The web site is getting hammered. Sorry about that, but there’s a reason why the main discussion thread for installing January 2018 takes a long time
[See the full post at: A quick overview of January patching recommendations for Windows]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
A quick overview of January patching recommendations for Windows
- This topic has 110 replies, 22 voices, and was last updated 5 years, 3 months ago.
AuthorViewing 67 reply threadsAuthor-
-
If you look at Control Panel\Admin Tools\Computer Management\Disk Management you will see the layout of the hard drive.
When I make a disk image, I include in the image all the partitions and the boot sector. (all my drives are legacy BIOS). I have never included more than one drive in the image. I have used Acronis (paid ver) for years. I do not install it. When I make the image I boot from the emergency CD/USB and run the software from there. That way there are no Win files in use.
1 user thanked author for this post.
-
-
-
@wildbill: I use Macrium Reflect. The version is 5.1; I remember long ago making a conscious decision not to update it because newer versions dropped some feature that I considered important, although now I can’t remember what that was…
Anyway, what you (probably) want to do is to select all the partitions on your system drive: go to the Disk Image tab and select the “Create a Backup” tab there. Make sure that all the partitions on the physical disk that contains your OS are checked off. (I always include the “factory image” D: drive for good measure.)
If you have more than one physical disk on the PC, you will see more than one row of disk partitions. They will be identified as “MBR Disk 1,” “MBR Disk 2,” etc. followed by the disk’s model number and size so that you can verify you’re looking at the disk you want.
Now see below the row of partitions for the desired disk, where you have a choice to “clone this disk” or “image this disk.” Click on “image this disk.” A new smaller window will pop up, showing you the disk you’ve selected to image (the “source”) and asking where you want the image to be stored (the “destination”). Find the location where you want the image to go and give it the name you want (I just go with Macrium’s recommendation for the name).
Now click on the “Next” button. The window will change to show you what you are about to do. After verifying the backup source and destination, you can click on “Advanced Options” in the lower left corner to see your compression and other options, and to add a description of what you’re doing. (I write something like “full uncompressed backup done February 6, 2018” as it minimizes the chances for confusion later on if I need to restore a backup.) When you’re done, click OK and then click “Finish” in the smaller window.
Now you will get a further set of options, this time to save the instructions for making the image to an XML file that you can reuse later. Your choice. Make sure that “run this backup now” is checked and then click OK. The backup process will begin.
Let me know if you need more information, but this really should be enough to get you going.
As I said before, I’m using an older version of Reflect so what you see on your screen may not match exactly what I see, but the concepts should be basically the same.
Good luck.
-
Woody, I appreciate the tremendous effort you and the MVPs have been making in these last few weeks, and not for the fun of it or for some kind of gain, but because of the dismal mistakes of others.
That said, I really like my old Win 7, x64, Pro, Intel I-7 “Sandy Bridge” PC. (This is relevant to what follows.) And am a convinced Group B person.
On the security only Windows 7 January patch, I have heard some advocating KB4056897 and others KB4073578. Having listened carefully to both sides, I have reached the firm decision to wait and see what happens to those who follow one or the other piece of advice.
Particularly since I see no reason to hurry and do something about it just now. (To me, IE11 is a different issue, and I am patching it. Same thing with Office.)
So I’ll be delighted to hear something about how (and if) the experiences vary between those choosing to install one update, and those choosing to install the other. Probably I’ll hear the gnashing of teeth, rending of garments and lamentations, if any, but those tend to be from the noisy and often clueless, and so of no great help — although better than nothing.
Evidence for the above claims:
@OscarCP you should install KB4056897 it’s a security only update; KB4073578 it is not and it’s for AMD devices
for me KB 4056897 and KB 4056568 (E11) both installed as Group BMrBrian, though:
Group B Windows 7:
Manually install KB4073578. Manually install KB4056568.
-
You have an Intel chip. The ‘AMD64’ is basically telling you your system is 64 bit. The ‘AMD’ is there for some combination of historical/traditional/customary reasons. I think maybe AMD was the first chip manufacturer to make 64 bit chips.
But, repeating, you have an Intel chip.
1 user thanked author for this post.
-
-
Correct in both cases
1 user thanked author for this post.
Woody, please move this info to the appropriate area and edit as necessary:
I have determined that the January 31 Cumulative update suffers from the same problem we saw several months ago where Windows Update will not find it if Pro users have Defer Feature Updates set to anything other than “0” (zero.) As soon as I set both Feature and Quality Defer to “0”, Windows Update immediately found and installed the January 31 Cumulative update.
DJG
1 user thanked author for this post.
I didn’t mention anything about .NET Framework updates in my advice because the existing Group A and Group B instructions should be sufficient for .NET Framework updates. I installed the Windows 7 January 2018 .NET Framework monthly rollup a few weeks ago.
Flash Player update is out
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180004I’m on win7 x64, group B. I went with MrBrians advice and installed KB4073578 despite having an intel processor (4690k)
No problems , but I note in “installed updates” it’s listed as “Update for Microsoft Windows” rather than “Security Update for Microsoft Windows”
Should I be concerned or just ignore it and get on about my business?
Long time reader, 1st post, huge thanks to Woody and everyone who helps out here 🙂
-
I’m on win7 x64, group B. I went with MrBrians advice and installed KB4073578 despite having an intel processor (4690k)
No problems , but I note in “installed updates” it’s listed as “Update for Microsoft Windows” rather than “Security Update for Microsoft Windows”
Should I be concerned or just ignore it and get on about my business? Long time reader, 1st post, huge thanks to Woody and everyone who helps out here
Based on analysis of the contents of KB4073578 vs. KB4056897, the files in these updates are identical, except that KB4073578 contains some newer file versions. You can convince yourself that KB4073578 contains security-related updates by using InSpectre or a similar program to check for the presence of Windows Meltdown/Spectre mitigations after you install it and restart your computer.
Thanks for posting your feedback :).
-
-
-
MrBrian
I do have a AMD processor.
This is what came down the trough.
Important…………… KB4055532 Checked
Important…………… KB4056894 Checked *
Recommended……. KB4033342 Unchecked
Important MSRT…… KB890830 CheckedOptional……………. KB4057400 Unchecked *
Optional……………. KB4057270 Unchecked* I have both KB4056894 & KB4057400 patches. Do I install both?
Besides those two patch, what other patches do I need to install?Thanks,
Sparky
Your AMD cpu seems not affected (per WU detection metadata), that’s why you get KB4056894
but just to be safe, either install the preview KB4057400 or wait for the next tuesday security rollup
1 user thanked author for this post.
-
-
I got brave and installed Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 updates for Windows 7 SP1 and Server 2008 R2 SP1 (KB 4055532) but I didn’t get the screen to “restart now” but I restarted it anyway to be safe. All is a-ok as far as I can tell.
Strange thing is history shows KB4055532 BUT installed updates show KB4054998. Mark up another day I’m confused.A reboot is usually not required for .NET installs.
The .NET Rollup has separate patches for multiple versions of .NET. You will only see the Rollup number in WU, but it installs the particular patch for your version and that is what shows up in Update History or Installed Updates.1 user thanked author for this post.
Strange thing is history shows KB4055532 BUT installed updates show KB4054998. Mark up another day I’m confused.
It is confusing indeed. One shows the “parent” update, and the other shows the “child” updates. Look at the “Microsoft Update Catalog” section of https://blogs.msdn.microsoft.com/dotnet/2018/01/09/net-framework-january-2018-security-and-quality-rollup/ to see if you understand what I mean by parent vs. child update in this context.
1 user thanked author for this post.
MrBrian
I do have a AMD processor. This is what came down the trough.
I would install the three updates that are checked by default. You could choose to substitute KB4057400 for KB4056894 if you want to (abbodi86’s advice). There’s no need to install both KB4057400 and KB4056894.
1 user thanked author for this post.
Some posts in this topic mention installing both KB4073578 and KB4056897. That does not follow the advice I gave in this topic, but if you want to install both anyway, then I recommend installing KB4073578 before installing KB4056897.
1 user thanked author for this post.
Is there a guide to uninstall the rollup if the system fails to boot?
You could try this DISM command.
1 user thanked author for this post.
It’s a little late now, being a few days after MS-Defcon went to 3, but… well, I didn’t try updating ’till now, so I didn’t discover the issue until now either.
The January rollup for Windows 8.1 x64 contains updated versions of two of the three files that need to be patched for custom themes. Other versions of Windows probably have the same issue, but I haven’t tried any of them, so I can’t be sure.
If you use a custom theme and you use one of the various patchers out there to enable this rather than the UXThemes service, be aware that this update will undo some of that patching… and Windows 8.1 does not cope well with this.
Windows 7 would just load a MS signed theme when the user-specified theme would no longer work because the patches had been undone; Windows 8.1 boots to a black screen (only the mouse arrow is visible) and just leaves it at that. It did this even though I had selected the default Windows theme before installing the patch the second time around; it still didn’t work, for reasons that elude me.
I’ve usually gone the patching route rather than the UXThemes service route; patching works in Safe Mode flawlessly, and I don’t remember if the same is true of the service. It’s been a long time since I’ve thought about this, but it seems to me that the service is not loaded in Safe Mode, meaning that Safe Mode will not be available… well, ever, if you have a custom theme. Trying to boot into Safe Mode will just give you that delightful black screen where all you can see is the mouse pointer and the “Safe mode” watermarks on the corners.
If not for that, I would almost certainly have gone for the UXThemes method, since it allows the files to be patched without malfunctioning.
None of this would be necessary if MS had not decided to enforce signature checking on themes. There’s no executable code in a theme, so there’s no good reason why a simple theme file would have to be digitally signed by MS. They’re trying to prevent people from having control over how the computer screen they stare at all day looks… if it doesn’t match Microsoft’s branding efforts for Windows, you can’t have it. Even if it hurts your eyes and looks terrible to you, you are supposed to put up with it because MS said your computer has to look how they want it to, even if you’re the only one who ever sees it.
It really annoys me that they did this. It’s just such a… I’m struggling to figure out how to say this and remain within the decorous language rules… I seldom use that kind of language even when allowed to, but sometimes there’s not really any other way of putting it that will accurately convey what I am thinking. It’s a real $epithet move.
It started with either Vista or 7… not sure which it was, but it’s been a while that MS has been trying to deny people control over how their PCs look.
1 user thanked author for this post.
^^ That was me… yarr.
Got it!
1 user thanked author for this post.
Not used to this new system, however will do my best. I’m searching for “safe” or “not safe” for the following 2 patches: KB4055532 and KB4056894
On the front blog page @MrBrian says
Windows 7 Monthly Rollup (“Group A”) – recommended:
If Windows Update offers KB4056894 then install it. If Windows Update doesn’t offer KB4056894, then if Windows Update offers KB4057400 then install it. If neither update is offered, then wait for the February 2018 Windows updates.
KB4057400 (if you need it) will be in the “optional” list and you will have to CHECK the box and then click on OK at the bottom of the window.
KB4055532 is the .NET Rollup and it’s OK to install.
1 user thanked author for this post.
? says:
I just finished updating the last Windows 7 machine, and I had KB2952664 in optional updates. I didn’t see a version number, I’ve hidden it every time it has been offered over the last couple of years. So, I hid it once again. Wish they would quit sending it…
Thank you once again @mrbrian. After reading the article you linked I realized that I had read it when it was first published. Then I guess I completely forgot about it. In this case though I’m glad I did because reading it again made me start thinking about something: if the registry key fixes the compatibility issues that cause the blue-screening, why do/can the systems still crash?
You’re welcome :).
If you’re refering to the AMD processor issue, see https://arstechnica.com/gadgets/2018/01/bad-docs-and-blue-screens-make-microsoft-suspend-spectre-patch-for-amd-machines/.
1 user thanked author for this post.
-
Re: anonymous at link 166451
My AV program has a software updater tool that notifies me when updates are available, so I’m fairly confident I have the most current versions.
I don’t have an explanation as to why, but I had to completely delete my AV program. It was up to date as to its definitions, but it had no clue about the needed registry key. I installed the same program’s newest version and it installed the required key without any problem.
Non-techy Win 10 Pro and Linux Mint experimenter
2010 Toshiba Laptop running Intel Pentium dual core processor Win7 SP1 HE
Installed Security update only KB4073578
IE 11 KB4056568
Security and Quality Rollup for Net Framework KB4055532Ran Gibson’s Inspectre App and all looks good.
Thank you Woody, Mr. Brian and PKCano for all your input and all for their questions and experiences. Very Helpful.
A 2012 HP laptop found its way to me (Win 7 Pro SP1 x64 with an Intel i73820QM and Nvidia 650M GPU & a 512 GB Samsung 850 Pro system drive). The only browser used is Firefox ESR with uBlock Origin, NoScript, HTTPS Everywhere and Privacy Badger. Antimalware are Avira Free, Malwarebytes Pro and the Windows Firewall Control (from BiniSoft). The owner reports that there has never been a malware infection.
The issue: with KB4056897 (and KB4056568) installed, the unit took a significant performance hit. This machine is often used to transcode multimedia files, so with the “Meltdown” protection enabled, its utility is greatly compromised. (It also runs about 10 C hotter, which is particularly concerning as the consumer HPs have undernourished cooling systems.)
Running GRC’s InSpectre as Administrator and using it to toggle the Registry setting to disable Meltdown protection restores the processor’s speed and power (and lowers the operating temperature).
One thing that I have not tried is replacing KB4056897 with KB4073578, but I fail see how that might make a difference.
Since (to date) there are no known exploits of Meltdown in the wild, the browser is locked-down and this machine’s operator is extremely careful, I am tempted to leave the Meltdown Registry key set to disabled for the present (subject to change, should an exploit in the wild be discovered), which the owner would prefer (other than yanking KB4056897 altogether).
Any input from @MrBrian, @abbodi86, PKCano, Noel Carboni, othr MVPs or, of course, Da Boss: would be greatly appreciated.
1 user thanked author for this post.
moonbear wrote:
if the registry key fixes the compatibility issues that cause the blue-screening, why do/can the systems still crash?
Hi moonbear, love your handle.
Not trying to be pedantic, but just to be clear… the registry key doesn’t actually fix anything. The registry key is meant to be set by the installed AV program to indicate to the Windows OS that operation of the installed AV scanner is compatible with Microsoft’s latest patches (e.g., the AV scanner is not using funky calls to kernel memory).
The upshot of this is that if someone was using an incompatible version of an AV scanner, but manually set the reg key and installed the latest patches anyway…
as any underlying compatibility issues would not have been fixed prior to patch installation, the user would be risking the very system crash/BSOD situation that the reg key is attempting to prevent.Hope this helps.
Since (to date) there are no known exploits of Meltdown in the wild, the browser is locked-down and this machine’s operator is extremely careful, I am tempted to leave the Meltdown Registry key set to disabled for the present (subject to change, should an exploit in the wild be discovered), which the owner would prefer (other than yanking KB4056897 altogether).
In that case, I might also be tempted to leave the Meltdown mitigation disabled, at least for now.
1 user thanked author for this post.
Hm… The info doesn’t say that, whether on the MS site or in the Update Catalog. But this was probably mentioned before? Either way, AKB2000003 should be edited to remove that first one then.
KB4056897 is not bad.
KB4056897 will work fine for non-AMD machines. It just doesn’t have the extra fix included.
KB4073578 covers both bases,Intel and AMD. That’s why we recommend it and why it replaces KB4056897.Yes it is for Group B. I’ve just downloaded what’s still unchanged in Topic 2000003, and saved them. I don’t have an AMD processor so it would seem I don’t need the KB4073578. I’m holding off installing them until I hopefully get a definite answer. But time’s getting short.
Experience is that marvelous thing that enables you recognize a mistake as soon as you make it again.
1 user thanked author for this post.
I’m holding off installing them until I hopefully get a definite answer. But time’s getting short.
That IS a definite answer. Install KB4073578.
@pkcano, Will KB4073578 work with the January rollup as well as the stadalone security patch?
If you have not installed Jan patches, install EITHER the Preview KB4057400 (if you are doing Group A) OR the Security-Only KB4073578 (if you are doing Group B). You don’t need both.
If you already installed the Rollup KB4056894 or the original Security-onlyKB4056897 and you have no problems, you don’t need to do anything.
1 user thanked author for this post.
I am in the BGroup with Win7. I have not installed anything from January yet. Am I correct in assuming that I could install KB4056897 and NOT the later KB4073578 (1/12) in order to get January security updates WITHOUT the Intel “fix”???
All of the January updates (the Rollup and both security-only_ contain the Intel fis.
1 user thanked author for this post.
-
If you are not having any problems, I would just let things stay as they are and wait for the DEFCON-3 on Feb patches.
1 user thanked author for this post.
Viewing 67 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Wine Updates
by 6 minutes ago
-
WWDC 2023: Here’s everything Apple announced this week
by 3 hours, 41 minutes ago
-
Malwarebytes Browser Guard extension in Firefox: where is the MB logo?
by 3 hours, 57 minutes ago
-
Android – or Android muic app – file system
by 7 hours, 13 minutes ago
-
Restore Points Being Deleted
by 11 hours, 8 minutes ago
-
Why millions of usable hard drives are being destroyed
by 4 hours, 29 minutes ago
-
YouTube Display is Very Large
by 14 hours, 29 minutes ago
-
1Password and passkeys
by 23 hours, 25 minutes ago
-
Macrium user error:selected volume guid?
by 18 hours, 4 minutes ago
-
Windows 11 Insider Preview Build 22621.1835 and 22624.1835 released to BETA
by 1 day, 14 hours ago
-
Unexpected HP Install Request anfter removal of Norton AV
by 1 day, 10 hours ago
-
Will Incontrol stop Windows 11 22H2 update, if used after update is paused?
by 14 hours, 20 minutes ago
-
Restoring a Bitlockered System Image with Macrium Reflect Free
by 1 day, 19 hours ago
-
Prevent emails from ever being seen in Outlook 2013
by 1 day, 14 hours ago
-
Windows Update
by 15 hours, 8 minutes ago
-
Vivaldi 6.1 with Bing chat , browsers mimic
by 14 hours, 10 minutes ago
-
MS-DEFCON 2: Are you still on Windows 10 21H2?
by 13 hours, 55 minutes ago
-
Word 2021 – Print View problems
by 1 day, 20 hours ago
-
Windows 11 Insider Preview build 25387 released to Canary
by 11 hours, 18 minutes ago
-
Windows 11 Insider Preview build 23475 released to DEV
by 2 days, 13 hours ago
-
WordPress added AI – Jetpack
by 2 days, 12 hours ago
-
PXE Boot and Hyper-V virtual machines and other strange things
by 2 days, 16 hours ago
-
Testing for adding table to post
by 2 days, 14 hours ago
-
I honestly can’t tell if this is a scam or not
by 1 day, 11 hours ago
-
New Life For Ten Year Old DIY NAS Hardware
by 16 hours, 33 minutes ago
-
June 2023 Office non-Security updates have been released
by 3 days, 12 hours ago
-
Web Apps from Brave Browser
by 2 days, 10 hours ago
-
Firefox 114 offering Secure DNS Options – does AT&T ISP Support?
by 2 days, 14 hours ago
-
macOS 14 Sonoma
by 2 days, 16 hours ago
-
Just a fyi – I think I’ll skip on an Apple Vision Pro hardware section
by 3 days, 14 hours ago
