Windows KB2952664 and KB2976978 telemetry updates re-released (again)
Here we go again. Microsoft re-released the Windows 7 telemetry update KB2952664 and the Windows 8.1 telemetry update KB2976978 yesterday.
You can check out our October 2016 article on the last re-release of the updates.
Windows 7 and 8.1 users may still know these updates as they were the prerequisites for Microsoft's infamous Get Windows 10 (GWX) campaign that haunted users who did not want to upgrade to Windows 10 for almost a year.
The two updates have been released with the optional flag for now, which means that they won't be installed on most systems.
What is likely going to happen however is that Microsoft will promote the updates in the near future, maybe next Tuesday, to important. This would install the updates automatically on systems that use the default configuration for Windows Update. The company has done so in the past for those updates, and it seems likely that it will do so again this time.
Windows 7 and 8.1 administrators who have hidden the updates will notice that they reappeared in Windows Updates because of the re-release.
KB2952664 and KB2976978 telemetry updates
The hidden flag for updates on Windows Update that administrators can set is only valid for a particular revision of an update. When Microsoft releases a new update revision, it becomes available again.
If it was blocked by hiding it in Windows Update, it needs to be blocked again each time Microsoft re-releases the update.
To hide a Windows update, right-click on it in the Windows Update window, and select "hide update" from the context menu. Unless it is re-released, it won't show up anymore on the machine and won't be installed either.
Both "compatibility updates for keeping Windows up-to-date" are offered through Windows Update and Microsoft Update Catalog.
The update description is identical for KB2952664 and KB2976978:
This update performs diagnostics on the Windows systems that participate in the Windows Customer Experience Improvement Program. The diagnostics evaluate the compatibility status of the Windows ecosystem, and help Microsoft to ensure application and device compatibility for all updates to Windows. There is no GWX or upgrade functionality contained in this update.
According to the description, the update performs diagnostics on machines that participate in the Windows Customer Experience Improvement Program. The program has been part of Windows since Vista, and is designed to collect information on hardware, software and services.
As I mentioned back in October 2016 already when I described how to leave the Windows Customer Experience Improvement program, Microsoft does not reveal the actual data that the program collects.
You could say that these updates are not that bad then if you do not participate in the Windows Customer Experience Improvement Program.
Woody Leonhard demonstrated that the last revision of the updates did trigger new scans regardless of the membership status of the Customer Experience Improvement program. While it has not been tested yet with the new version, it seems likely that Microsoft has not changed that.
We don't know an awful lot about what KB2952664 and KB2976978 actually do. They do seem to trigger a new Windows task called DoScheduledTelemetryRun, but it is unclear what is being collected, and whether something else is changed on the system during installation of the updates.
Tip: You can use the Windows Task Schedule, PowerShell, or Nirsoft's Task Scheduler View to manage tasks on all recent versions of the Windows operating system.
Now You: Did you hide these updates in the past on your machines?
KB2976978 ended up somehow being installed on my 8.1 pc last month, even though I carefully checked in order to avoid that. It took some effort to get it removed, for it reinstalled itself each time after removing it the simple/usual way. Finally I was able to remove it, via
the command line (as administrator). Luckily, … so I thought to be freed of it.
The computer hadn’t been used since then, now to my horror discovered that although KB 2976978 is listed under (recently) hidden updates, it ALSO listed again under installed updates. It reinstalled itself – I think secretly – again and to my knowledge without a new update download and install, (with the same installation date as before) however this time it’s so far been really impossible to remove. Tryint to remove it via the command line generates a popup message stating that the update is essential for the computer to work, therefore it can’t be uninstalled!
If anybody knows the solution how to get rid of it, (other then getting another OS right away)..please let me know.
KB2976978 ended up somehow being installed on my 8.1 pc last month, even though I carefully checked the updates in order to avoid that.
(As it was installed, I really started doubting myself, did I overlook it. Still think I didn’t.)
It took some effort to get it removed, for it reinstalled itself each time after removing it the simple/usual way. Finally I was able to remove it, via
the command line (as administrator). Luckily, … so I thought to be freed of it.
The computer hadn’t been used since then, now to my horror discovered that although KB 2976978 is listed under (recently) hidden updates AS WELL AS under installed updates. It reinstalled itself – to my knowledge secretly, without a new update download and install – again, (with the same installation date as before) however this time it’s so far been really impossible to remove. It generates a Windows popup message stating that the update is essential for the computer to work, therefore it can’t be uninstalled! (this so called “optional” thing..)
This feels like having a virus/malware on your computer.
If anybody experienced the same and knows the solution how to get rid of it, (other then getting another OS right away)..please let me know.
PS: Also noticed several other “optional”, (but not unwanted) updates can now no longer be uninstalled, from the installed updates list.
One can see in the Event Panel what kind of events the MS telemetry generates. Mine generates test scenarios and runs GWX –specifying that it is not to run in the tray. I am not enrolled in the Windows Customer Experience Improvement Program (I confirmed this through the Control Panel–nonetheless I see CEIP user logins in my Event Panel). I have hidden telemetry updates but I must have missed one somewhere.
MS also found a third party driver I must have needed and replaced a (computer manufacturer, not MS) semi-essential software that seemed to be giving me trouble, so this may not be all bad.
Still, MS is running tests for Win10 on my PC I think I deserve some compensation other than “upgrading” to an OS that I think is not designed for my needs.
After hiding it every time in the past, KB2952664 made its “magical” reappearence today
Windows Update W8.1 KB 297 6978
Has anybody reported their pc’s failing to get onto the Internet if they, in fact, had accepted
the update please?
Unfortunately for me, I downloaded the free Macrium Reflect the same day as MS sent the
W.8 update to me. RESULT – I was unable to get onto the Internet no matter what provider
I used here in Indonesia – I should add that the majority of us here use dial-up modems.
The only way I could get back to normal was by setting a Restore Point to the time just before
both Update and Macrium had been downloaded. Wonderful !
I emailed Macrium that I suspected their software had a ‘rogue’ file (just as MalwareBytes had
with their latest offering driving hundreds of thousands to despair preventing them using the
Internet also ((just like me who purchased the offer)) and they rejected it being possible outright.
SO that only leaves the Win Update – because it for sure was ONE of them.
This company can go **** itself. My next OS will be Linux. In the meantime, an unpatched, out-of-the-box Win7 with SP1 and Update Rollup 2 will have to do, not my problem if this Company wants to become obsolete.
With behavior like this by Microsoft, it becomes less and less likely that my next operating system will be a Microsoft OS.
same here, i stopped updating a while ago, stuff this. took AGES to install a hand full of updates.
also more than once windows patches broke my system, more or less.
Regarding the update KB2976978, I have just checked my windows update,
under optional updates I did find it, I right clicked on it and chose to hide the
update, at other times this did work, not this time, the window closed and the
UAC opens and asks if I want it to make changes to my computer, I click on NO,
the UAC closed, the update is still in my optional updates, I cannot hide it.
I have tried this several times with the same outcome, looks like it will need
to stay where it is. I am running windows 8.1
Thanks for the info, Martin. Re-hidden.
Thanks for the warning, Martin. My Windows 8.1 did indeed show KB2976978 under Optional Updates once again, and once again I had to “hide” it to remove it from the list. No doubt it will return at some later point in time.
Maybe virus scanners such as Malwarebytes should finally take the natural step to include Microsoft’s pestering snooping efforts in their malware block lists.
We do not know what the revisions are in each release. They have been updated something in the range of 11 times. CEIP either collects and sends info or not. We do not know if MS respects the user’s settings. We do not know if the registry settings are respected either. Trust was eroded some time ago.
Other telemetry tracking tasks include the identifier, ‘diagnostics’ in some form or another. Diagnostics has always been defined as ‘concerned with the diagnosis of illness or problems’ or something not working as it should. If data that is collected is not being used to find a remedy to restore function or operation, then it is being collected under false pretenses.
I believe there is PII collected and stored by Microsoft. I have no proof, but all you have to do is look at the MS Account, Bing, Cortana, Edge and Outlook – it is more than obvious that they have access to PII. I also believe that they produce reports for their business partners and clients that use PII, but I do not know if these reports are sold to them or are free (they probably pay for certain services and they get these reports as part of that service, therefore the lawyers can argue that they are free and not sold). Because of this I hide KB2652664. I also do not install W7 rollups. I install security only patches on W7.
The joke’s on Microsoft. After waiting for hours while “checking for updates”, I gave up on ever getting updates for Windows 7 again. So, they can publish these patches all they like.
same here, i stopped updating a while ago, stuff this. took AGES to install a hand full of updates.
also more than once windows patches broke my system, more or less
Just an FYI for you or others having the “checking for updates takes hours” problem with Windows 7. Try manually installing KB3138612 (make sure to get the right version for your system, x86 or x64) then recheck for updates. It seems to fix the issue for many people.
http://www.microsoft.com/en-us/download/details.aspx?id=51208
Some people might also need KB3145739 also if the above doesn’t work.
How to force uninstall of update KB2976978 from win8.1 ?
NOT working:
start /w wusa.exe /uninstall /kb:2976978 /quiet /norestart
On 7 to check if they’re installed:
get-hotfix -id KB***,KB###
To uninstall:
wusa /uninstall /kb:***
I assume it must be the same on 8.1. These commands have to be run through PowerShell with administrator priviledges.
In your case, it would be:
wusa /uninstall /kb:2976978
KB2952664 KB3021917 KB3068708 KB3080149 KB3184143 KB971033
Are all the updates that need to be hidden on 7. Well, unless M$ crafted more, this was the list of nasty updates that they were still sending to 7 as of September 2016, right before they switched to the cumulative model. I haven’t updated my system since then.
__________________
I’m posting this from the https ghacks, the http (non secure) one loads a blank page..
As soon as I saw the headline for this article I ran a manual scan to check for updates. Sure enough, the scan returned the notice that I had KB2952664 available as an optional update for my Windows 7 system.
I hid it – again – and cannot even remember how many times I’d already hidden that very same update during the MSFT “Free Giveaway” period for Windows 10.
Thanks to Martin for the heads up.
Does WSUS Offline Updater have a mode to blacklist telemetry stuff? It’s getting to be too hard to keep up with everything that’s going on. We need a full guide, Martin.
UPDATE Dave !
Here’s a Small Tutorial I’ve done to learn how to exclude updates with “WSUS Offline Updater”
https://justpaste.it/WSUS_OfflineExcludeUpdates
Enjoy ! :)
Thanks Mikhoul
Yes Dave you can do it and it’s not really hard, follow those instruction at the top of the file: https://svn.wsusoffline.net/svn/wsusoffline/tags/wsusoffline6.6/doc/faq-enu.txt
Once it will be done WSUS Offline will never download them again even if they are “re-released. :)
in offline wsus you can choose to get the rollup version or the separate kb updates.
and you can blacklist certain updates.
But I’ve only seen the text and did not yet tried it.
We talked about this last time
I still don’t know if Martin knows what the ‘Windows Customer Experience Improvement Program’ is
@ Anonymous
IMO he knows a lot more about it than someone who is “Anonymous”.
Explain your comment and be less of a Troll. Anyone with brains and basic PC knowledge disables Win CEIP.
Unless, of course, you are off your Troll(e)y.
@Anonymous, CEIP is only disabled by default in a managed environment.
“Win CEIP.” is disabled by default, no need brain or basic PC knowledge.
What makes you say that?
@Anonymous, that’s because your using it a managed environment, i.e that computer is either joined to a domain and has a group policy applied to it or someone has set a local policy to disable CEIP.
Martin published an article back in October explaining how to Turn off the Windows Customer Experience Improvement program.
https://www.ghacks.net/2016/10/26/turn-off-the-windows-customer-experience-program/
Judging by your screen shot that’s what someone has done.
https://www.ghacks.net/2016/10/05/microsoft-resurrects-telemetry-updates-kb2952664-kb2976978/#comment-3994665
Information regarding if the update has enabled it has, to my knowledge, not been reported on
Martin, please correct your typo. It’s 2952664 instead of 2652664.
Thanks, corrected. Sorry if it caused confusion
Did I hide KB2652664 in the past? I certainly have, at the time the best of WinUpdates wasn’t yet bundled in a mandatory way with the worst. KB2652664 has that fragrance of Monday morning garbage, a smell you don’t forget especially when the garbage is refilled with the same trash over and over again.
No WinUpdates, and none of its trash. Microsoft is hopeless. Fortunately some of us have understood it, already.
I had of course KB2952664 in mind and not the pasted 2652664. It’s the “2664” which was stuck in a neuron, perhaps because of a “1664” beer. Memory takes advantages of all our affinities!
Thanks to Sander for mentioning the typo.
I certainly hid them in the past and I did it again, together with Intel and NVIDIA driver updates.
Martin, will these updates be part of a roll up KB or stand alone ?
FYI, I don’t allow auto updating and I do hide KBs such as 2952664 / 2976978.
Gary, we don’t know that yet unfortunately.
OK thanks