Huge problem with unwanted Windows 10 download

On my machine it is hidden on C. You have to change folder options to view hidden files and folders to see it. I hid the GWX update but still got the folder.

Edit: Pete, if you have VoodooShield installed, go to Settings > Custom Folders > Enable Custom Folders and if you have it you will see it.

 

Not on the list, I just checked. It may make no difference whatsoever that I brought this to his attention, but at least I said something. If nothing else I feel better.

 

6 were 7 Pro 64 bit, one is Home Premium 32 bit if I recall correctly. I'll check this again when I can.

 

Except the GWX update was installed automatically if someone has AU set to recommended settings. It's only fair if someone reserves the Win10 upgrade.

ETA: just clicked through to the video. That's hilarious!

 

Except I hid KB3035583 and did not install it.

 

I've just found these instruction and it works to delete the hidden $Windows.~BT folder.

http://answers.microsoft.com/en-us/...s/cb24d5c3-e233-45fd-8358-573aed1331d0?auth=1

 

Even easier is to use Disk Clean-up. Clean up System Files.

 

I tried that but didn't work.

 

I had to run Disk Cleanup twice. First time it got most of the files, reboot, then it got the rest of them. Taking ownership from the command line like you posted is definitely faster.

 

It's a two stage process. Did you tick all boxes after the first stage (but don't click OK) and then click Cleanup System Files and tick all boxes again?

 

I'll remember that for next time.

 

Yes, went to the second stage both times. It removes most of the folder the first time, leaving I think the Sources folder. Reboot, second run removes the remainder.

 

Sorry, just to make sure we are doing the same thing. "Cleanup System Files" is different from "Disk Cleanup".

 

I uninstalled GWX before Jul 29th, I dont have the $Windows.~BT. Maybe it is possible MS is pushing Windows 10 download for *some* versions of Windows 7?

 

Yes. When you click on the prompt for Disk Cleanup, it has a selection menu, and a button for Cleanup System Files. Clicking that reveals more options, including removing temporary install files. I had to find and select removal of temp install files once, then reboot, then drill down to find it again, let it run and reboot again to completely remove $Windows.~BT. Two cleanings with a reboot between.

 

Yes, Subrobhandari, I think this is the case. I have installs of W7 32bit HP and an install of W7 64bit Pro Tech Net that this behavior is not occurring. Seems at this point, based on a very limited sample, to be happening to OEM installs. Anyone seeing similar results?

 

Quick update - found this on 8 more computers today. Two of three 7 Pro in one location, all 5 at another with 7 Pro, and on a Win 8.1 Home install. I'm trying the following: Uninstall KB 3035583, reboot, hide in Windows Updates, install KB3050265 (except on 8.1, apparently not necessary), apply the group policy fix, reboot, delete the $Windows.~BT folder, reboot, cross fingers.

It seems to have worked on one Win 7 Pro computer so far. Doing this on another W7 Pro and the Win 8.1 Home now. Hoping to have a positive result to report tomorrow.

 

Somewhat related: do not let Microsoft Level 2 Support take control of your computer to try to fix this issue. I did, as noted earlier. I didn't watch him every moment, in fact he had 10-15 minutes unattended. I found Backup and Restore broken today and all the System Restore points prior to his repair attempts deleted. Nothing like adding insult to injury, Microsoft. Instead of trying to track down anything else that might be broken or messed with, I did a repair install. More time spent on this idiocy.

 

I can only wonder how many people are going through the same ordeal all over the world.

 

I uninstalled KB3035583 on Windows 7X64 Ultimate. It kept installing itself back no matter how many times I unchecked the update. I hide it, and that has worked so far. I just uninstalled KB3035583, and hide it on my test machine which I have not used in several weeks. I still have all kinds of components related to GWX running on my test machine requesting to dial out. I will have a lot more uninstalling to do on my test machine.

In general Microsoft gets away with doing what ever they want. They have been most unethical lately. Another example is their Application Experience, and Customer Experience Improvement Program. It says it's an opt in service to provide usage, and performance data to Microsoft. There's nothing opt in about it. Anytime I have ever been asked if I wanted to opt in to any type of service like this I have always opted out. It keeps adding itself back to task scheduler, and running. I constantly have to remove it, or disable it. It just adds itself back, or enables itself again. If you see your firewall flag something to do with telemetry, or appraiser.dll then it could be part of Microsoft's data collection service. They are both listed in my task scheduler right now as being part of these data collection programs. I just had to disable them again. I guess you can get away with what ever you want when you have Billions of dollars.

 

Yes, same here, lots of SxS assemblies and the like. JR has a list of telemetry and other updates in post #3 of this thread. I'm taking out the first two he mentions, KB3068708 and KB3022345 along with the infamous KB3035583 and KB2952664 and KB3021917.

Interesting reading here, too: http://www.msfn.org/board/topic/173752-how-to-avoid-being-upgraded-to-win-10-against-your-will/
I'm going to take many of these out one at a time after an image, run for a bit and see if anything breaks. Yet more wasted time.

 

It seems to have started in earnest around here on Aug 20th. I am now seeing it everywhere. Even on a lightning struck box that got hit yesterday. Processor fried, but the windows.bt folder is there. Apparently lightning won't stop it.

 

Hopefully final update on this. The procedure described in post #43 appears to work and appears not to break anything else on Windows 7 Pro and Windows 8.1 Home. I assume it will work on other variants of these OS's as well.

Some notes: When uninstalling KB3035583, two computers hung on the "Do not turn off your computer" screen during reboot. The hard drive activity light was out. I had to do a hard shutdown then "Start Windows normally". The update uninstallation then proceeded. It may take up to three attempts to completely delete the $Windows.~BT folder. What seems to work best is to run only the first two commands from the script provided in post #15 by Syrinx. The first run it will ask for permission for certain files. It may stall on the second command. I found that closing the command prompt and manually deleting the folder gets rid of most of it. Reboot, run the first two commands again, attempt to delete again. Usually succeeds, if not do it a third time.

Huge thanks to everyone who helped with finding a way to stop this mess. I sincerely hope this is a permanent fix. It bears repeating that in every case I've seen, the Windows 10 upgrade was not reserved. I just found out that someone on a capped Mi-Fi connection went over their limit because of this. I'm going to look at that one tomorrow, among others. I've been calling other IT people to let them know about this. Please spread the word.

 

I've just had this once again on another Win7 HDD. GWX hidden, Win10 malware not invited but still downloaded.