Beware of Windows Update KB4512941

[nukecad]

I got caught out by the KB4512941 update last night.

Cortana, which I had disabled, turned itself on and immediately started using 75%+ of my CPU:

After messing about for a couple of hours in the end I uninstalled the Update to get things back to how they were:

 

If you get caught the same way then :

Go to Windows Update > View update history > Uninstall Updates.
In the screen that comes up Double click on the update and then click Yes to uninstall it.

Edited September 2, 2019 by nukecad

[Porthos]

4 hours ago, nukecad said:

If you get caught the same way then :

Go to Windows Update > View update history > Uninstall Updates.
In the screen that comes up Double click on the update and then click Yes to uninstall it.

That update is not a patch Tuesday update and would not have been installed unless you updated manually thru Windows update.

It is a preview of the next patch Tuesday update.  The Cortana issue is a known issue

That is why it shows as Optional. It is in the testing phase for "seekers" of early releases. It will have a different kb number when the released version comes sept 10.

 

Edited September 2, 2019 by Porthos

[nukecad]

Indeed it is sat there as an 'optional' update in Windows Update.

But this is not an insider build, I'm not in the insider programme.

So I believe that the warning is needed.

MS should not be putting (possibly buggy) beta updates on RTM machines without a warning.  That's what the Insider channels are supposed to be for.

'Optional' is not the same as 'experimental'.

[Porthos]

1 hour ago, nukecad said:

Indeed it is sat there as an 'optional' update in Windows Update.

But this is not an insider build, I'm not in the insider programme.

So I believe that the warning is needed.

MS should not be putting (possibly buggy) beta updates on RTM machines without a warning.  That's what the Insider channels are supposed to be for.

'Optional' is not the same as 'experimental'.

There are sometime 2 of those each month. Yes it can and should be reworded but it is NOT FORCED you have to click to download and install. That is the current way MS delivers these updates. 

Quote

Types of monthly updates
Windows 10 quality updates are cumulative and contain all previously released fixes to guard against fragmentation of the OS that can lead to reliability and vulnerability issues when only a subset of fixes are installed.  Most users are familiar with what is commonly referred to as “Patch Tuesday” or Update Tuesday.  These updates are published on the second Tuesday of each month, known as the “B” release (“B” refers to the second week in the month), and are the only regular monthly releases that include both new security fixes and previously released security and non-security fixes. We chose the second Tuesday at 10:00 a.m. Pacific time to give commercial customers plenty of time to test the updates and deploy them to devices.

We also release optional updates in the third and fourth weeks of the month, respectively known as “C” and “D” releases. These are validated, production-quality optional releases, primarily for commercial customers and advanced users “seeking” updates. These updates have only non-security fixes. The intent of these releases is to provide visibility into, and enable testing of, the non-security fixes that will be included in the next Update Tuesday release (we make these optional to avoid users being rebooted more than once per month). Advanced users can access the “C” and “D” releases by navigating to Settings > Update & Security > Windows Update and clicking the “Check for updates” box. The “D” release has proven popular for those “seeking” to validate the non-security content of the next “B” release.

 

https://blogs.windows.com/windowsexperience/2018/12/10/windows-monthly-security-and-quality-updates-overview/

Edited September 2, 2019 by Porthos

[nukecad]

And how many RTM Windows users have ever heard of that blog?

If the Optional Updates being offered are beta/experimental then it should clearly explain so within Windows Update itself.

Not burried in a blog when the 'average' user will never see it.

[Maurice Naggar]

Please see my notes   https://forums.malwarebytes.com/topic/251171-warning-issued-for-millions-of-microsoft-windows-10-users/?do=findComment&comment=1332796

 

[exile360]

It's odd they don't label their updates better on 10.  In Windows 7 every time they release a preview of the following month's update(s) they always label it as 'Preview of <name of update/KB number etc.>' and they are listed as 'Optional', separate from the recommended/important updates so that you know it is a 'Preview' of a planned future update and they are not checked/selected for installation by default so that the user must manually check the box to install them (I generally do and haven't had any issues so far, but doing things this way is better IMO for the sake of users who might not know the risks).

I'm surprised they aren't doing it this way in Windows 10.  It seems like a bit of a regression in my opinion, especially since, at least on Windows 7, updates for MSE/Windows Defender also come through Windows Update, so if a user wants to keep their default MS AV up to date they must use Windows Update to do so (though it will do so through automatic updates, some users, like me, prefer doing all updates manually so that I know when installations are happening and what is being installed in order to prevent interruptions of resource intensive activities and so that I can stay on top of any changes to my system; a useful thing to do in case any problems with the system do crop up so that I can see when an issue occurred, what the most recent changes to the system were at the time and so that I know in advance of an issue occurring what the most recent change/installation made to the system was, including any Windows Update(s) I might have installed).

[Porthos]

9 hours ago, nukecad said:

And how many RTM Windows users have ever heard of that blog?

If the Optional Updates being offered are beta/experimental then it should clearly explain so within Windows Update itself.

Not burried in a blog when the 'average' user will never see it.

The average RTM user does not usually manually check for updates either.  The update is classified as Optional. Most users back in the day rarely installed Optional updates anyway. 

Not making excuses but if you are going to manually update Windows a user needs to know above average skills/knowledge.

What you experienced is what keeps us repair guys in business. Many of us repair guys ( at least those who are subscribed to all things 10) know this stuff. That is why we still exist in this world of Google search and "You of tube" university.

[nukecad]

Indeed, you had to manually update to get it.

The point still stands that MS should not put experimental builds there without a clear warning.

I have noting against Beta versions being released for general user testing (I have a couple of Malwarebytes Betas running) but tell people that it is a beta so that they can decide of they want to try it or not, and know that it may have issues.

[exile360]

Yep, agreed.  They should at least label it as a 'preview' or 'beta' as they do the early access versions of each month's monthly rollup patches on Windows 7 so that there is a clear distinction between the different types of patches and their readiness (or not) for use in production environments.  I suspect the fact that they aren't has something to do with them eliminating much of their QA for their software and wanting more of the public to participate in testing their early releases.  There are plenty of non-technical users who check for updates manually simply to avoid unplanned usage of system resources by background scheduled/automatic updates so I think assuming that everyone who checks for updates manually is deliberately participating in any sort of early access/beta testing is a poor assumption on Microsoft's part.

[Maurice Naggar]

Today is the monthly Microsoft Windows update cycle for Sept 2019.

If you have Windows 10 see this  https://support.microsoft.com/en-us/help/4515384/windows-10-update-kb4515384

 

This security update includes quality improvements. Key changes include:

• Provides protections against a new subclass of speculative execution side-channel vulnerabilities, known as Microarchitectural Data Sampling, for 32-Bit (x86) versions of Windows (CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130). Use the registry settings as described in the Windows Client and Windows Server articles. (These registry settings are enabled by default for Windows Client OS editions and Windows Server OS editions.)
• Addresses an issue that causes high CPU usage from SearchUI.exe for a small number of users. This issue only occurs on devices that have disabled searching the web using Windows Desktop Search.
• Security updates to Microsoft Edge, Internet Explorer, Microsoft Scripting Engine, Windows App Platform and Frameworks, Windows Input and Composition, Windows Media, Windows Fundamentals, Windows Authentication, Windows Cryptography, Windows Datacenter Networking, Windows Storage and Filesystems, Windows Wireless Networking, the Microsoft JET Database Engine, Windows Kernel, Windows Virtualization, and Windows Server.

[Porthos]

https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-10-high-cpu-usage-in-cortana/

Edited September 11, 2019 by Porthos

[nukecad]

Interestingly I've just done the Patch Tuesady updates on this laptop - and Cortana no longer appears anywhere in Task Manager (Not even 'suspended').

I also noticed an new (to me) thing in the update process.
After the restart and the usual install screens there was a new (to me) "Cleaning Up; please wait" screen.

[Maurice Naggar]

It seems your machine's Windows is doing fine now.

[nukecad]

On 9/11/2019 at 5:50 PM, Maurice Naggar said:

It seems your machine's Windows is doing fine now.

Not quite.
I've noticed that following patch Tuesday my system tray icons, and Taskbar icons are behaving oddly.
(I've also seen reports of some users having their Start Menu corrupted, mine's OK - sort off, see the edit).

Left clicking on any of the Windows icons, sound, networking, power, action centre etc. has no effect.
It should open the settings flyouts in the notification area.
Right clicking the icons gives the option to open the full settings pages.
Non-Windows icons in the system tray respond correctly.

Conversely, right clicking any icons on the rest of the taskbar has no effect, it should show a context menu, but left clicking will launch them as normal.

It's an annoyance more than something that will stop you working, still it shouldn't happen.

I'll fix it when I have time to get round to it.

Edit - Typing directly into the Start Menu to search has also stopped working for me.
I'm definitely coming to believe that all these glitches are down to the changes MS are making to Cortana and Search.

Edited September 14, 2019 by nukecad

[exile360]

6 hours ago, nukecad said:

Edit - Typing directly into the Start Menu to search has also stopped working for me.
I'm definitely coming to believe that all these glitches are down to the changes MS are making to Cortana and Search.

Interesting, that sounds like the exact same issue I reported here and I don't even have build 1903 installed yet (Windows Update keeps saying my system isn't ready yet for whatever reason; I'm guessing because it has some hardware component that is known to have issues with the update).  No idea what is causing it or how to fix it but I don't use 10 frequently enough for it to really matter anyway I suppose.

[nukecad]

sfc is reporting dual ownership of various files, but the old and new (Windows) owners are exactly the same.

Many of these seem to be Start Menu (and so Taskbar) related files.

It's also reporting a pile of hash mismatches for Defender, which seems to be a resurgance of a previously know issue which was supposed to have been fixed.

It's Saturday so I'm now in the pub having a beer or seven, might run DISM later.

[Maurice Naggar]

Did you check your Windows Update history to see the most recent updates completed.

Does yours show KB4515384 ?

[nukecad]

I always check for updates again following a cumulative update install, and yes everything installed sucessfully and KB4515384 is there.

Just for more fun I've now noticed that my laptops wifi adaptor is not seeing any networks at all. (I've been using 4G tethering through my phone).
Other devices see 4 or 5 available networks, but the laptop won't even look for them when you click 'Show available networks'.
(Windows troubleshooting says it's a driver error, wasn't an error before patch tuesday).
Interestingly I can connect my phone to one of those wifi networks instead of 4G and then tether that network through to the laptop via USB.

I'm thinking a restore point, or maybe even a repair/reinstall, may be in order. I'll think about it.

I've never had issues like this with any previous update, guess my machine just doesn't like this particular one.

Edited September 15, 2019 by nukecad

[nukecad]

I found the wifi connection problem, and have managed to resolve it.
It appears to be a Windows power saving setting that has messed things up following Patch Tuesday.

If anyone else is seeing this issue here is what I did to fix it:

I went into Device Manager, right clicked the wifi adapter, and selected properties.
In the 'Power Management' tab I unchecked the "Allow the computer to turn off this device to save power".
Then clicked OK, and closed out of Device Manager.

Then going to Settings>Network & Internet>WiFi and turning WiFi off and on again found (one of the) available networks.
But it was still having problems actually connecting.
So I went into 'Manage known networks', selected the one I wanted to use, and told Windows to 'Forget' it.
Then I put it back again with '+ Add a new network' (needs the wifi password) and selected the 'connect automatically' option.

It appears that you need to do this for all the wifi networks that you want to use; with the added complication that you need to add the wifi network name manually.
Windows seems not to be showing wifi networks that are not in your 'Manage known networks' list.
For example my phone was showing my neighbours wifi network, but Windows wouldn't show it as available until I manually added it to the list.
Once I had done that it was shown and I could connect to it. (Yes I do have their permission).

Now to try and work out what's going on with the taskbar context menus and system tray flyouts.

[exile360]

Yeah, I always disable the power saving functions for all devices on my systems.  That's something I've always done going all the way back to the XP days because I don't like the idea of any of my hardware going to 'sleep' and being unavailable/non-functional (USB devices, network devices, disk drives/HDDs etc.).

[nukecad]

As I say though there does seem to be a bigger issue as the Windows settings will not show the available networks.

It will show the one that your are connected to, which has to be in your known networks list, but clicking on 'Show available networks' results in no action whatsoever.

I'll relocate later and see if it will pick up the network(s) there.
I suspect that I'll have to do the 'forget' and 'add' trick again though.

EDIT- nope I relocated and it picked up the network and connected automatically.
Still can't see the other available networks though. I've tried updating the adapter driver with no joy.
As long as I can connect OK then I'll leave it for MS to get around to fixing it properly.

Edited September 16, 2019 by nukecad

[nukecad]

On 9/16/2019 at 3:40 PM, nukecad said:

As I say though there does seem to be a bigger issue as the Windows settings will not show the available networks.

It will show the one that your are connected to, which has to be in your known networks list, but clicking on 'Show available networks' results in no action whatsoever.

Just to note (belatedly) that later updates have cured this issue.

It  was then showing all available networks, but on startup I did have to toggle flight mode off and on to get it to connect automatically.
I eventually changed from and then back to Automatic start up for the WLAN AutoConfig service and it seems to be working normally now and automatically connecting at boot.
(Start Menu>All apps>Windows Administrative tools>Computer management>Services and Applications>Services>WLAN AutoConfig>Properties>General>Startup Type)