How Microsoft copied malware techniques to make Get Windows 10 the world's PC pest

The Register ^ | Mar 17, 2016 | Andrew Orlowski

[dayglored]

Note: I've posted numerous threads on the "Get Windows 10" nagware situation, and almost passed this one up -- but it's far and away the best I've seen, most complete, and most likely to be accurate. So have at it... - dayglored

Subtitle: Here's how to nuke this persistent menace

Microsoft uses techniques similar to aggressive malware to promote its “Get Windows 10” offer.

As many readers have discovered, the persistent and constantly changing methods Microsoft uses to continually reintroduce its “Get Windows 10” tool, or GWX, onto computers means it’s extremely difficult to avoid.

Windows users who decline to use it find it is repeatedly reintroduced. The language of the counter-malware industry is more appropriate than the language of enterprise IT for GWX.

GWX subverts a channel intended for one purpose (security hotfixes) for another (advertising); it changes its “attack vectors”, it “conceals itself” kinda like a rootkit; it uses “polymorphic” techniques; and it consistently overrides users' actions and permissions.

Much of the attention in the tech press on combatting GWX has been has focused on eliminating the work of one patch, KB3035583, which constantly reappears on users' PCs, even after removal. However, an investigation shows that ‘583 is a symptom, rather than the cause, of recurring GWX infestations.

The ‘583 patch is most commonly reinstalled by another patch, KB2952664. Once ‘664 is on a system, '583 will be requested for download and installation. Getting rid of, and thereby controlling, '664 could be the key to controlling the sophisticated "Get Windows 10" nagware network.

[freds6girlies]

bookmark

[Southside_Chicago_Republican]

Bookmark

[Roccus]

Total computer illiterate here.

Windows 7.... I disabled auto updates 7/8/2013

153 important & 48 optional updates in que. Machine is normally on 24/7

Can MS still force the upgrade for 10 on me?

[MarkL]

Great advice. Except NOBODY buying a new notebook computer has any original install media or ISO.

The first thing anyone should do when they unbox their new conmputer (desktops don't come with install media either,) is to create their restore media. Every computer will allow you to make at least 2 copies (some will allow unlimited copies.)

You can also download recovery media from Microsoft:

Windows 7 Media (you will need to enter your product activation key to download it)

You can do a google search to get instructions on downloading the proper media for Windows 8, 8.1, and 10, depending on whether you've got retail or oem versions of Windows.

The downside of downloading recovery media directly from Microsoft is it will be up to you to get all of the drivers you need for your system. If you create the system's recovery media, you'll have all the drivers automagically installed, but you'll also get the standard bloatware manufactures tend to install on new systems.

Finally, if you don't know your activation key (and it's generally no longer on a sticker on the system,) there are a number of ways to get it, such as "Magic Jellybeans" and my personal favorite, because it gives all sorts of system information that can be very useful, "Belarc Adviser."

Mark

[Lera]

On Window 8 you won’t get nagged for the Window 10 update if you refuse the Windows 8.1 update.

[867V309]

Every computer will allow you to make at least 2 copies (some will allow unlimited copies.)

The last 2 notebooks I bought (HP XP, and Toshiba W8) allowed a single restore media copy, then the option was gone. If my copy was bad, tough luck. I've never had to use them, and have absolutely no faith that they would work.

I'm not saying it's impossible, but i don't know of anyone ever having gotten a useful OS replacement free from microcrap.

[Bob434]

[[Great advice. Except NOBODY buying a new notebook computer has any original install media or ISO. ]]

You can legally download the ISO right from MS- but you just won’t be able to activate it- you can still use it, but you won’t be able to personalize it (but there is a way aroudn that)

I’ve been running windows 10 in a virtual machien from the downloaded ISO for awhiel now- I don’t allow windows any access to itnernet- and personally just use windows for my windows specific programs like photoshop- I also dual boot with windows 10 and linux for when I want to use photoshop with full graphics capabilities (in a virtual machine you don’t get full graphics card power)

[Bob434]

not if you’ve not updfated your windows- but you shoudl update your windows because of security reasons, but you will have to either know how to get rid of the windows 10 nag screen, or use catnipman’s suggestion above for more automatic way of doing it-

[Wingy]

I must admit that I’m confused. I am writing this reply on a machine that is on Windows 7, and I’m happy with that situation. I have updates turned on to receive updates automatically. I have received an offer to upgrade to Windows 10 which I declined. I’ve never heard from them since. So, what confuses me is the number of stories of unwanted upgrades and how Microsoft is so rotten. Am I just lucky?

[Roccus]

That’s what I thought.

Thank you.

[dayglored]

> Am I just lucky?

I suppose so, although I would remain vigilant. One of my Win7 VMs has the GWX icon in the SysTray but only got one "reminder" -- however, it's getting a lot of other unwanted upgrades (ones I declined, but are being re-enabled each Patch Tuesday cycle).

I would opine, yes you've been lucky so far. Microsoft's procedures aren't foolproof. But remain alert.

[Excellence]

I actually found it easy to not be bothered by the “reminders,” and didn’t upgrade until my IT specialist ex-husband did. And then, last week, I bought a Surface 3! Where are these adverts supposed to show up, because I haven’t seen any.

[Faith65]

Thanks!

For later...

[Madame Dufarge]

pingy

[rockrr]

As a follow-on to dayglored’s excellent advice I would urge vigilance as well because it seems clear that 1.) Microsquash is determined and, 2.) they keep changing their strategy to entice/coerce/mandate migration to Win-10.

And as a last resort caution I would make certain that I have a good, complete data backup of anything I can’t afford to lose - because ya just never know...

[dljordan]

Good one.

[dljordan]

I used your tools on both my Win 7 PCs. Worked great.

[catnipman]

“I used your tools on both my Win 7 PCs. Worked great.”

thanks for the feedback. it’s quite helpful.

[Neidermeyer]

I’ve received OEM’s from HP in the last year for corporate laptops that were purchased used but still under the extended warranty .. the original purchaser (a hospital) replaced W7 with XP ... I have also downloaded good OS images from getintopc.com ... they’re a legal site ,, just images , no keys or crack tools.

[Neidermeyer]

“I used your tools on both my Win 7 PCs. Worked great.”
*************
Same here ,, only (tiny) glitch ... on the update remover I just hit enter at the “reboot now” prompt and the script assumed a “Y” when I wanted to wait and reboot later.. I saved the output file from the regedit showing the flag change for disallowing an upgrade in case they get nasty and make these updates “critical”.

This whole gameplaying really upsets me.. I don’t get paid to investigate every supposedly “good for me” update from MS ,, not like I used to with IBM’s patches and PTF’s to MVS , JES2 and VTAM ... damnit I’m in the “user” role here not the techie.. I just want Windows to work and leave me alone and that’s what updates are supposed to be doing for me. Now I have to be on guard against MS and investigate every update before I allow it... That’s time consuming and just wrong. I’ve run the pre-installation tool for W10 and my computer fails on video, if they sneak it onto mine at some later date I’m screwed.

Thanks again for the tool.