WIN 7 Updates still being sent?

[Howard Davis]

I received what appeared to be a Win 7 update yesterday.

I was wondering if these are still being sent, and if not, whether or not malware could be installed through this route?

If this poses a vulnerability, can the receiving of such updates be blocked?

[erpster3]

what is the specific Win7 update you are talking about?

post a screenshot of it if possible

[Howard Davis]

12 hours ago, erpster3 said:

what is the specific Win7 update you are talking about?

post a screenshot of it if possible

It was received on Feb. 12 or 13, and nothing showed indicating installation was in process when I turned on the computer on Feb 13th.

Going to installed updates shows Adobe Acrobat reader 20.006.20034 was installed yesterday (2/13).

[goretsky Supervisor]

Hello,

Microsoft released one post-EOL update for Windows 7 to fix an issue with the wallpaper not being displayed as a result of the last Windows 7 update, from what I recollect.

That was just a one-off update to fix an issue caused by the last "supported" update; you should not expect any further updates to Windows 7.  It would probably be a good idea to look in to updating to Windows 10 if you can, as Microsoft is providing mainstream support for it (security, performance, compatibility and bug fixes), as well as new features, functionality and device support, when needed.

 

Regards,

 

Aryeh Goretsky

 

[Howard Davis]

Thanks for the replies.

It appears that Win 7 may be as secure or more so than 10, if one has good virus and malware protection.

My concern is that the updating process may be used to bypass this protection to install malware. Now that no more updates can be expected for 7, can this possible vulnerability be removed by deleting whatever enables updates to be installed? If so, how?

[Jim K Global Moderator]

17 minutes ago, Howard Davis said:

Thanks for the replies.

It appears that Win 7 may be as secure or more so than 10, if one has good virus and malware protection.

My concern is that the updating process may be used to bypass this protection to install malware. Now that no more updates can be expected for 7, can this possible vulnerability be removed by deleting whatever enables updates to be installed? If so, how?

How/why would Microsoft Windows Update start feeding you malware/etc.?  afaik they are the same server(s) used by Win 8.x/10 ... WSUS just determines which updates are applicable to your system (Win7 being "none" now).

 

I would be more concerned of an unpatched (never to be patched) exploit down the road which may bypass your "good virus and malware protection"

 

"Win 7 may be as secure or more so than 10" ... yea, no.

[Mockingbird]

Windows 7 is end-of-life (EOL)

 

Upgrade to Windows 10

[Louisifer]

This is one of the 3rd party updates that come from windows update, theres a small chance MS will still allow some partners to push updates if critical enough. 

 

As for Windows 7 being more secure than windows 10... nope. at best the security would be 80%'ish, its security is based on designs from 2009.. by this time next year it'll probably be a secret bitcoin miner.

[restroom]

17 hours ago, Howard Davis said:

Thanks for the replies.

It appears that Win 7 may be as secure or more so than 10, if one has good virus and malware protection.

My concern is that the updating process may be used to bypass this protection to install malware. Now that no more updates can be expected for 7, can this possible vulnerability be removed by deleting whatever enables updates to be installed? If so, how?

Heh. Unless you are part of a corporation that uses WSUS or equivalent and redirects clients to update via their internal server AND if that server became compromised and someone managed to push out malicious code, then you MIGHT get something along the lines of what you are thinking.

 

Otherwise, other than Windows 7 being EOL and therefore now insecure, Windows update is not going to suddenly start being compromised.

[Howard Davis]

My concern is that hackers and scammers will discover and use whatever means Microsoft uses to send/install updates to PCs, and use that method for their own malicious purposes. If there is little or no chance legitimate updates will be sent, disabling the PCs ability to be so accessed will improve security. Due to past experience with a scammer posing as a Microsoft tech, I believe this possible, as he probably is or was an employee with inside knowledge.

[Jim K Global Moderator]

21 minutes ago, Howard Davis said:

My concern is that hackers and scammers will discover and use whatever means Microsoft uses to send/install updates to PCs, and use that method for their own malicious purposes. If there is little or no chance legitimate updates will be sent, disabling the PCs ability to be so accessed will improve security. Due to past experience with a scammer posing as a Microsoft tech, I believe this possible, as he probably is or was an employee with inside knowledge.

Well ... sounds like you need to move on up to Windows 10 (or another operating system which receives regular security updates).

[shockz]

57 minutes ago, Howard Davis said:

My concern is that hackers and scammers will discover and use whatever means Microsoft uses to send/install updates to PCs, and use that method for their own malicious purposes. If there is little or no chance legitimate updates will be sent, disabling the PCs ability to be so accessed will improve security. Due to past experience with a scammer posing as a Microsoft tech, I believe this possible, as he probably is or was an employee with inside knowledge.

You'd have to have a dns hijack to be concerned about that, and even then I'd say it's a long shot unless an existing and now unpatched exploit manages to get into your registry and point to a rouge WSUS server, and even then I'd say it is still a long shot. There'd have to be some pretty hefty exploits to masquerade as a legitimate update.

 

Just upgrade to Windows 10, you're clearly concerned about security, and even with a Virus Scanner, 7 will continue to be an ever growing vector of attack. Virus Scanners aren't going to pick up the slack of securing an abandoned operating system outside of normal virus scans. Upgrade and have peace of mind again, it's just silly at this point.

 

Wish I could find the old youtube video of Windows XP, getting put on a public IP, with a fresh install of latest possible updates, and within hours was infected with no user interaction. Honestly, now adays with Kali Linux, it'd probably doable in minutes. Virus Scanners won't protect XP with that amount of gaping security holes, and within a few years I'd imagine 7 would have the same issue. Granted I doubt you'll ever be directly connecting to your ISP without a router/firewall on back end.

Edited February 17, 2020 by shockz

[Ve7878]

On 2/16/2020 at 6:12 PM, Howard Davis said:

Thanks for the replies.

It appears that Win 7 may be as secure or more so than 10, if one has good virus and malware protection.

My concern is that the updating process may be used to bypass this protection to install malware. Now that no more updates can be expected for 7, can this possible vulnerability be removed by deleting whatever enables updates to be installed? If so, how?

Due to the way that WU works and some details other posters have already explained, this is extremely unlikely and you're more likely to get the system compromised by other methods long before WU gets affected. I doubt many would go through the trouble of trying to compromise WU when there are easier methods.

 

You could simply disable Windows Update but at the moment Microsoft is still publishing the Malicious Software Removal Tool and Security Essentials via WU. Also if you're running a supported version of Office (Prior to 2016 c2r version) then these will be also be delivered by WU so it's best to keep it on for now.

 

Ultimately, you should move to Windows 10 or another supported OS. Windows 7 is over 10 years old and should have disappeared years ago for the majority and if you're having to ask these questions, it's clearly not suitable for your usage.

 

Adobe Reader updates will show in update history because they use MSP files to patch their software.

[goretsky Supervisor]

Hello,

There is always the remote possibility, however small, that Microsoft will push a post-EOL Windows Update to all copies of Microsoft Windows 7, again.  They have done so 3-4 times for Microsoft Windows XP and Vista, as I recall, for things like RDP vulnerabilities.  There are also the Extended Security Updates for Windows 7 that Microsoft is distributing to businesses that have purchased licenses for them.  Because of this, the channels and mechanisms used to update Microsoft Windows 7 are still being actively maintained by Microsoft. 

 

That said, you should not expect any further updates for Microsoft Windows 7,  If you are concerned about the security of your operating system, upgrade to Microsoft Windows 10, as it is fully supported by Microsoft and continues to get fixes for security issues and improvements to security all the time.

 

Regards,

Aryeh Goretsky

 

[Howard Davis]

Thank you all. As no one mentioned it, it would seem that Malwarebytes (which I have) is not considered significant additional protection to the Windows firewall and Avast antivirus. Malwarebytes does intercept anything suspicious - websites i attempt to go to, usually via a link, are sometimes blocked for that reason.

 

I'll upgrade to Win 10 eventually.

[Mockingbird]

14 minutes ago, Howard Davis said:

Thank you all. As no one mentioned it, it would seem that Malwarebytes (which I have) is not considered significant additional protection to the Windows firewall and Avast antivirus. Malwarebytes does intercept anything suspicious - websites i attempt to go to, usually via a link, are sometimes blocked for that reason.

 

I'll upgrade to Win 10 eventually.

"Eventually" should have been over a month ago.

[cork1958]

1 hour ago, Howard Davis said:

Thank you all. As no one mentioned it, it would seem that Malwarebytes (which I have) is not considered significant additional protection to the Windows firewall and Avast antivirus. Malwarebytes does intercept anything suspicious - websites i attempt to go to, usually via a link, are sometimes blocked for that reason.

 

I'll upgrade to Win 10 eventually.

Easy as pie to upgrade to Windows 10. Heck, I even upgraded sister in laws desktop to it last week and that feeble machine is a 32bit, Pentium 4, I think, and only has 2GB's memory and doesn't really run to bad for just surfing the internet like she does. Will hate to hear her complain when the next feature update comes along though!!

 

Do have to give Windows 10 credit for being an awesome memory manager after installing it on that machine. Recently bought for her a laptop that came with only 4GB's memory and that thing is snappy as heck. Upgraded it to 16GB's though.

 

Just wondering if anyone has installed Windows 10 on anything as feeble as that machine? LOL

Not stealing topic and don't care if no one answers.

[restroom]

On 2/17/2020 at 5:18 PM, Howard Davis said:

My concern is that hackers and scammers will discover and use whatever means Microsoft uses to send/install updates to PCs, and use that method for their own malicious purposes. If there is little or no chance legitimate updates will be sent, disabling the PCs ability to be so accessed will improve security. Due to past experience with a scammer posing as a Microsoft tech, I believe this possible, as he probably is or was an employee with inside knowledge.

If this was possible then ALL version of Windows which use Windows update services are at risk...

[+BudMan MVC]

There was a concern about spoofing windows update many yeas ago - flamer I think it was called, very complex sort of exploit with a chained cert.. This was addressed with

https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2012/2718704

 

Its not like MS ended windows 7 support of the blue, it was years in the making... You have had years knowing that the eol was coming and it would no longer supported.. They even extended - a few times..

 

There is NO EXCUSE for you to be still using windows 7 - none!!!

 

Its time to move on!!  If you don't want to use windows 10... Then pick another OS that is current and supported... There are plenty of linux or bsd even OSes you could run that are supported.

 

If you choose to continue to run a no longer supported OS, then yes there are security concerns - and they only get bigger with every passing day.

 

[Ve7878]

20 hours ago, cork1958 said:

Easy as pie to upgrade to Windows 10. Heck, I even upgraded sister in laws desktop to it last week and that feeble machine is a 32bit, Pentium 4, I think, and only has 2GB's memory and doesn't really run to bad for just surfing the internet like she does. Will hate to hear her complain when the next feature update comes along though!!

 

Do have to give Windows 10 credit for being an awesome memory manager after installing it on that machine. Recently bought for her a laptop that came with only 4GB's memory and that thing is snappy as heck. Upgraded it to 16GB's though.

 

Just wondering if anyone has installed Windows 10 on anything as feeble as that machine? LOL

Not stealing topic and don't care if no one answers.

Yes. I ran it on an Acer Aspire One for a while (Intel Atom Netbook). The device came with XP, I upgraded it to 7 but wasn't very happy with performance. When 8.0 came out I installed it and found a vast improvement over XP and Windows 7, same with 8.1.

 

Windows 10 ran just as good as 8.x did but eventually websites were just getting too heavy for it. I ended up going for a customised Slackware installation as I literally just use it for OneNote these days.

[Howard Davis]

Thanks again for your replies.

I contacted the expert tech that installed a solid-state hard drive in my computer last year, which works fine - faster and more reliable than than the hard drive the computer came with. Here is his response:

 

"I still have windows 7 running on my thinkpad laptop. I wouldn’t upgrade to Windows 10 unless it’s absolutely necessary. For one thing, I’m not sure if the upgrade is free...technically you have to buy a Windows 10 upgrade license but I read somewhere that the upgrade may be free. Since you already have avast and malwarebytes, I would just stick to Windows 7 for now."

[shockz]

6 minutes ago, Howard Davis said:

Thanks again for your replies.

I contacted the expert tech that installed a solid-state hard drive in my computer last year, which works fine - faster and more reliable than than the hard drive the computer came with. Here is his response:

 

"I still have windows 7 running on my thinkpad laptop. I wouldn’t upgrade to Windows 10 unless it’s absolutely necessary. For one thing, I’m not sure if the upgrade is free...technically you have to buy a Windows 10 upgrade license but I read somewhere that the upgrade may be free. Since you already have avast and malwarebytes, I would just stick to Windows 7 for now."

That guy shouldn’t be considered expert tech. Invite him here for a discussion, hopefully he’s not an expert tech for anyone else. 
 

hint: it’s absolutely necessary. It’s a security risk. Also the upgrade is free if you run the upgrade tool from Microsoft. Malware bytes and avast won’t protect you from gaping security exploits. At least get on 8.1, that’s not free though. 

[Brandon H Supervisor]

3 minutes ago, Howard Davis said:

Thanks again for your replies.

I contacted the expert tech that installed a solid-state hard drive in my computer last year, which works fine - faster and more reliable than than the hard drive the computer came with. Here is his response:

 

"I still have windows 7 running on my thinkpad laptop. I wouldn’t upgrade to Windows 10 unless it’s absolutely necessary. For one thing, I’m not sure if the upgrade is free...technically you have to buy a Windows 10 upgrade license but I read somewhere that the upgrade may be free. Since you already have avast and malwarebytes, I would just stick to Windows 7 for now."

not a very good techie if he's not aware the free upgrade can still be performed on personal equipment.

 

Plus Avast has really dropped in quality over the last few years so the fact that he's still recommending it is kinda laughable. Malwarebytes is good on occasion but not for it's live scanner. Either way an anti-virus suite will only protect you so much at this point if vulnerabilities remain unpatched in the system.

 

Up to you in the end; we just want you to be aware of the possible risks remaining on 7 now that support has ended.

[shockz]

I’ll be honest with you...

 

Windows 10 sucks compared to Windows 7 out of the box for a regular PC user. It’s a mishmash of abandoned directions MS built in hopes of having a unified platform for all devices that run Windows (phones, tablets, hybrids, laptops, desktop).  It never came to fruition and leaves desktop users in a limbo UI, where there’s a duality of settings, applications, and half baked UI and features. Cortana included. Dead App Store. Etc...
 

But. Having said that. All of that can be fixed with a few simple tweaks, shortcuts, and even free third party programs if it bothers you that much. I’ve had 10 as my daily driver since the first public betas. And it’s just as good as 7 once you work out your personal usability quirks.  Not to mention faster on modern hardware. M.2. Etc...  oh. And still receiving security updates. These above issues also become less of a nuisance with each feature update. 
 

The pros outweigh the cons. By far. 
 

be smart and either upgrade or migrate to a different operating systems... MacOS, Linux. Sorry that Windows 10 didn’t go the way someone wanted, but it’s the only real option for people who wish to stay on Windows and be a responsible user. 
 

Don’t be... a computer novice... and stay on Windows 7 and leave yourself open to exploits.

 

You’re going to have to use 10 eventually. Either when your hardware dies and you have to purchase a new system, rig, and the new stuff won’t have Windows 7 drivers, or you are hit with an exploit.   Might as well embrace it now when it’s still free. 

Edited February 20, 2020 by shockz

[Matthew S.]

25 minutes ago, Howard Davis said:

Thanks again for your replies.

I contacted the expert tech that installed a solid-state hard drive in my computer last year, which works fine - faster and more reliable than than the hard drive the computer came with. Here is his response:

 

"I still have windows 7 running on my thinkpad laptop. I wouldn’t upgrade to Windows 10 unless it’s absolutely necessary. For one thing, I’m not sure if the upgrade is free...technically you have to buy a Windows 10 upgrade license but I read somewhere that the upgrade may be free. Since you already have avast and malwarebytes, I would just stick to Windows 7 for now."

That "expert tech" is just afraid of change.  To be honest, I haven't had a need to tweak anything on Windows 10 (that I'm aware of doing) to make it fit my needs, not at home, nor at work.  I use multiple OS's (macOS, Linux, Windows 10) daily, they each have their own quirks but I rather deal with the quirks than leave myself wide open for infection.