That key is on purpose blockade if CompatTelRunner.exe returns, like via cumulative update, it's a reroute to taskkill, could be anything Windows related.Herre is the registry key
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe]
"Debugger"="%windir%\\System32\\taskkill.exe"
This was exactly after a host refresh.
Series of steps I performed after a refresh;
Nuhi: It's the telemetry client, seems to be removed just fine, tested now.
- Check autoruns: where I find and delete that key
- Check for updates via windows update
- Ntlite - remove reinstalls
- check autoruns; no reference to that autorun key
The key is a leftover after the telemetry client has been removed?
its microsoft spywareNot sure where this exe is tied to. But it shows up in my autoruns. Initial searches say that it is tied to diagnostics and feedback.. This is the first time this exe showed up in my autoruns
yep. hence why its spyware. its under the guise of being "useful" when nothing is further from the truth. windows error reporting was designed to send crash logs to Microsoft. Now, this day and age, "telemetry" is all about tracking how you use your pc, what purchases you make, etc. so they can send you relevant advertisements, whilst selling your personal information to advertising companies, such as google. there are many ways to block this spyware, there are apps designed to do it, or you can delete the spyware exe's, using iobit unlocker, and block the corresponding servers, using a HOSTS file. works wellThe other scary part it is also tied to MsStore. It determines that none of the files have been tampered with either. Its like a double sided sword, providing telemetry and security.