Help me find this stealth update that is sneaking in my system!

[sluggerb]

So on my Win 7 machine, some update has slipped by in the last week or so that is causing the screen to act differently. It is now brighter and causing eye strain. I have had this happen with other updates.

• I have Windows Updates turned off. So no automatic updates are being installed through WU. I manually install updates and have not installed one recently. I checked msconfig and nothing snuck into my Startup.
• The only auto updates I had turned on were the Windows Defender updates. I checked the Update History, and it says there have been many of those updates installed, including in the last week or or so. But I could not see how to uninstall them. When I go to "Installed Updates" it does not show any of the Windows Defender updates. They only show up on the Update History
  
  So question #1: How do you uninstall a Windows Defender Update? I have a third party AV solution so I don't even need Windows Defender running.
• I have Weekly Macrium Backups images of the system drive, so I rolled back to an image from 3 weeks ago. When the backup completed, after logging in, I got the spinning circle for a long time, as if it was installing some pending update. I rarely reboot this computer so it could have some pending update that has been sitting there for ages and just got installed when I booted up the restore
  
  So question #2: Can you boot Windows and have it skip any pending update installs? Would Safe mode do that? If so, once logged in, how can you identify and remove that pending update so it does not install?

Worse case scenario I have a Macrium backup from like 2 years ago which I could restore to but that would be a hassle of reinstalling things I have installed since then, although it would be a lot easier than rebuilding the whole system.

 

[michael diemer]

Maybe do a System Restore on that Macrium image, to before the problem began?

 

[sluggerb]

Maybe do a System Restore on that Macrium image, to before the problem began?

I rolled back 3 weeks and it's still there. I only keep a rolling 4 week backup. I'm going to try the oldest one and see of that gets it.

I suspect there was an update pending reboot for a while that I did not know about and that Macrium snapshot captured it so it's lurking in all my backup images.

 

[accwlo]

IAM QUOTING WHAT I FOUND ON NET ELSEWHERE
Start system in SafeMode.

Removing Windows 7 and 8.1 spyware updates.
To remove "spyware" updates open Command Prompt as Administrator by clicking right mouse button.
Sometimes you need to run this file several times till "get-hotfix" no longer find spyware updates (for ex. KB2952664 and others).
Before running the tool disable automatic update installation in Windows Update Center. After updates are deleted, check for updates and hide ones from this list for them not to get istalled again, then you can re-enable auto updates.
Add KBnumber of update you want to get rid of

Created by Zerbino, thanks to ru-board, hackread.com, ghacks.net and Google.
Copy txt below and save it as removespyware.bat
echo off
color 0E
echo DETECTING INSTALLED SPYWARE UPDATES
echo =============================================================================
powershell get-hotfix -id KB2923545,KB2970228,KB2592687,KB3035583,KB2660075,KB2506928,KB2726535,KB2994023,KB2545698,KB2976978,KB3075249,KB3080149,KB3021917,KB3022345,KB3068708,KB3044374,KB3035583,KB2990214,KB2952664,KB3075853,KB3065987,KB3050265,KB3075851,KB3083324
echo =============================================================================
echo IF RED STRINGS PRESENT YOU CAN CLOSE THIS SCRIPT
echo THERE ARE NO SPYWARE UPDATES
echo or
echo PRESS ANY KEY TO START REMOVING SPYWARE UPDATES
pause

echo Delete KB2923545 RDP 8.1(custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2923545 /quiet /norestart

echo Delete KB2970228 (custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2970228 /quiet /norestart

echo Delete KB2592687 (custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2592687 /quiet /norestart

echo Delete KB2660075 (custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2660075 /quiet /norestart

echo Delete KB2506928 (custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2506928 /quiet /norestart

echo Delete KB2726535 (custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2726535 /quiet /norestart

echo Delete KB2994023 (custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2994023 /quiet /norestart

echo Delete KB2545698 IE9 (custom by How to Uninstall Microsoft Spying Updates from Windows 7/8)
start /w wusa.exe /uninstall /kb:2545698 /quiet /norestart

echo Delete KB2976978 (telemetry for Win8/8.1)
start /w wusa.exe /uninstall /kb:2976978 /quiet /norestart

echo Delete KB3075249 (telemetry for Win7/8.1)
start /w wusa.exe /uninstall /kb:3075249 /quiet /norestart

echo Delete KB3080149 (telemetry for Win7/8.1)
start /w wusa.exe /uninstall /kb:3080149 /quiet /norestart

echo Delete KB3021917 (telemetry for Win7)
start /w wusa.exe /uninstall /kb:3021917 /quiet /norestart

echo Delete KB3022345 (telemetry)
start /w wusa.exe /uninstall /kb:3022345 /quiet /norestart

echo Delete KB3068708 (telemetry)
start /w wusa.exe /uninstall /kb:3068708 /quiet /norestart

echo Delete KB3044374 (Get Windows 10 for Win8.1)
start /w wusa.exe /uninstall /kb:3044374 /quiet /norestart

echo Delete KB3035583 (Get Windows 10 for Win7sp1/8.1)
start /w wusa.exe /uninstall /kb:3035583 /quiet /norestart

echo Delete KB2990214 (Get Windows 10 for Win7 without sp1)
start /w wusa.exe /uninstall /kb:2990214 /quiet /norestart

echo Delete KB2952664 (Get Windows 10 assistant)
start /w wusa.exe /uninstall /kb:2952664 /quiet /norestart

echo Delete KB3075853 (update for "Windows Update" on Win8.1/Server 2012R2)
start /w wusa.exe /uninstall /kb:3075853 /quiet /norestart

echo Delete KB3065987 (update for "Windows Update" on Win7/Server 2008R2)
start /w wusa.exe /uninstall /kb:3065987 /quiet /norestart

echo Delete KB3050265 (update for "Windows Update" on Win7)
start /w wusa.exe /uninstall /kb:3050265 /quiet /norestart

echo Delete KB3075851 (update for "Windows Update" on Win7)
start /w wusa.exe /uninstall /kb:3075851 /quiet /norestart

echo Delete KB3083324 (update for "Windows Update" on Win7 replaces KB3075851)
start /w wusa.exe /uninstall /kb:3083324 /quiet /norestart

echo ALL DONE. NOW YOU CAN CLOSE WINDOW.
pause

- - - Updated - - -

Eventually:

wusa /uninstall /kb:3035583 /quiet /norestart
wusa /uninstall /kb:2952664 /quiet /norestart
wusa /uninstall /kb:3068708 /quiet /norestart
wusa /uninstall /kb:3022345 /quiet /norestart
wusa /uninstall /kb:3075249 /quiet /norestart
wusa /uninstall /kb:3080149 /quiet /norestart
wusa /uninstall /kb:971033 /quiet /norestart
wusa /uninstall /kb:2990214 /quiet /norestart
wusa /uninstall /kb:3021917 /quiet /norestart
wusa /uninstall /kb:3123862 /quiet /norestart