Secret Windows Update Process?

[Noel]

In the past day I've observed my Windows 7, 8.1, and 10 systems all doing something uncommon:

My firewall blocked all these systems from communicating with ctldl.windowsupdate.com. Specifically, it's Explorer.exe doing the trying. Normally I do not see these different systems all do something similar like this at nearly the same time, and Explorer.exe only VERY rarely communicates online. Curious, eh?

I have everything set as manual as possible on all three of these systems. Beyond the WU settings, I have various pro-privacy registry tweaks, the Windows Update service disabled, and of course the firewall in place to block comms that are not explicitly allowed (and without reconfiguration, which I do when requesting updates, Windows Updates are not allowed).

Explorer itself is not normally in the habit of communicating online much at all, which makes these observations stand out.

These are excerpted from my DNS server logs, coincident in time with the windowsupdate.com checks. The other DNS resolutions for the Windows 7, 8.1, and 10 systems around the same times as the ctldl.windowsupdate.com checks are listed in respective order.

DualServer20160419.log:[19-Apr-16 17:55:59] Client 192.168.2.44, crl.microsoft.com A resolved Locally to 23.14.84.171
DualServer20160419.log:[19-Apr-16 17:55:59] Client 192.168.2.44, ctldl.windowsupdate.com A resolved Locally to 96.16.98.112

DualServer20160419.log:[19-Apr-16 23:41:06] Client 192.168.2.32, crl.usertrust.com A resolved from Forwarding Server as 178.255.83.2
DualServer20160419.log:[19-Apr-16 23:41:07] Client 192.168.2.32, ctldl.windowsupdate.com A resolved Locally to 96.16.98.112

DualServer20160420.log:[20-Apr-16 08:31:49] Client 192.168.2.26, ctldl.windowsupdate.com A resolved Locally to 96.16.98.112
DualServer20160420.log:[20-Apr-16 08:31:49] Client 192.168.2.26, ocsp.startssl.com A resolved Locally to 23.14.84.171
DualServer20160420.log:[20-Apr-16 08:31:49] Client 192.168.2.26, www.classicshell.net A resolved from Forwarding Server as 184.168.173.1

I don't think this is triggered by Classic Shell itself, which does do occasional auto-update checks.  It's installed on all my systems, but since only one of the them actually checked classicshell.net it may just be a coincidence because those were times the systems were logged-in. 

But the unexplained part of the coincidence is that both Classic Shell and whatever else wants to talk to ctldl.windowsupdate.com at the same logon, after going more than a month without trying to communicate with anyone.  There's nothing special about April 19/20 as far as I can see, EXCEPT if Microsoft built some kind of secret check into Windows to happen around this time.

I am imagining some kind of internal update process that's occasionally kicked off inside Explorer. I'm also asking on the Classic Shell forum about this.

Any thoughts?

-Noel

[Bayer A.User]

If i had to guess, I would say that Wuwebv.dll was looking
for a web control update. As i recall this involves the windowsupdate.microsoft.com website.

[Locutus deBorg]

//crl.*

has to do with "Certificate Revocation Lists"

something running or being snooped by exploder.exe is making it have a fit and requesting access to current CRL

were you by chance running a program installation or navigating a directory that contains .exe or .msi installer files ?

[Noel]

Yes, the crl (and ocsp, et. al.) servers are associated with certificate management and security (and thus comms are allowed through the firewall), but that may have been coincidence, since all three systems didn't access the same security servers.

But Gaurav over on the Classic Shell forum nailed it:  ctldl.windowsupdate.com is contacted as part of normal security update checks:  technet.microsoft.com/en-us/library/dn265983.aspx

The scary thing is that I must have figured this out before, as I have already a rule defined that allows these comms, but somehow I didn't make a note of having done so.

Was it because of something specific I was doing? I don't think so...  I don't know exactly what I was doing on each system, but on at least one of the systems I wasn't actively working at the time.

Wuwebv.dll eh? I have each system store a list of loaded modules every night (via TaskList /M /FO:CSV /NH), and Wuwebv.dll doesn't show up. Could it have been loaded then unloaded? I suppose.

At least my query on the Classic Shell forum turned up the way to disable Classic Shell auto checks for updates, which I had missed doing on my Win 8.1 and 10 systems before (but again, scary, because apparently I *had* done it on my Win 7 system).  My mind isn't what it used to be.

Per Ivo Beltchev:

"You can disable the Classic Shell checks from the 'Classic Shell Update' tool. Uncheck 'Automatically check for new versions'."

-Noel

[Deleted]

"There's nothing special about April 19/20 as far as I can see"

Both marijuana smokers and non-smokers recognize April 20 or 4/20 as a national holiday for cannabis culture
time.com/4292844/420-april-20-marijuana-pot-holiday-history/

[Noel]

So you're saying the programmers at Microsoft are pot heads?

I would have figured them for Acid users myself.

-Noel

[Deleted]

Like the Energizer bunny, it just keeps on, keeping on.
www.winbeta.org/news/interrupt-twitch-broadcast-bring-windows-10

[Techie007]

    Last night, my Windows 14342 downloaded something via Windows Update, but I had no clue what it was.  I first noticed it when suddenly my Internet became unusably slow.  After taking a quick look at my router's status page, I realized that my desktop PC was taking all the bandwidth.  A quick check revealed Windows Update (via svchost.exe) with several dozen connections open downloading something.  But when I went to Settings, there were no updates being downloaded, found, or installed.  This download continued for 5 minutes.  Looking at my update history today, the only thing listed is this build, installed on May 11.


    However, looking in my Software Distribution (Windows Update download) folder reveals that four items were indeed downloaded this morning between 1:07 and 1:10 AM:




    But each of those folders is empty!  So I can't tell what was downloaded quite yet.  So I took a look at ReportingEvents.log, and the truth was revealed:




    Yes!  So it was updating the Get Office, Groove Music, Mail and Calendar, and OneNote apps.  Given that I haven't gotten around to uninstalling them on this build, I guess that's OK.  But why is Windows Update being so secretive?  AND, why is Windows Update splitting its downloads up into so many slices?  If it had done single-slice downloads like everyone else, I wouldn't have even noticed that my PC was downloading something, because the Internet bandwidth would have been shared fairly on my network instead of stealing all the bandwidth for itself.

[Bayer A.User]

Strict outbound Firewall rules is the only way to make 10 trustworthy.
Otherwise, i would never turn my back on it.
We pay the I$P bill every month, not MSFT.

[Noel]

May 14, 2016 10:02:56 GMT -6 Techie007 said:

    it was updating the Get Office, Groove Music, Mail and Calendar, and OneNote apps. 

Good sleuthing, Techie007.

My thoughts mirror Bayer's...

Microsoft really doesn't give a damn that the resources THEY use are OURs.  And quite clearly they've decided that what we want is now a distant second to what THEY want.  Once they started down the slippery slope of putting themselves first, it was inevitable.

Think "desperate gambler" and their actions become more understandable.

Regarding what to do about it...

Beyond the removal of Apps, it seems to me at one point I found and hammered something (think Thor) in the Task Scheduler that would have prevented such a thing from happening.  I recall disabling *something* about the Windows Store...  Did I build that into my re-tweaker script?  I wish my memory was what it used to be, but in my defense it's very late.  Yes, I just looked, it's an entry entitled "\Microsoft\Windows\WindowsUpdate\Automatic App Update".  See what the schedule is for that on your system.

I've said this before, but I'll reiterate:  I keep Windows Update Disabled except when *I* choose to check for updates, and also keep my firewall configuration in a state where it cannot contact the online servers even if something starts it.  I rarely see Windows 10 try to download anything that I have not sanctioned, but rarely is not never...  I hate the fact that STILL - after ALL the reconfiguration and tweaking - STILL once in a while it bangs its ugly head on my firewall.

-Noel

[Bayer A.User]

Yet another Win7x64 system.....

Wu actually works fine. None of the post October 2014 Kb's were ever
installed.    Update agent from Feb of this year= 7.6.7601.19161 now
up and running/downloading updates.  
 
If there is a secret update process, The "null" software company LOL...free software from the one and only "null" 

[Deleted]

New York Attorney-General pursuing further cases against Microsoft over “forced” Windows 10 upgrades

Following a recent case where a woman sued Microsoft over a forced upgrade to Windows 10 – and won $10,000. The company is now believed to be facing several more cases, with the New York Attorney-General building a case from multiple customers of Microsoft, with them making claims of “forced” and “deceiving” upgrades.

www.winbeta.org/news/new-york-attorney-general-pursuing-cases-microsoft-forced-windows-10-upgrade

[Locutus deBorg]

"Especially if they can prove that Microsoft was deceitful in the way it persuaded users to accept the upgrade, or in some cases, forced them."

for starters they can pull up the fact that
MS changed the meaning of X
from X = close (never supposed to mean anything else)
to X = schedule the installation (this is a malware practice)

regardless of wind woes update settings mode, the change of the X = malware

[Deleted]

And if they overrode users employing GWX control panel

[Bayer A.User]

Surprise, surprise. MSFT gets caught red handed.
Luv it 
We ALL could write volumes on the subject !
We ALL know what kind of sneaky shit they have pulled in the last 18 months ! 

srFreakman had better cover his  B-hind

[Noel]

Deceiving?

SURELY not the Microsoft WE know and love!

We all know that:

- Windows 10 is faster.
- Windows 10 is more secure.
- Windows 10 respects your network bandwidth.

-Noel

[Techie007]

Jul 12, 2016 14:22:31 GMT -6 @chuckcutler said:

And if they overrode users employing GWX control panel

    Of course they did.  GWX Control Panel is junk.  I've done a lot of research and I know for a fact that his solution won't give dependable results.  He doesn't reset enough of the GWX and Windows Update values.  Several are control values, and several are indicator values.  He's changing an important indicator value and leaving the control value set, which causes it to revert whenever his hack of crippling GWX itself gets reverted by Windows Update.  In addition to writing an extra value that won't even affect anything—he obviously doesn't know how GWX works.  I've been telling you guys all along to NOT use that program!
    Recent further research of mine reveals that Never10 is slightly worse—it totally ignores GWX and just sets the policies.  The problem with that is that if the flags have already been set to start the download and installation of Windows 10, the upgrade can happen spontaneously though Windows Update even though the policies are set to prohibit the GWX icon and to not put the automatic upgrade into motion.  Those flags can get set early on (especially if the user interacts with GWX), and when the user later uses Never10 to eliminate the annoying GWX popups, it successfully disables GWX and the automatic setting of the flags, but the automatic upgrade has already been enabled and can happen any time.

    Yes, Microsoft should have coded in a clear (and fully effective) opt-out into the GWX GUI, but I hate it when people use a 3rd-party hack written by someone who hasn't quite done their homework, and then blame Microsoft for the inevitable failure of the hack.  I mean...Mr. Gibson and Mr. Mayfield didn't even put GWX through its paces like I did in order to figure out how it worked in the first place!  And GWX Control Panel is a whopping 4.6 MB download. . . come on guys!  I'll continue to use the nice, little (<50KB), and well researched program I wrote to continue opting customers' machines out of the upgrade.  Never had a single machine download or upgrade to Windows 10 after being opted out.  There is absolutely no sense in using or promoting poorly written hacks—especially on this site!

[Locutus deBorg]

I didn't have to install anything to prevent winders 10 being shoved down on me

simply skipping all the BS updates means it was never offered nor downloaded

[Noel]

Bravo, Techie007.

While I did what Locutus describes, I do understand that not everyone wants to have to keep vigilant, and that they COULD potentially sneak another GWX variant in another, different update, so I ran your tool too. Thank you!

I also keep Windows Update Disabled normally, and the Sphinx firewall configured not to allow Windows Updates.

There's nothing wrong with maintaining multiple lines of defense!

Of course, Microsoft COULD just ignore all the settings tweaks and start the service or they COULD download the info via another means (Skype, anyone? Defender?) - though the rumblings from various Attorney Generals COULD cause them to pull back from their current stance...

-Noel

[Bayer A.User]

Techie007, You and i (in a previous life) as insiders back in May2015 had this same conversation in the "old irish wake"thread. The generic GWX installer was on our systems then,we noticed it, we investigated it,we even tried to run it. As i recall it would start then quit. At that time Windows10 did not exist(aside from TechPreview) and additional KB's were to follow that would make the thing fully functional.
Only a handful of insiders listened then,but the cat was outta the bag and people began to pay attention.
Here we are,over a year later and 10 is still installing itself at 3am and people are surprised and outraged by it.

[Deleted]

I used GWX control panel last summer at it was the only tool known to me at the time. I have no reports from customers of it being ineffective.
It does not impact any of my machines as updates have been turned off for a very long time now.

Techie, I do not seek to promote GWX control panel in any way here or anywhere else. I simply mentioned it as an indication of how far MS is going to ram these crappy bits down everyone's throat, and the potential liability of doing that.

I now have your tool as well and will try it at the next opportunity.

[Noel]

Jul 13, 2016 7:29:35 GMT -6 Bayer A.User said:

You and i (in a previous life) as insiders back in May2015 had this same conversation in the "old irish wake"thread...

By the way, if I failed to say it - thanks.   Even though I couldn't participate I did appreciate all you fine folks said.

-Noel

[Bayer A.User]

Secret Windows Update Process
Firewalls, Outbound rules, and successfull connections. What 10 does while you are asleep in your bed.
yeah,we need to talk about this.

When Microsoft deprecated the old WU GUI
early on in the TechPreview builds,we all noticed it.We all complained about it.They ignored us. Win10 would offer users little or no control over what and when updates were installed on their PC's. 
 Using Windows Firewall with advanced security was a simple way to get back some control. If the update agent could not connect,it could not search.If it could not search,then it would not find available updates. Result: no 3 or 4GB download when you were trying to get some work done. No 45-60 minute inplace install in the middle of a video edit project. No reboot before you could save your work. No middle of the night upgrade to the next buggy version . Etc.    You get the idea.

[Bayer A.User]

Long story short.
Default firewall setup allows anything and everything outbound connectivity .
Including Windows Update.

Blocking outbound connections except for processes allowed by a rule is what i have used on all my win10 installs for the past year. This kills a bunch of birds with one stone.
The system can only connect online when and how I choose,with my rules.

[Bayer A.User]

10 creates some outbound rules by default. Core Networking allows basic connectivity.
Edge gets it's own dedicated rule, iex11 does not. Cortana and Diagtrack telemetry get dedicated rules, Malwarebytes and 3rd party browsers do not. So I created custom rules in order to go online with iex11,Opera,Firefox or update MBAM or Defender definitions.

Also, I disabled the outbound rules for all the B.S. that i don't need,want,or ever use.

This results in an OS that does not waste my bandwidth or use up resources doing gawd knows what whenever it want's. It does'nt mess with my network or any devices on the network.
Because I know(and everyone else should know by now) that at any time MSFT can introduce a new feature or change an old one in 10 that will give us grief or cause problems. 

Creating and Disabling rules ,and making note of what works and what does'nt as result is part of testing 10.   Enabling firewall log shows when & what connections are made .

[Bayer A.User]

OK, now to the point i'm trying to make.
As Noel has said many times, Disabling the Windows Update service does what anyone would expect. No updates for Windows10.
What i have done with the firewall(not allowing wuauserv out) accomplishes the same thing.
I can use 10, let it idle 24/7, turn my back on it, go to work,go to sleep,live my life and the damn machine just sits there doing nothing unexpected.
With 2 clicks i can go to the default firewall setup,run WU, dwnld & install whatever cumulative nightmare MSFT has dreamed up and at my leisure go through the system.
New features,old problems,issues,services re enabled,violations of group policy, etc etc etc.

What if MSFT introduces in 10 a new way for the system to update online.
They would never tell us about it. The last two years proves that they would add it and wait n see if anyone noticed(most users never would) or if anyone tried to defeat it(they would know via telemetry) and last but not least any future cumulative KB would restore it to full functionality.   So,what the hell am i talking about?

Question: Are they deprecating the "old" WU (wuauserv) and gradually phasing in a new hidden update process that hides inside a generic svcHost task ?  I believe so.

[Noel]

I agree - in order to maintain control over our own systems it's imperative we understand the detail of how it's working.

In my case, in addition to setting the group policy to disallow automatic initiation of updates, I reconfigure my firewall (not the Windows one, but Sphinx) to disallow updates AND disable the Windows Update service. You can't be too careful. I also disable the Windows Firewall service, as Sphinx completely replaces it.

Reconfiguring the Sphinx firewall and starting the Windows Update service to allow a manually-initiated update isn't terribly difficult, and up to recently even with all those things disabled I have seen Windows Defender go online and get its own definitions updates even with the Windows Update service disabled.

My Win 10 VM is currently fully up to date as of a couple of days ago, and I haven't seen any evidence lately of a new update service/process so far, but I haven't run it continuously long enough to know whether the latest update has brought in something new. I wonder if you could be seeing activity from the support processes for the Windows Store. The Windows Store is long gone from my system.

I'm leaving Win 10 running today to gather new/updated information with regard to Defender or update processes.

-Noel

[Bayer A.User]

OK,Heres my Pro 14393.187-  WU (wuauserv) doesn't matter if its set  to Auto,Auto delayed or manual trigger.  If i go into settings>update & security>Windows update and hit check for updates, It can NOT get through my firewall.  Precisely why i set it up this way on numerous Home,Pro,Enterprise installs on 4 different machines in the last year.  All of these systems worked fine and gave me little trouble.

Notice that WU is running while i click on "check for updates" and the resulting message box.

[Bayer A.User]

Another interesting Firewall tidbit.  Windows Firewall with Advanced Security 
       14393.187 Pro
If i create a generic outbound rule allowing wuauserv to connect to the internet, i have the option to choose that the connection is secure. I tried all three options and guess what ?
WU could NOT connect to the internet and Defender could NOT update definitions.

When i created the exact same generic outbound rule without any requirement for a secure connection,  WU still could NOT connect to the internet but Defender COULD update definitions.


  Note: DoSvc(multiple source updates)&Branchcache DISABLED

[Noel]

I can find no direct evidence so far that there has been a recent/fundamental change in the way updates are organized under the covers, with regard to what services are doing what I/O... Disabling the Windows Update service keeps Windows Updates from even being tried.

With the Windows Update service Disabled entirely, I still get Defender updates. I captured the traffic this morning at 11am.

Firewalls find it difficult to extract which service it is that's doing what communications.

-Noel