, but that's beyond my ability to help. However, we do know a few things. If you have Bitdefender running then the hosts file is not getting updated and Ancile's changes aren't affecting it. The Windows firewall is not active and Bitdefender's firewall doesn't have Ancile's rules, so those changes made by Ancie aren't affecting it. The only thing left are the changes made to the routing table. These changes are network related and are similar to the changes made when modifying the hosts file, and could explain the networking issues you are having.

    You can undo the routing table changes by (WARNING: incorrect changes to your registry can damage your system beyond repair. only follow the below steps if you are absolutely sure you know what you are doing. If your network configuration relies on custom routing rules, deleting them may break your networking. Backup all registry keys before making any changes. Don't say I didn't warn you):

    • Open up regedit
    • Go to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes"
    • Delete all entries added by Ancile (for a complete list see "ancile\data\hosts\ip\ancile_hostsip.lst")
    • Reboot

    With these three things disabled, Ancile is no longer modifying anything network related.

    I think it's important to note that Ancile contains layers of extra security for your system. The one we're focused on here is the networking changes (hosts, firewall, routing) that Ancile makes in order to try and prevent Windows from leaking telemetry data and phoning home. There are other things that Ancile does to cover the same types of things through different means. This is designed to try and ensure that we catch everything even when some aspects are bypassed (e.g. There are some programs that have been known/suspected to bypass the hosts file completely, and even bypass the entire Windows networking stack. Programs like this would completely ignore any networking changes made by Ancile, and could even ignore Bitdefender's firewall.). Any solution you pick is never going to be 100%, and there will always be unaddressed gaps. I think it's best to not get too caught up trying to get everything working perfectly.

    My recommendation would be to disable the networking changes listed above (MODHOSTS, MODROUTES, MODFIREWALL), double check that Ancile's changes have been undone, and not worry too much about leaking telemetry data. Ancile does disable telemetry through other means, and what little does leak through should be less troublesome than having a system that doesn't work well. If you're really concerned about blocking telemetry traffic, you can go through the list of hosts and IP addresses included with Ancile and try adding them one by one to the hosts file (If Bitdefender will let you) and to Bitdefender's firewall. Let me know if you do figure out any problematic hosts or IP addresses. that would be a big help.

    Hosts and IP addresses can be found:

    • ancile\data\hosts\dns\ancile_hostsdns.lst
    • ancile\data\hosts\ip\ancile_hostsip.lst
  5. Ilja reporter

    So i looked at the ip's, thats a lot, adding them all to Bitdefender's Firewall would be a lot of work, i decided, to disable the Bitdefender Firewall, and add the hosts file to exceptions, run Ancile yet again. then Enable the Bitdefender Firewall, in hopes Bitdefender will take at least some rules from the Windows FW, but it probably just overrides them with it's own rules, still worth a try i thought. The hosts file i then excluded from exceptions again and, of course Bitdefender recognized it as trojan and editet all the entries with #. I then included hosts to BDF exceptions again, manually editet the file, excludet it from exceptions and Bitdefender said nothing. I did 3 full scans of the system SSD, restarted the the PC 3 times, checked hosts again, and it looks fine.

    So, it looks like you have to edit hosts by hand, so that Bitdefender doesn't see it as a threat.

    And Firewall i think i will just leave it like it is, i hope Bitdefender doesn't leak infos to everyone, but since it's all Microsoft services it will not think of them as malicious probably so... as you said, it will never be fully secure from telemetry, but at least some things are blocked. (Damn, Windows is just a big ass malware programm at this point, if only Linux had better programms and game support, all hopes in power of Vulkan.

    I am not going to undo the routing table changes, because i didn't have the mesage popping up yet, if it happens i'll try that.

    Ok, thanks for the answers and the time dedicated to Ancile, although it doesn't work fully for me i might work for some one else.

  6. Ilja reporter

    BTW, in regards to Antivirus editing hosts file after Ancile. ^^ I said if i edit the file by hand my antivirus seems to not care anymore, turned out to be wrong, because Bitdefender detected the change made by hand and edited the file, so i edited it back again, by hand, and set the file to read only, and NOW Bitdefender seems to not modify it again.

    So might be helpful to other people if you added the note that turning off the Antivirus, running Ancile and setting hosts to "read only" and then turn on the Antivirus is recomended, i don't know how other AV's react to hosts modifications, but thats whats going on with Bitdefender.

  7. Matthew Linton

    That's a good point. I could see how other antivirus software might see changing the hosts file by Ancile as malicious behavior.

    Thanks for the followup. I'll keep that in mind for the next release.

  8. Linda Meyer

    Hi Matthew,

    huge thanks for your great work on this tool!

    I do encounter some issues though. The first has happened for the last few months already: every time I run the script: everything seems to work well, until suddently the CMD window closes; and when I check the log file, the last thing written there is "BEGIN UNINSTALL WINDOWS UPDATES".

    Additionally, today, after updating to the current version, I got some error messages. I ran the script several times today, with similar results - see log file contents below. Any help would be appreciated.

    I am running Windows 8.1 on an Acer Aspire notebook. I am regularly using other anti-spy tools as well, namely Blackbird, Spybot Anti-Beacon and DoNotSpy78 - not sure if that might be the factor that causes the trouble?

    LOG FILE ENTRIES TODAY:

    [22/12/2016 11:33:11.59] ### Ancile v1.8 ################################# [22/12/2016 11:33:11.59] Created by Matthew Linton [22/12/2016 11:33:11.59] https://bitbucket.org/matthewlinton/ancile/ [22/12/2016 11:33:11.59] ##########################################################

    [22/12/2016 11:33:11.60] BEGIN NTP SYNC The Windows Time service is stopping. The Windows Time service was stopped successfully.

    The operation completed successfully.

    The operation completed successfully.

    The command completed successfully. The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [SC] ChangeServiceConfig SUCCESS The Windows Time service is starting. The Windows Time service was started successfully.

    The command completed successfully. Sending resync command to local computer The command completed successfully. [22/12/2016 11:33:15.22] END NTP SYNC

    [22/12/2016 11:33:15.23] BEGIN CREATE RESTORE POINT [22/12/2016 11:33:17.88] END CREATE RESTORE POINT

    [22/12/2016 11:33:17.89] BEGIN AUTOMATIC UPDATES ERROR: Failed to download update from "https://bitbucket.org/matthewlinton/ancile_updates/downloads/modify_Hosts.data.zip" ERROR: Failed to download update from "https://bitbucket.org/matthewlinton/ancile_updates/downloads/modify_Routing.data.zip" ERROR: Failed to download update from "https://bitbucket.org/matthewlinton/ancile_updates/downloads/modify_WINFirewall.data.zip" ERROR: Failed to download update from "https://bitbucket.org/matthewlinton/ancile_updates/downloads/uninstall_Updates.data.zip" [22/12/2016 11:33:26.19] END AUTOMATIC UPDATES

    [22/12/2016 11:33:26.20] BEGIN REGISTRY KEY OWNERSHIP

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\ancile_Registry.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSCEIP.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSDT.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSkyDrive.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSpyNet.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSTRS.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSWER.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WiFiSense.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WINXupdate.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\modify_WINUpdate.lst

    [22/12/2016 11:33:28.55] END REGISTRY KEY OWNERSHIP

    [22/12/2016 11:33:28.57] BEGIN DISABLE INTERNET EXPLORER UPDATE PLUGIN MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 7

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 7.0 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 8

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 8 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 9

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 9 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 10

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 10 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF INTERNET EXPLORER 11

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 11 on . The operation completed successfully.

    [22/12/2016 11:33:28.83] END DISABLE INTERNET EXPLORER UPDATE PLUGIN

    [22/12/2016 11:33:28.84] BEGIN DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN Removing MS AEP related tasks [22/12/2016 11:33:29.08] END DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN

    [22/12/2016 11:33:29.09] BEGIN DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN Removing MS CEIP related tasks Removing MS CEIP from system The operation completed successfully.

    Removing MS CEIP from MS Messenger The operation completed successfully.

    [22/12/2016 11:33:35.31] END DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN

    [22/12/2016 11:33:35.33] BEGIN DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN Disabling diagnostic tracking service Disabling dmwap push service service Disabling diagnostic data collection registry entries The operation completed successfully.

    Deleting Diagnostic Log files

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\AsimovUploader" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\Sideload" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLanding" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger" now owned by the administrators group. processed file: C:\ProgramData\Microsoft\Diagnosis processed file: C:\ProgramData\Microsoft\Diagnosis\AsimovUploader processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs processed file: C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore processed file: C:\ProgramData\Microsoft\Diagnosis\Sideload processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLanding processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger Successfully processed 15 files; Failed processing 0 files Could Not Find C:\ProgramData\Microsoft\Diagnosis*.rbs [22/12/2016 11:33:35.79] END DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN

    [22/12/2016 11:33:35.82] BEGIN DISBLE MICROSOFT SKY DRIVE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:33:35.88] END DISBLE MICROSOFT SKY DRIVE PLUGIN

    [22/12/2016 11:33:35.89] BEGIN DISABLE MICROSOFT SPYNET PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:33:35.92] END DISABLE MICROSOFT SPYNET PLUGIN

    [22/12/2016 11:33:35.93] BEGIN DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN Modifying Windows Service The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2013 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2016 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:33:36.04] END DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN

    [22/12/2016 11:33:36.06] BEGIN DISABLE MS WINDOWS ERROR REPORTING PLUGIN Disabling Microsoft Windows Error Reporting tasks: Modifying Microsoft Windows Error Reporting registry: The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:33:36.14] END DISABLE MS WINDOWS ERROR REPORTING PLUGIN

    [22/12/2016 11:33:36.15] BEGIN DISABLE MICROSOFT WIFI SENSE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:33:36.18] END DISABLE MICROSOFT WIFI SENSE PLUGIN

    [22/12/2016 11:33:36.20] BEGIN DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN Removing MS WMC related tasks [22/12/2016 11:33:36.67] END DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN

    [22/12/2016 11:33:36.68] BEGIN DISABLE SERVICES

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Services\disable_RemoteRegistry.lst

    [SC] ChangeServiceConfig SUCCESS [22/12/2016 11:33:36.79] END DISABLE SERVICES

    [22/12/2016 11:33:36.82] BEGIN DISABLE TASKS

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_MSWMC.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_OtherTasks.lst

    INFO: Scheduled task "\microsoft\windows\autochk\proxy" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\autochk\proxy" have been changed. INFO: Scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" have been changed. INFO: Scheduled task "\microsoft\windows\maintenance\winsat" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\maintenance\winsat" have been changed. INFO: Scheduled task "\microsoft\windows\pi\sqm-tasks" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\pi\sqm-tasks" have been changed. INFO: Scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" have been changed. [22/12/2016 11:33:37.61] END DISABLE TASKS

    [22/12/2016 11:33:37.62] BEGIN DISABLE WINDOWS 10 FORCED UPGRADE Killing Get Windows 10 processes: Disabling Get Windows 10 Task: Adding registry keys: The operation completed successfully.

    The operation completed successfully.

    Locking Windows 10 download directory:

    SUCCESS: The file (or folder): "C:\$windows.~bt" now owned by the administrators group. processed file: C:\$windows.~bt Successfully processed 1 files; Failed processing 0 files [22/12/2016 11:33:38.23] END DISABLE WIN 10 FORCED UPGRADE

    [22/12/2016 11:33:38.25] BEGIN HOST FILE MODIFICATION Generating clean hosts file Processed 468 Lines Adding host entries

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_Hosts\modify_hosts.lst

    [22/12/2016 11:34:26.11] ### Ancile v1.8 ################################# [22/12/2016 11:34:26.11] Created by Matthew Linton [22/12/2016 11:34:26.11] https://bitbucket.org/matthewlinton/ancile/ [22/12/2016 11:34:26.11] ##########################################################

    [22/12/2016 11:34:26.12] BEGIN NTP SYNC The Windows Time service is stopping. The Windows Time service was stopped successfully.

    The operation completed successfully.

    The command completed successfully. The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [SC] ChangeServiceConfig SUCCESS The Windows Time service is starting. The Windows Time service could not be started.

    A system error has occurred.

    System error 2 has occurred.

    The system cannot find the file specified.

    The following error occurred: The service has not been started. (0x80070426) The following error occurred: The service has not been started. (0x80070426) [22/12/2016 11:34:29.43] END NTP SYNC

    [22/12/2016 11:34:29.43] BEGIN CREATE RESTORE POINT [22/12/2016 11:34:31.56] END CREATE RESTORE POINT

    [22/12/2016 11:34:31.57] BEGIN AUTOMATIC UPDATES [22/12/2016 11:34:55.98] END AUTOMATIC UPDATES

    [22/12/2016 11:34:55.99] BEGIN REGISTRY KEY OWNERSHIP

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\ancile_Registry.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSCEIP.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSDT.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSkyDrive.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSpyNet.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSTRS.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSWER.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WiFiSense.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WINXupdate.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\modify_WINUpdate.lst

    [22/12/2016 11:34:58.04] END REGISTRY KEY OWNERSHIP

    [22/12/2016 11:34:58.07] BEGIN DISABLE INTERNET EXPLORER UPDATE PLUGIN MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 7

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 7.0 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 8

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 8 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 9

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 9 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 10

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 10 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF INTERNET EXPLORER 11

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 11 on . The operation completed successfully.

    [22/12/2016 11:34:58.30] END DISABLE INTERNET EXPLORER UPDATE PLUGIN

    [22/12/2016 11:34:58.31] BEGIN DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN Removing MS AEP related tasks [22/12/2016 11:34:58.51] END DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN

    [22/12/2016 11:34:58.52] BEGIN DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN Removing MS CEIP related tasks Removing MS CEIP from system The operation completed successfully.

    Removing MS CEIP from MS Messenger The operation completed successfully.

    [22/12/2016 11:34:58.86] END DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN

    [22/12/2016 11:34:58.87] BEGIN DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN Disabling diagnostic tracking service Disabling dmwap push service service Disabling diagnostic data collection registry entries The operation completed successfully.

    Deleting Diagnostic Log files

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\AsimovUploader" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\Sideload" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLanding" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger" now owned by the administrators group. processed file: C:\ProgramData\Microsoft\Diagnosis processed file: C:\ProgramData\Microsoft\Diagnosis\AsimovUploader processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs processed file: C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore processed file: C:\ProgramData\Microsoft\Diagnosis\Sideload processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLanding processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger Successfully processed 15 files; Failed processing 0 files Could Not Find C:\ProgramData\Microsoft\Diagnosis*.rbs [22/12/2016 11:34:59.10] END DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN

    [22/12/2016 11:34:59.11] BEGIN DISBLE MICROSOFT SKY DRIVE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:34:59.15] END DISBLE MICROSOFT SKY DRIVE PLUGIN

    [22/12/2016 11:34:59.16] BEGIN DISABLE MICROSOFT SPYNET PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:34:59.19] END DISABLE MICROSOFT SPYNET PLUGIN

    [22/12/2016 11:34:59.20] BEGIN DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN Modifying Windows Service The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2013 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2016 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:34:59.32] END DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN

    [22/12/2016 11:34:59.34] BEGIN DISABLE MS WINDOWS ERROR REPORTING PLUGIN Disabling Microsoft Windows Error Reporting tasks: Modifying Microsoft Windows Error Reporting registry: The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:34:59.43] END DISABLE MS WINDOWS ERROR REPORTING PLUGIN

    [22/12/2016 11:34:59.44] BEGIN DISABLE MICROSOFT WIFI SENSE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:34:59.47] END DISABLE MICROSOFT WIFI SENSE PLUGIN

    [22/12/2016 11:34:59.49] BEGIN DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN Removing MS WMC related tasks [22/12/2016 11:35:00.00] END DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN

    [22/12/2016 11:35:00.02] BEGIN DISABLE SERVICES

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Services\disable_RemoteRegistry.lst

    [SC] ChangeServiceConfig SUCCESS [22/12/2016 11:35:00.07] END DISABLE SERVICES

    [22/12/2016 11:35:00.09] BEGIN DISABLE TASKS

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_MSWMC.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_OtherTasks.lst

    INFO: Scheduled task "\microsoft\windows\autochk\proxy" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\autochk\proxy" have been changed. INFO: Scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" have been changed. INFO: Scheduled task "\microsoft\windows\maintenance\winsat" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\maintenance\winsat" have been changed. INFO: Scheduled task "\microsoft\windows\pi\sqm-tasks" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\pi\sqm-tasks" have been changed. INFO: Scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" have been changed. [22/12/2016 11:35:00.83] END DISABLE TASKS

    [22/12/2016 11:35:00.88] BEGIN DISABLE WINDOWS 10 FORCED UPGRADE Killing Get Windows 10 processes: Disabling Get Windows 10 Task: Adding registry keys: The operation completed successfully.

    The operation completed successfully.

    Locking Windows 10 download directory:

    SUCCESS: The file (or folder): "C:\$windows.~bt" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\$windows.~bt" now owned by the administrators group. processed file: C:\$windows.~bt Successfully processed 1 files; Failed processing 0 files [22/12/2016 11:35:01.37] END DISABLE WIN 10 FORCED UPGRADE

    [22/12/2016 11:35:01.40] BEGIN HOST FILE MODIFICATION Generating clean hosts file Processed 468 Lines Adding host entries

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_Hosts\modify_hosts.lst

    Copying to system hosts file C:\Users\HS\AppData\Local\Temp\Ancile\modify_Hosts\system.hosts.tmp C:\Users\HS\AppData\Local\Temp\Ancile\modify_Hosts\modhosts.hosts.tmp 1 file(s) copied. [22/12/2016 11:35:16.93] END HOST FILE MODIFICATION

    [22/12/2016 11:35:16.96] BEGIN ROUTING TABLE MODIFICATION Modifying routing table:

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_Routing\modify_routes.lst

    [22/12/2016 11:35:22.00] END ROUTING TABLE MODIFICATION

    [22/12/2016 11:35:22.02] BEGIN FIREWALL MODIFICATION Generating firewall ruleset

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_WINFirewall\modify_winfirewall.lst

    Deleting old firewall ruleset Deleting old firewall ruleset

    Deleted 1 rule(s). Ok.

    Adding new firewall ruleset Adding updated firewall ruleset Ok.

    [22/12/2016 11:35:22.55] END FIREWALL MODIFICATION

    [22/12/2016 11:35:22.56] BEGIN MODIFY WINDOWS UPDATE The operation completed successfully.

    The operation completed successfully.

    Modifying Automatic Updates The operation completed successfully.

    [SC] ChangeServiceConfig SUCCESS Restarting Windows Updates Service: The Windows Update service is stopping. The Windows Update service was stopped successfully.

    The Background Intelligent Transfer Service service is stopping.. The Background Intelligent Transfer Service service was stopped successfully.

    The Windows Update service is starting. The Windows Update service was started successfully.

    [22/12/2016 11:35:29.95] END MODIFY WINDOWS UPDATE

    [22/12/2016 11:35:29.99] BEGIN UNINSTALL WINDOWS UPDATES [22/12/2016 11:38:09.85] ### Ancile v1.8 ################################# [22/12/2016 11:38:09.85] Created by Matthew Linton [22/12/2016 11:38:09.85] https://bitbucket.org/matthewlinton/ancile/ [22/12/2016 11:38:09.85] ##########################################################

    [22/12/2016 11:38:09.86] BEGIN NTP SYNC The operation completed successfully.

    The command completed successfully. The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [SC] ChangeServiceConfig SUCCESS The Windows Time service is starting. The Windows Time service could not be started.

    A system error has occurred.

    System error 2 has occurred.

    The system cannot find the file specified.

    The following error occurred: The service has not been started. (0x80070426) The following error occurred: The service has not been started. (0x80070426) [22/12/2016 11:38:12.19] END NTP SYNC

    [22/12/2016 11:38:12.20] BEGIN CREATE RESTORE POINT User has skipped creating restore point
    [22/12/2016 11:38:15.09] END CREATE RESTORE POINT

    [22/12/2016 11:38:15.10] BEGIN AUTOMATIC UPDATES [22/12/2016 11:38:30.09] END AUTOMATIC UPDATES

    [22/12/2016 11:38:30.11] BEGIN REGISTRY KEY OWNERSHIP

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\ancile_Registry.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSCEIP.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSDT.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSkyDrive.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSpyNet.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSTRS.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSWER.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WiFiSense.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WINXupdate.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\modify_WINUpdate.lst

    [22/12/2016 11:38:32.36] END REGISTRY KEY OWNERSHIP

    [22/12/2016 11:38:32.38] BEGIN DISABLE INTERNET EXPLORER UPDATE PLUGIN MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 7

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 7.0 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 8

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 8 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 9

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 9 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 10

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 10 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF INTERNET EXPLORER 11

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 11 on . The operation completed successfully.

    [22/12/2016 11:38:32.61] END DISABLE INTERNET EXPLORER UPDATE PLUGIN

    [22/12/2016 11:38:32.62] BEGIN DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN Removing MS AEP related tasks [22/12/2016 11:38:32.81] END DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN

    [22/12/2016 11:38:32.83] BEGIN DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN Removing MS CEIP related tasks Removing MS CEIP from system The operation completed successfully.

    Removing MS CEIP from MS Messenger The operation completed successfully.

    [22/12/2016 11:38:33.12] END DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN

    [22/12/2016 11:38:33.13] BEGIN DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN Disabling diagnostic tracking service Disabling dmwap push service service Disabling diagnostic data collection registry entries The operation completed successfully.

    Deleting Diagnostic Log files

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\AsimovUploader" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\Sideload" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLanding" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger" now owned by the administrators group. processed file: C:\ProgramData\Microsoft\Diagnosis processed file: C:\ProgramData\Microsoft\Diagnosis\AsimovUploader processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs processed file: C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore processed file: C:\ProgramData\Microsoft\Diagnosis\Sideload processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLanding processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger Successfully processed 15 files; Failed processing 0 files Could Not Find C:\ProgramData\Microsoft\Diagnosis*.rbs [22/12/2016 11:38:33.39] END DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN

    [22/12/2016 11:38:33.40] BEGIN DISBLE MICROSOFT SKY DRIVE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:38:33.44] END DISBLE MICROSOFT SKY DRIVE PLUGIN

    [22/12/2016 11:38:33.45] BEGIN DISABLE MICROSOFT SPYNET PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:38:33.48] END DISABLE MICROSOFT SPYNET PLUGIN

    [22/12/2016 11:38:33.49] BEGIN DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN Modifying Windows Service The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2013 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2016 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:38:33.61] END DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN

    [22/12/2016 11:38:33.62] BEGIN DISABLE MS WINDOWS ERROR REPORTING PLUGIN Disabling Microsoft Windows Error Reporting tasks: Modifying Microsoft Windows Error Reporting registry: The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:38:33.70] END DISABLE MS WINDOWS ERROR REPORTING PLUGIN

    [22/12/2016 11:38:33.71] BEGIN DISABLE MICROSOFT WIFI SENSE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 11:38:33.74] END DISABLE MICROSOFT WIFI SENSE PLUGIN

    [22/12/2016 11:38:33.75] BEGIN DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN Removing MS WMC related tasks [22/12/2016 11:38:34.26] END DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN

    [22/12/2016 11:38:34.27] BEGIN DISABLE SERVICES

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Services\disable_RemoteRegistry.lst

    [SC] ChangeServiceConfig SUCCESS [22/12/2016 11:38:34.32] END DISABLE SERVICES

    [22/12/2016 11:38:34.34] BEGIN DISABLE TASKS

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_MSWMC.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_OtherTasks.lst

    INFO: Scheduled task "\microsoft\windows\autochk\proxy" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\autochk\proxy" have been changed. INFO: Scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" have been changed. INFO: Scheduled task "\microsoft\windows\maintenance\winsat" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\maintenance\winsat" have been changed. INFO: Scheduled task "\microsoft\windows\pi\sqm-tasks" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\pi\sqm-tasks" have been changed. INFO: Scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" have been changed. [22/12/2016 11:38:35.10] END DISABLE TASKS

    [22/12/2016 11:38:35.11] BEGIN DISABLE WINDOWS 10 FORCED UPGRADE Killing Get Windows 10 processes: Disabling Get Windows 10 Task: Adding registry keys: The operation completed successfully.

    The operation completed successfully.

    Locking Windows 10 download directory:

    SUCCESS: The file (or folder): "C:\$windows.~bt" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\$windows.~bt" now owned by the administrators group. processed file: C:\$windows.~bt Successfully processed 1 files; Failed processing 0 files [22/12/2016 11:38:35.65] END DISABLE WIN 10 FORCED UPGRADE

    [22/12/2016 11:38:35.66] BEGIN HOST FILE MODIFICATION Generating clean hosts file Processed 468 Lines Adding host entries

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_Hosts\modify_hosts.lst

    Copying to system hosts file C:\Users\HS\AppData\Local\Temp\Ancile\modify_Hosts\system.hosts.tmp C:\Users\HS\AppData\Local\Temp\Ancile\modify_Hosts\modhosts.hosts.tmp 1 file(s) copied. [22/12/2016 11:38:44.23] END HOST FILE MODIFICATION

    [22/12/2016 11:38:44.24] BEGIN ROUTING TABLE MODIFICATION Modifying routing table:

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_Routing\modify_routes.lst

    [22/12/2016 11:38:48.85] END ROUTING TABLE MODIFICATION

    [22/12/2016 11:38:48.87] BEGIN FIREWALL MODIFICATION Generating firewall ruleset

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_WINFirewall\modify_winfirewall.lst

    Deleting old firewall ruleset Deleting old firewall ruleset

    Deleted 1 rule(s). Ok.

    Adding new firewall ruleset Adding updated firewall ruleset Ok.

    [22/12/2016 11:38:49.14] END FIREWALL MODIFICATION

    [22/12/2016 11:38:49.15] BEGIN MODIFY WINDOWS UPDATE The operation completed successfully.

    The operation completed successfully.

    Modifying Automatic Updates The operation completed successfully.

    [SC] ChangeServiceConfig SUCCESS Restarting Windows Updates Service: The Windows Update service is stopping. The Windows Update service was stopped successfully.

    The Windows Update service is starting. The Windows Update service was started successfully.

    [22/12/2016 11:38:53.88] END MODIFY WINDOWS UPDATE

    [22/12/2016 11:38:53.90] BEGIN UNINSTALL WINDOWS UPDATES [22/12/2016 14:23:38.62] ### Ancile v1.8 ################################# [22/12/2016 14:23:38.64] Created by Matthew Linton [22/12/2016 14:23:38.64] https://bitbucket.org/matthewlinton/ancile/ [22/12/2016 14:23:38.65] ##########################################################

    [22/12/2016 14:23:38.67] BEGIN NTP SYNC The Windows Time service is stopping. The Windows Time service was stopped successfully.

    The operation completed successfully.

    The command completed successfully. The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [SC] ChangeServiceConfig SUCCESS The Windows Time service is starting. The Windows Time service could not be started.

    A system error has occurred.

    System error 2 has occurred.

    The system cannot find the file specified.

    The following error occurred: The service has not been started. (0x80070426) The following error occurred: The service has not been started. (0x80070426) [22/12/2016 14:23:42.45] END NTP SYNC

    [22/12/2016 14:23:42.48] BEGIN CREATE RESTORE POINT [22/12/2016 14:24:04.91] END CREATE RESTORE POINT

    [22/12/2016 14:24:04.94] BEGIN AUTOMATIC UPDATES [22/12/2016 14:24:25.54] END AUTOMATIC UPDATES

    [22/12/2016 14:24:25.58] BEGIN REGISTRY KEY OWNERSHIP

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\ancile_Registry.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSCEIP.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSDT.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSkyDrive.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSSpyNet.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSTRS.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_MSWER.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WiFiSense.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\disable_WINXupdate.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\registrykeyownership\modify_WINUpdate.lst

    [22/12/2016 14:24:29.59] END REGISTRY KEY OWNERSHIP

    [22/12/2016 14:24:29.62] BEGIN DISABLE INTERNET EXPLORER UPDATE PLUGIN MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 7

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 7.0 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 8

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 8 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 9

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 9 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF MICROSOFT INTERNET EXPLORER 10

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 10 on . The operation completed successfully.

    MICROSOFT TOOL KIT TO DISABLE DELIVERY OF INTERNET EXPLORER 11

    Copyright (C) Microsoft Corporation. All rights reserved.

    Blocking deployment of Internet Explorer 11 on . The operation completed successfully.

    [22/12/2016 14:24:30.11] END DISABLE INTERNET EXPLORER UPDATE PLUGIN

    [22/12/2016 14:24:30.14] BEGIN DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN Removing MS AEP related tasks [22/12/2016 14:24:30.55] END DISABLE MICROSOFT APPLICATION EXPERIENCE PROGRAM PLUGIN

    [22/12/2016 14:24:30.57] BEGIN DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN Removing MS CEIP related tasks Removing MS CEIP from system The operation completed successfully.

    Removing MS CEIP from MS Messenger The operation completed successfully.

    [22/12/2016 14:24:31.09] END DISABLE MICROSOFT CUSTOMER EXPERIENCE IMPROVEMENT PROGRAM PLUGIN

    [22/12/2016 14:24:31.11] BEGIN DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN Disabling diagnostic tracking service Disabling dmwap push service service Disabling diagnostic data collection registry entries The operation completed successfully.

    Deleting Diagnostic Log files

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\AsimovUploader" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\Sideload" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLanding" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger" now owned by the administrators group. processed file: C:\ProgramData\Microsoft\Diagnosis processed file: C:\ProgramData\Microsoft\Diagnosis\AsimovUploader processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs processed file: C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore processed file: C:\ProgramData\Microsoft\Diagnosis\Sideload processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLanding processed file: C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json processed file: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger processed file: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger Successfully processed 15 files; Failed processing 0 files Could Not Find C:\ProgramData\Microsoft\Diagnosis*.rbs [22/12/2016 14:24:31.54] END DISABLE MICROSOFT DIAGNOSTICS TRACKING PLUGIN

    [22/12/2016 14:24:31.57] BEGIN DISBLE MICROSOFT SKY DRIVE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 14:24:31.63] END DISBLE MICROSOFT SKY DRIVE PLUGIN

    [22/12/2016 14:24:31.66] BEGIN DISABLE MICROSOFT SPYNET PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 14:24:31.72] END DISABLE MICROSOFT SPYNET PLUGIN

    [22/12/2016 14:24:31.75] BEGIN DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN Modifying Windows Service The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2013 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    Modifying MS Office 2016 The operation completed successfully.

    The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 14:24:31.97] END DISABLE MICROSOFT TELEMETRY REPORTING SERVICE PLUGIN

    [22/12/2016 14:24:31.99] BEGIN DISABLE MS WINDOWS ERROR REPORTING PLUGIN Disabling Microsoft Windows Error Reporting tasks: Modifying Microsoft Windows Error Reporting registry: The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 14:24:32.13] END DISABLE MS WINDOWS ERROR REPORTING PLUGIN

    [22/12/2016 14:24:32.15] BEGIN DISABLE MICROSOFT WIFI SENSE PLUGIN The operation completed successfully.

    The operation completed successfully.

    [22/12/2016 14:24:32.22] END DISABLE MICROSOFT WIFI SENSE PLUGIN

    [22/12/2016 14:24:32.25] BEGIN DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN Removing MS WMC related tasks [22/12/2016 14:24:33.16] END DISABLE MICROSOFT WINDOWS MEDIA CENTER TELEMETRY PLUGIN

    [22/12/2016 14:24:33.18] BEGIN DISABLE SERVICES

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Services\disable_RemoteRegistry.lst

    [SC] ChangeServiceConfig SUCCESS [22/12/2016 14:24:33.27] END DISABLE SERVICES

    [22/12/2016 14:24:33.33] BEGIN DISABLE TASKS

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_MSWMC.lst

    D:\Programme\Ancile (block windows spying in win7+8)\data\disable_Tasks\disable_OtherTasks.lst

    INFO: Scheduled task "\microsoft\windows\autochk\proxy" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\autochk\proxy" have been changed. INFO: Scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector" have been changed. INFO: Scheduled task "\microsoft\windows\maintenance\winsat" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\maintenance\winsat" have been changed. INFO: Scheduled task "\microsoft\windows\pi\sqm-tasks" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\pi\sqm-tasks" have been changed. INFO: Scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" has already been disabled. SUCCESS: The parameters of scheduled task "\microsoft\windows\power efficiency diagnostics\analyzeSystem" have been changed. [22/12/2016 14:24:34.49] END DISABLE TASKS

    [22/12/2016 14:24:34.51] BEGIN DISABLE WINDOWS 10 FORCED UPGRADE Killing Get Windows 10 processes: Disabling Get Windows 10 Task: Adding registry keys: The operation completed successfully.

    The operation completed successfully.

    Locking Windows 10 download directory:

    SUCCESS: The file (or folder): "C:\$windows.~bt" now owned by the administrators group.

    SUCCESS: The file (or folder): "C:\$windows.~bt" now owned by the administrators group. processed file: C:\$windows.~bt Successfully processed 1 files; Failed processing 0 files [22/12/2016 14:24:35.35] END DISABLE WIN 10 FORCED UPGRADE

    [22/12/2016 14:24:35.37] BEGIN HOST FILE MODIFICATION Generating clean hosts file Processed 468 Lines Adding host entries

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_Hosts\modify_hosts.lst

    Copying to system hosts file C:\Users\HS\AppData\Local\Temp\Ancile\modify_Hosts\system.hosts.tmp C:\Users\HS\AppData\Local\Temp\Ancile\modify_Hosts\modhosts.hosts.tmp 1 file(s) copied. [22/12/2016 14:24:44.78] END HOST FILE MODIFICATION

    [22/12/2016 14:24:44.80] BEGIN ROUTING TABLE MODIFICATION Modifying routing table:

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_Routing\modify_routes.lst

    [22/12/2016 14:24:49.61] END ROUTING TABLE MODIFICATION

    [22/12/2016 14:24:49.62] BEGIN FIREWALL MODIFICATION Generating firewall ruleset

    D:\Programme\Ancile (block windows spying in win7+8)\data\modify_WINFirewall\modify_winfirewall.lst

    Deleting old firewall ruleset Deleting old firewall ruleset

    Deleted 1 rule(s). Ok.

    Adding new firewall ruleset Adding updated firewall ruleset Ok.

    [22/12/2016 14:24:49.89] END FIREWALL MODIFICATION

    [22/12/2016 14:24:49.91] BEGIN MODIFY WINDOWS UPDATE The operation completed successfully.

    The operation completed successfully.

    Modifying Automatic Updates The operation completed successfully.

    [SC] ChangeServiceConfig SUCCESS Restarting Windows Updates Service: The Windows Update service is stopping. The Windows Update service was stopped successfully.

    The Windows Update service is starting. The Windows Update service was started successfully.

    [22/12/2016 14:24:54.68] END MODIFY WINDOWS UPDATE

    [22/12/2016 14:24:54.71] BEGIN UNINSTALL WINDOWS UPDATES

  9. Matthew Linton

    Looking at your log it seems that something is killing Ancile from continuing execution when it gets to uninstalling updates. This could be caused by anti-spy tools. I don't think Spybot Anti-Beacon is causing a problem, but I don't have any experience with Blackbird, or DoNotSpy78. if either of those two actively look for running spyware they might be shutting Ancile down. You could try disabling them before running Ancile, if you can, and see what happens.

    I do see that you are getting an error when restarting the NTP service. This is a known issue and there should be a fix in the next version.

  10. Linda Meyer

    <html> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">Hi Matthew,<br> <br> many thanks for the quick and thoughtful reply! I believe that both Blackbird and DoNotSpy78 are only active when I execute them (not 100% sure though), but I have Avast Free Anti Virus as well, and it's active all the time. Anyway, I just disabled Avast temporarily and ran the Ancile script - same issue again:<br> [23/12/2016 12:56:18.96] BEGIN UNINSTALL WINDOWS UPDATES <br> Then I suspected Windows Defender might cause the problem, but when I try to open Defender, I am told this application is turned off by group policy. <br> <br> Not sure how I can check which process shuts Ancile down? (I am not a pro.) <br> <br> Great to hear that the bug regarding the restart of NTP is going to be solved.<br> <br> Thanks and best,<br> Linda <br> <br> <br> <br> Am 22/12/2016 um 22:19 schrieb Matthew Linton:<br> </div> <blockquote

  11. Log in to comment