Solved Prevent GWX.exe Windows 10 upgrade from showing up every start-up.

Status
Not open for further replies.

Raul90

Level 14
Thread author
Feb 5, 2012
658
Briefly explain your current issue(s)
Laptop has only Avast Premier / Malwarebytes Free as setup for normal use. Cannot add any other security app as the laptop is used by the family and may cause an annoyance when HIPS or any other AE is added.
Steps taken to resolve, but have been unsuccessful
At the moment installed NVT EXE Radar to blacklist the GWX.exe program from running at start-up.
The recent GWX.exe program from Microsoft is forcing an upgrade for Windows 7/8/8.1 users. I have used the fix found in thehackernews.com (below) but it seems it did not work and when Windows 7 booted the Windows 10 upgrade symbol was still there. I blocked all concerned via Avast Premier firewall (see images below) but it still started after every boot. I had to use NVR EXE Radar to blacklist it/block it so it will not run at start-up.

This laptop has only Avast Premier and Malwarebytes Free as security. Just added NVT to it just to block that GWX program at the moment.

Is there anything that I can do? I intend to just use Avast Premier / MBAM Free on this laptop as there are no annoyances for the family when the setup is like this.

This method is applicable for both Windows 7 and Windows 8.1 users and specifically targets the Windows 10 download files.

Install KB3065987 (for Windows 7) or KB3065988 (for Windows 8.1) updates from Microsoft's official website, depending on the operating system you are using

Now restart your computer and open up the registry editor (search Regedit)

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

Right-click "Windows", and Select New, then Key and then Type "WindowsUpdate"

Click on the newly created "WindowsUpdate" key and create a 32-bit DWORD called "DisableOSUpgrade" with a value of 1.

Restart your computer. That's it.

eP2Cdw4.jpg


V3zvs73.jpg


zgbaX56.jpg


c7ArBi3.jpg


Currently listed below are what I have blocked via NVT.

C:\Windows\System32\GWX\GWXConfigManager.exe
C:\Windows\System32\GWX\GWXDetector.exe
C:\Windows\SysWOW64\GWX\GWX.exe
C:\Windows\System32\GWX\GWX.exe
 
Last edited:
L

LabZero

You can remove the Windows 10 Update notification by removing the files that generate i.e. GWX and GWXTriggers.
These are located in the C:\Windows\System32\Tasks\Microsoft\Windows\Setup folder, delete them and reboot your PC.
 
Upvote 0

Raul90

Level 14
Thread author
Feb 5, 2012
658
You can remove the Windows 10 Update notification by removing the files that generate i.e. GWX and GWXTriggers.
These are located in the C:\Windows\System32\Tasks\Microsoft\Windows\Setup folder, delete them and reboot your PC.

@Klipsh,

Thanks for the reply there :)

Will there be any untoward effects if I do that? Have been reading some posts on other forums that sometimes their system went buggy...wellit ain't on this issue but in the MS Telemetry updates --which is a bit nasty.

Any more ways to prevent the GWX program from being downloaded?
 
  • Like
Reactions: scot and LabZero
Upvote 0
L

LabZero

Alternatively, you can uninstall the update

If you want to completely remove the icon from the system and remove the GWX.exe process that keeps your PC ready for Windows10 Installer, you must uninstall the update signed with KB3035583 code.

To do this, find and open "Windows Update" in the start menu or the Control Panel, click on installed updates and look for the one with the title "KB3035583".

Click on the right button and select "Uninstall" to uninstall the update and do away with GWX icon.
 
Last edited by a moderator:
  • Like
Reactions: frogboy
Upvote 0
L

LabZero

@Klipsh,

Thanks for the reply there :)

Will there be any untoward effects if I do that? Have been reading some posts on other forums that sometimes their system went buggy...wellit ain't on this issue but in the MS Telemetry updates --which is a bit nasty.

Any more ways to prevent the GWX program from being downloaded?
After you've removed KB3035583, to prevent, changes the Windows Update options: check for updates manually and hide KB3035583
 
  • Like
Reactions: frogboy
Upvote 0

frogboy

In memoriam 1961-2018
Verified
Top Poster
Well-known
Jun 9, 2013
6,720
I think i remember now but again sorry it will not help you, i restored from a backup and just hid all the updates concerned with much the same as @Klipsh posted above. ;)
 
  • Like
Reactions: LabZero
Upvote 0

vishwa

Level 1
Verified
Aug 18, 2015
22
Open your control panel and than click system and security and than click view installed updates. Here in the search bar type KB3035583 it will show an update installed in your PC. select it and right click on it and choose uninstall, restart your PC and the GWX will gone from your PC.
 
  • Like
Reactions: frogboy
Upvote 0

Kuttz

Level 13
Verified
Top Poster
Well-known
May 9, 2015
625
Uninstall the windows update KB3035583 then after a reboot check of windows update, the uninstalled update appears again and you simply block it there. There is no need to go through the firewall or any other apps to do that. I have being using Windows 7 without any issues here.
 
  • Like
Reactions: frogboy
Upvote 0

Raul90

Level 14
Thread author
Feb 5, 2012
658
Hi guys,

Thanks very much for the replies. The issue is solved now thanks to your help :) I also saw a GWX Control Panel at Majorgeeks,

Download GWX Control Panel - MajorGeeks,

for that but am not going to use it as the issue has been resolved now.

Incidentally I read about NoVirusThanks Smart Object Blocker and I believe it can do the job also though this is still on beta stage. If they can merge that with EXE Radar then it'll be great :)
 
  • Like
Reactions: LabZero and frogboy
Upvote 0
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top