"Intel Connectivity Performance Suite"/"Intel Killer Performance Suite" silently leaks DNS

[Tc-001]

What happened:
"Intel Connectivity Performance Suite" is an app that comes preinstalled with my laptop ASUS Zenbook 14 UX3405MA, and there is seemingly no way to uninstall it.

It seems to be a rebrand of "Intel Killer Performance Suite", a network boosting thing originally from Rivet Networks.

With it running, I am leaking DNS even when portmaster shows the connections in the UI:

I have set quad9 as my DNS in portmaster, and cloudflare is configured on my router
I also have "Ignore System/Network Servers" turned on

Disabling the driver using this guide:
https://support.lenovo.com/us/en/solutions/ht513263-how-to-completely-uninstall-intel-connectivity-performance-suite-driver-from-a-system
solves DNS resolution and portmaster returns to working as expected.
But a windows update ~2 days later re-installed the driver as Intel Corporation - SoftwareComponent - 40.25.725.165, making the issue present again.

What did you expect to happen?:

As ICPS is doing strange things to the network stack, I do not expect portmaster to be able to stop it. (If it is possible, that would be nice, as it seems to be a somewhat common app for newer high-end intel laptops) But it should be able to detect it as a DNS leak and warn the user, as currently there is no feedback of something being off.

How did you reproduce it?:

Both of these should install the driver, but it seems to have some sort of OEM restrictions about what chipsets they can be installed on.

https://www.intel.com/content/www/us/en/download/19779/intel-killer-performance-suite.html
https://www.intel.com/content/www/us/en/download/738623/intel-connectivity-performance-suite-icps-for-intel-wireless-products-and-intel-connectivity-manager-icm.html

Debug Information:

It was too long for the issue, but I believe most of it is applicable
https://pastebin.com/czty77NK

[eabase]

This reminds me of...

In fact, you want to remove and disable anything from Intel, that is not directly necessary, which is just about everything. If your computer boots without the Intel malware, then there is nothing else needed from them. I had a hell of a time trying to remove something similar from a Lenovo, called Queencreek. Which came as an Intel update!

---

Warning

Another Intel provided malware is called QUEENCREEK and is supposed to help you tune your processor... Instead uploading just about everything else about your computer, your network, your connected devices, apart your files themselves! This include every possible Network setting, info on every single SW and app installed and a full record of what programs have been running on the CPU.

Upload folders can be found here:

• C:\WINDOWS\system32\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\

Program folder here:

• C:\Program Files\Intel\SUR\QUEENCREEK\x64\

Registry Keys here:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESRV_SVC_QUEENCREEK\

Service is called ESRV_SVC_QUEENCREEK.

# Stop Service
sc.exe stop ESRV_SVC_QUEENCREEK

# Delete Service
sc.exe delete ESRV_SVC_QUEENCREEK

# Disable (or delete) scheduled task:
schtasks.exe /change /tn USER_ESRV_SVC_QUEENCREEK /disable

Use firewall to block port 49350.