News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon
  • Widespread reports of freezing with this month’s Win7 Monthly Rollup, KB 4493472, and Win8.1 Monthly rollup KB 4493446

    Posted on April 10th, 2019 at 07:26 woody Comment on the AskWoody Lounge

    Spiceworks has a nearly-feature-length litany of problems with KB 4493472.

    DON’T let Windows Automatic Update get to your Windows 7 or 8.1 (or Server 2008 R2 or Server 2012 R2) machines. But you knew that already.

    Thx @BoltsfanKevin (that’s Kevin Hughes)

    UPDATE: Server 2008 R2 machines are falling left and right. From the Sophos Endpoint Security blog:

    SAV service was logging lots of error messages in event log. Event IDs : 7022 (service hang), 80, 81, 83, 85, 82, 566, 608, 592.

    The server became unresponsive, no rdp, no file share access, Ctrl Alt Delete not working.

    Only solution is to uninstall the patch. Which may be difficult.

    ANOTHER UPDATE: Sophos has posted an official acknowledgment, putting the blame on both the Win7 Monthly Rollup and the Win 8.1 Monthly Rollup, KB 4493467:

    If you have not yet performed the update we recommend not doing so.

    If you have performed the update but not yet rebooted we recommend removing the update prior to rebooting.

    If you have performed the update and have rebooted, triggering the issue:

    Boot into safe mode
    Disable the Sophos Anti-Virus service
    Boot into normal mode
    Uninstall the Windows KB
    Enable the Sophos Anti-Virus service

    It’s still much, much too early to tell if the same change in Win7 and 8.1 will also clobber other software. Just sit tight and wait for the MS-DEFCON level to change.

    More details (including a question about precisely which patches are breaking Sophos) in Computerworld Woody on Windows.

    UPDATE: We’ve had several reports that Avast customers are experiencing the same symptoms. Avast has a mea culpa:

    Windows machines (particularly those running Windows 7) are becoming locked or frozen on startup after Microsoft updates KB4493472, KB4493448, and KB4493435.

    Avast has received reports of an issue affecting our customers running Avast for Business and Avast Cloud Care on Windows machines, particularly those with Windows 7 operating systems. While this problem is currently being researched, we have discovered some temporary solutions to restore functionality to our users.
    1. Reboot your machine into Safe Mode. Our customers are reporting that they are able to get past the login/Welcome screen in Safe Mode.
    If that helped, take a second to support AskWoody on Patreon

    Home Forums Widespread reports of freezing with this month’s Win7 Monthly Rollup, KB 4493472

    This topic contains 65 replies, has 22 voices, and was last updated by

     PKCano 3 days, 11 hours ago.

    • Author
      Posts
    • #350449 Reply

      woody
      Da Boss

      Spiecworks has a nearly-feature-length litany of problems with KB 4493472. I’ll have more later this morning in Computerworld. DON’T UPDATE Windows 7.
      [See the full post at: Widespread reports of freezing with this month’s Win7 Monthly Rollup, KB 4493472]

    • #350453 Reply

      anonymous

      Seems to only affect those that have Sophos antivirus installed.

      1 user thanked author for this post.
    • #350485 Reply

      MikeMc
      AskWoody Lounger

      No problems on my SBS 2011 or web server; both 2008 r2 based and not using sophos.

    • #350487 Reply

      anonymous

      8.1 user here. I did install the latest update. I haven’t had any issues, but I don’t use Sophos, so that might be why.

    • #350491 Reply

      TheOwner
      AskWoody Lounger

      No problem on my Win 7 64bit machine.

    • #350509 Reply

      anonymous

      Can confirm.

      Windows 7 64bit with Sophos. Installed updated on three machines and all three had this issue.

    • #350510 Reply

      anonymous

      W7 – 64 & W7 – 32 Starter. Both OK. Norton Security.

      1 user thanked author for this post.
    • #350521 Reply

      anonymous

      Made my weekly Acronis disk image and then updated my Win 7 system w/ KB4493472 yesterday. No problems so far. I do not use Sophos a/v. Do use Avast and Malwarebytes real time.

    • #350535 Reply

      abbodi86
      AskWoody_MVP

      It’s clearly Sophos fault

      1 user thanked author for this post.
    • #350537 Reply

      GoneToPlaid
      AskWoody Plus

      The office is mostly Win7, with a few Win8 and Win10 computers. All are Group A. No issues since all run Panda AV.

    • #350538 Reply

      UncleRemus83
      AskWoody Lounger

      I installed the Windows 7 update on my laptop (I’m the canary in the coal mine) and I have not had any issues, although I don’t use Sophos Antivirus.  You can bet I won’t be letting this update out the WSUS chute or applying to my servers until there’s an acknowledgement from Microsoft though.

      Thanks Woody for the heads up on these things.  I wonder how many hours you’ve saved people?

      2 users thanked author for this post.
    • #350540 Reply

      anonymous

      There are reports of freezing in the latest Win 10 1809 update too:

      Comp Cmndo (tenforums)

      Pete81 (tenforums)

      1 user thanked author for this post.
    • #350543 Reply

      anonymous

      We have been affected by this today on dozens of computers. In our experience so far it is not necessary to disable Sophos. The quickest way we have found is to:

      1. Boot into safe mode

      2. Check System Restore to see if there is a suitable restore point from before the system update.

      a. If there is a suitable restore point, run system restore.

      b. If there is not a suitable restore point, uninstall the update

      3. Boot into normal mode.

      3 users thanked author for this post.
      • #350739 Reply

        anonymous

        Two of our desktop techs at two different sites reported the same shortcut.  No need to disable AV and deal with the tamper protection.

        Boot to safe mode. Restore to a point before updates.

        –or–

        Boot to safe mode. Un-install offending KBs.

        If you have Sophos Safeguard FDE, the tamper protection will protect Endpoint/AV from being altered. If you don’t need to mess with it…makes the procedure easier.

    • #350560 Reply

      plodr
      AskWoody Plus

      I am group B and do not do the large bundled updates.

      I installed 4493448, Security only and 4493435 IE 11 Cum. Security update on a 32 and 64 bit Win 7 Home Premium system with no issues on either.

      Got coffee?

    • #350580 Reply

      GoneToPlaid
      AskWoody Plus

      We have been affected by this today on dozens of computers. In our experience so far it is not necessary to disable Sophos. The quickest way we have found is to: 1. Boot into safe mode 2. Check System Restore to see if there is a suitable restore point from before the system update. a. If there is a suitable restore point, run system restore. b. If there is not a suitable restore point, uninstall the update 3. Boot into normal mode.

      Uninstalling the update in Safe Mode just might be the solution for those affected by this issue.

    • #350610 Reply

      anonymous

      Heads up for anyone experiencing this issue: You can uninstall the patch using ‘wusa’ from safe mode.

      wusa /uninstall /kb:4493472

      5 users thanked author for this post.
    • #350643 Reply

      steakapples
      AskWoody Lounger

      DEFINITELY having serious issues with 7 and this patch, pro and ultimate.

      Our server auto-updated and got stuck at ‘configuring updates’ on the reboot at 48%

      No sophos-anything.  No idea what’s causing the issue as of now, no time to deal with it.

      Safemode-uninstall the patch is the only way to get back in for me.

      I should have done it since January’s clusterf—  Windows updates -> MANUAL ONLY.

      MS is continually effing this up, and now they want to charge me $100 for it next year?

      For the record none of our W10 machines had any problem except one, which stalled out on the patch install after reboot… then a hard reboot allowed it to finish and it’s ok now, with patch still installed.

      Not happy!  I’m getting yelled at by the boss for something that should be mindless-ez.

      2 users thanked author for this post.
    • #350706 Reply

      anonymous

      Hello,

      Win7 64-bit Pro without Sophos. Had issues since the update, which took way too much time to install/configure. Since then, Windows was taking forever to load, freezing on desktop ~3-4 minutes before unlocking and performing all attempted actions during the freeze at once.

      Uninstalled kb4493472. Everything back to normal.

      2 users thanked author for this post.
      • #350718 Reply

        PKCano
        Da Boss

        What Anti-virus are you using? There are a lot of reports of trouble with Sophos and some with Avast for Business/Cloud.

        1 user thanked author for this post.
        • #402100 Reply

          anonymous

          What Anti-virus are you using? There are a lot of reports of trouble with Sophos and some with Avast for Business/Cloud.

          I’m using Avira free antivirus.

           

          • #402106 Reply

            PKCano
            Da Boss

            As of yesterday (Sat, Apr 13th) MS still had Avira and Sophos AVs blocked. We have not heard either have issued an update to fix the issue with kb4493472. Check back here for more news as it unfolds.

    • #350728 Reply

      anonymous

      Hi folks,

      They messed it up again! Alle test machines (six W7/64 and W7/32) experience veeeeeeery long booting and some freeze after a couple of minutes. Removed KB4493472 which took two automatic reboots and also very long and the systems are working fine again. No Sophos her but Avira.

      No problems on the test machines running Windows 10 1809 though.

      Do not install KB4493472, just take the Office and Adobe updates aso.

      Regards,

      Joe_Gerhard

       

      3 users thanked author for this post.
    • #350825 Reply

      Seff
      AskWoody Plus

      Thanks for all the info on this.

      It’s unbelievable that updates aren’t properly tested. It’s as if Microsoft are keen to demonstrate how better off Windows 7 users will be when these monthly shenanigans come to an end next January!

      1 user thanked author for this post.
    • #350830 Reply

      yerma
      AskWoody Lounger

      I just helped a user on one of our unmanaged Win7 notebooks, 500 km away. We use Sophos as well. System got stuck after reboot, switched computer off with force, next normal reboot had the same effect again. After another forced reboot and going into safe mode, computer automatically reverted the update and user was able to work again. Thanks Microsoft…

    • #350829 Reply

      anonymous

      Microsoft has temporarily blocked devices from receiving this update if the Sophos Endpoint is installed until a solution is available.

      Both KB4493446 and KB4493472 have the above “known issue”. Also, they automatically got unapproved in WSUS overnight. :‑)

      1 user thanked author for this post.
    • #350836 Reply

      anonymous

      Same here: Win 7 Pro 64 bit with neither Sophos or Avast, but Avira Free Antivir. Machine freezes for up to 50 sec, then starts running smoothly again. Next stop: Debian, surely not Win 10 …

    • #350853 Reply

      doriel

      This happened to all of our Dell PCs with Windows 7 and Sophos installed (approx 50 machines). Having fun these days 🙂 At least, this error speeded up our migration to Win10 🙂

      Solution is to uninstall update in Safe Mode.

      For few users who restarted PC during process is solution to boot to safe mod (if possible) and disable Sophos/Avast/… servicies and go on unsecured, then uninstall updates. If not possible, you can also boot to CMD and disable all antivirus servicies, for example:

      sc config “swi_update” start= disabled
      sc config “swi_service” start= disabled

      I have 9 sophos servicies, then you can boot your PC normally and do whatever you want – restore, uninstall, …

      Edit to remove HTML. Please use the “Text” tab in the entry box when you copy/paste.

      1 user thanked author for this post.
    • #350875 Reply

      anonymous

      Running Sophos on Win 7 x64 – had same ‘black screen of death’ on reboot. Able to boot into safe mode and use System Restore to roll back the 2019-04 Security Monthly Quality Rollup (KB 4493472)

    • #350892 Reply

      mn–
      AskWoody Lounger

      Hm. Did KB4493472 and KB4493446 get rereleased already or what’s this I’m seeing, it being new again today?

      Sheesh, now I’ll have to track down which boxes got the original variant…

      Oh well. Now it at least has a “known issue” entry for Sophos. Nothing for the other.

    • #350897 Reply

      woody
      Da Boss

      Martin Brinkmann has an excellent update on the current state of affairs. Six KBs have been singled out:

      • KB4493448 Security-only update for Windows 7 SP1 and Windows Server 2008 R2 SP1
      • KB4493472 Monthly rollup update for Windows 7 SP1 and Windows Server 2008 R2 SP1
      • KB4493467 Security-only update for Windows 8.1 and Windows Server 2012 R2
      • KB4493446 Monthly rollup update for Windows 8.1 and Windows Server 2012 R2
      • KB4493450 Security-only update for Windows Server 2012
      • KB4493451 Monthly rollup update for Windows Server 2012

      and the problem is with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC); and with Avast for Business and Avast Cloud Care. Microsoft is now officially blocking installation on machines with the Sophos products.

      The thread at Spiceworks now has active participation from both Sophos and Avast. Haven’t seen them around these parts yet.

      Pardon me for repeating an oft-repeated phrase, but I just have to wonder out loud who tests these things….

      2 users thanked author for this post.
    • #350898 Reply

      StavRoss
      AskWoody Plus

      I recently replaced the HDD with an SSD, reinstalled Windows 7 Pro from scratch. The system was brought up to date with regard to updates  as at March 26th. I have not installed KB 4493472 and my laptop does not run Sophos Anti-Virus, and yet it freezes quite often. Is any other previous patch known to cause such freezes?

       

      • #350920 Reply

        woody
        Da Boss

        I haven’t seen any reports.

        This is a very specific error – systems won’t boot after installing the patch.

        Freezes such as the one you describe are more common with hardware problems.

    • #350910 Reply

      PKCano
      Da Boss

      I just updated one of my Win8.1 VMs Group A running TrendMicro with no problems so far.

    • #350911 Reply

      anonymous

      Same here. All windows 7 pro machines frozen post a reboot. Uninstalling the monthly quality roll up patch fixed it. I am just looking if we can have a powershell script to uninstall all those patches

    • #350917 Reply

      fernlady
      AskWoody Lounger

      Any word about AVG Free causing problems or is it to early to tell?

      Windows 7 Home Premium x64 AMD Group A Realtek PCLe GBE Family Controller

      • #350918 Reply

        PKCano
        Da Boss

        No report on AVG here – so far

        1 user thanked author for this post.
        • #350923 Reply

          anonymous

          I am running AVG on W8.1 x64 system and the April Quality Update was pulled today. I do not know if AVG is the reason the update is no longer offered.

          1 user thanked author for this post.
    • #350925 Reply

      smachado
      AskWoody Lounger

      Hey can we get BETTER HEADLINES for posts ? that mention the connection with Sophos ?

      I just approved updates yesterday to a test group and was about to panic, thinking I needed to back the updates out before a reboot happened then discovered that is only affects those with Sophos installed (which we do not use).

      • #350928 Reply

        PKCano
        Da Boss

        Well, it’s not just Sophos. Avast, Avira and maybe AVG are also involved.
        Hope you had none of those either.
        Waiting for a while to patch has its advantages, thus the DEFCON System supported at AskWoody.

        1 user thanked author for this post.
    • #350947 Reply

      James Bond 007
      AskWoody Lounger

      I have not yet installed the January / February / March security updates (Group B). All my systems running Windows 7 and 8.1 are on December 2018 level, and judging from the issues with April’s updates (even though I don’t run Sophos or other antivirus software so it is probable I won’t be affected) I will continue to hold on December 2018 level.

      There is no urgency to patch so far as far as I can see. I will continue to monitor the situation month by month, and will continue to delay patching until I am satisfied with the bugs situation. Meanwhile I can continue working on my computers without worrying about the possible problems caused by the 2019 patches.

      On the other hand, did Microsoft test their patches with third party antivirus products at all? Because if they did then shipping software and patches should not have such problems at all.

      Hope for the best. Prepare for the worst.

      • This reply was modified 6 days, 19 hours ago by
         James Bond 007. Reason: Addition
      • #350951 Reply

        PKCano
        Da Boss

        Does Microsoft test anything except by “Likes” in the Insider Hub?
        [ /sarcasm ]

        2 users thanked author for this post.
    • #350950 Reply

      anonymous

      Same here,

      half of the company could’t work the whole morning after Windows Update. All Win 7 PCs with Sophos Endpoint Security crashed after the reboot…

       

      1 user thanked author for this post.
    • #350955 Reply

      GoneToPlaid
      AskWoody Plus

      I recently replaced the HDD with an SSD, reinstalled Windows 7 Pro from scratch. The system was brought up to date with regard to updates as at March 26th. I have not installed KB 4493472 and my laptop does not run Sophos Anti-Virus, and yet it freezes quite often. Is any other previous patch known to cause such freezes?

      Windows 7 may freeze if the SSD uses the JMicron JMF602 controller. Only solution is to use a different SSD.

      1 user thanked author for this post.
    • #351024 Reply

      anonymous

      Has anyone tried this update on a Windows 7 system runing Malwarebytes Premium or Cybereason RansomFree?

    • #351087 Reply

      enigmaxg2
      AskWoody Lounger

      Looks very suspicious that almost only Windows 7 and 8.1 are failing, seeing that Microsoft put a bug on purpose on Windows 10 against anti-cheat software. I can expect more dirty tricks like that.

    • #351156 Reply

      plodr
      AskWoody Plus

      To anonymous, #351024: I patched four Windows 7 computers on Wednesday all running malwarebytes premium. I do the security only and not the “big bundle”. No freezing nor slowing to a crawl noticed on any of the computers with 4493448 and 4493435 installed.

      Got coffee?

    • #351154 Reply

      anonymous

      Updated two XPs, Win 7 starter, Win 8.1,  Win 10 1703, 1803, 1809.   No problems on any of them.  All run the Microsoft antivirus product.   The Win 10s are in VMs.

    • #351173 Reply

      Robertos42
      AskWoody Lounger

      Running windows 7 with Sophos (standalone) here.  I installed KB4493472 from windows update yesterday lunchtime and all seemed well, no freezing etc.  To be on the safe side I uninstalled it from windows update today and it just did it without going in to safe mode 🙂

      I restored from yesterdays disk image and checked WU again and it was not offered, just the Office security patches.

    • #351182 Reply

      NightOwl
      AskWoody Lounger

      @ PKCano

      I just updated one of my Win8.1 VMs Group A running TrendMicro with no problems so far.

      *Technically*, I thought *Group A* did the monthly roll ups, but waited until the Defcon was at 3 or better–if you are referring to installing this month’s roll up (April)–wouldn’t you be more in *Group Canon Fodder*?! (grin)

      NightOwl

      No question is stupid ... but, possibly the answers are 😉 !

      • #351183 Reply

        PKCano
        Da Boss

        It’s a VM test machine, Group A designating the type of patching.

        I have VMs testing many versions of Winndows XP, 7, 8,1, v1803, v1809, an Insider Preview Fast Ring.

        Group A is not DEFCON is not Group A is not DEFCON. Group A may follow the DEFCON System but it is not the DEFCON System. And test machines do not necessarily follow the DEFCON System but may follow Group A patching..

        • This reply was modified 6 days, 12 hours ago by
           PKCano.
    • #351265 Reply

      anonymous

      Whether you volunteered or not to help MS test their updates, all of us are still testing their updates. Non-volunteers are just not sending them feedback! ;-D

      I’m group B. I manually installed KB4493435 and KB4493448 as per Ask Woody’s “Ongoing list of Group B monthly updates for Win7 and 8.1 – Topic 2000003” on a Lenovo H405 desktop computer running Windows 7 Ultimate (an x64-bit AMD microprocessor machine). When my machine did not restart properly, I turned off all power to everything at the power strip for a few minutes (to think about it). After restoring power, my machine booted fine. When Windows updating seemed to be stalled, I pressed the Enter key a few times (slowly) until my machine responded and completed the update (100%). Instead of going to the Press Ctrl-Alt-Delete to Logon screen, Windows update did another restart, and then completed the install quickly (in a few seconds, enough to determine that it had already finished the time before).

      About 10 minutes after logging on after doing updates, I always do another restart, because Norton Security Suite does not always restart the first time. Because of this, I keep my NIC (Ethernet to Cable-MoDem connection) turned off at all times. I only turn it on when I want to go online to the Internet/W.W.W.; and I turn it off immediately thereafter.

      Now, after all that and since, my machine is booting up much more rapidly than it used too (about 1/10th the time). So, I have no complaints with the two security updates I installed.

    • #355856 Reply

      anonymous

      Server 2012R2 DC with Symantec Endpoint Protection comes up to login screen but after entering password and hitting enter or clicking the arrow on the password field, nothing happens.  Stuck on the login screen.  Removed KB4493446 and KB4493450 and so far no luck.

      1 user thanked author for this post.
      • #356516 Reply

        woody
        Da Boss

        By “no luck” I assume you mean that removing the patches didn’t fix the problem.

        ?

    Please follow the -Lounge Rules- no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

    Reply To: Widespread reports of freezing with this month’s Win7 Monthly Rollup, KB 4493472

    You can use BBCodes to format your content.
    Your account can't use Advanced BBCodes, they will be stripped before saving.

    Your information: