Blue screens, bungled releases, stealthy NET upgrades, CRM blocks and complex manual fixes. It’s shaping up to be one hell of a patch-encumbered month
[See the full post at: MS-DEFCON 1: Patches failing at a phenomenal rate]
|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
-
MS-DEFCON 1: Patches failing at a phenomenal rate
- This topic has 118 replies, 42 voices, and was last updated 7 years, 6 months ago.
AuthorViewing 45 reply threadsAuthorWell, I’m a life-long Cubs fan, so I am a certified masochist. Still, I haven’t applied the patches. More to the point, it seems very clear that, in particular, Win 10 is actually a Rube Goldberg machine, which MS seems to then apply a new Rube Goldberg machine to when the previous Rube Goldberg machine doesn’t work. I think it was either Ch100 or Noel, who once commented that, in the past, it has taken a while for a new MS OS to stabilize. I think that observation is true, although I didn’t have the problems with Vista others did and I found Win 7 stable from the get-go. In any event, we’re deep enough into this to see there is likely no way out for MS and Win 10 now. Again, Ch100 and Noel know more about this stuff than I, but with this track record of not fixing things, and often times making matters worse, to ultimately really fix this seems to me to be nearly impossible.
What’s next for MS is unclear, but they’d be completely shortsighted, at this point, to end support for Win 7 in 2020.
8 users thanked author for this post.
-
Group B, win7Pro-64_SP1. I installed all of the MSOffice 2010 patches, the MSRT, and the October .NET rollup. No issues on either the Lenovo laptop or the Intel i7 desktop. All went well and no issues after testing. In my WU, the Outlook 2010 patch was checked this month, unlike the past months.
I did NOT try importing an XLS file into another document. That was forbidden at work and I never did it at home either (have no need). I will try it after I do the group B patches. I have not yet installed the October Group B Security only IE or Security Only Win7-64 patches.
I have said never Win10, but this month has solidified it unlike any past months. I was going to update the organizational Win10 laptop, but I will just create my own LTSC (LTSB) by never connecting to the web. There is no need for that device to connect, and it is still working well. Maybe that strategy will be Long Term Servicing Celibacy… 🙂 No catching any patch sicknesses.
Well this is the first Anniversary of the Win7-8.1 Cummulative/roll up updates.
Congratulations it M$ it seems your celebrating in style, with a “bang” so to speak. 😉
5 users thanked author for this post.
-
In regards to patching M$ appears to have adopted literally, that famous saying in the movie Forrest Gump.
“Life is like a box of chocolates YOU NEVER KNOW WHAT YOU ARE GONNA GET”
lol.
1 user thanked author for this post.
-
I have KB4041678 and KB4040685 (security only and IE11) patches installed on one Windows 7 Pro x64 machine for the past 3 days with no problems so far. Group B: P8P67 Pro, I7-2600K, Radeon HD 6850.
Edit to remove HTML
Please convert to plain text (.txt) before copy/paste-
I don’t trust it either when a adobe update pop’s up on my screen. I don’t click on it, I go direct to adobe and check to see if it’s real. I got the pop up screen yesterday the 12th. Went to Adobe and they had an update.
3 users thanked author for this post.
-
It appears that TransUnion is also redirecting visitors to fake Adobe Flash updates (though in Central America).
Ars Technica Article: https://arstechnica.com/information-technology/2017/10/equifax-rival-transunion-also-sends-site-visitors-to-malicious-pages/
3 users thanked author for this post.
-
Even the app stores aren’t immune from fake issues, such as the Edge app found in Google Play recently:
WARNING!!! There's a fake/scam Edge app in the Google Play Store. This is NOT from Microsoft.
Use this direct link: https://t.co/pYecSTdzyj pic.twitter.com/hKqcHQgaiM— Nick Landry (@ActiveNick) 12 October 2017
And on the subject of fake Flash Player installations:
Equifax rival TransUnion also sends site visitors to malicious pages
People visiting TransUnion’s Central American site redirected to potpourri of badness.
Dan Goodin | October 13, 2017Equifax isn’t the only credit-reporting behemoth with a website redirecting visitors to fake Adobe Flash updates. A security researcher from AV provider Malwarebytes said transunioncentroamerica.com, a TransUnion site serving people in Central America, is also sending visitors to the fraudulent updates and other types of malicious pages.
Read the full article here
4 users thanked author for this post.
-
Hello @ax kramer,
For those who may have inadvertently been infected with the adware contained in that hijack (known as Adware.EoRezo) the easiest approach for the non-technical would be to install, update and run a scan with Malwarebytes (installing it as the free version); links for the application’s download and a tutorial at site (from BLEEPINGCOMPUTER).
If that does not thoroughly clean the system, then try the Norton Power Eraser (read through the page fully before starting, and keep in mind that this utility tends to be rather aggressive; that is, it may generate false positives).
(For a more technical and detailed set of procedures, please see Remove “Update Flash Player” or “Update Java” fake alerts (Help Guide) (from MALWARETIPS); again, several of the other applications mentioned can be quite aggressive.)
Hope this is useful.
AJN
-
It’s probably worth mentioning that if you are just seeing the popup, you are most likely not infected. Just don’t click on it. That is just the Javascript from the 3rd party connection working as it should. Unless you disable Javascript completely (not recommended), or use a script blocking plugin, you are at the mercy of the website.
But if you have already clicked on it… yup, follow the advice given above…
Windows 10 Pro 22H2
1 user thanked author for this post.
Patch Tuesday needs a new baby brother… 3 1/2 weeks later, “Safe patch Monday” has a nice ring to it.
12 users thanked author for this post.
-
-
Patching early is always an option, but…
Recommended process:
Take a current system disk image first, to a secondary drive location.
Patch.
Test.
If problems with patches, restore image, wait 3.5 more weeks.
Else keep on running and wait for the fun to begin again the following month.
Repeat.
Windows 10 Pro 22H2
-
-
-
-
Because Woody explains in his Computerworld article that if you install the rollup, you will be effectively upgrading to .Net 4.7, and .Net 4.7 causes problems on Windows 7 machines – or so we have been advised on this site. That’s the point.
-
Not just the patches failing at a phenomenal rate Woody..Confidence, Integrity and Trust are just a few things….
I’ve found in GNU Linux after 5 years of use.
Windows - commercial by definition and now function...1 user thanked author for this post.
-
I have a friend that lives linux and hates MS. I ALWAYS hear him (actually there were 2 linux users) complain about having a problems with their computers. One said more than once, a linux (mint) update ruined his Home Directory and he had to reinstall. I feel there are bugs and problems with all OSs. Whatever OS you use, keep it updated to stay safe, or use a very good 3rd party firewall that show OUTBOUND connections.
-
Reply:
Linux Mint Update has 5 Levels, ie Level 1 to 5. The default setting only installs Level 1 to 3 updates.
Smart users will choose to only install Level 1 & 2 updates and then peruse Level 3 updates before installing them because a certain few Level 3 updates may be problematic.
… Some Level 4 & 5 updates will often bork the Linux system, especially Linux kernel updates on older computers.I have been updating my LM 17.3 Cinnamon computer for more than a year without any problem. If done properly, updating LM is like drinking Cinnamon Tea = calming effects, unlike Windows Update post-Oct 2016 = difficult, confusing and stressful.
-
The good thing about Linux Mint is that they don’t automatically force updates. They also rank the updates from 1 (safe) to 5 (do at your own risk), unlike Ubuntu, which wants you to install all their updates.
What’s not mentioned here is if the affected computers above were running dual boot (which may or may not be stable, based on what MS does), or if they were running PPA’s (software installed outside of the repositories). Usually, the software in the repositories are vetted by the developers, while PPA’s tend to be less stable.
As always, backups are vital, and good sense (turning on firewalls, doing updates) is good practice. Even in Linux, though, it’s always good to wait a bit to see if the updates are stable.
1 user thanked author for this post.
-
I used to think a firewall with outbound connection control was important. I still use one, but I realize it is not really going to stop smart malware. Just use it to keep a few things from phoning home.
Too much stuff can just hop onto Windows Service Host today, and you can’t block that in your firewall that without breaking a lot.
It’s better to know every executable that you have running on your PC is signed and trusted. If not, why are you running it? If it’s trusted, is it really going to matter if it uses the network?
Windows 10 Pro 22H2
1 user thanked author for this post.
-
-
If it’s security or privacy that is the concern, then they are two separate issues. Don’t conflate the two. Each one requires a different approach.
Windows 10 Pro 22H2
1 user thanked author for this post.
-
-
-
Hello, JohnW has a good point. I have seen adobe reader updated via the SVhost when the abobe updater was blocked in the firewall. So yes it can happen. But so can getting a virus even though one has an antivirus. Should one stop using the AV? No. The 3rd party firewall will show outbound connections for far more things that most people do not know about. I have seen “signed approved products” try to go out, even though “check for updates” was not checked. So it is a good idea to have a 3rd party firewall as an added protection. We have “Little Snitch” on our MAC as well as our Windows PCs. It works very well and is an eye opener for outbound connections. People here at woody’s are a little more technical, and I assure you that the average user does not even know what a signed exe file is. We must do the best we can to protect ourselves and others (clients, relatives, etc) with the tools out there and with Woody’s (and other vetted peoples here) advice.
1 user thanked author for this post.
-
I want to confirm johnf’s points.
And as long as we’re being anecdotal <g>, I switched an XP system to Ubuntu in Oct 2010, decided I didn’t like the direction Canonical was going and switched to (and have stayed with) Linux Mint since Oct 2010. There is an emphasis on usability and stability that is refreshing. When a new version is released, they will caution against upgrading (if it ain’t broke…) and that the previous version is still supported. I have found the patching system rock solid; so much so that I will install updates the day they are released and — real shocker — not bother to back up first (as long as I have backed up in the past 2 weeks).
(versus waiting 3-4 weeks on MS patches and never, ever, installing a MS patch unless I have created a system image first)
as always YMMV,
anon
3 users thanked author for this post.
-
Oh I know, I was just dreaming. Meanwhile the threat from MS is very likely much greater in practice than from anyone else, but so be it!
As for what to do come 2020, there’s still no indication that upgrading to Windows 10 will be any wiser than continuing with Windows 7 beyond that point given the present mess with that system’s vulnerabilities and updates. Unfortunately, Linux isn’t a viable alternative for many of us. All we can hope is that somehow against all the odds MS get their house in order over the next couple of years.
-
Hopefully Linux distro developers are aware that they could easily gain massive marketshare in the coming years if they take advantage of the upcoming opportunity when the coming Windows exodus occurs (Looking at you Mint and Ubuntu).
3 users thanked author for this post.
-
To echo — and build upon — your hope (which, it should be safe to say, is shared by countless millions around the world), let us also hope that the software vendors are paying attention, and have the forward thinking to create Linux versions their products, both popular home (such as for multimedia) and professional applications (accounting, law and medicine, to mention but three areas).
To quote [what is often cited as] an ancient Chinese curse, May you live in interesting times. (Not to digress, but it is neither ancient nor Chinese: https://quoteinvestigator.com/2015/12/18/live/ .)
As I have muttered before, on more than one occasion, Who’s on first? (http://www.baseball-almanac.com/humor4.shtml).
3 users thanked author for this post.
-
-
Your hopes are good ones, but as AJ’s comments reflect, it is really up to the application developers to make this happen. Lately I have become aware of a few small multimedia companies releasing cross platform versions of their applications. Here is one example: https://www.tracktion.com/products/t6-daw and the latest version even runs on a Raspberry Pi!
The Linux distro creators do not control what applications are written as cross platform. They have merely provided the OS and tools to enable it.
Anyway, there is not really any revenue to be made in releasing a Linux distro, since it is free and open source. There are a few commercial companies that have been successful with monetizing Linux, by packaging a free OS with some value adds, and selling support contracts to businesses.
Windows 10 Pro 22H2
1 user thanked author for this post.
-
-
-
-
@Canadian Tech: Agree, however isn’t the Group C, the one that doesn’t do “any” updates, or does it only do those which are “critical” to securing your computer. It’s been a while since we’ve seen you here. Welcome back! 🙂
1 user thanked author for this post.
I can’t begin to describe how happy I am since I put Windows in the rear-view mirror and installed Linux.
I no longer have to wend my way through a minefield of defective updates every month while hoping that MS will eventually get it right.
Clearly the inmates are running the asylum in Redmond.
-
I’m glad that is an option for some. I use both, because I need Windows applications that only run on real Windows.
If I could run everything on Linux, I would, but that is not possible or practical for me yet. I would like to see the day that everything runs native on Linux. I have tried Wine, but have only had luck with a few apps, and that is always with a lot of fiddling and crashes. Not wasting my time with that stuff anymore. Native Linux only!
If I only used web, email, office, and development apps, the solution would be easy. Linux has great replacement apps for those use cases.
But commercial applications for content creators seem to only support Windows and/or Mac. I use Photoshop, so don’t even get me started on Gimp, LOL!
Windows 10 Pro 22H2
-
“wushowhide shows several available drivers that do not show in windows update.”
Windows 10 doesn’t show updates of type Recommended or Optional
1 user thanked author for this post.
-
I’ve mentioned this before here, but this is why my clients use modified WSUS settings and sync schedules. Not sure what group this places us in though . . .
After WSUS has been configured via the Wizards (recommended) we go in and turn off the nightly sync. We set automatic rules to approve only critical patches.
A scheduled sync is set for Friday night at 9 PM. This way Critical patches get installed typically 3 days after patches are posted by MS to WSUS. We find that problematic patches almost always get pulled by MS from WSUS within this time frame – and this has saved us much grief.
The following week after the next Friday sync (10 days after patches are published) we review the remaining patches requiring acceptance – the non-critical Important and Rollup plus optional etc. By now some will have been pulled by MS, some have been re-released/superseded, the rest we review for approval at that time, or we may wait based on what others have been sharing about the patch quality that month . . . (thanks Woody!)
Keep in mind that WSUS allows you to UNinstall and block a patch across your organization – which happens a couple of times a year for us.
My stance with all this remains: I would rather take the pain of removing/revoking an installed patch, than skipping them all and getting ransomed.
~ Group "Weekend" ~
-
We auto-release to our alpha group. Our Alpha group is comprised of half VM’s and the other half is random people in IT, in this building, where the users can easily receive help. A week later we release to beta, which is a cross section of random people from different departments, although it’s still weighted heavily on IT. Then we have a Level 1, Level 2, Level 3, and Level 4 group. Depending on how alpha and beta went we may released to 1-4 on alternating business days or it could be 1 level per week.
Servers are handled by a different WSUS and they also auto-release to an alpha group. General deployment doesn’t take place until about a month after Microsoft releases patches, unless there is an active threat like WannaCry. Each server is put in a AD security group that determines the patching cycle. The requirements vary so much from server to server that we have about 20 different schedules.
Now we are also on migrating away from WSUS and towards an SCCM SUP, which still utilizes WSUS on the back-end. The goal is eventually to get to the point where we do montly patching of 3rd party products and get to the point where we have automated patch compliance reporting. Unfortunately we’re not quite at the same level of sophistication as we were at my last job, but there is a lot of support for the direction we are going in.
2 users thanked author for this post.
It is becoming more and more evident as time goes by, that the biggest security threat to your operating system is Micro$oft. I worry more about what they’re going to do my system month to month more than any other threat out there. That’s a sad state of affairs. Just my opinion.
8 users thanked author for this post.
-
Image. Image. Image.
Preferably that is daily, weekly, monthly…
Windows 10 Pro 22H2
The “Inaccessible boot device” (blue screen) issue was bad enough. Thankfully our testing process worked as intended and it didn’t make it into the full production environment.
However, I must say that I’m SUPER UPSET about this CRM thing. The bug they caused a couple of months ago affected over 3,000 systems here and it was just after Microsoft [mess]ed up the previous month of patching (in a year where basically every month has been filled with missteps). Now I’m reluctant to push any patches this month.
Our main response to the lack of a proper Microsoft QA process has been to drastically extend our roll-out cycle. It’s a fine line though because you don’t want the next WannaCry malware to be the one that finally takes down the entire environment.
Even when Microsoft had a proper QA process, bugs would slip through. Yet generally if you followed best practices you wouldn’t be burned too badly. Unfortunately, since they disposed of their QA team and especially since they’ve started transitioning to this cumulative approach to patching, the act of patching has become more like a game of Russian roulette.
What I’m most afraid of is that Microsoft doesn’t understand that business and government only moves so quick. All the wishing, pushing, and prodding that Microsoft can do will NOT change that. A lot of organizations have spent serious amounts of money to get their software capabilities and business processes to align – therefore it becomes extremely frustrating for their largest customers when they break things without understanding the real world ramifications of their decision making process.
It’s fine and dandy that they want to evolve. What they have is a failure to communicate.
Using the example of their last CRM fiasco:
If there are serious problems in CRM and the fixes that they want to do to CSS in IE will break customization’s that organizations have made then the solution shouldn’t be to break everything and ask for forgiveness latter. They should offer the patch as optional instead of critical or a security update. Then communicate about the types of things that will need to be addressed before the patch can be rolled out everywhere. Even if they don’t want to do it exactly that way, there is some variation that could work.
When Microsoft becomes more of a problem than a solution, that’s when people start to look for other solutions. Maybe they can’t be replaced on the desktop OS level yet, but there are plenty of areas where we can kick Microsoft out the door and adjust (down) our licensing with them.
-
In the words of David das Neve, the WaaS evangelist “We are the last ones to move onto this kind of model”.
The assumption here is that this kind of model is suitable for every scenario. Microsoft doesn’t compete on innovation on the OS level, at least not anymore. They need rock solid stability, support, good performance, not VR and ads for businesses. One could argue they add more security, but the OS itself hasn’t been built for security from the start so great to have tools to catch up to a less risky OS. Anyone would dare say Windows is more secure than IOS or MacOS, built on one of the most secure Unix, BSD?
And for people at home, although Windows can be tweaked pretty good, most do not know how to do it and they end up with a horrible user experience with unwanted software on their system, things they don’t know if they should remove or not, productivity hindering things all over the place, viruses. So, guess what, when faced with other options, it might suit them better and it is fine. Some might buy the marketing gimmicks. I know people who wants the latest OS because they can talk about having it, but they don’t have a clue about the differences. It is getting less common today, but it still exists, this inflatable neighbor syndrome with computers, although they are getting so common it is less palpable.
So, when you still own 90%+ of the desktop market and everybody supposedly have moved to a different development model, you think you are wrong and should do like others? Then, you better be sure what you want to do won’t break what has worked and still works for you to have that much exceptional presence in the market. If you don’t understand that, and you insist on pushing valueless upgrades with added costs to own, you are just opening the door for a smart company to step in and kick you out of the business market.
Who in their right mind would use Microsoft everywhere to manage server farms of web sites instead of Linux ? Microsoft have shown its incompetence with their IIS solution a long time ago. I guess they really try hard to convince businesses that they can’t be trusted for business no more too by blaming the users for not wanting their unwanted product, regardless of how they develop it. Basic strategic mistake: if you have the wrong product-market fit, it doens’t matter how you execute it. When you fail, I already hear you saying it is all your clients fault for not doing what you wanted them to do.
4 users thanked author for this post.
-
Group C, Anyone?? It sure looks like a safer place.
Canadian Tech
I just posted in the Windows 7 forum what happened with me.
2 weeks after I applied the Sept. patches (group b), my computer had huge problems.
After a lot of attempts at everything, (read my post in Windows 7 forum) I deceided to try one more thing. I removed Sept. IE11 patch kb4036586. That’s when the computer turned the corner.
So, almost 2 weeks before it was a problem.
The security patch was not removed.First take, it appears many of the issues are related to W7 and W10 although I am aware of known bugs in the October W8.1 Cumulative Update. We all know that the MS pre-release QA testing for updates is less than robust but this monthly fusillade of update issues is exacting reputational damage to MS and its products. I view W10 as little more than a slow moving train wreck and will resists using that OS until all viable options become exhausted. That’s a pity as I had high hopes for W10 until MS ingested all of the crazy pills.
1 user thanked author for this post.
Woody, it is interesting to learn that installing the .Net Rollups starting from July 2017 will “transform” .Net 4.6.x to 4.7 under the hood.
I don’t install any of these rollups. Instead I adopt the “Full” Group B approach by installing only the Security Only .Net Updates, the last of which was in May 2017. I am aware that there is a Security Only .Net Update released in September, but I have not installed it yet on my systems running Windows 7 and 8.1. I have .Net 4.6.2 installed on Windows 8.1.
Will installing only these Security Only Updates now and in the future still “convert” .Net 4.6.x into 4.7?
Hope for the best. Prepare for the worst.
-
“I don’t install any of these rollups. Instead I adopt the “Full” Group B approach by installing only the Security Only .Net Updates…”
I also employ the Group B approach. And though “rollup” is a dirty word for us, it has an entirely different meaning in .Net Framework, as explained here:
https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/
Security and Quality Rollup
The Security and Quality Rollup is recommended for consumer and developer machines. It includes both security and quality improvements and is cumulative, meaning that it contains all of the updates from previous rollups. This makes it easy to catch up if you have missed any of the previous updates. The Security and Quality Rollup update will be made available on Windows Update and Windows Update Catalog.Security Only Update
The Security Only Update is recommended for production machines. It contains only the security updates that are new for that month. This enables you to fine-tune the security updates that are applied. If you have installed the Security and Quality Rollup for the month, then you are up to date and do not need to install the Security Only Update. The Security Only Update will be made available on Windows Server Update Services and Microsoft Update Catalog.So although I wasn’t initially sure which mode of .Net Framework to install, I’ve been installing the cumulative ‘Security and Quality Rollup’ mode (I have both 3.5.1 and 4.6.1 on my system). So far, so good . . .
Now, as far as “transforming” .Net 4.6.x to 4.7 under the hood, I’ll also be interested in knowing the answer.
Win 7 SP1 Home Premium 64-bit; Office 2010; Group B (SaS); Former 'Tech Weenie'1 user thanked author for this post.
I have installed, same as others posting here, this month’s Windows 7 Security only and IE11 Cumulative updates, so far with nothing going amiss (that I have noticed). If something nasty turns up, I shall post a note describing the problem.
On the other hand, I am, for now, holding off on installing the MS Office patches in both my Windows PC and my Mac, as well as the .Net one in the former, until some time goes by, in case several users, somewhere online, e.g. in “Ask Woody”, start reporting, consistently, on some awful things that happened to them as a result of doing that.
Since I’ve never have used, nor I see any reason why I’ll ever use, Outlook, I am excluding that piece of MS Office from this comment.
P.S.: I am posting anonymously here because, once upon a time, I subscribed to “Woody”, and got instantly flooded with emails with postings that I can just as well read online by visiting this site, so I cancelled my subscription.
If there were a way to post here without that (to me) undesirable side effect, I’d love then to subscribe and post as a user (and be able, among other things, to “thank” others for postings that I see as particularly useful and informative.)
1 user thanked author for this post.
-
There is a difference between “Register” and “Subscribe.”
You can register – create an ID and password, receive a confirmation email, and you’re in.
If you “Subscribe” to a topic by clicking the link on the right side of the gray bar at the top of the topic, or checking the box ” Notify me of follow-up replies via email” at the bottom of a post/reply, you are requesting emails when people reply to the topic or post. So if you stay away from those two things, you should be fine as a registered member.
Patching early is always an option, but… Recommended process: Take a current system disk image first, to a secondary drive location. Patch. Test. If problems with patches, restore image, wait 3.5 more weeks. Else keep on running and wait for the fun to begin again the following month. Repeat.
Yep, that pretty much sums up my pre-patch procedure. Nearly a year ago, I learned to quickly perform an incremental backup of the Windows OS partitions on my computers before installing Windows Updates. Why? Because I have encountered a couple of them which either can not be uninstalled, or which do not properly uninstall — no matter what.
1 user thanked author for this post.
Hello to everyone,
Piriform’s Speccy utility does correctly show what versions of .Net are installed on your computer, including the latest installed service pack for the given installed .Net version.
Yes, .Net 4.6.2 and above does indeed remove the 260 character path limit under Windows 7, and this is indeed a nice feature to have on your Windows 7 computers. On the other hand and with only .Net 4.5.X installed, I have occasionally encountered issues with path limits which have more than 240 characters. Why is that? Because it depends on how long your computer name is, when syncing files across your local network.
Note that since .Net 4.6.2 and above must inherently have direct low level access to the NTFS on every hard drive within your computer via the Windows kernel, in order to implement the removal of the 260 character path limit, all versions of .Net higher than 4.5.X represent an obvious additional direct attack vector on your computer.
One has to ask, why did Microsoft decide to “fix” the 260 character path limit issue via .Net, instead of fixing Windows itself?
All .Net Framework versions above .Net 4.5.X also include baked in telemetry capabilities for installed programs which are written to explicitly gather such telemetry, and also may be required to be installed if you want to run programs which were designed to run under Win8 or Win10.
Rule 1: If a program, which you install on your Windows 7 computer, also installs a .Net version which is greater than .Net 4.5.X, then most likely the program author desires to gather telemetry regarding the use of said program, and more.
Rule 2: All versions of .Net above 4.5.X, for Windows 7 computers, include baked in telemetry capabilities.
Rule 3: If you want to uninstall, on your Windows 7 computer, versions of .Net which are greater than 4.5.X, then the uninstall utility will show you a list of what installed programs “could” potentially be affected, since there is a difference between “desired” and “required”.
Rule 4: If you uninstall .Net Framework versions on your Windows 7 computers which are greater than .Net version 4.5.X, and if you subsequently encounter an issue with an installed program which does not start correctly, then the installed program, upon startup, will show an error message which indicates that you must install a later version of .Net Framework.
The upshot is that .Net version 4.5.X is the last baseline requirement for programs which were designed to inherently run on Windows 7 computers, and I might add — without gathering any telemetry.
All versions of .Net above 4.5.X have baked in capabilities, should the program author with to use such capabilities, to gather telemetry with regards to their program, and more.
So, hopefully now you all will now see WHY the latest .Net updates specifically split out how the update is applied. Yes, this is related to CONSENT. The latest .Net updates, if only .Net 4.5.X and no higher is installed, will merely update .Net 4.5.X. The latest .Net updates, if .Net versions are installed which are greater than .Net 4.5.X, WILL upgrade the .Net 4.6.X branch to the latest .Net 4.7.X branch.
Oh, did you expect to get any sort of popup message about the revised .Net EULAs which could and should inform you about the gathering of telemetry? Uh, no, because you unknowingly CONSENTED to the .Net update when you ALLOWED Windows Update to download and install it. You can imagine how it would take YEARS for this to wrangle through the US court system — and Microsoft knows this. Microsoft has its legal bean counters, just like pharmaceutical companies.
Similar issues apply to the VisualC++ redistributables as well, but that would be an entirely separate topic. For example, the VisualC++ 2013 and above redistributables install telemetry. The VisualC++ 2015 also installs KB2999226 which is a known update that installs deep telemetry.
Microsoft = NSA
Many years ago, Microsoft jumped onto the bandwagon, in cahoots with the NSA, to gather all possible telemetry. It started with PRISM. The NSA wins since this is what the NSA wants. Microsoft perceives that it will also win since Microsoft had, and still has, the delusional idea of overthrowing Google’s reign of being the most powerful advertiser on the Internet. Ask yourself, has Microsoft ever published a “canary” on any of its web domains? Of course not. Windows 8 and Windows 10 are in fact based on Microsoft’s delusional idea that Microsoft could, years late, force their way into the mobile marketplace. It is what it is.
Do you ever check to see what goes out of your computer, and to what IP addresses? Most likely, you do not. Backdoors. IP connections which, under Windows and using various utilities, you might not know about. Yet your home router’s logs will show you what actually went out, and to where.
Best regards to all,
GoneToPlaid
-
-
-
KB2999226 had indeed insidiously snuck on to several of my computers. I guess I’ll have to check my entire list of telemetry/tracking updates once again to see if any others got by. – ryegrass.
I checked and KB2999226 was installed on my Win 7 x64 computer on 9/24/2016. So it’s been on my computer for over a year now. Should I uninstall it? And if so, will any issues/problems be created in the process?
-
Each system is different, but I uninstalled KB2999226 last night (along with Microsoft Visual C++ 2013 and Microsoft Visual C++ 2015) and have had no problems so far. Be sure and make a backup before proceeding, if for some reason things don’t go well.
1 user thanked author for this post.
-
Each system is different, but I uninstalled KB2999226 last night (along with Microsoft Visual C++ 2013 and Microsoft Visual C++ 2015) and have had no problems so far. Be sure and make a backup before proceeding, if for some reason things don’t go well. – ryegrass
I don’t have the comfort level to start uninstalling things indiscriminately without a better understanding of the benefits and risks. I did install and run TCPView – for some reason I had downloaded it years ago, but never installed it on this computer until now.
I see that a connection is established from Avast service which doesn’t surprise me. I also see that Dell’s Backup and Recovery Toaster has a connection established which does surprise me. But I don’t see any other surprises going on.
-
-
-
-
Hi everyone,
Note that you can not get rid of KB2999226 if you also have Office 365 installed. It also depends on how KB2999226 got installed in the first place — either via Windows Update or via Office 365.
I am knee deep in alligators at work. Thus I won’t be able to provide the full details until this weekend. For the time being, people should not uninstall KB2999226 since it could result, for virtually program which you launch and including Office 365, the following error message:
“The program can’t start because api-ms-win-crt-runtime-l1-1-0.dll is missing from your computer.”
Yet there is a way to rip KB299226 from monitoring every program which you run on your computer. I will post this weekend about how to deal with this nasty update.
-
Note that you can not get rid of KB2999226 if you also have Office 365 installed. It also depends on how KB2999226 got installed in the first place — either via Windows Update or via Office 365.
I am knee deep in alligators at work. Thus I won’t be able to provide the full details until this weekend. For the time being, people should not uninstall KB2999226 since it could result, for virtually program which you launch and including Office 365, the following error message:
“The program can’t start because api-ms-win-crt-runtime-l1-1-0.dll is missing from your computer.”
Yet there is a way to rip KB299226 from monitoring every program which you run on your computer. I will post this weekend about how to deal with this nasty update. – GoneToPlaid
I’m glad I wasn’t hasty about removing KB2999226. When I read your post, I remembered how KB2999226 got on my system – I installed it myself!
I remember now there was a time when that exact error message was being displayed by Paint.NET, and there was a post by Rick Brewster to install KB2999226 to fix the issue. The KB2999226 standalone installer is still sitting in my Downloads folder.
So I will be very interested in reading your instructions on how to stop the monitoring.
Thanks!
-
-
Adobe have issued another update for their Flash Player, version 27.0.0.170. As they have not yet released a changelog nor Security Bulletin, it is unclear whether this is a security update; however, since this follows so closely on the heel of 27.0.0.159, it is not unlikely.
For those who manually update it, here are the direct download links for the off-line (full) installers for version 27.0.0.170, as well as the Uninstaller, all “clean” — (right-click; select Save Link As):
NPAPI for Firefox, Safari, Opera: https://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player.exe | 19.8 MB
AX for Internet Explorer: https://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player_ax.exe | 19.3 MB
PPAPI for Opera and Chromium-based browsers: https://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player_ppapi.exe | 19.7 MB
Adobe Flash Player Uninstaller: http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe | 1.25 MB1 user thanked author for this post.
-
Adobe have released the Security Bulletin for their out-of-band patch for Flash Player (see post above):
APSB17-32 Security updates available for Adobe Flash Player – 10/16/2017
Vulnerability: Remote Code Execution
Severity: Critical
CVE Number: CVE-2017-11292
-
My Google Chrome says that it is up to date, and checking the Flash version shows it at 27.0.0.170. Autopilot update! 🙂
It’s at times like this that I am glad I do not have Flash installed in any other browsers…
Windows 10 Pro 22H2
-
-
Totally agree!!! I have banished web plugins or extensions for Flash (except for the Chrome browser), Java, Silverlight, Quicktime, etc.
Chrome is not my default browser, so I only use Chrome to open Flash based sites if absolutely necessary, and only if Chrome is up to date (with Flash).
HTML5 is the future, and if site admins are too lazy to update, then sorry… 🙁
Windows 10 Pro 22H2
-
-
-
Today Microsoft added issues to many Windows knowledge base articles. Here are some involving recent Windows updates:
https://support.microsoft.com/en-us/help/4041681/windows-7-update-kb4041681
https://support.microsoft.com/en-us/help/4041678/windows-7-update-kb4041678
https://support.microsoft.com/en-us/help/4041693/windows-81-update-kb4041693
https://support.microsoft.com/en-us/help/4041687/windows-81-update-kb4041687
https://support.microsoft.com/en-us/help/4042895
https://support.microsoft.com/en-us/help/4041689/windows-10-update-kb4041689
https://support.microsoft.com/en-us/help/4041691/windows-10-update-kb4041691
https://support.microsoft.com/en-us/help/4041676/windows-10-update-kb4041676
4 users thanked author for this post.
-
I have noticed that Java is a topic that confuses many casual users. Many think that just having the JRE installed leaves them open to security issues. But that issue is actually all about the browser plugin. There is no good reason to still be running the Java browser plugin in 2017. Oracle has deprecated that with Java JDK and JRE v9.
The plugin is what exposes you to exploits in the wild.
I use a couple of local applications that require Java (JRE) to be installed. That just enables the runtime that allows Java programs (that you trust) to execute on the local PC. It really has nothing specifically to do with the web. It would be recommended to run the latest patched JRE if you can. Browser plugins are another story entirely, and I got rid of mine a long time ago… So your best bet is to remove it from your browsers, if you still have it.
See this article: Oracle’s finally killing its terrible Java browser plugin
https://www.theverge.com/2016/1/28/10858250/oracle-java-plugin-deprecation-jdk-9
And this from Krebs: Good Riddance to Oracle’s Java Plugin
https://krebsonsecurity.com/2016/02/good-riddance-to-oracles-java-plugin/
Windows 10 Pro 22H2
-
-
I agree regarding Java updates, and even said so in my post.
That said, JRE is probably not normally an issue for the end user if you only run signed code from a trusted vendor. Such as with a commercial or enterprise application.
But running random stuff you downloaded from the web is always risky, Java or not.
Windows 10 Pro 22H2
-
-
-
It seems that a Microsoft patch for the WPA-2 WiFi KRACK vulnerability is buried in the October updates…
CVE-2017-13080 | Windows Wireless WPA Group Key Reinstallation Vulnerability
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080
Windows 10 Pro 22H2
Viewing 45 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
USB webcam / microphone missing after KB5050009 update
by 2 hours, 7 minutes ago
-
TeleMessage, a modified Signal clone used by US government has been hacked
by 3 hours, 24 minutes ago
-
The story of Windows Longhorn
by 3 hours, 53 minutes ago
-
Red x next to folder on OneDrive iPadOS
by 5 hours, 22 minutes ago
-
Are manuals extinct?
by 28 minutes ago
-
Canonical ditching Sudo for Rust Sudo -rs starting with Ubuntu
by 14 hours, 30 minutes ago
-
Network Issue
by 1 hour, 35 minutes ago
-
Fedora Linux is now an official WSL distro
by 1 day, 2 hours ago
-
May 2025 Office non-Security updates
by 1 day, 2 hours ago
-
Windows 10 filehistory including onedrive folder
by 1 day, 4 hours ago
-
pages print on restart (Win 11 23H2)
by 5 hours, 44 minutes ago
-
Windows 11 Insider Preview build 26200.5581 released to DEV
by 1 day, 7 hours ago
-
Windows 11 Insider Preview build 26120.3950 (24H2) released to BETA
by 1 day, 7 hours ago
-
Proton to drop prices after ruling against “Apple tax”
by 1 day, 14 hours ago
-
24H2 Installer – don’t see Option for non destructive install
by 6 hours, 49 minutes ago
-
Asking Again here (New User and Fast change only backups)
by 2 days, 1 hour ago
-
How much I spent on the Mac mini
by 1 day, 1 hour ago
-
How to get rid of Copilot in Microsoft 365
by 4 hours, 50 minutes ago
-
Spring cleanup — 2025
by 2 days, 7 hours ago
-
Setting up Windows 11
by 1 day, 2 hours ago
-
VLC Introduces Cutting-Edge AI Subtitling and Translation Capabilities
by 2 days, 3 hours ago
-
Powershell version?
by 2 days, 3 hours ago
-
SendTom Toys
by 14 hours, 51 minutes ago
-
Add shortcut to taskbar?
by 2 days, 7 hours ago
-
Sycophancy in GPT-4o: What happened
by 3 days ago
-
How can I install Skype on Windows 7?
by 2 days, 23 hours ago
-
Logitech MK850 Keyboard issues
by 2 days, 5 hours ago
-
We live in a simulation
by 3 days, 14 hours ago
-
Netplwiz not working
by 3 days, 1 hour ago
-
Windows 11 24H2 is broadly available
by 4 days, 2 hours ago
Remembering Woody
