Why did Windows 7 just install an update?

[TakuSkan]

I had imaged my drive before MS dropped support for Win7 last month. So I thought I was prepared. But I was really surprised when I booted the system up just now, and found Windows doing a pretty lengthy update that took some 5 to 10 minutes.

After booting into the desktop I got no notification about the update. And there's nothing listed in the 2 locations I look for recently installed updates... Windows Updates and Programs and Features > View Installed Updates in Control Panel.

Has anyone else seen this, or know what it's all about? I really wasn't expecting something like this to pop up so soon after the Jan 15th when MS dropped update support.


EDIT: Event Viewer shows 1 entry where Windows checked for updates at 3:43 AM before I shut down the system, and a 2nd for the system being shut down. Above that shows Automatic Updates and Windows Update Agent logging events. Listing keywords: Health,State - Connection - Success, Check for Updates - Check for Updates.

There's 46 events lists there for today. 36 of the most recent are duplicate Event ID 40. I see no information in there on what was installed. But I'm really not familiar with how to interpret what I'm seeing in there.

Thoughts anyone?

 

[AK6DN]

The last updates were pushed out on 1/14/2020, so you probably just picked those up (KB4534310. KB4535102, KN890830)

 

[TakuSkan]

The last updates were pushed out on 1/14/2020, so you probably just picked those up (KB4534310. KB4535102, KN890830)

Thanks... but checking I see:

KB4534310 was listed as being installed in Programs and Features > Installed updates on 1/14/2020

KB4535102 and KN890830 are listed as being installed in Windows Updates > View Update History on 1/14/2020.

 

[Bree]

MS have said that MSE will continue to get engine and definition updates until 2023. Even if you don't use MSE, Defender uses the same definitions.

 

[TakuSkan]

MS have said that MSE will continue to get engine and definition updates until 2023. Even if you don't use MSE, Defender uses the same definitions.

Yeah... I found info on that in another recent thread in this forum. I checked my Action Center to see if I have MSE configured, but found nothing at all was listed there for malware/virus protection. Seems the free copy of Avast I've have installed for years used to be listed there, but isn't now.

After a bit of research on that last point, I see Windows Defender has been disabled in registry at:

HKEY_LOCAL_MACHINE> software > policies > Microsoft > windows defender > DisableAntiSpyware

..which is set to 1.

I can't tell if Avast may have disabled that, so I installed and ran another free copy of Malwarebytes as I've done in the past to see what it may find. It did find and remove something that looks relatively innocuous:

HKLM\SOFTWARE\WOW6432NODE\TweakBit

But nothing that looks like it was set to run from anywhere in registry, or anything related to Windows Update.

 

[torchwood]

Hi

what about KB4536952, also released 14 Jan.

There are updates that are not included in the history list - eg drivers

Have a look here,

C >> Windows >> logs >> cbs > (top folder).


Roy

 

[NoN]

Hi

what about KB4536952, also released 14 Jan.

There are updates that are not included in the history list - eg drivers

Have a look here,

C >> Windows >> logs >> cbs > (top folder).


Roy

that's the Servicing stack update : https://support.microsoft.com/en-us...date-for-windows-7-sp1-and-server-2008-r2-sp1


It came straight after all January 14th updates

 

[TakuSkan]

Hi

what about KB4536952, also released 14 Jan.

There are updates that are not included in the history list - eg drivers

Have a look here,

C >> Windows >> logs >> cbs > (top folder).


Roy

I ran a scan of the PC's entire C: drive for all files modified after 2/1/2020 6:37:52 PM as reported for Windows Update in Event Viewer and before 6:57:52 PM. The 2 files it reported that look the most interesting were:

C:\Windows\Software\Distribution\ReportingEvents.log
C:\Windows\logs\cbs\CbsPersist_20200202025047.cab

^- That cab contains CbsPersist_20200202025047.log, a 1,262,784 line file that reports 'TrustedInstaller initialization' events from 2020-01-14 through 2020-02-01.

It shows TrustedInstaller has been active every day since the 14th of January, working on dozens of KB updates. It started getting very active between 2020-02-01 03:38:00 and 2020-02-01 03:43:20 logging 645670 new lines.

Then at 2020-02-01 18:26:08 when I booted the system and had to wait 5 to 10 minutes for it to update, the log shows WU getting really active, logging 1,684,697 new lines involving dozens of KB updates.

The log file ReportingEvents.log reports the KB4536952 Roy mentioned was successfully installed just after midnight on 1/15/2020 when a total of 34 updates where installed.

So I guess MS's final Win7 updates have taken a little over 2 weeks to fully install. Perhaps that long 5 - 10 minute bootup that involved installing updates the other day indicated in those 1,684,697 new log lines might have just been the final, or perhaps the most complete installation of the final updates.

Does that make sense? Has no one else been experiencing this sort of behavior?

 

[torchwood]

Hi

Thats par for the course makes the files much bigger than they used to be because;

When MS introduced the new style of updating, (roll-ups a while back now), these cumulative updates included everything from a specific point in time, and checked/updated as neccessary
Updates are owned by Trusted Installer and the internal workings are performed via Software Distribution, CBS and Winsxs.

if youv'e not run MS's disk cleaner run it, it cleans up update files and you can gain an awfull lot of space.
It also works like the windows update process, with its operation performed before and after a reboot.

There is also another update due to be released, to correct an error in the final update which impacted stretched backgrounds

Roy

 

[TakuSkan]

Hi

Thats par for the course makes the files much bigger than they used to be because;

When MS introduced the new style of updating, (roll-ups a while back now), these cumulative updates included everything from a specific point in time, and checked/updated as neccessary
Updates are owned by Trusted Installer and the internal workings are performed via Software Distribution, CBS and Winsxs.

if youv'e not run MS's disk cleaner run it, it cleans up update files and you can gain an awfull lot of space.
It also works like the windows update process, with its operation performed before and after a reboot.

There is also another update due to be released, to correct an error in the final update which impacted stretched backgrounds

Roy

Running Windows Disk Cleanup is always a good suggestion. I'm finding remnants of old WUs in there all the time. I started to look for specific KB updates in that 2/1/2020 CbsPersist_20200202025047.log to see what exactly may have been installed. But as you point out Roy, it seems every single update, hundreds of them, are reviewed and addressed in there. Pretty much makes the task impossible.

I found an odd Network Adapter in Device Manager that as far as I know doesn't exist in my system that failed to install, and removed it. Not sure how it got there, but I guess it's not related to this strange unannounced WU the other day that took so long at boot. I wish I knew more in general about security issues in Windows. But from what I can see so far, this odd update behavior is a valid MS installation.

Thanks for the heads up on the upcoming update.