Why is Microsoft providing wrong codebase updates for an Intel based cpu machine running Microsoft Windows Professional 10 and acting like a virus?

I found this post on https://www.redmondpie.com/disable-turn-off-automatic-updates-in-windows-10-heres-how/comment-page-2/

I have not included the preamble but this seems to disable Microsoft Update if you follow it do it at your own risk . I am doing it to see what it will do and will report back if it works

*** Note : You must be logged in with an administrator level account.

1. Start by selecting COMPUTER / LOCAL DISK (C:) / WINDOWS / SYSTEM32
2. Scroll down and RIGHT CLICK on WindowsUpdateElevatedInstaller.exe and select PROPERTIES.
3. Select the SECURITY tab and click the ADVANCED button. Click CHANGE on second line next to Owner.
4. In the Object Name Box, type in the USER NAME of your Administrator Account and the click on the CHECK NAMES button. The FULL Admin Account Name should now appear in the box. Highlight the Admin Name and click OK.
5. The OWNER should now be your Admin Account. Close this box and then immediately re-open. In the list box below, double click and select ALLOW ADMINISTRATORS ( your admin account ) and check ALL available permission boxes. Click on OK. Re-highlight ALLOW ADMINISTRATORS in the list box and click on APPLY. Next click OK and OK a second time to return to the SYSTEM32 File List.
6. Right click on WinUpdateElevatedInstaller.exe and select RENAME. Remove the highlight and move cursor to last character before .exe and add an X to the end of the file name. ( ie... WindowsUpdateElevatedInstallerx.exe )
7. Next, scroll down the SYSTEM32 File List to WUAPI.DLL and repeat steps 2 through 6.
8. Scroll to WUAPIHOST.EXE and repeat steps 2 through 6 again.
9. Scroll to WUAUCLT.EXE and once again, repeat steps 2 through 6.
10. Close all open windows and return to desktop.
11. Finally - Select CONTROL PANEL / ADMINISTRATIVE TOOLS / SERVICES ..... and RIGHT CLICK on WINDOWS UPDATE. Select STOP and then select PROPERTIES. In the center of the box, select the drop down arrow at the right of the STARTUP TYPE text box and select DISABLED. Hit OK and close all windows to return to desktop. Select START / SHUTDOWN / RESTART and re-boot your computer.
12. Upon rebooting, go back to CONTROL PANEL / ADMINISTRATIVE TOOLS / SERVICES ..... Scroll down to Windows Update and verify current status is still DISABLED.

"Close all open windows and breath a satisfactory "Hell Yeah !" You now have full control of the Windows Update Utility and can now toggle the service back on / off anytime you wish to check for updates or disable the service."

You must be a Microsoft employee? Quite frankly I am disgusted as you are aware that I have not received proper updates since January 2019 . Why would you be sending all these computers the same rubbish. to every computer connected to the internet . your comments are pointless and there are many MIcrosoft customers having probe,ems with these updates who demand Microsoft Act.

If you are as fed up as me with these non working malware updates follow this simple procedure . Please do so at your own risk and ensure you have a good Anti Virus Program and a Firewall. Personally I like and trust Norton:

This seems to disable Microsoft Update if you follow it do it at your own risk . I am doing it to see what it will do and will report back if it works

*** Note : You must be logged in with an administrator level account.

1. Start by selecting COMPUTER / LOCAL DISK (C:) / WINDOWS / SYSTEM32
2. Scroll down and RIGHT CLICK on WindowsUpdateElevatedInstaller.exe and select PROPERTIES.
3. Select the SECURITY tab and click the ADVANCED button. Click CHANGE on second line next to Owner.
4. In the Object Name Box, type in the USER NAME of your Administrator Account and the click on the CHECK NAMES button. The FULL Admin Account Name should now appear in the box. Highlight the Admin Name and click OK.
5. The OWNER should now be your Admin Account. Close this box and then immediately re-open. In the list box below, double click and select ALLOW ADMINISTRATORS ( your admin account ) and check ALL available permission boxes. Click on OK. Re-highlight ALLOW ADMINISTRATORS in the list box and click on APPLY. Next click OK and OK a second time to return to the SYSTEM32 File List.
6. Right click on WinUpdateElevatedInstaller.exe and select RENAME. Remove the highlight and move cursor to last character before .exe and add an X to the end of the file name. ( ie... WindowsUpdateElevatedInstallerx.exe )
7. Next, scroll down the SYSTEM32 File List to WUAPI.DLL and repeat steps 2 through 6.
8. Scroll to WUAPIHOST.EXE and repeat steps 2 through 6 again.
9. Scroll to WUAUCLT.EXE and once again, repeat steps 2 through 6.
10. Close all open windows and return to desktop.
11. Finally - Select CONTROL PANEL / ADMINISTRATIVE TOOLS / SERVICES ..... and RIGHT CLICK on WINDOWS UPDATE. Select STOP and then select PROPERTIES. In the center of the box, select the drop down arrow at the right of the STARTUP TYPE text box and select DISABLED. Hit OK and close all windows to return to desktop. Select START / SHUTDOWN / RESTART and re-boot your computer.
12. Upon rebooting, go back to CONTROL PANEL / ADMINISTRATIVE TOOLS / SERVICES ..... Scroll down to Windows Update and verify current status is still DISABLED.

"Close all open windows and breath a satisfactory "Hell Yeah !" You now have full control of the Windows Update Utility and can now toggle the service back on / off anytime you wish to check for updates or disable the service."

"This morning things are looking better . The updates seems to have stopped and the services have remained set under my admin control. The internet and machines are all faster without this malware."

Hello Martin!

Settings in Windows 10

Here's some info about settings for Windows Update. If you need help with something else, enter your question and I'll try to find the best answer for you.

Get the latest updates for Windows

Troubleshoot Windows Update

Schedule or pause updates in Windows

Talk to an Agent

OK. You can connect to a person below.

Select your product

Next

Select your issue

Next

Talk to a person

DJ M has joined the chat

Microsoft Answer Tech

Thank you for contacting Microsoft Support. I am DJ M. How can I help you today?

Please be aware that if you switch apps or change focus to another window while working with us, you may get disconnected from your chat session. To ensure the best support experience, please stay active in this chat window.

Hi there! It seems that the information you entered did not go through completely, can you please tell me more about the issue? Thanks.

Hi I was speaking to one of your agents

1472398955

of the name Cyril Y

Thank you for providing this to me, kindly provide me a few minutes to review the case.

np

Just to confirm the service is still running

Thank you for patiently waiting. Upon checking it here on our end. You are having issue with Windows update. Am I correct?

I am expecting to be able to run SC Delete wuauserv

to delete this Windows Update Service after restarting it had no affect on it

May I know what error you are having when you run the command?

There is nothing shown

background: https://answers.microsoft.com/en-us/windows/forum/all/why-is-microsoft-providing-wrong-codebase-updates/

I am following the procedure https://www.technipages.com/delete-services

How to Remove Services in Windows 10

Posted on July 17, 2018 by Mitch Bartlett 5 Comments

Remove services from the list in the services.msc utility in Microsoft Windows with one of these two options.

Option 1 – Command

You can also remove services using a command line. Hold down the Windows Key, then press “R” to bring up the Run dialog.

Type “SC DELETE servicename“, then press “Enter“.

“servicename” should be the exact name of the service.

Also, can you please tell me why are you trying to delete the Windows update services?

Se background link I posted

Please see the background link I posted

Yes I have seen it. Basically we can just disable it permanently on the registry but I think that may be a hard steps for you. Also I do not want to have a mistake and mess up your PC.

I am unsure why the correct procedure will not delete a service with the correct management tools could you explain why it is not being deleted?

Basically Windows update services cannot be deleted, it can only be disable the update from automatically updating your PC.

The control procedures for disabling the service do not function . These are overwritten and the service starts running of its own accord when I have disabled it permanently.

The control procedures for disabling the service do not function . These are overwritten and the service starts running of its own accord when I have disabled it permanently.

And for you information disabling the update is not recommended on our devices since Windows updates also helps us fix some issues on the older version of our OS

Well I don't want it don't need it infecting my machine with the wrong code base software

I see, then if you don't mind I can access your computer and do the work. Are you cool with that?

Microsoft dump 66k of files .5Gigabyte for AMD64 on my machine which will not run on processor I call that a virus.

I am not on same machine

And its behind a firewall

I understand. Thank you for that. But if you really want to disable it I can send the steps on your email and perform it on your most convenient time.

You have not provided any correct updates since January as your update service is seriously flawed

yes please send it to my email

and also provide it here

I truly understand your side. I will be sending the email after the chat.

please send the information here

Sure thing, kindly save the information that I will be providing to you.

1- Open Registry (regedit)

2- Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings

3- In the right pane, right click on a space/blank area> Choose "New"> Select "Dword (32 bit) Value"> Name it as DeferUpgrades and set the value to 1

4- On the same page, look for DeferFeatureUpdatesPeriodInDays and set the value to 365. If the value name is not existent, you need to create it just like the instructions in step #3.

5- Open services.msc and look for Background Intelligent Transfer Service, Cryptographic Service and Windows Update Service>Stop them and set them as manual

6- Open File Explorer and navigate to C:\WINDOWS and rename SoftwareDistribution to SoftwareDistribution.old

6- Restart PC

Why is this not published as link on a technote

This doesn't work

I have tried it before Microsoft Office reinstalls it. When it detects the keys changed

Hence why I wanted to remove it

May I know what are you referring on the Microsoft Office reinstalls it?

yes that is correct

Basically the 2 is not related. When you install an app of Microsoft Office, it doesn't affect the Registry.

Well Microsoft does not start after this procedure messes with crypto services. It fails to recover or start up and you have to reinstall to restore it to working condition . Which then installs Windows Update again !

I have already been round this route several times

I asked for a port and server address so that they ports and address could be blocked in the router. Its never been forthcoming

If you would like we can perform a custom or clean installation of your device since you might have done some major changes on your registry and other settings.

There is nothing wrong with my windows instal . It is just your Windows Update

Basically the steps that I have provided to you is to disable only the Windows update services of your device and not the crypto services.

which I have deleted SoftwareDistribution folder in windows more times than I have had breakfast since january

Have you tried modifying your registry? And can you also provide me the steps that you have done?

1.    I have already explain this procedure 1 - 6 Does not remove the Windows Update .

2.    I have asked you how to use the windows management tools to delete this service from my machine

3.    I have asked previously to be provided with port address and address of the remote windows server supplying updates so that it can be blocked in our router

I'm afraid we cannot provide it because the Windows update is automatic. And the only to disable the automatic windows update is the steps that I have provided to you.

And also, I will be reporting your issue to the engineering department. Because honestly this is the first time that I have encountered this kind issue, not being able to disable the update services.

I have already informed you twice giving reasons why these steps you have provided do not work

This doesn't work either reporting this to everyone

its already been reported to everyone at Microsoft. I have been trying to resolve this since January

It is now May

5 months later

There has not been one helpful suggestion as a result of those reports

Okay, if you don't mind I can take over your computer and proceed with disabling the services, I will make sure to disable it all.

Do I have to report this as a virus to Norton as it is clear from what you have told me that it is self-replicating and dumping material 66K files which are incompatible to my system onto a hard drive connected to it!

Can you please inform me what other steps I should be require to do to mark these malignant files you call Windows Update as a verified virus?

I perfectly understand where you are coming from. If none of the advanced steps didn't work, we can do a remote access to the affected device for me to check it. I will also check the availability of our higher level of support for further assistance.

Why is your own Microsoft Anti Virus protection not cutting in and detecting this malware

This falls under our No charge support.

?

which seems centered around this service WSUS: wuauserv

Actually, we have windows defender full scan and offline scan.Sometimes Windows Defender Antivirus might find malware that it can’t remove—for example, highly persistent malware such as rootkits. If that happens, it will prompt you to run Windows Defender Offline, which is already installed with Windows 10.

Would it be alright if we do a remote session so I can check it further?

Well I have clearly shown you that WSUS: wuauserv is self replicating and dumping 60K of incompatible files on to a hard drive which has Windows Professional 10 on it. It is clear none of your procedures can disable this process. Why then is Windows Defender not doing its job

Please refer to my previous comments

Have you also tried the steps under this link: https://social.technet.microsoft.com/Forums/office/en-US/abde2699-0d5a-49ad-bfda-e87d903dd865/disable-windows-update-via-powershell

please hold

Sure thing.

Sadly that is only available on WindowsServer

If that's the case, we only have one last shot for this which is to do a custom installation process. This will remove any faulty system files and correct the services that are not properly running on your device.

We can just download an ISO file and directly run it to the affected device

We can still keep your files, but the apps you installed needs to be redownloaded again

Yes but it will not remove this malware WSUS: wuauserv

Its actually not a malware, its a service for windows updates that is default to windows devices.

I asked you provide us with a Microsoft written version of Ntlite free

But it will reconfigure its function for you to be able to disable the services of windows updates in the future as any changes doesn't apply on your PC due to file misconfiguration as of the moment

I can make and exemption for you and prepare it as an email

WSUS: wuauserv has the same MO as a virus and malware self replicating and downloading foreign corrupting software which will not run on the processor it is being downloaded too

]

I am sure Norton would define this as a virus

Have you tried using Norton then?

A computer virus is a type of malicious software that, when executed, replicates itself by modifying other computer programs and inserting its own code. When this replication succeeds, the affected areas are then said to be "infected" with a computer virus. Computer virus - Wikipedia https://en.wikipedia.org/wiki/Computer\_virus

I ask you to provide the correct steps to report this fully as a virus under the definition WSUS: wuauserv

Sorry I cant do that as it is NOT a virus. is a windows update service which is default to windows machines

Ive seen here that you've been contacting us back and forth with issues you are creating with your device.

You are in error I am afraid I have already given you the definition from WIKI

Please provide me the method to report this as a registered virus under the name WSUS: wuauserv

I understand, but you cannot find anywhere about wuauserv being a virus

That is because you are not providing me the correct steps to register it

are you therefore not acting in regard to the service agreement

You can use the feedback hub application found once you click on Start menu and have this reported

to protect services

I have done that it did nothing no answer

I require you to provide a website independent to Microsoft that this evidence can be sent to confirming this WSUS: wuauserv is in fact a virus which cannot be removed

I can get a follow up about it and you can provide your email account to me so that I can send you an email as soon as we have the feedback from our Management regarding this

Its not a virus though

Please provide the steps to register a new virus?

So that at least I can act inline with service agreements

I repeat A computer virus is a type of malicious software that, when executed, replicates itself by modifying other computer programs and inserting its own code. When this replication succeeds, the affected areas are then said to be "infected" with a computer virus. Computer virus - Wikipedia https://en.wikipedia.org/wiki/Computer\_virus

If there is nothing else that I can assist you with, I can go ahead and close this chat session

WSUS: wuauserv has exactly the same nature described on this wiki page.

It is not.

https://en.wikipedia.org/wiki/Computer\_virus

Well it will not be currently as you are not providing me with a clear procedure or outcome how to register a new virus.

It is not telling that WUAUSERV is a virus.

I have defined this is in this email

You did not admit the clear thought processes were wrong

If you like to know more about it, you can also refer to https://en.wikipedia.org/wiki/Windows_Server_Update_Services

https://en.wikipedia.org/wiki/Computer\_virus aka WSUS: wuauserv is inserting 60k of files into my system which are designed to not be compatible and therefore corrupting in nature. It is self replicating and cannot be removed If you turn it off it comes back on again

I don't know how to make this clearer to you

There is no mark that this is a virus, please understand that Microsoft wont let any harm to any of our customers devices.

Well you are harming my computer equipment and have been doing this since January 2019

That cant be possible if you have windows defender active or any AV software like Norton that you have mentioned.

If there is nothing else then, we can do close this chat session.

You have been served legal notice to stop sending these files to our systems

I will share this on your chat services

Thank you for contacting Microsoft Windows Support. Have a great day/night.

Your Microsoft expert DJ M has ended your chat session. Thanks for visiting Microsoft Support.

Chat ended

DJ M has left the chat

Microsoft Answer Tech

We appreciate your feedback

We appreciate your feedback

Wonders if Microsoft is no longer fixing errors with Windows professional 10?  It sure does feel like no one is listening any more! All they want to do is run a remote session; like its going to solve the problem, when I have already informed them that the registry keys that they are inspecting in their Software update app to determine what to download which is downloaded from their server to my distribution directory in Windows home 10 do not exist in Windows Professional 10. It is then clueless knowing what to download . Can someone please inform me who is writing this rubbish update code which is becoming very frustrating.