Suspicious Windows Update Session In The Middle Of Night

Hello

I have been in the past suspicious of some app truning my windows update service on, and a few other things I noticed that would happen at night when I was half-sleeping when I left PC to play radio show or some video (with scheduled sleep)

I just couldn't get myself to remember the issue once I woke up the next morning to look it up, I was just doing some digging today in event viewer for some completely other thing and I stumbled across the only events about windows update in the log (im not sury why are the only ones under System, i did manually update I think a few times since april 2013)

I actually remember shutting down windows and seeing the "do not turn off, windows update" ... i just got pissed about it but I forgot about it for a few days, then I remember I was doing some threads about my windows update enabling it self and I don't know i forgot if that was traced down to a third-party program doing it or not.

But back then it was just the popups that kepts saying "windows updates are ready" or something like that, it wasn't installing anything at all, so that's all it was.

But now, in the middle of the night at 3 AM - I leave my PC to sometimes to 2 or 3 or 4 AM (depending on my sleep cycle) to go to sleep, now in the past year I've also been suspicious of some weird HDD loading and I think i found that to be some background defragging of the storage drives for some reason, even tho sysroot is an SSD (all indexing disabled and I know I have no program but unfortunately i never did an audit trace log as I should so im not sure)

So the update service turns it's self from DISABLED to MANUAL and instally about 5 updates then actually puts it self back to disabled.

I don't remember waking up and seeing my PC standing in the welcome screen so I really have no idea how that sneaky reboot worked that happened an hour later.


Here's the example from the event viewer.

https://i.imgur.com/gRaqtwS.png

I didn't manually update for like a year I think and I checked those KBs, I check all KBs before I install them so I haven't heard any of these at all before, no way I would just forget, updating is a special event for me so I would remember it - I really really hated automatic updates when I was growing up around winXP times and learning most of the stuff about PCs and that habit of turning off auto-update-anything has been with me since.


EDIT: I think I remember I forcefully renamed the service DLL and/or system component files of windows update to prevent them from being executed, I'm not sure if that trick is active right now but I remember I was reading about it and actually trying it out, that was many months ago, this suspicious thing was less than a month ago.

NOD32 seems to monitor for updates My ESET icon is orange?how do I disable my ESET product from notifying me about Windows updates? (4.x) - ESET Knowledgebase so, maybe NOD32 turned on the Windows update service.

Ah thanks for reminding me ... I thought it could be or even confirmed it but forgot, yes I do have NOD32, even tho I have Windows Security Center messages and monitoring completely disabled (but for some reason the service it self it's still enabled maybe i forgot to disable that)