New 7 SP1 Install - Installing Updates?

[Elliot77]

Hello,

I'm putting 7 Home 64 on a new machine, and I've seen there are issues with telemetry-related updates included in the Convenience Rollup.

My question is, what would be the best approach to have a secure and efficient Windows 7 system, while avoiding any Windows 10, telemetry-related, or otherwise potentially problematic updates?

Thank you

Edited September 17, 2016 by Elliot77

[sanszajnrege]

The best way is to run Simplix Updater after installation. That's what I do every reinstall. It doesn't contain any evil updates.

http://update7.simplix.info/

Click "Загрузите UpdatePack7R2" on the left top corner of site.

[CamTron]

AFAIK, Windows 10 is no longer free to upgrade, so you shouldn't be upgraded to Windows 10 against your will anymore.

[sanszajnrege]

yeah, but telemetry updates are still present.

[erpdude8]

On 9/19/2016 at 11:33 AM, sanszajnrege said:

yeah, but telemetry updates are still present.

but only a few.  There's the KB3184143 update that removes alot of the Get Win10 free stuff.

[HarryTri]

20 hours ago, erpdude8 said:

but only a few

Don't be misled, telemetry updates for Windows 7 and Windows 8.1 do their (malicious I would say) work.

[vinifera]

even 1 is enought no frown, let alone "few"

[Nomen]

Back in August I was working with RT7 to create an installation image of Win-7 SP1 Ultimate 32-bit but without any of the "bad" KB's.  This is what I had determined at the time:

Here's my list of 99 "Bad KB's" for Windows 7.

947821 2823324 2999226 3054464 3075853 3084905 3107998 3138615
949810 2840149 3012973 3058168 3078405 3086255 3112336 3139921
958559 2876229 3014460 3060746 3078667 3088195 3112343 3139923
971033 2882822 3015249 3064683 3080042 3090045 3118401 3139929
976932 2902907 3021917 3065987 3080149 3092627 3121260 3146449
2454826 2922324 3022345 3065988 3080800 3093983 3123862 3150513
2505438 2923545 3029606 3068707 3081437 3099834 3124280 3167679
2506928 2952664 3035583 3068708 3081454 3100956 3125574 3173040
2545698 2970228 3042058 3072318 3081954 3102429 3126030
2592687 2976978 3044374 3074677 3083324 3102810 3134815
2660075 2977759 3046480 3074683 3083325 3102812 3135445
2670838 2990214 3050265 3075249 3083710 3103696 3135449
2726535 2994023 3050267 3075851 3083711 3103699 3138612

The convenience rollup kb 3125574 (which I list as "bad") contains the following "bad KB's" that are in the above list:

2660075 2970228 3075249 3092627
2726535 2994023 3078667 3102429
2882822 2999226 3080149 3107998
2923545 3068708 3081954 3118401


If you start with a fresh install of Win-7 Ultimate 32-bit (this might apply to 64-bit as well) and do not choose KB3125574 but take everything else offered by WindowsUpdate, then the following KB's will be offered to you that are on my bad list:

976932 2726535 3042058 3092627 3167679
2506928 2923545 3068708 3102429
2545698 2952664 3078667 3118401
2592687 2970228 3080149 3124280
2660075 3021917 3086255 3138612

One other note: KB3161102 will irreversibly remove the "Windows Journal" feature/function from your system. I'm not calling this a "bad" kb because of the relative lack of use of that feature and it's well documented troubles as being exploitable by malware. If you use Windows Journal, then put 3161102 on your bad list.

Bottom line: If you avoid the 99 KB's in my bad list, then there are a total of 278 "good" KB's that you might or should want to download (or roll into an install image). This includes 107 KB's in the convenience rollup, some of which may not be offered to you through a WU session but instead would have to be downloaded and installed manually. There is one exception: KB2670838. It's called an "Evil update" but it is one of a handful of necessary KB's you need to update the system to IE 9 or higher.

 

[pointertovoid]

What about the Servicing Stack?
I know it's required before installing the Convenience Rollup by standard means. But does it by itself contain updates?
In other words, if I install the blessed telemetry-free post-SP1 updates instead of the Convenience Rollup, is the Servicing Stack any necessary?

Also: I've seen people using special commands to integrate the Convenience Rollup in the Seven installation Dvd.
Can the normal updates /integrate to the contents of the Seven installation Dvd as was done for W2k and Xp?

And does anything speak against Nero to add the boot sector to the Dvd, instead of using a part of the 1.7GB AIK?

Thanks!

[erpdude8]

On 11/4/2016 at 7:13 AM, Nomen said:

There is one exception: KB2670838. It's called an "Evil update" but it is one of a handful of necessary KB's you need to update the system to IE 9 or higher.

 

KB2670838 is only required when installing either IE10 or IE11, not IE9.  plus there's KB2834140, which provides a fix for KB2670838.

KB2670838 is no longer "evil" - it was only evil when installed on laptops with hybrid or switchable amd/intel or nvidia/intel graphics adapters using outdated graphics drivers.  updated graphics drivers were provided to OEM/PC manufacturers that were compatible with the KB2670838 update.

to answer pointertovoid's question about servicing stack updates, install either KB3020369 or KB3177467 servicing stack update first before any other update.

Edited May 30, 2017 by erpdude8

[Nomen]

> KB2670838 is only required when installing either IE10 or IE11, not IE9.
> plus there's KB2834140, which provides a fix for KB2670838.

My Win-7 SP1 install image (created with RT7) I believe currently contains both 2670838 and 2834140. Because my install image also includes IE 11, you're saying I can remove 2670838 and keep 2834140 - yes?

> KB2670838 is no longer "evil" - it was only evil when installed on laptops
> with hybrid or switchable amd/intel or nvidia/intel graphics adapters using
> outdated graphics drivers.

The Dell laptop that I use for my test platform does indeed have both Intel and Nvidia graphics adapters, and I'm pretty sure that my win-7 install image has the most recent Nvidia / Dell drivers.

> to answer pointertovoid's question about servicing stack updates,
> install either KB3020369 or KB3177467 servicing stack update first
> before any other update.

I see that my install image does have 3020369, and not 3177467. I find that windows-update queries seem to complete just fine, taking maybe a few minutes.