Ask Me Help Desk - Block a Single Windows Update with Auto-Update Enabled

One of the Windows updates sent out on 10/13/09 caused a problem on my XP system (very, very slow operation of all functions).

After a System Restore to a date prior to the update download, the problem was gone.

After another Auto-Update, the problem returned.

I know I can update manually and choose which updates to exclude, but wouldn't really know how to choose.

I have also learned that I can remove an update through Add/Remove Programs, but as soon as I turn on Auto-Update again, the problem update will be downloaded and return.

I have been using Auto-Update for years with no problems and wish to continue if possible.

All I know for sure, is the problem update was downloaded on 10/13 and it is 1 of 10.

Is there any way to permanently uninstall, or Permanently block a Windows Update from re-downloading, once I turn Auto-Update back on?

Thanks...

If you run an update manually you can deselect individual updates and check a box for them not to be offered again, however realize you are dealing with Microsoft and they may magically reappear at a later date if Microsoft's interests are served; Windows Genuine Advantage and new Internet Explorer versions come to mind. A greater level of certainty can be obtained with the free Windows Server Update Services (WSUS) that can be placed on your own server to act as an update repository for other computers. However, this is overkill to update a single computer.

Thanks, I found it. This is just what I needed!

If I select "Don't show this update again" will it also take it off the list of Auto-Updates?

Or does this only work if you load the updates manually?

Quote:

Originally Posted by mitchsc

If I select "Don't show this update again" will it also take it off the list of Auto-Updates? Or does this only work if you load the updates manually?

Now that you've made me think about it, I'm not 100% certain. I use WSUS with clients and my personal machines are set to notify but not download so I can review the updates. The most recent thing I had disabled was IE8 and I don't recall it showing up in the notify list, but I'm not absolutely certain. Best I can suggest is to wait until next month's updates and try it.

Other thought: If the bad update has already been disabled by running a manual update, it might be possible to test by setting Automatic Updates to notify, uninstall a single update, and then issue "wuauclt /detectnow" from the command-line to force detection, and see what shows up in the list.

Now that you mention it, as I recall, IE8 gave you a choice if you wanted to update or not. I chose no, and it never asked or tried to update again. May not be the same mechanism.

I've been chatting with Morgaine and have noticed that even without the Windows Update, my PC is now running very slow now. I don't know if it's possible that the Windows update messed up something in my registry that can't be undone with a Sys Restore, or if my PC is just getting mucked up and needs a fresh install.

It definitely runs much slower with the update. But now I am wondering if that may just be because my PC is clogged up.

I am going to do a fresh install. What I don't know is whether to install these last 10 Windows updates when I am done.

Several experts on this site say they install updates manually. I would have no idea how to know which ones are needed and safe to install. I have just trusted that MS knows what they are doing when they tag these as high priority updates.

Thanks...

Quote:

Originally Posted by mitchsc

Several experts on this site say they install updates manually.

I'm in that category too and wait about a week before installing to see if anyone complains on the Microsoft forums. I would think anyone who is or has been responsible for maintaining more than a handful of Windows machines probably trusts Microsoft about as far as they could throw them having spent far too much time over the years recovering from half baked patches or avoiding "critical" updates that aren't security fixes at all.

Quote:

Originally Posted by mitchsc

I would have no idea how to know which ones are needed and safe to install.

The only way is to test on a guinea pig machine before doing a wholesale rollout. Unfortunately this isn't possible nor practical for a single machine. If you set Automatic Updates to notify, there will be links in the resulting patch list to additional information about the patches. The info can be reviewed to gain an understanding of the attack scenarios and likelihood of being compromised. Usually, any update rated critical plugs an attack vector that would result in the machine being taken over by an outside party, but often unfettered network access is required. If your broadband connection has a good hardware firewall running NAT and the computer itself has a security suite running on it the risk is greatly reduced even for unpatched systems. Delivery by email, or more recently, by a compromised website is more likely.

Microsoft offers several security newsletters to keep informed about updates. They can be subscribed to from the "manage subscriptions" section of your profile at the Profile Center.

I'm going to jump into this one too. I have to agree about how much people trust MS. You've seen me say before that I don't like anything that is automatic, most particularly from them. :-) I'm almost surprised they let you do them manually, cause I feel like they think they're allowed to do whatever the heck they want.

I'm with you on not always knowing what I want to install. I get way behind on these updates, because I spend the time to read the bulletins, and those are really meant for techies who really understand that stuff. But the other update page doesn't give enough info to suit me, so I struggle through the techie stuff. Many of them say the same thing over and over anyway. You'll see a gazillion "specially crafted websites" and references to having to be lured to the site. Those are a dime a dozen, so to speak.

It is true that if you've got a good firewall and don't do a lot of stupid things, that you're a lot safer even without the updates. I'm never caught up on them and I don't have problems. (Knock on wood.) I'd say the vast majority of the updates are probably things I would never have to worry about, but if I think there's the slightest chance I could be affected, I get it. That is, if in doubt, I get it.

Now some of them are geared towards certain software I don't have so I don't get those. If I'm behind, I concentrate first on the critical ones. I pretty much get any of the critical or important ones that are relevant to XP. If it's for specific software, depends on whether I use it.

One thing about the auto update that I don't like is that there's all sorts of stuff in there that really isn't important at all. I'll have the thing scan my computer occasionally, just to see what it thinks I need, and it just comes up with tons of stuff that's totally stupid. Not to mention that it'll do updates to your video drivers and all sorts of things. I do NOT update drivers unless I'm having a problem. It'll also update Media Player and that sort of thing. I hate that, so that's why I avoid the auto thing. In other words, I don't know what to get either, but I can certainly make a decision about whether it's for XP or IE and might compromise my system (if in doubt, get it), or whether it's going to update my video driver.

OK, I believe this has gone into the realm of what's known as jabbering. (Something I'm very good at.) I would say my personal overall advice would be to just cut out driver updates or anything you absolutely know doesn't really apply to you, and get everything else. You don't have to install them manually like what I do. You can still go to the page, have it scan you and tell you what you need, dump anything you obviously don't need, and it'll still do the rest automagically. It also keeps track of what you've done.

Or you can keep it on auto. That's what most people do.