Windows KB2952664 and KB2976978 telemetry updates re-released (again)

Martin Brinkmann
Feb 10, 2017
Updated • Feb 10, 2017
Windows
|
39

Here we go again. Microsoft re-released the Windows 7 telemetry update KB2952664 and the Windows 8.1 telemetry update KB2976978 yesterday.

You can check out our October 2016 article on the last re-release of the updates.

Windows 7 and 8.1 users may still know these updates as they were the prerequisites for Microsoft's infamous Get Windows 10 (GWX) campaign that haunted users who did not want to upgrade to Windows 10 for almost a year.

The two updates have been released with the optional flag for now, which means that they won't be installed on most systems.

What is likely going to happen however is that Microsoft will promote the updates in the near future, maybe next Tuesday, to important. This would install the updates automatically on systems that use the default configuration for Windows Update. The company has done so in the past for those updates, and it seems likely that it will do so again this time.

Windows 7 and 8.1 administrators who have hidden the updates will notice that they reappeared in Windows Updates because of the re-release.

KB2952664 and KB2976978 telemetry updates

The hidden flag for updates on Windows Update that administrators can set is only valid for a particular revision of an update. When Microsoft releases a new update revision, it becomes available again.

If it was blocked by hiding it in Windows Update, it needs to be blocked again each time Microsoft re-releases the update.

To hide a Windows update, right-click on it in the Windows Update window, and select "hide update" from the context menu. Unless it is re-released, it won't show up anymore on the machine and won't be installed either.

Both "compatibility updates for keeping Windows up-to-date" are offered through Windows Update and Microsoft Update Catalog.

The update description is identical for KB2952664 and KB2976978:

This update performs diagnostics on the Windows systems that participate in the Windows Customer Experience Improvement Program. The diagnostics evaluate the compatibility status of the Windows ecosystem, and help Microsoft to ensure application and device compatibility for all updates to Windows. There is no GWX or upgrade functionality contained in this update.

According to the description, the update performs diagnostics on machines that participate in the Windows Customer Experience Improvement Program. The program has been part of Windows since Vista, and is designed to collect information on hardware, software and services.

As I mentioned back in October 2016 already when I described how to leave the Windows Customer Experience Improvement program, Microsoft does not reveal the actual data that the program collects.

You could say that these updates are not that bad then if you do not participate in the Windows Customer Experience Improvement Program.

Woody Leonhard demonstrated that the last revision of the updates did trigger new scans regardless of the membership status of the Customer Experience Improvement program. While it has not been tested yet with the new version, it seems likely that Microsoft has not changed that.

We don't know an awful lot about what KB2952664 and KB2976978 actually do. They do seem to trigger a new Windows task called DoScheduledTelemetryRun, but it is unclear what is being collected, and whether something else is changed on the system during installation of the updates.

Tip: You can use the Windows Task Schedule, PowerShell, or Nirsoft's Task Scheduler View to manage tasks on all recent versions of the Windows operating system.

Now You: Did you hide these updates in the past on your machines?

Summary
Windows KB2952664 and KB2976978 telemetry updates re-released (again)
Article Name
Windows KB2952664 and KB2976978 telemetry updates re-released (again)
Description
Here we go again. Microsoft re-released the Windows 7 telemetry update KB2952664 and the Windows 8.1 telemetry update KB2976978 yesterday.
Author
Publisher
Ghacks Technology News
Logo
Advertisement

Tutorials & Tips


Previous Post: «
Next Post: «

Comments

  1. Arno said on April 6, 2017 at 10:17 pm
    Reply

    KB2976978 ended up somehow being installed on my 8.1 pc last month, even though I carefully checked in order to avoid that. It took some effort to get it removed, for it reinstalled itself each time after removing it the simple/usual way. Finally I was able to remove it, via
    the command line (as administrator). Luckily, … so I thought to be freed of it.
    The computer hadn’t been used since then, now to my horror discovered that although KB 2976978 is listed under (recently) hidden updates, it ALSO listed again under installed updates. It reinstalled itself – I think secretly – again and to my knowledge without a new update download and install, (with the same installation date as before) however this time it’s so far been really impossible to remove. Tryint to remove it via the command line generates a popup message stating that the update is essential for the computer to work, therefore it can’t be uninstalled!

    If anybody knows the solution how to get rid of it, (other then getting another OS right away)..please let me know.

  2. Arno said on April 6, 2017 at 10:08 pm
    Reply

    KB2976978 ended up somehow being installed on my 8.1 pc last month, even though I carefully checked the updates in order to avoid that.
    (As it was installed, I really started doubting myself, did I overlook it. Still think I didn’t.)

    It took some effort to get it removed, for it reinstalled itself each time after removing it the simple/usual way. Finally I was able to remove it, via
    the command line (as administrator). Luckily, … so I thought to be freed of it.
    The computer hadn’t been used since then, now to my horror discovered that although KB 2976978 is listed under (recently) hidden updates AS WELL AS under installed updates. It reinstalled itself – to my knowledge secretly, without a new update download and install – again, (with the same installation date as before) however this time it’s so far been really impossible to remove. It generates a Windows popup message stating that the update is essential for the computer to work, therefore it can’t be uninstalled! (this so called “optional” thing..)

    This feels like having a virus/malware on your computer.

    If anybody experienced the same and knows the solution how to get rid of it, (other then getting another OS right away)..please let me know.

    PS: Also noticed several other “optional”, (but not unwanted) updates can now no longer be uninstalled, from the installed updates list.

  3. jj said on March 15, 2017 at 9:15 am
    Reply

    One can see in the Event Panel what kind of events the MS telemetry generates. Mine generates test scenarios and runs GWX –specifying that it is not to run in the tray. I am not enrolled in the Windows Customer Experience Improvement Program (I confirmed this through the Control Panel–nonetheless I see CEIP user logins in my Event Panel). I have hidden telemetry updates but I must have missed one somewhere.

    MS also found a third party driver I must have needed and replaced a (computer manufacturer, not MS) semi-essential software that seemed to be giving me trouble, so this may not be all bad.

    Still, MS is running tests for Win10 on my PC I think I deserve some compensation other than “upgrading” to an OS that I think is not designed for my needs.

  4. Anonymous said on March 8, 2017 at 5:53 pm
    Reply

    After hiding it every time in the past, KB2952664 made its “magical” reappearence today

  5. BaliRob said on February 18, 2017 at 5:01 pm
    Reply

    Windows Update W8.1 KB 297 6978

    Has anybody reported their pc’s failing to get onto the Internet if they, in fact, had accepted
    the update please?

    Unfortunately for me, I downloaded the free Macrium Reflect the same day as MS sent the
    W.8 update to me. RESULT – I was unable to get onto the Internet no matter what provider
    I used here in Indonesia – I should add that the majority of us here use dial-up modems.

    The only way I could get back to normal was by setting a Restore Point to the time just before
    both Update and Macrium had been downloaded. Wonderful !

    I emailed Macrium that I suspected their software had a ‘rogue’ file (just as MalwareBytes had
    with their latest offering driving hundreds of thousands to despair preventing them using the
    Internet also ((just like me who purchased the offer)) and they rejected it being possible outright.

    SO that only leaves the Win Update – because it for sure was ONE of them.

  6. iKnow said on February 18, 2017 at 11:27 am
    Reply

    This company can go **** itself. My next OS will be Linux. In the meantime, an unpatched, out-of-the-box Win7 with SP1 and Update Rollup 2 will have to do, not my problem if this Company wants to become obsolete.

  7. Chris said on February 16, 2017 at 7:49 am
    Reply

    With behavior like this by Microsoft, it becomes less and less likely that my next operating system will be a Microsoft OS.

  8. Tom said on February 12, 2017 at 5:55 pm
    Reply

    same here, i stopped updating a while ago, stuff this. took AGES to install a hand full of updates.
    also more than once windows patches broke my system, more or less.

  9. Rob said on February 11, 2017 at 12:33 pm
    Reply

    Regarding the update KB2976978, I have just checked my windows update,
    under optional updates I did find it, I right clicked on it and chose to hide the
    update, at other times this did work, not this time, the window closed and the
    UAC opens and asks if I want it to make changes to my computer, I click on NO,
    the UAC closed, the update is still in my optional updates, I cannot hide it.
    I have tried this several times with the same outcome, looks like it will need
    to stay where it is. I am running windows 8.1

  10. sirpaul2 said on February 11, 2017 at 4:08 am
    Reply

    Thanks for the info, Martin. Re-hidden.

  11. Henk van Setten said on February 10, 2017 at 4:36 pm
    Reply

    Thanks for the warning, Martin. My Windows 8.1 did indeed show KB2976978 under Optional Updates once again, and once again I had to “hide” it to remove it from the list. No doubt it will return at some later point in time.

    Maybe virus scanners such as Malwarebytes should finally take the natural step to include Microsoft’s pestering snooping efforts in their malware block lists.

  12. LD said on February 10, 2017 at 4:34 pm
    Reply

    We do not know what the revisions are in each release. They have been updated something in the range of 11 times. CEIP either collects and sends info or not. We do not know if MS respects the user’s settings. We do not know if the registry settings are respected either. Trust was eroded some time ago.

    Other telemetry tracking tasks include the identifier, ‘diagnostics’ in some form or another. Diagnostics has always been defined as ‘concerned with the diagnosis of illness or problems’ or something not working as it should. If data that is collected is not being used to find a remedy to restore function or operation, then it is being collected under false pretenses.

    I believe there is PII collected and stored by Microsoft. I have no proof, but all you have to do is look at the MS Account, Bing, Cortana, Edge and Outlook – it is more than obvious that they have access to PII. I also believe that they produce reports for their business partners and clients that use PII, but I do not know if these reports are sold to them or are free (they probably pay for certain services and they get these reports as part of that service, therefore the lawyers can argue that they are free and not sold). Because of this I hide KB2652664. I also do not install W7 rollups. I install security only patches on W7.

  13. kevin said on February 10, 2017 at 4:29 pm
    Reply

    The joke’s on Microsoft. After waiting for hours while “checking for updates”, I gave up on ever getting updates for Windows 7 again. So, they can publish these patches all they like.

    1. Anonymous said on February 12, 2017 at 5:55 pm
      Reply

      same here, i stopped updating a while ago, stuff this. took AGES to install a hand full of updates.
      also more than once windows patches broke my system, more or less

    2. Anonymous said on February 12, 2017 at 12:57 am
      Reply

      Just an FYI for you or others having the “checking for updates takes hours” problem with Windows 7. Try manually installing KB3138612 (make sure to get the right version for your system, x86 or x64) then recheck for updates. It seems to fix the issue for many people.

      http://www.microsoft.com/en-us/download/details.aspx?id=51208

      Some people might also need KB3145739 also if the above doesn’t work.

  14. tank said on February 10, 2017 at 2:43 pm
    Reply

    How to force uninstall of update KB2976978 from win8.1 ?

    NOT working:
    start /w wusa.exe /uninstall /kb:2976978 /quiet /norestart

    1. Yuliya said on February 10, 2017 at 4:31 pm
      Reply

      On 7 to check if they’re installed:
      get-hotfix -id KB***,KB###

      To uninstall:
      wusa /uninstall /kb:***

      I assume it must be the same on 8.1. These commands have to be run through PowerShell with administrator priviledges.

      In your case, it would be:
      wusa /uninstall /kb:2976978

  15. Yuliya said on February 10, 2017 at 2:03 pm
    Reply

    KB2952664 KB3021917 KB3068708 KB3080149 KB3184143 KB971033
    Are all the updates that need to be hidden on 7. Well, unless M$ crafted more, this was the list of nasty updates that they were still sending to 7 as of September 2016, right before they switched to the cumulative model. I haven’t updated my system since then.
    __________________

    I’m posting this from the https ghacks, the http (non secure) one loads a blank page..

  16. Straspey said on February 10, 2017 at 1:45 pm
    Reply

    As soon as I saw the headline for this article I ran a manual scan to check for updates. Sure enough, the scan returned the notice that I had KB2952664 available as an optional update for my Windows 7 system.

    I hid it – again – and cannot even remember how many times I’d already hidden that very same update during the MSFT “Free Giveaway” period for Windows 10.

    Thanks to Martin for the heads up.

  17. Dave said on February 10, 2017 at 1:22 pm
    Reply

    Does WSUS Offline Updater have a mode to blacklist telemetry stuff? It’s getting to be too hard to keep up with everything that’s going on. We need a full guide, Martin.

    1. Mikhoul said on February 10, 2017 at 7:58 pm
      Reply

      UPDATE Dave !

      Here’s a Small Tutorial I’ve done to learn how to exclude updates with “WSUS Offline Updater”

      https://justpaste.it/WSUS_OfflineExcludeUpdates

      Enjoy ! :)

      1. Dave said on February 11, 2017 at 11:04 am
        Reply

        Thanks Mikhoul

    2. Mikhoul said on February 10, 2017 at 6:38 pm
      Reply

      Yes Dave you can do it and it’s not really hard, follow those instruction at the top of the file: https://svn.wsusoffline.net/svn/wsusoffline/tags/wsusoffline6.6/doc/faq-enu.txt

      Once it will be done WSUS Offline will never download them again even if they are “re-released. :)

    3. Ann said on February 10, 2017 at 5:28 pm
      Reply

      in offline wsus you can choose to get the rollup version or the separate kb updates.
      and you can blacklist certain updates.
      But I’ve only seen the text and did not yet tried it.

  18. Anonymous said on February 10, 2017 at 12:26 pm
    Reply

    We talked about this last time
    I still don’t know if Martin knows what the ‘Windows Customer Experience Improvement Program’ is

    1. Gary D said on February 10, 2017 at 2:22 pm
      Reply

      @ Anonymous

      IMO he knows a lot more about it than someone who is “Anonymous”.

      Explain your comment and be less of a Troll. Anyone with brains and basic PC knowledge disables Win CEIP.

      Unless, of course, you are off your Troll(e)y.

      1. Corky said on February 10, 2017 at 5:03 pm
        Reply

        @Anonymous, CEIP is only disabled by default in a managed environment.

      2. Anonymous said on February 10, 2017 at 4:22 pm
        Reply

        “Win CEIP.” is disabled by default, no need brain or basic PC knowledge.

    2. Martin Brinkmann said on February 10, 2017 at 12:30 pm
      Reply

      What makes you say that?

      1. Corky said on February 11, 2017 at 9:58 am
        Reply

        @Anonymous, that’s because your using it a managed environment, i.e that computer is either joined to a domain and has a group policy applied to it or someone has set a local policy to disable CEIP.

        Martin published an article back in October explaining how to Turn off the Windows Customer Experience Improvement program.
        https://www.ghacks.net/2016/10/26/turn-off-the-windows-customer-experience-program/
        Judging by your screen shot that’s what someone has done.

      2. Anonymous said on February 11, 2017 at 8:54 am
        Reply

        https://www.ghacks.net/2016/10/05/microsoft-resurrects-telemetry-updates-kb2952664-kb2976978/#comment-3994665

        Information regarding if the update has enabled it has, to my knowledge, not been reported on

  19. Sander said on February 10, 2017 at 11:59 am
    Reply

    Martin, please correct your typo. It’s 2952664 instead of 2652664.

    1. Martin Brinkmann said on February 10, 2017 at 12:07 pm
      Reply

      Thanks, corrected. Sorry if it caused confusion

  20. Tom Hawack said on February 10, 2017 at 11:11 am
    Reply

    Did I hide KB2652664 in the past? I certainly have, at the time the best of WinUpdates wasn’t yet bundled in a mandatory way with the worst. KB2652664 has that fragrance of Monday morning garbage, a smell you don’t forget especially when the garbage is refilled with the same trash over and over again.

    No WinUpdates, and none of its trash. Microsoft is hopeless. Fortunately some of us have understood it, already.

    1. Tom Hawack said on February 10, 2017 at 12:20 pm
      Reply

      I had of course KB2952664 in mind and not the pasted 2652664. It’s the “2664” which was stuck in a neuron, perhaps because of a “1664” beer. Memory takes advantages of all our affinities!

      Thanks to Sander for mentioning the typo.

  21. wybo said on February 10, 2017 at 9:56 am
    Reply

    I certainly hid them in the past and I did it again, together with Intel and NVIDIA driver updates.

  22. Gary D said on February 10, 2017 at 9:42 am
    Reply

    Martin, will these updates be part of a roll up KB or stand alone ?

    FYI, I don’t allow auto updating and I do hide KBs such as 2952664 / 2976978.

    1. Martin Brinkmann said on February 10, 2017 at 12:09 pm
      Reply

      Gary, we don’t know that yet unfortunately.

      1. Gary D said on February 10, 2017 at 2:18 pm
        Reply

        OK thanks

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.