Latest Updates

Update for Windows 7 and 8.1 silently installs Windows 10 downloader

Posted 05 April 2015 13:54 CEST by Jan Willem Aldershoff

Microsoft has released an optional update that “enables additional capabilities for Windows Update notifications when new updates are available to the user”. We discovered the update is actually a downloader for Windows 10 which will notify the user that Microsoft’s upcoming operating system can be downloaded.


(Dutch version of Windows 8.1 – Windows 10 downloaden (download Windows 10) clear visible as file description)

Windows Update KB3035583 doesn’t reveal much about itself, only that it adds additional capabilities to Windows Update and applies to computers running Windows 8.1 or Windows 7 Service Pack 1. The update is offered as a recommended update since March 28th and because it’s a recommended update users have to  manually put a checkmark next to the update in order to receive it.

Once the update is downloaded it adds a folder to System32 called “GWX” which contains 9 files and a folder called “Download”. One of the four .EXE files reveals what the update really is, the description of GWXUXWorker.EXE states, “Download Windows 10”. This explains the X in the name, the X is the Roman number 10.

Update: Want to get rid of this KB3035583 – Windows 10 Downloader Update? Read on here

The folder also contains “config.xml” which contains some URLs that at the moment of writing didn’t work.  The config  file mentions “OnlineAdURL” that points to and Telemetry BaseURL pointing to


The section “Phases” describes how the downloader should behave when the Windows 10 release date nears. Initially, during phase “None”, all features are disabled, then during  phase “AnticipationUX” advertising banners will be shown, presumably on a homescreen tile and additionally a tray icon will appear.

The next phase is called “Reservation” which according to the config file will show the advertisement tile, the tray icon but also a reservation page. Further phases are the first publication of the final RTM (release to manufacturing), version the general availability (GA) as well as various phases of the upgrade process such as UpgradeDownloadInProgress, UpgradeDownloaded, UpgradeReadyToInstall, UpgradeSetupCompatBlock, UpgradeSetupRolledBack and UpgradeSetupComplete.

It appears Microsoft is serious when it comes to upgrading Windows 7 and Windows 8.1 users to Windows 10. The upgrade will be free in the first year and it appears Microsoft will take that time to convince users to upgrade. Users that don’t want to receive the upgrade “advertisements” should simply not install the recommend update. If Microsoft however decides to make KB3035583 an important update it will install automatically with other Windows update.

Join the Windows 10 Google+ Community for more news and updates

Posted on: 05 Apr 15 11:59
Here are both XML files for those who want to check
1 Agree

MyCE Member
Posted on: 05 Apr 15 21:29
Without going into much details, this update also detects validity of the OS. See my post in the windows loader support thread. It detects and flags the slics by the latest loader version
5 Agree

G_Ivan Awfulitch
MyCE Resident
Posted on: 06 Apr 15 17:01
If anyone has the update number please post it. I don't even want it on my computer.
Thanks Guys
-12 Agree

MyCE Member
Posted on: 06 Apr 15 17:14
Try reading the article again, it's already in it. Immediately below the image
10 Agree

MyCE Resident
Posted on: 06 Apr 15 20:33
Here you go Ivan :

If you did install it this is what to look for:
Once the update is downloaded it adds a folder to System32 called “GWX” which contains 9 files and a folder called “Download”. One of the four .EXE files reveals what the update really is, the description of GWXUXWorker.EXE states, “Download Windows 10?.
2 Agree

New Member
Posted on: 06 Apr 15 20:37
"This explains the X in the name, the X is the Romanian number 10"

This part is wrong. Yo guys meant to say Roman. Romania uses the Arabic numbering system
13 Agree

MyCE Member
Posted on: 06 Apr 15 22:12
My firewall caught this crap a couple of days ago. There wasn't much information about it online so I kept it temporarily (without internet
access) but I uninstalled it today after verifying what it is.
-2 Agree

MyCE Resident
Posted on: 06 Apr 15 22:25
I keep Windows Update set to disabled in services.
When I want to use it I set it to Manual.
Thanks to this article I was able to just right click on it & "Hide update" it.
-3 Agree

MyCE Member
Posted on: 07 Apr 15 11:50
why disable? you do know you can configure it to just look for updates but not download/install them right? Does the same thing and thats how i got it. Unistalled that update too know that its clear what it is, a freaking trojan in a way from micro$oft
2 Agree

G_Ivan Awfulitch
MyCE Resident
Posted on: 07 Apr 15 12:20
Thanks to both of you. I don't know how I missed it.
-1 Agree

Senior Administrator & Reviewer
Posted on: 07 Apr 15 16:08
I booted Windows 8.1 on my Desktop which was last booted a few months ago and I caught the following screenshot just it completed installing:

Attachment 300839

I wonder what it installed extra, unless this update was installed automatically without being given the choice...
0 Agree

MyCE Resident
Posted on: 07 Apr 15 16:31
I need to get MS to count me out 50 dollars a million times giving me 51 of 50 .
0 Agree

Senior Administrator & Reviewer
Posted on: 07 Apr 15 20:31
Interesting description for this update in the Windows update screen - totally different to Microsoft's KB page. This is on my laptop which didn't have the update installed yet:

Attachment 300843

After the update claimed it was installed, I didn't see a 'GWX' folder in system32, so I searched the OS drive for it. In the short time it took the command prompt to search the drive, it suddenly appeared:

Attachment 300844

When I brought up the task manager, I could see a Windows installer process running hogging the CPU for another minute. So this update is quite sneaky, continuing to run despite the Windows Update screen claiming the update has already completed!

It's similar to the pesky .NET framework updates where they hog the CPU compiling modules in the background for several minutes after Windows Update claims it finished installing them.
3 Agree

New Member
Posted on: 02 Jun 15 01:18
Seán, you did not see GWX in your first DIR command because the directory has the System attribute. Your second DIR command includes the /A which shows ALL files/folders, incjuding Hidden and System.

0 Agree

Legal Senior Admin
Posted on: 02 Jun 15 01:47
Hmm, I now have a tray icon on the taskbar of both my windows 7 systems entitled "Get Windows 10". Installed wholly without any action my part. Grr!
3 Agree

New Member
Posted on: 01 Jul 15 21:33
My Wife and I both have windows 8.1 Pro and KB3035583 has been installed on both of our Computers . She received the Windows Icon on her computers task bar to Reserve Windows 10 , But I have Not. Not Sure Why.
0 Agree

MyCE Resident
Posted on: 02 Jul 15 00:42
If this news keeps going I might have to remove


as well...
0 Agree

MyCE Resident
Posted on: 02 Jul 15 14:10
I have several boxes, all 8.1 equipped and all received the KB303553 update.
I have uninstalled the update on all and it has removed the icon and whatever traces on all computes but one.
On that box the tray icon notification is gone but I'm left with a notification in Windows Update which I am unable to remove. I would appreciate any input on how to eradicate.
2 Agree

MyCE Resident
Posted on: 02 Jul 15 16:12
@ Nemesys that is odd I don't get that on my Windows 7 even with Windows update 10 notification on my task bar.
0 Agree

MyCE Resident
Posted on: 02 Jul 15 19:24
Four desktops and two laptops and only one desktop displays it.
This is a brand new build only several day old.
I have even reinstalled KB3035583 and uninstalled it to no avail.
0 Agree

New Member
Posted on: 01 Aug 15 19:23
Dear All
How much data it will consume for windows 10 to download in background, because I had lost around 5 GB in last one week.
0 Agree

New Member
Posted on: 31 Aug 15 18:13
I inadvertently installed the GWX updates and I was able to uninstall it but my firewall indicated that telemetry data (I use this term loosely) was still being sent...I followed the exe and found that a task has been installed, running using the Trusted Installer user - I could not change, disable or delete it because I did not have the password to that account. I eventually found the task in the Windows/system32 folder and deleted it from there and then I blocked all the GWX exes I could find, all telemetry exes, all inventory exes and a diagnostic tracker exe....I think I blocked 8 exes in all. And this was after I supposedly uninstalled the GWX offering. and I am not an expert by any means. Do you think I got them all? Very unhappy with this - I have joined the crowd that will not be moving to WinX.
1 Agree

New Member
Posted on: 25 Jan 16 05:26
So, I too fell victim. I beat the fucker. This is how you do it.
First I found in my installed updates an update simply called :KB3035583

Uninstalled no luck....
Then I rebooted, went back into installed updates.. I searched : KB3035583

I found an installed update : something like System upgrade or windows system update.... I forgot to really read cuz I didn't think this would be the end all be all fix.. sorry.
But then I noticed kinda hidden in cursive was that same old KB3035583

Uninstalled it, rebooted...

GONE even the GWX folder in system 32 disappeared....

Those sneaky bastards can try...
1 Agree


Register to

Register in 10 seconds, pick a username, enter your mail address and proof you're human, that's all!

An username is required and can only contain letters and numbers
Email is required, we'll send the password there

Welcome back

Sign in with your Myce account. Not a member yet? Create an account

A username is required and can only contain letters and numbers
A password is required

Post your comment settings

Several settings at can be changed, they are stored in cookies, which means they will be reset if you clear cookies


Change the background to a plain color or trianglified image (similar to the default image)

No tracking features

At Myce most social media feature are done server side and impose no privacy risk to the visitor when not used. Several features use Javascript with you can turn off here


Switch to the List layout for an index with chronologycally listed news items or Grid layout for a block based layout. To see the change you need to reload the page