Widespread reports of freezing with this month’s Win7 Monthly Rollup, KB 4493472

Topic

New Reply

Spiecworks has a nearly-feature-length litany of problems with KB 4493472. I’ll have more later this morning in Computerworld. DON’T UPDATE Windows 7.
[See the full post at: Widespread reports of freezing with this month’s Win7 Monthly Rollup, KB 4493472]

11 users thanked author for this post.

Chessie, Elly, Propje, PhotM, abbodi86, CADesertRat, Mr. Natural, fk5353, fernlady, GreatAndPowerfulTech, Myst

Reply | Quote

Replies

Seems to only affect those that have Sophos antivirus installed.

1 user thanked author for this post.

rontpxz81

Reply | Quote

That’s what I’ve seen – but I’m always skeptical, when we get an overnight flare-up like this, that there may be more problems with other software that just hasn’t reached the necessary decibel level.

3 users thanked author for this post.

Chessie, PhotM, Myst

Reply | Quote

Reports of Avast Cloud Care customers seeing the same behavior.

https://kb.support.business.avast.com/GetPublicArticle?title=Windows-machines-running-Avast-for-Business-and-Cloud-Care-Freezing-on-Start-up

 

2 users thanked author for this post.

Chessie, woody

Reply | Quote

No problems on my SBS 2011 or web server; both 2008 r2 based and not using sophos.

Reply | Quote

8.1 user here. I did install the latest update. I haven’t had any issues, but I don’t use Sophos, so that might be why.

Reply | Quote

No problem on my Win 7 64bit machine.

Reply | Quote

Can confirm.

Windows 7 64bit with Sophos. Installed updated on three machines and all three had this issue.

Reply | Quote

W7 – 64 & W7 – 32 Starter. Both OK. Norton Security.

1 user thanked author for this post.

Myst

Reply | Quote

Made my weekly Acronis disk image and then updated my Win 7 system w/ KB4493472 yesterday. No problems so far. I do not use Sophos a/v. Do use Avast and Malwarebytes real time.

Reply | Quote

you might want to read this comment about Avast here:

https://community.spiceworks.com/topic/2203711-update-kb4493472-issues?page=2
https://community.spiceworks.com/topic/2203711-update-kb4493472-issues?page=3

2 users thanked author for this post.

Propje, woody

Reply | Quote

Thanks, fortunately I don’t have either Avast Cloudfare or Avast Business installed, so it should not be a problem.

Reply | Quote

It’s clearly Sophos fault

1 user thanked author for this post.

woody

Reply | Quote

How so?

Reply | Quote

Nevermind, i was just defending Microsoft 😀

anyway, all this month Win 7/8.1 updates had been revised (no change to binaries)
https://www.catalog.update.microsoft.com/Search.aspx?q=2019+for+x64

they probably staggered them

1 user thanked author for this post.

Myst

Reply | Quote

The office is mostly Win7, with a few Win8 and Win10 computers. All are Group A. No issues since all run Panda AV.

Reply | Quote

I installed the Windows 7 update on my laptop (I’m the canary in the coal mine) and I have not had any issues, although I don’t use Sophos Antivirus.  You can bet I won’t be letting this update out the WSUS chute or applying to my servers until there’s an acknowledgement from Microsoft though.

Thanks Woody for the heads up on these things.  I wonder how many hours you’ve saved people?

2 users thanked author for this post.

Chessie, MrToad28

Reply | Quote

There are reports of freezing in the latest Win 10 1809 update too:

Comp Cmndo (tenforums)

Pete81 (tenforums)

1 user thanked author for this post.

woody

Reply | Quote

We have been affected by this today on dozens of computers. In our experience so far it is not necessary to disable Sophos. The quickest way we have found is to:

1. Boot into safe mode

2. Check System Restore to see if there is a suitable restore point from before the system update.

a. If there is a suitable restore point, run system restore.

b. If there is not a suitable restore point, uninstall the update

3. Boot into normal mode.

3 users thanked author for this post.

MrToad28, woody, 616c

Reply | Quote

Two of our desktop techs at two different sites reported the same shortcut.  No need to disable AV and deal with the tamper protection.

Boot to safe mode. Restore to a point before updates.

–or–

Boot to safe mode. Un-install offending KBs.

If you have Sophos Safeguard FDE, the tamper protection will protect Endpoint/AV from being altered. If you don’t need to mess with it…makes the procedure easier.

Reply | Quote

I am group B and do not do the large bundled updates.

I installed 4493448, Security only and 4493435 IE 11 Cum. Security update on a 32 and 64 bit Win 7 Home Premium system with no issues on either.

Got coffee?

Reply | Quote

anonymous wrote:

We have been affected by this today on dozens of computers. In our experience so far it is not necessary to disable Sophos. The quickest way we have found is to: 1. Boot into safe mode 2. Check System Restore to see if there is a suitable restore point from before the system update. a. If there is a suitable restore point, run system restore. b. If there is not a suitable restore point, uninstall the update 3. Boot into normal mode.

Uninstalling the update in Safe Mode just might be the solution for those affected by this issue.

Reply | Quote

Heads up for anyone experiencing this issue: You can uninstall the patch using ‘wusa’ from safe mode.

wusa /uninstall /kb:4493472

5 users thanked author for this post.

MrToad28, GoneToPlaid, 616c, woody

Reply | Quote

DEFINITELY having serious issues with 7 and this patch, pro and ultimate.

Our server auto-updated and got stuck at ‘configuring updates’ on the reboot at 48%

No sophos-anything.  No idea what’s causing the issue as of now, no time to deal with it.

Safemode-uninstall the patch is the only way to get back in for me.

I should have done it since January’s clusterf—  Windows updates -> MANUAL ONLY.

MS is continually effing this up, and now they want to charge me $100 for it next year?

For the record none of our W10 machines had any problem except one, which stalled out on the patch install after reboot… then a hard reboot allowed it to finish and it’s ok now, with patch still installed.

Not happy!  I’m getting yelled at by the boss for something that should be mindless-ez.

2 users thanked author for this post.

phaolo, woody

Reply | Quote

Hello,

Win7 64-bit Pro without Sophos. Had issues since the update, which took way too much time to install/configure. Since then, Windows was taking forever to load, freezing on desktop ~3-4 minutes before unlocking and performing all attempted actions during the freeze at once.

Uninstalled kb4493472. Everything back to normal.

2 users thanked author for this post.

Chessie, phaolo

Reply | Quote

What Anti-virus are you using? There are a lot of reports of trouble with Sophos and some with Avast for Business/Cloud.

1 user thanked author for this post.

woody

Reply | Quote

What Anti-virus are you using? There are a lot of reports of trouble with Sophos and some with Avast for Business/Cloud.

I’m using Avira free antivirus.

 

Reply | Quote

As of yesterday (Sat, Apr 13th) MS still had Avira and Sophos AVs blocked. We have not heard either have issued an update to fix the issue with kb4493472. Check back here for more news as it unfolds.

Reply | Quote

Hi folks,

They messed it up again! Alle test machines (six W7/64 and W7/32) experience veeeeeeery long booting and some freeze after a couple of minutes. Removed KB4493472 which took two automatic reboots and also very long and the systems are working fine again. No Sophos her but Avira.

No problems on the test machines running Windows 10 1809 though.

Do not install KB4493472, just take the Office and Adobe updates aso.

Regards,

Joe_Gerhard

 

3 users thanked author for this post.

belangerya, phaolo, woody

Reply | Quote

Thanks for all the info on this.

It’s unbelievable that updates aren’t properly tested. It’s as if Microsoft are keen to demonstrate how better off Windows 7 users will be when these monthly shenanigans come to an end next January!

1 user thanked author for this post.

Cybertooth

Reply | Quote

I just helped a user on one of our unmanaged Win7 notebooks, 500 km away. We use Sophos as well. System got stuck after reboot, switched computer off with force, next normal reboot had the same effect again. After another forced reboot and going into safe mode, computer automatically reverted the update and user was able to work again. Thanks Microsoft…

Reply | Quote

Microsoft has temporarily blocked devices from receiving this update if the Sophos Endpoint is installed until a solution is available.

Both KB4493446 and KB4493472 have the above “known issue”. Also, they automatically got unapproved in WSUS overnight. :‑)

1 user thanked author for this post.

woody

Reply | Quote

Same here: Win 7 Pro 64 bit with neither Sophos or Avast, but Avira Free Antivir. Machine freezes for up to 50 sec, then starts running smoothly again. Next stop: Debian, surely not Win 10 …

Reply | Quote

This happened to all of our Dell PCs with Windows 7 and Sophos installed (approx 50 machines). Having fun these days 🙂 At least, this error speeded up our migration to Win10 🙂

Solution is to uninstall update in Safe Mode.

For few users who restarted PC during process is solution to boot to safe mod (if possible) and disable Sophos/Avast/… servicies and go on unsecured, then uninstall updates. If not possible, you can also boot to CMD and disable all antivirus servicies, for example:

sc config “swi_update” start= disabled
sc config “swi_service” start= disabled

I have 9 sophos servicies, then you can boot your PC normally and do whatever you want – restore, uninstall, …

Edit to remove HTML. Please use the “Text” tab in the entry box when you copy/paste.

1 user thanked author for this post.

woody

Reply | Quote

Running Sophos on Win 7 x64 – had same ‘black screen of death’ on reboot. Able to boot into safe mode and use System Restore to roll back the 2019-04 Security Monthly Quality Rollup (KB 4493472)

Reply | Quote

Hm. Did KB4493472 and KB4493446 get rereleased already or what’s this I’m seeing, it being new again today?

Sheesh, now I’ll have to track down which boxes got the original variant…

Oh well. Now it at least has a “known issue” entry for Sophos. Nothing for the other.

Reply | Quote

I’m not seeing any re-release on the Update Catalog.

I assume you’re looking at WSUS?

See https://www.askwoody.com/forums/topic/widespread-reports-of-freezing-with-this-months-win7-monthly-rollup-kb-4493472/#post-350829, supra.

Reply | Quote

Martin Brinkmann has an excellent update on the current state of affairs. Six KBs have been singled out:

• KB4493448 Security-only update for Windows 7 SP1 and Windows Server 2008 R2 SP1
• KB4493472 Monthly rollup update for Windows 7 SP1 and Windows Server 2008 R2 SP1
• KB4493467 Security-only update for Windows 8.1 and Windows Server 2012 R2
• KB4493446 Monthly rollup update for Windows 8.1 and Windows Server 2012 R2
• KB4493450 Security-only update for Windows Server 2012
• KB4493451 Monthly rollup update for Windows Server 2012

and the problem is with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC); and with Avast for Business and Avast Cloud Care. Microsoft is now officially blocking installation on machines with the Sophos products.

The thread at Spiceworks now has active participation from both Sophos and Avast. Haven’t seen them around these parts yet.

Pardon me for repeating an oft-repeated phrase, but I just have to wonder out loud who tests these things….

2 users thanked author for this post.

Cybertooth, MrToad28

Reply | Quote

I also saw a complaint about Avira having the same problems.

1 user thanked author for this post.

woody

Reply | Quote

Looks like Avira have updated their Internet Security and Free AV programs to 15.0.45.1126 today. No mention of a changelog on Avira site that I can find (at time of post)
https://answers.avira.com/en/question/changelog-16826
Last Version 15.0.44

official mirror at Majorgeeks for Free version:
https://www.majorgeeks.com/files/details/avira_free_antivirus.html

and Premium:
https://www.majorgeeks.com/files/details/avira_antivir_premium.html

If debian is good enough for NASA...

2 users thanked author for this post.

SueW, woody

Reply | Quote

Any details?

Reply | Quote

Only one that pertains to patches on W10: #350931

If debian is good enough for NASA...

Reply | Quote

https://www.askwoody.com/forums/topic/widespread-reports-of-freezing-with-this-months-win7-monthly-rollup-kb-4493472/#post-350795

🙂

They are still in WU, just won’t get auto-offered for affected machines

1 user thanked author for this post.

woody

Reply | Quote

I recently replaced the HDD with an SSD, reinstalled Windows 7 Pro from scratch. The system was brought up to date with regard to updates  as at March 26th. I have not installed KB 4493472 and my laptop does not run Sophos Anti-Virus, and yet it freezes quite often. Is any other previous patch known to cause such freezes?

 

Reply | Quote

I haven’t seen any reports.

This is a very specific error – systems won’t boot after installing the patch.

Freezes such as the one you describe are more common with hardware problems.

Reply | Quote

I just updated one of my Win8.1 VMs Group A running TrendMicro with no problems so far.

Reply | Quote

Same here. All windows 7 pro machines frozen post a reboot. Uninstalling the monthly quality roll up patch fixed it. I am just looking if we can have a powershell script to uninstall all those patches

Reply | Quote

Any word about AVG Free causing problems or is it to early to tell?

Windows 11 Pro
Version 23H2
OS build 22631.4890

Reply | Quote

No report on AVG here – so far

1 user thanked author for this post.

fernlady

Reply | Quote

I am running AVG on W8.1 x64 system and the April Quality Update was pulled today. I do not know if AVG is the reason the update is no longer offered.

1 user thanked author for this post.

fernlady

Reply | Quote

Hey can we get BETTER HEADLINES for posts ? that mention the connection with Sophos ?

I just approved updates yesterday to a test group and was about to panic, thinking I needed to back the updates out before a reboot happened then discovered that is only affects those with Sophos installed (which we do not use).

Reply | Quote

Well, it’s not just Sophos. Avast, Avira and maybe AVG are also involved.
Hope you had none of those either.
Waiting for a while to patch has its advantages, thus the DEFCON System supported at AskWoody.

1 user thanked author for this post.

woody

Reply | Quote

I have not yet installed the January / February / March security updates (Group B). All my systems running Windows 7 and 8.1 are on December 2018 level, and judging from the issues with April’s updates (even though I don’t run Sophos or other antivirus software so it is probable I won’t be affected) I will continue to hold on December 2018 level.

There is no urgency to patch so far as far as I can see. I will continue to monitor the situation month by month, and will continue to delay patching until I am satisfied with the bugs situation. Meanwhile I can continue working on my computers without worrying about the possible problems caused by the 2019 patches.

On the other hand, did Microsoft test their patches with third party antivirus products at all? Because if they did then shipping software and patches should not have such problems at all.

Hope for the best. Prepare for the worst.

Reply | Quote

Does Microsoft test anything except by “Likes” in the Insider Hub?
[ /sarcasm ]

2 users thanked author for this post.

seamonkey420, Cybertooth

Reply | Quote

Same here,

half of the company could’t work the whole morning after Windows Update. All Win 7 PCs with Sophos Endpoint Security crashed after the reboot…

 

1 user thanked author for this post.

woody

Reply | Quote

StavRoss wrote:

I recently replaced the HDD with an SSD, reinstalled Windows 7 Pro from scratch. The system was brought up to date with regard to updates as at March 26th. I have not installed KB 4493472 and my laptop does not run Sophos Anti-Virus, and yet it freezes quite often. Is any other previous patch known to cause such freezes?

Windows 7 may freeze if the SSD uses the JMicron JMF602 controller. Only solution is to use a different SSD.

2 users thanked author for this post.

jburk07, woody

Reply | Quote

Has anyone tried this update on a Windows 7 system runing Malwarebytes Premium or Cybereason RansomFree?

Reply | Quote

Looks very suspicious that almost only Windows 7 and 8.1 are failing, seeing that Microsoft put a bug on purpose on Windows 10 against anti-cheat software. I can expect more dirty tricks like that.

Reply | Quote

To anonymous, #351024: I patched four Windows 7 computers on Wednesday all running malwarebytes premium. I do the security only and not the “big bundle”. No freezing nor slowing to a crawl noticed on any of the computers with 4493448 and 4493435 installed.

Got coffee?

Reply | Quote

Updated two XPs, Win 7 starter, Win 8.1,  Win 10 1703, 1803, 1809.   No problems on any of them.  All run the Microsoft antivirus product.   The Win 10s are in VMs.

Reply | Quote

Running windows 7 with Sophos (standalone) here.  I installed KB4493472 from windows update yesterday lunchtime and all seemed well, no freezing etc.  To be on the safe side I uninstalled it from windows update today and it just did it without going in to safe mode 🙂

I restored from yesterdays disk image and checked WU again and it was not offered, just the Office security patches.

Reply | Quote

@ PKCano

PKCano wrote:

I just updated one of my Win8.1 VMs Group A running TrendMicro with no problems so far.

*Technically*, I thought *Group A* did the monthly roll ups, but waited until the Defcon was at 3 or better–if you are referring to installing this month’s roll up (April)–wouldn’t you be more in *Group Canon Fodder*?! (grin)

Reply | Quote

It’s a VM test machine, Group A designating the type of patching.

I have VMs testing many versions of Winndows XP, 7, 8,1, v1803, v1809, an Insider Preview Fast Ring.

Group A is not DEFCON is not Group A is not DEFCON. Group A may follow the DEFCON System but it is not the DEFCON System. And test machines do not necessarily follow the DEFCON System but may follow Group A patching..

Reply | Quote

Whether you volunteered or not to help MS test their updates, all of us are still testing their updates. Non-volunteers are just not sending them feedback! ;-D

I’m group B. I manually installed KB4493435 and KB4493448 as per Ask Woody’s “Ongoing list of Group B monthly updates for Win7 and 8.1 – Topic 2000003” on a Lenovo H405 desktop computer running Windows 7 Ultimate (an x64-bit AMD microprocessor machine). When my machine did not restart properly, I turned off all power to everything at the power strip for a few minutes (to think about it). After restoring power, my machine booted fine. When Windows updating seemed to be stalled, I pressed the Enter key a few times (slowly) until my machine responded and completed the update (100%). Instead of going to the Press Ctrl-Alt-Delete to Logon screen, Windows update did another restart, and then completed the install quickly (in a few seconds, enough to determine that it had already finished the time before).

About 10 minutes after logging on after doing updates, I always do another restart, because Norton Security Suite does not always restart the first time. Because of this, I keep my NIC (Ethernet to Cable-MoDem connection) turned off at all times. I only turn it on when I want to go online to the Internet/W.W.W.; and I turn it off immediately thereafter.

Now, after all that and since, my machine is booting up much more rapidly than it used too (about 1/10th the time). So, I have no complaints with the two security updates I installed.

Reply | Quote

Server 2012R2 DC with Symantec Endpoint Protection comes up to login screen but after entering password and hitting enter or clicking the arrow on the password field, nothing happens.  Stuck on the login screen.  Removed KB4493446 and KB4493450 and so far no luck.

1 user thanked author for this post.

woody

Reply | Quote

By “no luck” I assume you mean that removing the patches didn’t fix the problem.

?

Reply | Quote

I use SEP, guess I’m waiting until May.  The last thing I need is 64 servers all down at the same time.

Reply | Quote

For me and those organisations with Server 2008 SP2 NOT R2 there has been different set of problems with this update on 64bit edition it was not possible to boot in normal mode, nor in safe mode had to use startup recovery WinPE environment and eventually fall back to system restore to restore back to before the April monthly rollup was installed.
On another machine using 32bit edition of same it boots up ok but has developed new undesirable explorer.exe behavior in that when trying to rename, copy into or delete files out of any protected location that requires UAC elevation to proceed the UAC prompts all occour but the actual operation is never attempted i.e. if renaming a registered file extension there is no warning changeing the file type may make the file no longer work or whatever words it would normally use suggesting the abort happens before the changes are even attempted. The action can be completed from an administrator command window but that is hardly convenient. But at least it is not a major show stopper that has been experienced by those with 64bit issues of windows and certain add on anti-malware products.

1 user thanked author for this post.

woody

Reply | Quote

It isn’t clear from your post…. are you having problems with the Monthly Rollup, KB4493471, or with the Monthly Rollup Preview, KB 4493460?

If you uninstall the update, does the problem persist?

Are you running any antivirus product?

Are you having the File Manager problem with both 32-bit and 64-bit?

Thanks.

Reply | Quote

The problem was with the rollup KB4493471 as offered from the security guidance website portal and yes I was able to uninstall the rollup and default explorer.exe behavior returned.

The 64bit build took out a 64bit machine that would not complete boot up in safe mode, last known good config option and had to use startup recovery to force a system restore to previous state but 32bit build booted ok but had the explorer.exe anomaly of not actioning file operations in protected folders even with rights elevation. Uninstalling said rollup restored normalcy. There is more to this rollups problems than just a conflict with certain 3rd party anti-malware. The 64bit machine is running avast free I think and the 32bit is not using any 3rd party anti-virus just windows defender and old spybot search and destroy to protect from unsolicited auto runs… technically they are desktop windows machines but the same codebase as Server 2008 SP2 (Don’t tell Microsoft 😉

 

1 user thanked author for this post.

woody

Reply | Quote

See my main blog post.

(I’m sure the folks at Microsoft will see it. Let’s see if they have any questions.)

Reply | Quote

I wonder if anonymous poster of April 26 and 28 was using VMware? There was a post at MSFN by a Windows 6.0 user who traced post-update problems to VMware services.

Reply | Quote