Removal of GWX not complete on fourth Win 7 Pro 64-bit PC - why?

[glnz]

To experts here - and I'm a nerd not a geek so be gentle - I have the following possible issue when I try to AVOID the automatic upgrade from Win 7 to Win 10, and I wonder if you can help.  Also, I wonder whether rn10950's removal tool you all discuss at

http://www.msfn.org/board/topic/173961-windows-10-gwx-update-removal-tool-for-windows-7-and-windows-81/
will fix this issue:

 

The facts:  On three Win 7 SP1 64-bit machines, the Win 10 upgrade icon was NOT showing in the tray.  I then uninstalled KB3035583, and that caused all the various files and folders with "GWX" to disappear after maybe 15 minutes. Also, a refresh of Windows Update did NOT re-download KB3035583, and so there was no need (or easy way) to hide it. So, on those three machines, it looks like I am successful in preventing the future upgrade.  Good.

HOWEVER, on a fourth Win 7 SP1 64-bit machine, the Win 10 upgrade icon was there in the tray. So I first opened its window, went to the hamburger index and found the link to UNreserve the future upgrade. It confirmed it was now UNreserved. I then uninstalled KB3035583. This time, a refresh of Windows Update showed that KB3035583 would be re-downloaded, so I hid it. HOWEVER, the numerous folders and files with GWX are still there. Also, there are a few registry entries with GWX in them. These GWX items are not disappearing as they did on the first three machines.

What's the diff? Also, is the fourth machine still going to upgrade in some stealthy manner?

 

Should I run rn10950's removal tool on the fourth machine, and are there any risks?

Thanks.

Edited July 5, 2015 by glnz

[glnz]

Wow - no thoughts from anyone?

[JorgeA]

It's been a slow posting week on MSFN. People must be on vacation.

 

Give it a few more days and we'll see what happens. Maybe somebody qualified to comment on the technical aspects of the issue (for sure not me )  will pick this up.

 

--JorgeA

 

[NoelC]

I can't answer because in all cases I thwarted it before it got in.  I had to do it several times, as Microsoft has made it show up in the list AGAIN, after hiding it.

 

-Noel

[techsup1983]

Hi, I came across this issue. If I hid the update and ran sysprep  after the machine was deployed the update would unhide itself and would need to be re-hidden.

I did a bit of research and testing and found that I could install the update and set a registry key to prevent the update from showing in the notification area.

The below fix survives a sysprep and no users see the icon.

 

If you just want to disable the GWX (Get Windows X) app, and keep the update installed, use the Registry Editor (Regedit) to create the following registry key and value. Or, copy and paste the following code into a text file with .reg extension, and then execute it.

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Gwx]
"DisableGwx"=dword:00000001

https://www.basic.co.uk/news.nsf/items/get-rid-of-windows-10-update.htm

 

I've tested this on Windows 7 Professional and so far it's worked great.

[NoelC]

So you would invite the hardened criminal into your house and ask him to only sit in the living room and not get up? 

 

Seems wrong somehow. 

 

-Noel

[glnz]

Thanks, guys, but can we get back to my Q - first post above?

[dencorso]

With all due respect, and meaning absolutely no offense, the reason you've got no answer is that your questions are unanswerable.

Some time ago I posted elsewhere the following definition for such questions:

 

Among those questions that never get answered, some are:

1) Truly unanswerable questions (= those that have no answer),

and

2) Still unanswered answerable questions (= those that have an answer, but no one knows it yet).

Sometimes it's really difficult to decide which of the above types some given unanswerable question belongs to.

Fortunately, in your case, most, if not all, your questions are answerable.

So:

Acquire full, byte-by-byte, known-good, backups of the current state of the machines in question.

Then experiment in order to answer the yet unanswered questions you posed.

The only answer I can provide without knowing minute details of the case is the following:

Provided you do create full, byte-by-byte, known-good, backups of the current state of the machines in question, there's no risk at all, because anything you do can be undone by re-deploying the backup.

That said, let me try to be more specific:

What's the diff?

I have no idea. But surely there must be some.

Also, is the fourth machine still going to upgrade in some stealthy manner?

I think not. But nobody can say for sure. Better remove the leftovers.

Should I run rn10950's removal tool on the fourth machine?

I think so.

and are there any risks?

Provided you do create full, byte-by-byte, known-good, backups of the current state of the machines in question, there's no risk at all, because anything you do can be undone by re-deploying the backup.

---- Questions you did not pose, but I will ---

Q: What about the three other machines?

A: Hiding or not KB3035583, we've seen it being re-offered... so keep eyes wide open.

Q: What if I just go ahead with no backup, and just hope for the best?

A: Then there may be risk, but, anyway, you're fully aware you could have avoided all risk by backing up, and chose not to.

[NoelC]

A: Hiding or not KB3035583, we've seen it being re-offered... so keep eyes wide open.

 

I've seen that I think 3 times now on one system.

 

Some other info:

 

Thread on prevention: 

http://www.msfn.org/board/topic/173752-how-to-avoid-being-upgraded-to-win-10-against-your-will/

 

Another's attempt at automating the malware GWX removal:

http://www.msfn.org/board/topic/173961-windows-10-gwx-update-removal-tool-for-windows-7-and-windows-81/

 

-Noel