Reports of Surface Pro swamping \Temp folder with bogus .evtx files

I don’t have many details at this point, but the most succinct description I can find is on the StackExchange forum, from Sam Axe:

Every few seconds a new .evtx file and a new .txt file appear in c:\windows\temp. Each .evtx file has nearly identical content (except for timestamps), ditto the .txt files.
The .evtx files are roughly 7 MB large and contain almost 3600 events each. As you can imagine, this is filling up the HDD rather quickly. We deleted ~30 GB worth of these files earlier today.

He’s had some luck with this solution:

We were able to resolve this by removing the “Surface” app via powershell:

Get-AppxPackage *surface* | Remove-AppxPackage

Completely removing the “Surface” app and rebooting appears to have solved the issue.

In the same thread, Camile reports that it doesn’t work all the time:

I’ve fixed 2 of these issues today by updating the windows to the latest 1903 build. The removal of the App worked on 1 but didn’t work for the other so just updated both.

The twist: It looks like this problem occurs sporadically on several different kinds of Surface devices and may (or may not) be triggered by a specific Windows update.

Anybody else hitting the problem? Does the Remove-AppxPackage solution work?

Peering into the Windows tea leaves

WOODY’S WINDOWS WATCH

By Woody Leonhard

You can expect some significant changes — existential changes — to Windows in the very near future.

Based on some official announcements and more than a few highly reliable leaks, it looks like Windows is in for a very bumpy ride.

Read the full story in AskWoody Plus Newsletter 16.40.0 (2019-11-04).

More on restoring drivers from local backups

LANGALIST

By Fred Langa

Windows offers an add-driver command, but it doesn’t do what you might think!

Plus: Tracking down the scattered locations and various methods for obtaining official Windows 7, 8.1, and 10 installation files. Also, are there issues with whole-disk encryption?

Read the full story in AskWoody Plus Newsletter 16.40.0 (2019-11-04).

Take charge of Windows 10 and Office 365 updating

WINDOWS PATCHING

By Susan Bradley

Recently, I started the process of migrating Windows Server 2008 R2 and Server 2012 R2 to Server 2019.

Unfortunately, Server 2019 (and 2016) has a problem in common with Windows 10 — limited user/administrator control over when and how the OSes get patched.

Read the full story in AskWoody Plus Newsletter 16.40.0 (2019-11-04).

Freeware Spotlight — Best diagnostic tools

BEST UTILITIES

By Deanna McElveen

After 20 years of troubleshooting and repairing computers, Randy and I have seen many fine and free diagnostics tools come and go.

And while we use many utilities for our work, we rely on a core set almost every day.

Read the full story in AskWoody Plus Newsletter 16.40.0 (2019-11-04).

BlueKeep now being used in attacks – but the sky isn’t falling

Remember BlueKeep – the “wormable” monster infection that was supposed to take over the Windows world?

Two months ago, I warned that there was a working exploit making the rounds.

We finally saw a slightly modified version of that Metasploit exploit used in a for-real infection. Except it isn’t nearly as scary as originally projected, doesn’t operate as a worm, and isn’t exactly taking the world by storm.

Kevin Beaumont found evidence of the infection in some honeypots he set up – but had stopped monitoring.

https://twitter.com/GossiTheDog/status/1190654984553205761

As expected, folks who have either disabled RDP or blocked port 3389 are fine. Still…

Word to the wise: If you haven’t updated your Win7 or Server 2008/Server 2008R2 machine since May, you better get on the stick.

See, there’s a reason why you have to update sooner or later.

Full details from Catalin Cimpanu at ZDNet. Thx GoneToPlaid (who just had a Tesla mode named after him).

UPDATE:

https://twitter.com/GossiTheDog/status/1191148135344693248

New Chredge logo

When Microsoft finally releases the new Chromium-based version of Edge, this will likely be the logo.

Sonic the Chredge Hog?

Thx Paul Thurrott.

MS-DEFCON 4: It’s time to get patched

The moment you’ve all been waiting for…

It looks like the October Windows patches are ready for prime time. The usual caveats — and there are many — apply. We also have special warnings for people running Win10 1903 with certain RealTek LAN adapters, and for folks who need to run older VisualBasic programs on 32-bit version 1903.

There’s no rush this month, by the way. Nothing in the patches screams for installation. But in the normal course of events you want to get patched. We’ve entered the normal course of events.

Full step-by-step updating details for everybody, from Win7 to Win10 1903, are in Computerworld Woody on Windows.

How to keep Win10 version 1909 from installing

The rules have changed. Keeping 1909 off your machine until you’re ready to install it is much easier than blocking upgrades in previous versions of Win10. Still, there are nuances.

Computerworld Woody on Windows.

An honest VPN commercial – from somebody who actually knows what he’s talking about

Tom Scott knows whereof he speaks – and he speaks the truth, as best I know it.

Thx Catalin Cimpanu

Win7 share declining slowly, Edge still in the doldrums

According to NetMarketShare, Win10 share usage is up from 52% in September to 54% in October. Win7 share went from 29% to 27%.

Statcounter says that Chrome went from 62 to almost 63% usage share, while Edge went from 3.1 to 3.0%.

All numbers subject to the usual disclaimers – based on flawed sampling, it ain’t gospel, more like reading tea leaves, and all that really matters is long-term trends.

Have an iPhone 5, iPhone 4s, or Older iPad Model? Time to Update It

From Nathan Parker:

We have been discussing on the AskWoody Lounge that owners of the iPhone 5, iPhone 4s, or
some older iPad models need to update to iOS 10.3.4 (iPhone 5 and fourth generation cellular
iPad) or iOS 9.3.6 (iPhone 4s or a handful of older cellular iPads). Apple provides more info
here.

For those who do not update their devices before November 3, there will be issues with GPS
on these models. This issue does not affect iPod touch or any iPad models that have Wi-Fi only.
It also doesn’t affect iOS devices newer than those listed in the support article.

If the update to iPhone 5 is not completed by November 3, 2019, customers will be required
to back up and restore using a Mac or PC in order to update because over-the-air software
updates and iCloud Backup will not work.

So for those with these devices, it’s time to ensure they’re up-to-date.

Apple has also recently launched a series of updates for devices this week, including macOS
Catalina 10.15.1 and iOS 13.2. We’re tracking the latest updates on the AKB, and let us know
anytime with your Apple questions!