Windows 10: Suggestions on services to disable?

Where did you get your Windows 10 ISO and how are you activating Windows 10 if its never been online?

 

http://www.thewindowsclub.com/free-f...ftware-windows

Ideas for free file encryption and container style encryption.

 

Microsoft.

 

Ty, I disabled the container services lastnight hopefully this might help.

 

So how are you activating Windows 10 if that PC never goes online?

 

Everytime I perform a clean install I go online long enough to activate and update windows, every time windows releases their updates (especially ones they claim that fix issues that allow "certain programs" to exploit remote services") I do a new format and install, I do not even open the browser however i do extract TCPView to the desktop and watch the 400+ endpoints, the 200+ active connections many of which are mainly sending and belong to akamitechnologies.

Anyway after updates are installed I disconnect reboot and install Photoshop again. Sometimes I wait a few days before reinstalling Photoshop, I was thinking Photoshop could be the cause of this, however I discovered in January that svchost sends with no connection and nothing at all installed. The svchost process that does this every time is the one that runs WPN and the other useless services. This does not happen every single day but most days. When 2 days passed and nothing at all appeared under "network other" I thought I had resolved the issue LOL until I clicked on the start menu then twice as much as normally pops up there appeared.

Oh and the webcache files issue I find appears before I install a thing.

Oh and just a little more I've tried over the past 14 months to stop whatever this is. While I had an Nvidia graphics card and was unable to keep remote services and Phone from running despite having disabled them, despite unchecking that "allow remote connections" box and disabling them in group policy, I started going through removing the registry entries for them. I discovered that if you remove all remote registry entries you cannot open your own photos instead you have a grayed out image with an error box that states "no connection." If you remove windows files for things you do not use nor want like phone you cannot open the start menu. But if you remove the JPNKorRoaming and CHSKorRoaming (I forget the exact name) from input you can stop windows settings from launching despite the fact that you have turned it off under privacy and, turned off sync your settings and so on.

I have been experimenting trying to find a solution myself since none of these guides to disable this or that works for me and found a way to stop most of those (if I want to follow resource monitor and those handles and delete files. Yes creating restore points as I go) but I cannot stop Microsoft.Photos from running EVER.

Interestingly enough I do not have a Microsoft account linked to the pc - Local only. 140 events for Live ID in event viewer. Another 170 events under TerminalService LocalSessionManager these are "Remote Desktop is not accepting logons because setup is running." So this happens during the install.

Screenshot of exact message you get when you try to launch one of your own photos stored on your own device after removing all registry entries for remote desktop.

 

Anyway update on my endeavors... I have changed all of those 1's to 0's in the registry HKLM\System\ControlSet\Control\TerminalServer I had previously disabled it in group policy and changed that 1 for "enable user to 0" but seems to have made no difference. So now I went through all the subkeys and chanced everything including remotefx to 0s.

I don't understand why disabling these things like rdp.clip and remotefx in group policy does not effect them but hopefully disabling everything (I hope) that seems to be enabled by default like enable auto login enable auto client auto client drives and so on might help my issues.

Can anyone tell me what I should do about the transport type it's currently set to 2 and lan is set to 0 (default I guess because I did not touch that one) I just want to disable it all and just maybe be able to protect my future work.

 

And finally these events from eventviewer took place on the 8th while I was busy working in Photoshop

 

You are barking at wrong three so to speak. It's very simple, no internet or network and things are not going anywhere.

 

The issue can't be related to Rasphone.exe? I was searching the registry trying to find adobe.drive (apparently adobe uses this for cloud and data collections in newer versions) anyway no sign of it. However I did come across the numerous MUICaches, only the few programs I use, Photoshop, Process Explorer, process Hacker, Bitlocker and TCPView listed. But so is rasphone.exe and tswbprxy.exe

Unable to find a service for either one of them so not something that I can disable and no idea why they would be in the MUICache.

 

Are you documenting all these things your doing to your system? Because sooner or latter your going to break things to where you'll have to reinstall Windows and start all over again. So where do you think this "data" is actually going? It's not going on the Internet if you don't have an Internet connection. How many times do we have to say this before it sinks in?

 

All I have done is disable services. And yes I have the restore points created. I am trying stop whatever is doing this. I keep process explorer open, while i'm working and suddenly the session number changes from 1 to 2, the pc does not seem to have suffered any issue, no black no waking up no hiccups in what I'm doing - just suddenly that number changes. So I reboot and check eventviewer and find "session 1 disconnected by session 1" "session 2 begin arbitration" and so on. Doesn't make sense to me and no one has an explanation for what's going on.

Now I find Rasphone.exe and TSwbprxy.exe in my most used cache. I don't use either so I can't figure out why they would be there.

 

Fsquirt.exe is also in my MUICache now I've searched this and apparently bluetooth. All bluetooth services are disabled. I don't have a bluetooth device... I've deleted it from the MUICache several times but everytime I check it's there again, so now I searched the windows folder and opened just one of the .dlls


^
 B l u e t o o t h F i l e T r a n s f e r S e g o e U I P

,
 ÿÿÿÿÿÿ‚ Y o u c a n u s e B l u e t o o t h t e c h n o l o g y t o t r a n s f e r f i l e s w i r e l e s s l y b e t w e e n t h i s c o m p u t e r a n d a B l u e t o o t h d e v i c e , o r b e t w e e n t h i s c o m p u t e r a n d a n o t h e r B l u e t o o t h e n a b l e d c o m p u t e r . P
 ,
 ÿÿÿÿÿÿ‚ T o c o n t i n u e , s e l e c t i f y o u w o u l d l i k e t o s e n d o r r e c e i v e f i l e s . 
P 2 
2 û* ÿÿ€ & S e n d f i l e s
M a k e s u r e t h e c o m p u t e r o r d e v i c e w h e r e y o u p l a n t o s e n d t h e f i l e s i s t u r n e d o n a n d r e a d y t o r e c e i v e t h e m . 
P d 
2 ú* ÿÿ€ & R e c e i v e f i l e s



+ ÿÿ‚ ß T h i s f i l e w a s r e c e i v e d o v e r a c o n n e c t i o n t h a t w a s n o t p a s s k e y - e n a b l e d . I t m i g h t h a v e b e e n s e n t b y s o m e o n e o t h e r t h a n t h e i n t e n d e d s e n d e r . I n a d d i t i o n , t h e f i l e m a y h a v e b e e n v i e w e d b y o t h e r s w h i l e i t w a s b e i n g t r a n s m i t t e d . PA  S e g o e U I  1 2  B l u e t o o t h F i l e T r a n s f e r PA S a v e t h e r e c e i v e d f i l e Q T r a n s f e r s f i l e s b e t w e e n d e v i c e s o r c o m p u t e r s u s i n g B l u e t o o t h w i r e l e s s t e c h n o l o g y . ' D o y o u w a n t t o s e n d o r r e c e i v e a f i l e s ?  S e l e c t w h e r e t o s e n d y o u r f i l e s  S e l e c t t h e f i l e s t o s e n d  T h e f i l e i s b e i n g s e n t  T h e f i l e i s b e i n g r e c e i v e d  W a i t i n g f o r a c o n n e c t i o n 3
Y o u s h o u l d s e e a f i l e t r a n s f e r b e g i n a s s o o n a s s o m e o n e s t a r t s t r a n s m i t t i n g f i l e s t o y o u r c o m p u t e r f r o m t h e i r B l u e t o o t h e n a b l e d c o m p u t e r o r d e v i c e .

Y o u m a y s e e a m e s s a g e t e l l i n g y o u a B l u e t o o t h d e v i c e i s t r y i n g t o c o n n e c t t o y o u r c o m p u t e r . Y o u m u s t a c c e p t t h e c o n n e c t i o n i n o r d e r f o r t h e t r a n s f e r t o o c c u r . ! S e l e c t t h e f i l e s y o u w a n t t o s e n d ‰ A c o n f l i c t w a s f o u n d o n t h e r e c e i v i n g d e v i c e o r c o m p u t e r . F o r m o r e i n f o r m a t i o n , c o n t a c t t h e m a n u f a c t u r e r o f y o u r d e v i c e . ( O B E X c o d e 0 x 4 9 )
C o n n e c t i n g . . .
S e n d i n g . . .


D o y o u w a n t t o o v e r w r i t e t h e e x i s t i n g f i l e ? ¿ M a k e s u r e y o u r B l u e t o o t h w i r e l e s s c o n n e c t i o n i s w o r k i n g p r o p e r l y a n d y o u r c o m p u t e r i s w i t h i n r a n g e o f t h e B l u e t o o t h d e v i c e o r B l u e t o o t h e n a b l e d c o m p u t e r y o u a r e t r y i n g t o t r a n s f e r f i l e s w i t h . È M a k e s u r e y o u r B l u e t o o t h w i r e l e s s c o n n e c t i o n i s w o r k i n g p r o p e r l y a n d y o u r c o m p u t e r i s w i t h i n w i r e l e s s r a n g e o f t h e B l u e t o o t h d e v i c e o r B l u e t o o t h e n a b l e d c o m p u t e r y o u a r e t r y i n g t o t r a n s f e r f i l e s w i t h .  B r o w s e A l l f i l e s PA; T h e t r a n s f e r w a s c a n c e l l e d b y t h e o t h e r d e v i c e o r c o m p u t e r . G T h e f i l e c o u l d n o t b e s a v e d . T r y s a v i n g t h e f i l e w i t h a d i f f e r e n t n a m e .
A c c e s s d e n i e d  I n v a l i d f i l e n a m e Q A f i l e n a m e c a n n o t c o n t a i n a n y o f t h e f o l l o w i n g c h a r a c t e r s :
\ / : * ? " < > |  E r r o r


P l e a s e s e l e c t f e w e r f i l e s . ? Y o u r f i l e t r a n s f e r d i d n  t f i n i s h b e c a u s e y o u r P C w e n t t o s l e e p .  S e g o e U I PA 1 2 R F i l e t r a n s f e r i s d i s a b l e d b y p o l i c y .

P l e a s e c h e c k w i t h y o u r s y s t e m a d m i n i s t r a t o r . % B l u e t o o t h f i l e t r a n s f e r n o t c o m p l e t e d  F i l e s u c c e s s f u l l y t r a n s f e r r e d F i l e N a m e PA S i z e  T r a n s f e r f i l e s u s i n g B l u e t o o t h l4 V S _ V E R S I O N _ I N F O ½ïþ

98
98?  
Ê
S t r i n g F i l e I n f o ¦
0 4 0 9 0 4 B 0 L 
C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n (
F i l e D e s c r i p t i o n n '
F i l e V e r s i o n 1 0 . 0 . 1 4 3 9 3 . 0 ( r s 1 _ r e l e a s e . 1 6 0 7 1 5 - 1 6 1 6 ) 8 
I n t e r n a l N a m e f s q u i r t . e x e € .
L e g a l C o p y r i g h t © M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . H 
O r i g i n a l F i l e n a m e f s q u i r t . e x e . m u i j %
P r o d u c t N a m e M i c r o s o f t ® W i n d o w s ® O p e r a t i n g S y s t e m >

P r o d u c t V e r s i o n 1 0 . 0 . 1 4 3 9 3 . 0 D
V a r F i l e I n f o $  T r a n s l a t i o n 

 

It's not getting out. You don't have any network connections. It might be making it to the network interface card, but it certainly isn't going anywhere.

As a server engineer now for nearly 20 years, I can guarantee you that servers cannot connect to clients without a network connection. Whatever you read is absolutely, unequivocally, unquestionably false. Servers cannot via software invent a communication channel without some type of interface hardware. ABSOLUTELY CANNOT.

 

Well, I don't know if I actually did stop it or just stopped the weird things from showing they're happening. I changed the logon account for the services after the latest install (ISO downloaded from Microsoft on September 27). Went online activated it then disconnected, went about disabling these services that somehow always launch... Changed the remote bootable setting for Com3 in the registry, after changing the account on a crucial service I had to reinstall, so I just did a another install luckily it did not deactivate my system and actually kept many of the changes I made to the services.

Searched process explorer for remote, ras and rdp. Nothing for rdp, only windows defender, eventviewer and process explorer yielded any results for remote. But ras, plenty of things come up, 2 different screenshots with very different results 28 entries for one the other had 41 both had RasPBK but only one has the Symbolic links \Global??\SWD#MSRRAS#MS_SSTPMiniport# I checked appdata\roaming\microsoft\network and found that hidden pbk was last modified at that current time. I have since changed the account on the SSTP service, and changed permissions for everything pbk in the registry. Nearly a month no traffic logged in the firewall since October 6th not one random session change not one event that says "%sfrom%S (@#$%)" since the install (that actually begins during the install process). Most recently, I found the debug folder and opened the WIA folder located in it and to my surprise found 2 rather large files that says "connect to server" and lots of "waitformultipleobjects." After disabling this service, I found these two folders msdt and msdtadmin that appeared in my temp folder on 10/14/2017 (the same day I disabled the wia service).

When I asked what they were and how they got there in Microsoft Answers they told me that they appear when I gave someone a token to remotely access the pc. (BUT I NEVER DID).