Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 PC involuntarily installed 10 via updates


  • Please log in to reply
22 replies to this topic

#1 OptimusSemi-Prime

OptimusSemi-Prime

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 02:42 PM

My PC has a notification windows 10 icon in the  taskbar area. i searched for the massive BT file to check, it must be hidden. i see an installed update KB3035583 which is the tipping point. i have G*X running in the task manager  and installed in some distinct folder position. how far did this crap go before it got truncated and how do i remove these windows 10 entries without doing damage?

 

sorry for posting a redundant topic, but i think my situation is somewhat unique.


Edited by hamluis, 06 October 2015 - 10:45 AM.
Moved from Win 7 to Win 10 Discussion - Hamluis.


BC AdBot (Login to Remove)

 


#2 rp88

rp88

  • Members
  • 3,082 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:15 PM

Posted 05 October 2015 - 03:00 PM

Make a system image first, like this http://www.bleepingcomputer.com/tutorials/create-system-image-in-windows-7-8/#manual, then I'll explain how to red rid of anything that's left of gwx.


Firstly however:
Go into "windows update" in "control panel", and go into "installed updates", remove KB3035583 if it's there, also remove KB2976978 and KB2952664 and KB3044374 (that last one might well not be present) if they are around.

Then set your updates to "check automatically but ask me before download", make sure to set yourself a routine of lookin at your update list every tuesday evening/wednesday morning and installng all the security ones (Security Update for...), and then unticking all the other ones (Update for ...) and then going through those other ones looking at their "more information" links, instaling any which fix bugs you have suffered, ignroing the rest. Make sure to install security updates (Security Update for...) but for all other updates install only if you really think you should.

Then search your C:\ drive for "gwx", see what comes up if anything. Make sure "hidden files" are set to be shown under "folder options", but you do not need to have "protected operating system files" showing. Post here a list of everything that is shown by the search.

Then have a look on your C:\ drive and see if there is a folder called $WINDOWS.~BT, if there is tell us.

Edited by rp88, 05 October 2015 - 03:00 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#3 OptimusSemi-Prime

OptimusSemi-Prime
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 03:07 PM

ok, i am firing it up now. thanks for the response. i know that PC wasn't connected to the net long enough to download a massive 5 gb file. i did do a clone about a week ago.

 

i have since turned off all windows updates and will only do them manually from now on, i know, a little too late for that.



#4 OptimusSemi-Prime

OptimusSemi-Prime
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 03:17 PM

i can't see any of the KBs under installed updates, but under update history...i know 3035583 was there, which scared me

 

ok, i have c:\windows\system32\gwx showing up

 

but the kb3035583 is showing in update history,as successful but not in installed updates. i al;so have KB2952664 in history, but not installed updates, but in history it is showing as successful.


Edited by OptimusSemi-Prime, 05 October 2015 - 03:28 PM.


#5 rp88

rp88

  • Members
  • 3,082 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:15 PM

Posted 05 October 2015 - 03:52 PM

There is a command prompt code for checking if particular updates are present, try the following:

copy and paste exactly the following line into command prompt and hit enter

wusa /uninstall /KB:3035583

a message will be displayed, tell me what it says

then do the same with the command

wusa /uninstall /KB:2952664

and post the message displayed here.

Those commands will do one of three things:
1.if the update is present they wil remove it
2.if it isn't present they'll give an error message
3.or there's a chance they might be present but it might not be able to remove them in which case it'll give a different error message.

Also I need to make some further checks on which updates should be removed from windows 7 systems, I run a windows 8.1 system so I never paid such close attention to gwx related updates for windows 7, I did however list all the gwx related ones for windows 8.1. I need to check some old lists and see if I can find any other ones that should be removed from windows 7. I suggest that while I go about doing that you make yourself a system image, see the link I gave you.

If you need any advice with that just ask. You'll need a blank external hard-drive to write the image to, or you might be luccky with a larg blank USb stick, but you will have to make sure the USb stick is one which cals itself a "local disk" rather than a "removable disk", which is why it's easier to just get an external hdd as they always call themselves "local disk"s.

P.S. I notice you have gwx folders on your system as returned by that search, please list the names of all the files within c:\windows\system32\gwx also please tell me if the search for gwx (just search it in the search box within the file explorer after going into C:\ ) returns any other results, I would expect it would have some gwx.exe files in other folders, perhaps bruied in a place called WinSxS. Don't do anything to any of these files just yet, but please list them all. List any file with those three letters GWX in it's name, not only files called GWX.exe. I expect you'll see files such as GWXUX.exe and GWXUXWorker.exe, list all of them here so we know what they are and what folder each is in.

P.S.2. Do you have that $WINDOWS.~BT folder on your C:\ drive? Please post a list of the names of all the folders you see (probably between 10 and 15) from within C:\, go to "this PC" in the file explorer, click on "Local disk (C:)" and tell me what folders are shown when you look there, don't even think of listing subfolders, there will be hundreds of thousands of them, just list the folder names you see when you look at C:\ the way I describe. Perhaps even take a screenshot, you could do that for the list of fles found with gwx in the name also.

Edited by rp88, 05 October 2015 - 03:52 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#6 OptimusSemi-Prime

OptimusSemi-Prime
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 04:03 PM

ok, did the command prompt, it came back with a rather large dialog, i am on my lappy while persuing this topic, the windows 7 PC is standalone. i can screen grab, but the image may not paste here


Edited by OptimusSemi-Prime, 05 October 2015 - 04:03 PM.


#7 rp88

rp88

  • Members
  • 3,082 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:15 PM

Posted 05 October 2015 - 04:13 PM

Take the screenshot, save it as a jpeg image, then try uploading it here, it should be possible. Otherwise failing that you could upload it at an image hosting site, or if you have a blog with google's blogger service one of the easiest ways is to put it as an image in a blog post there, then get the url for that image and paste the url, that lets you share the image at it's full resolution and the page anyone following the link goes to is just the jpeg, nothing else on it. Or just type in a post the names of the folders and files shown in the image you've screen captured.
Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#8 OptimusSemi-Prime

OptimusSemi-Prime
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 04:16 PM

ok, trying

Attached Files

  • Attached File  gux.JPG   72.03KB   1 downloads


#9 rp88

rp88

  • Members
  • 3,082 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:15 PM

Posted 05 October 2015 - 04:18 PM

That's helpful, but a screenshot, done in the same way, of your C:\ drive and a screenshot of all the files listed when you search (as done in the box in the top right corner as seen on your screenshot) the whole of C:\ (not just search the gwx folder, search the whole drive) for gwx.
Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#10 rp88

rp88

  • Members
  • 3,082 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:15 PM

Posted 05 October 2015 - 04:28 PM

In the screen shots I'm asking for one (the one of C:\ ) will have "-->This PC--> Local Disk (C:)-->" as the text in the main bar across the top and the other (the one for all the gwx stuff) will say "-->Search Results in Local Disk(C:)-->".

DO NOT type those file paths in using the --> symbol, I'm just showing what it will look like, so you will know where the screenshots must be taken.

First screenshot:
Double click on "Local Disk(C:)", as you see it in the shot you have already posted, then take a screenshot of it.

Second screenshot:
Then from within "-->This PC--> Local Disk (C:)-->" (as said in the main bar at the top) type into the search box, box at the top right, gwx. The search might take a few minutes, then when it is finished post a screenshot of the screen showing all the results found.

Also please do the following
go into folder options and untick "hide extensions for known file types", and also please add an extra column to the details view in the file explorer, have this column used for the full folder path for the folders/files listed on the left hand column.

P.S. have you run those two command prompt commands yet? write down the error messages they give and then type those messages into a post, I would expect the messages should only be a few sentences long.

Edited by rp88, 05 October 2015 - 04:30 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#11 OptimusSemi-Prime

OptimusSemi-Prime
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 04:33 PM

yes, i ran the wusa commands, but the 2 update kb are still showing up in the update history, but not in the installed update dialog.

 

ok, searching all gwx in c:\  now

 

also, the gwx search is resulting in alot of stuff, but i will grab the most recent, the later ones should be irrelevant

Attached Files


Edited by OptimusSemi-Prime, 05 October 2015 - 04:44 PM.


#12 OptimusSemi-Prime

OptimusSemi-Prime
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 04:48 PM

ok, got it. i am tempted to connect that 7 machine to make this easier

Attached Files

  • Attached File  srch.JPG   196.4KB   1 downloads


#13 OptimusSemi-Prime

OptimusSemi-Prime
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Oklahoma
  • Local time:06:15 PM

Posted 05 October 2015 - 06:22 PM

great news,

 

ok, i listed the updates, except this time i sorted by name instead of date ( i had to simplify the list somehow, there must be over 200 to look through) and found those two KB, uninstalled, and they are gone, and now no more gux and i will definitely learn from this one, thanks again for your help!!



#14 MH957

MH957

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:06:15 PM

Posted 06 October 2015 - 10:27 AM

KB3035583 was reissued yesterday so be careful it doesn't slip thru and reinstall itself.

 

Hopefully this version doesn't ignore the DisableGWX registry key but given MS lately it wouldn't surprise me.

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\GWX]
"DisableGWX"=dword:00000001
 

With that in place, even if KB3035583 is installed, GWX doesn't run.



#15 rp88

rp88

  • Members
  • 3,082 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:15 PM

Posted 06 October 2015 - 11:51 AM

Post #11, that huge error message you got is because you didn't type the command correctly, you missed out the spaces between "wusa" and "/" and "uninstall" and "/". If you copy the commands excatly from post #5 they should run. When running command prompt comamnds it is crucial to get them excatly right, thos spaces matter, that's why I suggested copy and pasting them from the text in my post. Note that in each command it starts with "wusa" then has a space, then has a slash, then no spaces, then the word "uninstall", then another space, then another slash, then no spaces, then the capital letters "K" and "B", then no spaces, then a colon, then no spaces, then the 7 numbers of the update to be removed.

Please run those commands anyway, just to fully verify that those updates are gone. If the update is gone already you should get an error message saying that the update couldn't be found, then do the same for the other update with the same command but the other number in it, once again you'll get an error message, post what the message says for each update. Alternatively you might not get that error message, you may get one which says that the update can't be removed, in which case things get problematic, or you might get a success message saying that the update is now gone (but indicating that it was still there until you ran the command).


Rgarding post #14, as long as your updates are set so that you have to approve updates before they can download then don't fear the re-issuing of kb3035583, it'll probably be offered but all you have to do is make sure that it's unticked befoe you install other updates.


Also optimus, thanks for the list of all the files which came up when you searched for gwx, very helpful to see that, please also post an equivalent picture showing what files and folders are on C:\, so I can see if you have a bt folder around. If you need to delete an image from this site such that you get more space to upload other images then you can delete your image from post #8.

And please try copying and pasting those commands excatly into command prompt, see what result it gives.

Report back what it says, with another screenshot if you like or you can just type the error message.

You might need to do a little more to get rid of gwx, depending on what result that command prompt command gives, and also depending on what folders are or are not present on C:\ . You should be alright, but if you just post the screenshot of C:\ and the messages you get when running those commands then I'll be able to verify if you are fully fixed, and remember in future have updates on "check automatically but ask me before downloading", do all the security ones, be very careful (going with the side of not installing when you cannot be sure if a non-security update is worth having) with the rest. remember also to look every tuesday evening/wednesday morning in "windows update" in control panel" to see when new updates are on offer so you can install the security ones quickly and have plenty of time to decide about others.

P.S. have you made a system image yet, I strongly suggest you do so, one day you will be glad of it.

P.S.2 I don't have a full list of "updates you might not want for windows 7", I do have such a list for windows 8/8.1. I suggest you start a new thread along the lines of "please can anyone advise on which updates should be avoided, for gwx reasons, by windows 7 users", just to check if there are any more updates that might be worth getting rid of.

Edited by rp88, 06 October 2015 - 11:57 AM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users