• More about the interlocking GWX patches, KB 3035583 and 2952664

    I assume y’all have read Andrew Orlowski’s article at The Reg.

    Reader JIY did a little more sleuthing, and here’s what he found:

    After reading your link to Andrew Orlowski’s article (great find) today, I broke out the tools to do some checking. Below are the screenshots of instances in which 2952664 and 3035583 were located in the registry. Five for 2952664 and one for 3035583.

    2952664 shot 1

    2952664 shot 2
    All files were contained in the folders, C:\Windows\SoftwareDistribution\Download\4a7d77dbff0bf4a0c11e5070d988f47b (for 2952664) and C:\Windows\SoftwareDistribution\Download\6f7643215b36bc8b4eae01ea7c4b5aab (for 3035583). In both cases, folders were created on 1/26/2016 and file dates were mostly 12/8/2015. The findings were exactly the same on both Win 7 x64 desktops.

    Below is a shot of one of the subfolders within C:\Windows\SoftwareDistribution\Download\6f7643215b36bc8b4eae01ea7c4b5aab (for 3035583). Not much more to wonder about, except how did they get there? Neither KB shows as installed on either system. The only conclusion I can reach is that I mistakenly allowed the installs in the effort to update these machines after they had been unused for about 3 months (in process of moving) and subsequently uninstalled. Still, I have a hard time understanding why I would do that since I’ve avoided non-security updates faithfully since about March 2015. So, while they might not be listed as installed, they and the related registry entries are still on those machines (for the next 2 minutes). When is an uninstall not an uninstall?

    2952664 shot 3