Windows 10: Need some help to understand Windows Defender telemetry.

This topic it may have been discussed somewhere in tenforums, if so please redirect me.

I decided to use Windows Defender (WD) and SmartScreen (SS) as AV. I would like to tweak its settings to avoid telemetry as far as it does not reduce the effectiveness of its protections.
Do I need to send cloud telemetry?
I understand that Disabling SS will lower the protection but I read that SS send a lot of things and it is of a privacy concern for many.
Does SS have access to the browsing history and surfing habit of the user? Does it send details of apps, files, TV series and the like the user watch or download?
With the upcoming W10 fall upgrade WD will be greatly enhanced with a number of new features. I suspect more telemetry too.

I'll much appreciate any thought, suggestion and insight how to find a balance between security and privacy.

:)

 

Why scans Defender every program when I start it?

Yes, I understand the Defender issure regarding the Scan of every program. Thank you for your reply.

As I said in the first post: I've scanned my PC with the newest release/database of Kaspersky Antivirus portable from USB stick via Linux + Malwarebytes scan, deep scan, nothing found. My system is clean.

1. No I'm using Windows Defender only.

2. No it happens only for third party programs, like Thunderbird or KeePass portable for example.

3. I think it started 4 or 5 weeks ago, after some Windows updates.

4. No Defender didn't detect any malware or viruses.

I'm not using the registry cleaning function of CCleaner, only for cleaning of temp files and cookies. I got the experience that cleaning the registry doesn't really help but rather makes the OS even worse. Unless there are some obtrusive uninstall rests
of programs which embed themselves deeply into the system.

Realtime protection is completely off, of Malwarebytes, same applies to CCleaner. Neither their processes are running.

Realtime protection of Defender is on, of course.

I also watched that the Telemetry and Data Collection as a source for high CPU usage. I used the tool
O&O ShutUp to kill it completely. And since then, my system runs pretty fast. I'll observe it for more days to make sure, but for now it has accelerated my PC significantly.

That was the only thing I've set off with the O&O ShutUp tool, because I like the concept of Windows 10 and don't want to destroy the user experience. But unfortunately Microsoft needs to improve the efficiency of Telemetry and Antivirus services and/or
processes. I will give feedback when I'm sure it has helped.

 

100 Disk Usage after Startup

This is the Microsoft Telemetry process which is utilize the whole I/O capacity of a computer independent of your model. It happens on all my Windows 10 machines and together with the Windows Defender process this can render your computer to 100% useless
for sometimes more than 10 minutes. It's a well known behavior since introducing Microsoft Telemetry.

 

Only MS can tell you that and they will not, but this says something:

Manage Privacy: SmartScreen Filter and Resulting Internet Communication

No. I disable all cloud features, I prefer AVs with heuristics. The tradeoff is, that the computer is mostly unprotected against new threats, but that is usually fixed within 24-48 hours by signatures updates.

As for cloud protection, you can customize those settings.

Code: Block at First Sight / 0 - Enable / 1 - Disable reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "0" /f Cloud-based Protection / 0 - Disable / 1 - Basic / 2 - Advanced reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "1" /f Send file samples when further analysis is required / 0 - Always prompt / 1 - Send safe samples automatically / 2 - Never send / 3 - Send all samples automatically reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "1" /f[/quote] Configuring SpyNet reporting

Enable Block at First Sight to detect malware in seconds | Microsoft Docs

Enable cloud-delivered protection in Windows Defender Antivirus | Microsoft Docs

 

Thanks for the information. Really appreciate your time and effort.

In regard the below statement:


Privacy: URLs that are collected may unintentionally contain personal information (depending on the design of the website that is visited). Like the other information that is sent to Microsoft, this information is not used to identify, contact, or target advertising to users. In addition, Microsoft filters address strings to remove personal information where possible.

Does SS collect the same even if I don't use Edge or IE?

 

@TairikuOkami

Would you recommend disabling this settings?

 

I would not say recommend, but if you are concerned about privacy, then you should keep it disabled.

No, but if it detects an unknown file, it might upload it online for the analysis.

 

So in a way SS monitor other browsers activity too. Or you mean that once a file is downloaded SS may access the computer folders and upload a newly downloaded file. Or that SS or WD have access to files and folders to monitor for old or new files?

BTW I use O&O ShutUp to disable Spynet and others unwanted Telemetry.

 

SS is like a realtime AV, it monitors all files, which are being accessed, they do not have to be from the internet.

Windows Defender SmartScreen Filter Frequently Asked Questions

 

Edit to post #6

@TairukiOkami
I can see the answers on the link you sent me.

Manage Privacy: SmartScreen Filter and Resulting Internet Communication

Thanks again, I guess does not make much sense using WD without SS. If I stick with it I have to accept some compromise.