This is… disturbing. Yesterday, Michael Horowitz published a detailed rundown of GWX remnants still on a Win7 PC. … today, I took a glance at the
[See the full post at: Brinkmann, Horowitz: Are remnants of the despised “GWX” Gets Windows 10 campaign still on your Win7 computer?]
|
There are isolated problems with current patches, but they are well-known and documented on this site. |
-
Brinkmann, Horowitz: Are remnants of the despised “GWX” Gets Windows 10 campaign still on your Win7 computer?
- This topic has 84 replies, 26 voices, and was last updated 4 years, 4 months ago.
AuthorViewing 31 reply threadsAuthor-
There were kb3184143 patches released by Microsoft to remove the triggers and accompanying cruft for Windows 7 and 8. Both available here:
microsoft kb3184143 patches
The amount of times I’ve seen $BT folder in the Windows directory in W7 PC’s..
It’s more than likely care-free owners who just use their PC’s for whatever and don’t pay attention to Tech sites and AskWoody.Keeping IT Lean, Clean and Mean!6 users thanked author for this post.
Steve Gibson offers a util to check if win 10 upgrade is enabled on your pc
Guess thats one main reason i still have the GWX control panel still activated on my pc. No remnants in mine
4 users thanked author for this post.
Gunter Born doesn’t have a translation on his
EnglishGerman-language blog. He translates most, but not all, entries to there. Use Google Translate if you want to understand it; I don’t read German.
MVP Edit: FTFYBought a refurbished Windows 10 64-bit, currently updated to 22H2. Have broke the AC adapter cord going to the 8.1 machine, but before that, coaxed it into charging. Need to buy new adapter if wish to continue using it.
Wild Bill Rides Again...1 user thanked author for this post.
Simple solution really. Set Windows Update to NEVER…. Disable Windows Update service Forget about Microsoft updates completely. They will create more hassle and reduce system reliability than the supposed security improvements are worth.
Proof positive. My 130 client computers have not had an update in 20 months now and the result is smooth running, no problems what so ever. Oh, stop using IE and use Chrome instead, and remove Adobe Reader, Adobe Flash and Java.
CT
-
CT is not talking about Windows 10, which I assume you are. My Windows 7 x64 Home edition PCs are set to “Never check for updates” every month, until it’s stated here that it’s time to install the month’s updates. Windows 10 is the only version of Windows that precludes this.
I found the same on a Win7 Home Premium 64-bit laptop just two weeks ago. Most updates had stalled some time previously because of corruptions to several system files, and the machine was rather neglected, though still working – slowly.
After a thorough clean-up, removing several AV programs, 30 copies of one printer(!), suspect applications and running AV, chkdsk and sfc scans, I started to apply the outstanding important Windows updates to be told it was updating to Windows 10! Luckily I was able to hit cancel in double-quick time and then ran GWX_control_panel to neutralise it. I also removed (via WUSA /uninstall) all 20 or so copies of KB2952664 ‘just in case’. Panic over for now, but I needed to lie down there for a while!
Tony H.
Bristol, UK3 users thanked author for this post.
-
-
This PC is the exception, not the rule. As for updates, on Dec 3, 2018 Windows Update was run and all available patches were installed. That said, the computer did go long stretches without any Windows patches. The previous run of Windows Update was Feb. 2018
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
-
-
-
GoneToPlaid, you may find this web page interesting.
https://answers.microsoft.com/en-us/windows/forum/windows_7-update/windows-7-updating-in-2018/291a9582-17a7-4942-8145-8d9f68265189?messageId=2f46cef5-da27-431d-8c6f-b5e7b2b89246It is my posting which explains how to re-install Windows with the aim of installing all security updates up to and including May 2017, then never again. In effect, by following this pretty detailed process, you avoid ever installing any non-security update that was issued after Dec 31, 2014. That is when Win7 development ended and all this nonsense began.
CT
1 user thanked author for this post.
-
Thank you CT, for throwing that link up. I’ve copied it fresh again. Haven’t needed to recently, but I still refer people to your directions when required.
2 users thanked author for this post.
-
-
-
-
-
Can you blame him if his PC isn’t up to date on patches? A lot of people are hesitant to allow automatic Windows updates because of the underhanded things Microsoft did to try to get people on Windows 10.
Group "L" (Linux Mint)
with Windows 8.1 running in a VM3 users thanked author for this post.
-
-
Yes, we can blame him. If Horowitz proposes to speak with some kind of authority, then he needs to do his research before he posts articles of this kind. Behavior such as this does nothing positive for one’s reputation.
1 user thanked author for this post.
-
Welllllllll… I wouldn’t cast that kind of aspersion.
If Michael has installed the latest Win7 Monthly Rollup, he could reasonably expect that it covers pertinent previous patches — including, notably, the patches that obliterate GWX.
-
-
I don’t really read tech articles much for Windows stuff unless I am looking for something specific, but I know both Horowitz and Brinkmann are both referenced here quite often and I do not get the impression either one are anything less than power users who know their way around Windows.
So, knowing that they are not amateurs, I must side with them and Woody on this one. If one installs a rollup of patches, you shouldn’t have to comb through the file system, task scheduler and whatever else to make sure they worked. That is absurd.
If something in those patches was supposed to remove GWX and, upon installing said patches, GWX was not removed, that means two things; 1. the patch failed to do it’s job and 2. it is reasonable to assume that if this happened once, it has also happened to others. How many others is anyone’s best guess, but I do not think it is wrong to report it as was done here nor does it, in any way, damage whatever credibility these two tech writers have accrued.
I have not patched since June of 2017 and I will remove June’s patch eventually to roll back to May of 2017 and stay there. There is nothing GWX anywhere on my system.
2 users thanked author for this post.
-
-
-
-
It’ll certainly not damage his reputation when it comes to his push for better router security:
https://routersecurity.org/ the guy is, in my book, a great advocate. Just needs louder shouts from around the interweb.Keeping IT Lean, Clean and Mean! -
Regardless of reasons, it’s probably best to do a little checking to see if files, folders, and tasks related to GWX are on your system. Sometimes prevention measures don’t work.
Carpe Diem {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1778 x64 i5-9400 RAM16GB HDD Firefox114.0b8 MicrosoftDefenderMS released KB3184143 to supposedly remove the vestiges of GWX. And anyone on Automatic updates should should have received it through WU.
But there were a lot of people hiding anything even vaguely related to GWX so they may have hidden it and not have applied that patch.Also, I had a friend that bought a new Win computer (don’t remember if it was 7 or 8.1) early on in the GWX campaign. The upgrade to Win10 came as a CHECKED update in the OPTIONAL updates! I had a fit with it b/c the computer, on Auto updates by default, started the upgrade immediately after initial startup. I had to do a Factory Restore and get rid of the upgrade before I connected it back up to the Internet.
Anyone doing a Factory Restore on that computer might run into the same thing.
6 users thanked author for this post.
-
Here’s the MS Update Catalog link to KB3184143, in case Windows Update does not offer it:
http://www.catalog.update.microsoft.com/Search.aspx?q=3184143
5 users thanked author for this post.
Separately, what is up with today’s two new security patches, KB931906 and KB2758694, which just showed up in Windows Update on my Win7 computers? Not sure if KB931906 is rated critical, but KB2758694 is rated critical. It appears that these are older updates which Microsoft is pushing again to all Win7 computers.
1 user thanked author for this post.
I have 2 Win 7 Ultimate 64 systems. A year or so ago, I installed & used GRC’s “Never10” utility to turn off GWX. It worked. But in Dec I started experiencing the classic intense disk activity shortly after startup that reminded me of GWX. ???
Investigating, saw GWXConfigManager running. Also noted CompatTelRunner was re-enabled (I’d disabled it previously). Looked further and saw the GWX scheduled tasks were back in place (which I’d disabled previously).
I re-ran GRC’s Never10 & it confirmed the reg entries to disable Win10 upgrade were still in place. Head-scratching ensued.
So, whatever MS installed in the Nov updates re-enabled some of GWX – and completely ignored the reg entries that are supposed to prevent this.
I went ahead and manually removed GWX scheduled tasks and disabled the GWX executables. No more crazy disk activity – at least until MS installs another update to their malware.
1 user thanked author for this post.
-
You might want to try blocking CompatTelRunner with an outbound firewall rule which prevents it from phoning home. The procedure is documented here in the section on blocking programs
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
1 user thanked author for this post.
-
As a non-techy who is a little less non-techy than family and friends, I’ve been handed several different computers that had not been used ‘for a while’ and found GWX on them. Surprise! I don’t criticize people, ’cause I figure we are all doing the best we can. These may have been the type of people that Microsoft wanted to force into updating to avoid the spread of mal-ware… but their choice is to avoid updating, as it has ’cause way more problems.
It is good that an expert does not jump over problems that personal computer users may encounter, by dismissing them by saying it would have been solved if they had updated fully. That is Microsoft’s pat answer, and following their directions caused all kinds of problems… leading to the next recommendation to get a new computer that will be compatible. Instead, through what I’ve learned here, they are still using the same old computers without any issues, completely contrary to Microsoft’s pat advice.
One Windows 7 laptop out of our family/friends group did finally bit the dust. Apparently placing it on the trunk of a car, having it slide off, and then driven over, was what it took to kill it. So backing up provided an example of the importance of backing up … (the computer, not the car).
Non-techy Win 10 Pro and Linux Mint experimenter
One more year, just hang in there 😀
p.s. idon’t agree with the amount of exaggeration in this matter
1 user thanked author for this post.
Something else to be on the lookout for:
I wouldn’t be surprised if MS is already preparing a nice little ‘surprise’ for all remaining Windows 7 users – possibly a non removable message in the bottom right hand corner of the screen – or worse, a ‘popup’ or ‘flyout’ message (similar to the ones in Windows 10 when you disconnect a removable drive, etc.) that keeps appearing over and over to remind you that Windows 7 is reaching EOL next January and you should ‘upgrade’ to Windows 10.
No doubt it will be slipped into an important or security update or, at the very least, it’ll be a separate update marked as important and ticked to install by default, of course.
PC1: Gigabyte B560M D2V Motherboard, Intel i5 11400 CPU, 16GB RAM, NVIDIA GeForce GTX 1650 Graphics Card, 1x Samsung 870 EVO 250GB SSD, 1x Samsung 860 EVO 250GB SSD, Windows 10 Professional 22H2 64bit.
PC2: Asus H81M-PLUS Motherboard, Intel i3-4160 CPU, 16GB RAM, NVIDIA GeForce GTX 1050 Graphics Card, 1x Samsung 870 EVO 250GB SSD, 1x Samsung 860 EVO 250GB SSD, Windows 10 Home 22H2 64bit.-
And those of us who religiously watch for DEFCON 3 (or 4, or 5) will already be made aware of this and know what to do, thanks to AskWoody.com!
Win 7 SP1 Home Premium 64-bit; Office 2010; Group B (SaS); Former 'Tech Weenie'1 user thanked author for this post.
Hi everyone,
I still have KB3184143 (the GWX uninstaller) installed on all of my Win 7 Group B computers. As mentioned, I am updated through November, yet no GWX stuff has showed up on any of my computers. I have two questions for everyone…
For those of you who are seeing new GWX stuff showing up, is KB3184143 listed in your installed updates under Programs & Features > View installed updates?
And for those who are seeing new GWX stuff, are you on Group A, or are you on Group B?
1 user thanked author for this post.
GoneToPlaid, From a practical point of view, if one finds KB2952664 is still installed and not KB3184143, before installing the latter should one first delete KB2952664? Any other steps that might be also necessary to finish the job? Thanks. Group B, Windows 7 Pro Sp1, x64.
Hi OscarCP,
Now that is a really good question. Let’s think this through…
KB3184143 kills GWX, yet will not uninstall any and all installed versions of KB2952664. So the first thing to do is to install KB3184143 to kill GWX. After killing GWX, KB3184143 remains installed on your computer. Perhaps KB3184143 remains installed as a flag to Microsoft that the user does not want to upgrade to Windows 10 — ever?
After installing KB3184143, and rebooting if asked, then you can run my CMD file for removing all instances of the three infamous telemetry updates which includes KB2952664. Note that all instances of a given telemetry update must be uninstalled, before proceeding to uninstalling all instances of the next telemetry update. Since there are three telemetry updates to be uninstalled, my CMD file must be run three times (if all three telemetry updates are reported as being installed) and with a reboot after each run (just pay attention to the instructions which my CMD file displays) in order to remove all instances of all three telemetry updates.
After the above is done, run my CMD file one final time (as a sanity check) so that you can confirm that all three telemetry updates are no longer installed on your computer. My CMD file will report if these three telemetry updates truly have been removed from your computer.
Best regards,
–GTP
1 user thanked author for this post.
…When it was released, I also installed the KB3184143 GWX removal tool. I have run the scripts to see if KB2952664 was on the machine and get a negative. As I kept reading I found other components and repositories of the GWX data and compatibility logs. These were also deleted. I still run the GWX Control Panel as it provides a quick indicator of changes to the WU, but I still check after each monthly patch session or any software upgrades to ensure WU is set to never. I have also disabled IE from auto-updating. I wonder if the telemetry that was recently included in the roll-ups, utilize some of the GWX analytical and appraisal tools that might have remained even after the removal of GWX system.
Your last sentence in particular caught my attention. I too installed the KB3184143 GWX removal tool. It remains installed. Yet it is rumored that recent windows security only updates supposedly have KB2952664 or some other telemetry baked in? I haven’t seen any telemetry activity on my Windows 7 Group B computers which are updated through November 2018. I don’t see any active telemetry related tasks, and I am not seeing my computers making connections to Microsoft’s telemetry servers.
So this gets me to thinking. If KB3184143 is installed, its presence is clearly telling Microsoft that the user has no desire to upgrade to Windows 10. If KB3184143 is not installed, maybe this is why some users are seeing a sudden reactivation of GWX? If it really is the latter, then this would seem to stoke fears that Microsoft may have intentions of forcing Windows 10 on all Windows 7 users who did not install KB3184143. I’m just throwing this out there as food for thought.
1 user thanked author for this post.
-
As the DISM command syntax contains the logic “find the string of characters that matches KB2952664”, I interpolate that it scans the same database used by the Installed Updates display. In different words, it searches for the title, not the functionality.
I will not claim your $64,000 prize. Although I fit your described classification, Group A through December 2018, including the suspect function contained in the cumulative rollup, I also might have changed the criteria by running @abbodi86 ‘s “W10tel” executable found in AKB2000012.
In any case, when I run the single line command (elevated)
dism /online /get-packages | findstr KB2952664
it returns an empty result. No joy.1 user thanked author for this post.
-
Since the 2018-09 Preview Rollup and the 2018-10 Monthly Rollup, the KB2952664 functionality has been included in the Group A patches – not the KB2952664 separate distinct patch. The evidence is in the appearance of KB3150513 in Windows Update, which will not appear without the KB2952664 functionality installed. It was not added to the Group B Security-only patches to my knowledge. I believe we had this discussion before back in October.
KB2952664 and it’s Win8.1 KB22976978 equivalent have NEVER been installed on any of my machines. I am patching Group A, and I have seen KB3150513 appear (and be immediately hidden) in WU on my machines. I am also running @abbodi86 ‘s script to neutralize the telemetry in an attempt to remain in Group A.
-
-
-
-
The gwxwu_4e813955262d8e9d497a10018c36299ac02fce5e.exe is exactly the same W7x64 file as the GWXWU.exe contained within the Windows6.1-KB3184143-x64.msu installer file I linked the download page of. Also packaged in that .msu are several other files (see image), including a PkgInstallOrder.txt:
-
-
-
-
You still need to run my CMD script to wipe out KB2952664 after you deal with installing KB3184143. I posted an alternative Microsoft link for KB3184143 which doesn’t additionally include a separate EXE file. Maybe satrow can shed some light about the EXE file, in terms of whether you run the EXE file first or after installing KB3184143.
1 user thanked author for this post.
-
-
-
Hi OscarCP,
Yes, you need to run my CMD script to remove all installed instances of KB2952664. I hope that you will report back about how many instances of KB2952664 were removed, as this information will roughly indicate how long you unknowingly had KB2952664 installed on your computer.
And you are most welcome!
Best regards,
–GTP
1 user thanked author for this post.
-
-
In cases where there are 2 files that are downloaded, one being a .exe file, and the other, say, a .msu file (as in the present case), simply download both to the same folder (downloads folder, desktop, or some other folder you have or make that’s convenient), and install the .msu file. In the process of installation the .msu file will cause the .exe file to execute. If you watch your monitor closely you’ll often see a small command line box show up for a fraction of a second or so as the .exe file executes. It should not be necessary to separately run the .exe file manually, although I don’t suppose it will hurt anything if you do.
-
-
You could try manually uninstalling KB3118401, KB3021917 and KB2999226 via Programs and Features > View installed updates. They could be permanently baked into the computer if you ran Disk Cleanup and cleaned up Windows Updates to get more free space on your hard drive. If this is the case, then these updates can not be be easily uninstalled. If these updates can’t be uninstalled, it is no big deal if you are opted out of CEIP. These updates do seem to honor your CEIP settings in terms of not sending telemetry if you are opted out of CEIP.
1 user thanked author for this post.
-
-
Your last sentence in particular caught my attention. I too installed the KB3184143 GWX removal tool. It remains installed. Yet it is rumored that recent windows security only updates supposedly have KB2952664 or some other telemetry baked in? I haven’t seen any telemetry activity on my Windows 7 Group B computers which are updated through November 2018. I don’t see any active telemetry related tasks, and I am not seeing my computers making connections to Microsoft’s telemetry servers.
If I remember correctly, the various telemetry updates of the past were not solely GWX specific. I believe the long range plan of MS (alluded to but never specifically said) was to also use the transmitted data to report on errors and also patch installations going forward. As such I do believe that the GWX specific issues were removed by the GWX removal patch, but other capabilities may remain. Unfortunately my habit of doing late night research and testing got the better of me when I removed the last vestige of GWX I found using the Process Explorer applet from Sysinternals. There was an unnamed, unknown task in my Windows task library. It was grouped with the CEIP ones.
I had used CEIP up until the GWX/Telemetry issue began to surface. I disabled them. However the unnamed one remained enabled. Not until doing some testing with the Process Explorer did I discover the linkage of the unnamed task to the GWX or Telemetry tasks. I then disabled it like the CEIP tasks.
Unfortunately, I did not document it in my notes.
My initial comments were about Rollups, not the Security Only patches. I have not found any changes with recent Group B patches that would point to telemetry being present. Possibly if they are, they are honoring the various task settings of disabled, as I see no new tasks or changes to settings. Additionally when I disable some tasks, I also disable (by editing) the task trigger (just in case).
BTW, Thanks, as your scripts have proven very useful.
1 user thanked author for this post.
A reminder to install KB3184143, then remove/hide/block the KB2952664 (for Win7), KB2976978 (for Win8/8.1) and KB3150513 updates.
see this attached pic: I have KB3184143 installed on a Win7 computer and KB2952664 & KB3150513 are not installed.
Viewing 31 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
How To Girls Filipino From Scratch (Awaiting moderation)
by 18 minutes ago
-
Updating Win 10 Pro 21H2 to 22H2
by 1 hour, 58 minutes ago
-
Changing mouse pointer options.
by 2 hours, 13 minutes ago
-
Desktop or Laptop? What’s your choice?
by 23 minutes ago
-
Anyone use Auslogics Bitreplica
by 15 hours, 13 minutes ago
-
Unleashing the Gaming Revolution: CrossOver Mac’s DirectX 12 Support Update!
by 1 day, 4 hours ago
-
Defender’s Offline Scan Fails to Run
by 10 hours, 27 minutes ago
-
Mouse problem : cannot grab a window without maximizing it
by 17 hours, 10 minutes ago
-
End of support for Cortana in Windows
by 3 hours, 13 minutes ago
-
Microsoft is really missing an advertising trick
by 1 day, 3 hours ago
-
New MOVEit Transfer zero-day mass-exploited in data theft attacks
by 2 days, 3 hours ago
-
Windows 11 Insider Preview build 25381 released to Canary
by 2 days, 3 hours ago
-
Authenticating Email Address
by 1 day, 2 hours ago
-
Confusion about password protecting a folder in W10
by 2 days, 5 hours ago
-
I broke my right arm yesterday
by 6 hours, 14 minutes ago
-
Kaspersky : iOS devices targeted with previously unknown malware
by 2 days, 2 hours ago
-
Which Updates From Each List Are Safe to Install ?
by 2 days, 3 hours ago
-
AOL changes its web based email
by 2 days, 1 hour ago
-
Windows 11 Insider Preview build 23471 released to DEV
by 3 days, 3 hours ago
-
Windows 11 Insider Preview Build 22621.1830 and 22624.1830 released to BETA
by 3 days, 3 hours ago
-
Spyboy Defense Evasion Tool Advertised Online
by 3 days, 11 hours ago
-
Gigabyte motherboards backdoor
by 2 days, 1 hour ago
-
numbering in a table
by 2 days, 20 hours ago
-
LMDE 5 32-bit dual boot on seperatd drives
by 18 hours, 39 minutes ago
-
Microsoft ends 2017 Surface Book 2 support
by 4 days, 3 hours ago
-
My monitors won’t turn on
by 15 hours, 26 minutes ago
-
AMD Software Failed to Launch Because Windows Update Has Replaced the AMD…
by 4 days, 13 hours ago
-
Microsoft : New macOS vulnerability, Migraine, could bypass System Integrity…
by 4 days, 15 hours ago
-
Remove One Drive
by 17 hours, 33 minutes ago
-
Firefox users on Windows 7, 8 and 8.1 moving to Extended Support Release
by 15 hours, 25 minutes ago
