Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trying to get rid of GWX files


  • Please log in to reply
8 replies to this topic

#1 dancing leaves

dancing leaves

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:55 AM

Posted 01 June 2015 - 09:20 AM

I uninstalled the Windows update (KB3035583 --corrected) and changed the owner of folders so I could delete the 2 gwx.exe files on my computer. I ran a search for 'gwx' and a bunch of files and folders came up, but I don't know which additional ones I should delete... They include:

 

All .exe's:

gwxgc

gwxux

gwxuxworker

gwxconfigmanager

gwxui

 

...and...

gwxmig.inf

Microsoft-Windows-GWX-Ins%4Operational.evtx

windows6.1-kb3035583-x64.psf.cix.xml

(several manifest files and folders in windows\winsxs)

(several folders named 'wow64_microsoft-windows-gwx...' and 'amd64_microsoft-windows-gwx...')


Edited by dancing leaves, 01 June 2015 - 05:17 PM.


BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:55 AM

Posted 01 June 2015 - 09:28 AM

Hi dancing leaves :)

Are all these files/folders located in C:\Windows\System32\GWX? Also, what Windows are you using?

Edited by Aura., 01 June 2015 - 09:28 AM.

animinionsmalltext.gif
unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 rp88

rp88

  • Members
  • 3,067 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:55 AM

Posted 01 June 2015 - 04:29 PM

You might need to disable the GWX service as well as trying to delete files. Services can be disbaled by following the blue text on the services tab within task manager. By the way, was the update which did this KB3039983 as you say, or did you mean KB3035583?

Edited by rp88, 01 June 2015 - 04:29 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#4 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:55 AM

Posted 01 June 2015 - 04:31 PM

I don't see any GWX Service on my machine? What is it called? And the issue here isn't to delete the files, it's to know which ones are safe to delete.

animinionsmalltext.gif
unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#5 dancing leaves

dancing leaves
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:55 AM

Posted 01 June 2015 - 05:20 PM

Aura, windows 7 professional sp1 64-bit. There is no GWX folder.

 

rp88, yes, I corrected the KB#. As to the rest, there is no "GWX" service running. I want to know about deleting the other GWX... files and folders previously listed.



#6 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:55 AM

Posted 01 June 2015 - 05:34 PM

Can you list the folders where these files are? And if they aren't in System32\GWX, they won't do anything. They aren't active so you could leave them there and it wouldn't make a difference.

animinionsmalltext.gif
unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#7 rp88

rp88

  • Members
  • 3,067 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:55 AM

Posted 01 June 2015 - 06:13 PM

Just a thought, regarding deleting these files.

If you aren't sure what is or isn't safe to delete, but you know they are all inactive, you could try copying them all to a different folder and then making that folder into a zip file.

That way you still have the files (in that zip file in a totally different directory, somewhere under your documents folder maybe) should you ever need them, but they can't be run unless you unzip the folder and copy them back to that directory, so they shouldn't be able to run automatically. For the purposes of preventing automatic running putting them into a zip file in another directory is as effective as deletion, but it can always be undone should you ever need to.

And I suggest you make some systems images soon, because with all this stuff going on now the windows 10 release date is announced there will be many things that could mess up your system, having something to fal back on in emergencies and get your system back to an older state is always helpful.

Edited by rp88, 01 June 2015 - 06:14 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#8 dancing leaves

dancing leaves
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:55 AM

Posted 02 June 2015 - 08:23 AM

Okay; thanks, everyone.



#9 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:55 AM

Posted 02 June 2015 - 08:25 AM

No problem dancing leaves, you're welcome :)

animinionsmalltext.gif
unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users