Microsoft has re-released the updates KB2952664 for Windows 7 and KB2976978 for Windows 8.1 with the same functionality. So far, there is no reason to worry, because the updates are marked as optional for installation, but Microsoft may change their status in the future.

For the first time, these updates were released in August 2015, and their functionality was initially classified. KB2952664 was described as “a compatibility update for a Windows 7 upgrade ... [which] helps Microsoft make improvements in the current operating system to simplify the process of upgrading to the latest version of Windows.” No further information. Both updates were extremely poorly documented.

What updates are doing

Immediately after installing the update KB2952664, which had the status of "important", users began to complain that a new DoScheduledTelemetryRun process had appeared in Windows Task Scheduler .
')


In Task Scheduler, this process was set to run daily as a task of the Microsoft Compatibility Appraiser.

%windir%\system32\rundll32.exe appraiser.dll,DoScheduledTelemetryRun

The process is supplied with the description “Collection of telemetric information, if there is a registration in the program Microsoft Customer Experience Improvement”. Despite the description, the task was launched for all users, regardless of whether they had registered with the Microsoft Customer Experience Improvement Program or not. Moreover, if you explicitly refuse to participate in this program, the task will still remain to be executed.

It is not known what data Windows collects for sending to a remote server, but users reported that the Appraiser task is very processor-intensive.

In March 2016, information security specialists noticed that Microsoft was using KB2952664 for the constant introduction of the intrusive GWX program (“Get Windows 10”) into the system. As soon as KB2952664 enters the system, it immediately requests the update of KB3035583 with the GWX program from the server for downloading and installing.

Constant mutation

A closer look at KB2952664 showed that this update constantly mutates — it changes frequently and contains a different burden than last time. Microsoft did not document its behavior. The company has long refused to explain what KB updates actually do.

In the system logs it was possible to track how the version number of this update changes.


Windows Update considers every new version a new update and a new installation object. So every time Microsoft changes the version number of KB2952664, all previous user attempts to block the update are canceled.

Uninstalling KB2952664 only uninstalls one version of the patch. Later it will be reinstalled with an alternate version.

Why do you need reissue?

Experts have not yet studied the functionality of KB2952664. The Microsoft description contains the following wording: “This update performs diagnostics on Windows systems that participate in the Windows Customer Experience Improvement program. Diagnostics evaluates the compatibility of the Windows ecosystem and helps Microsoft verify the hardware and software compatibility of all Windows updates. This update does not have GWX functionality or system upgrades. ”

It is clear that the campaign to promote Windows 10 is over, so it makes no sense to distribute GWX anymore.

Given the unseemly history of KB2952664 and KB2976978, these suspicious updates should pay special attention. Repeatedly, Microsoft quickly transferred optional updates to recommended status, which made it possible to distribute them to most Windows computers. During the last re-release of KB2952664, this update changed its status from optional to recommended during the week.

You can follow the change of the update description page, which is also constantly changing. Now for KB2952664 the date is February 9, 2017 and the revision number is 11 (although in October 2016, the revision number was 25).



The article describing update KB2976978 now has the revision number 7.

So far, all this looks strange - it is not clear why the Customer Experience Improvement diagnostic tool was released separately, and not along with the standard monthly update package on Tuesday. It is also strange that the revision number of the KB has changed from 25 to 11. But it is known for sure that previous versions of these updates collected telemetry data and did other things regardless of the desires of users - and this behavior was not documented.