GWX, otherwise known as the "Get Windows 10" popup, acts suspiciously similar to malware, except that it is made by Microsoft.

Like malware, GWX:

  • installs itself without the user's consent as an "important" update
  • downloads and "preloads" 6 GB worth of Windows 10 installation files without the user's consent
  • constantly nags the user about downloading Windows 10
  • actively prevents the user from disabling it permanently
  • changes its behavior through the addition of undocumented features to further prevent its disabling
  • requires a special, third-party tool to be removed completely from a system
  • advertises another product, even if Windows 7 users get it for free
  • is a potentially unwanted program (PUP).

Even TechRadar refers to GWX Control Panel's constant development as an "uphill battle" as random updates seem to push new versions of GWX (with new tricks) to Windows 7 computers.

So, can GWX be considered malware?

  • 6
    In my opinion, yes it is malware. I then disabled automatic Windows updates and didn't install any updates without checking what they do first (under the assumption that Microsoft doesn't outright lie about what each update does, of course...) – user253751 Dec 12 '15 at 11:47
  • 2
    @user20574 Given that oh so many KB articles about recent updates only say something like "this is important, but we don't bother telling you for what", you are not left with many updates to install – Hagen von Eitzen Dec 12 '15 at 14:25
  • 6
    Voting to close this as 'opinion-based'. I don't see any good can come of it, it's just going to turn into a rant-fest better suited to a chat forum. – Tetsujin Dec 12 '15 at 15:35
  • 3
    A key point of malware is that if the user knew the implications he would refuse to install the software. That is the case here for many users. In fact that makes it kind of a scam. – usr Dec 12 '15 at 17:59
  • 1
    @HagenvonEitzen's right. It really annoys me that updates are not clearly labelled. They're just "this is an important security update". How is that allowing me to make an informed decision about whether to install it? It's deliberately not, is the answer to that. – Lightness Races in Orbit Dec 12 '15 at 23:41

I would call it a rather irritating annoyance, but not malware - neither technically nor substantially.

installs itself without the user's consent as an "important" update

Only if you have "important" updates set to automatically install. Otherwise, you have the chance to review the list of pending updates, and uncheck (or hide for good) KB 3035583 which installs the "Get Windows 10" applet.

Needless to say, once you did enable auto-install of "important" updates, you waived your option to choose, and left it to Microsoft to decide what's "important".

actively prevents the user from disabling it permanently

There are several well documented ways to get rid of KB 3035583 if you installed it by accident, see for example How to disable the “Get Windows 10” icon shown in the notification area (tray)? or How to remove Windows 10 upgrade updates in Windows 7 and 8.

| improve this answer | |
  • 4
    There are well-documented ways to become root on Android, but we can still say Android actively prevents you from becoming root. – user253751 Dec 12 '15 at 20:45
  • 1
    One of the issues is Microsoft randomly decides to re-enable automatic updates every once in a while without letting you know. For example, this happens when you enable Microsoft Update from within Windows Update. So no, you don't necessarily waive the right to choose; sometimes they waive your right for you. – user541686 Dec 13 '15 at 1:01
  • @Mehrdad Microsoft Update is a superset of - and requires - Windows Update, so it's not a total surprise that enabling Microsoft Update may in fact change the Windows Update settings. Just as anecdotal evidence, I have always had Windows Update set to "never check" on my computers, and the wuAuServ service set to "manual" startup. I have seen neither updates reset to "auto" nor the service starting on its own, ever. Again, this is just my experience on a handful of computers and VMs. YMMV of course. – dxiv Dec 13 '15 at 2:28
  • @dxiv: Well it was one hell of a surprise for me. My mileage definitely has varied from yours! – user541686 Dec 13 '15 at 2:32

there is no objective definition of malware, so as such you are free to consider it what you want. The best definition I've found is here at the Oxford English Dictionary, but it includes subjective elements.

The code security industry has to make decisions on what is and what isn't malware by their assessment, as do legislatures around the world, and while those definitions may contain terms that describe GWX, the vast majority of users do not believe it to in fact be malicious, so no major entities are likely to determine it to be such.

| improve this answer | |
  • 4
    How do you know that the vast majority of users do not believe it to be malicious? – oldmud0 Dec 12 '15 at 4:58
  • 4
    I asked them ;-) – Frank Thomas Dec 12 '15 at 8:22
  • 3
    @FrankThomas Majority of 67 000 000 users at Jul 31?!? 8- ) I'm imperssed ;-) – g2mk Dec 12 '15 at 19:46
  • @g2mk Oh common, you only need to ask a representative sample to get a decent idea. My experience mirrors oldmud0's. Most folks do not consider GWX to be malicious. In fact, most folks I've dealt with have happily taken up the Win10 offer and are pleased to have something for nothing. As for me personally, GWX annoys the hell out of me. As does MS. I'm fascinated by just how much abuse the average Joe is happy to take these days. I guess iOS and Android started it, normalized it, and now MS can do whatever it wants. – misha256 Dec 12 '15 at 21:21
  • @misha256 I just have joked - I have visualized FrankThomas asking all that people. More seriously: 67*10^6 > W7/W8 updaters >> aware W7/W8 updaters. – g2mk Dec 12 '15 at 21:48

From Wikipedia:

Malware, short for malicious software, is any software used to disrupt computer operations, gather sensitive information, or gain access to private computer systems. Malware is defined by its malicious intent, acting against the requirements of the computer user, and does not include software that causes unintentional harm due to some deficiency. The term badware is sometimes used, and applied to both true (malicious) malware and unintentionally harmful software.[2]

So IMO...

Is it a software used to:

  • Disrupt computer operations? Maybe it's not designed or used to do that, but unfortunately can lead to disrupting computer operations. My opinion: almost is.
  • Gather sensitive information? If you don't pay enough attention its downloads and install a software that gather sensitive information. My opinion: it is.
  • Gain access to private computer systems? Fortunately it seems to not do that.

Is it:

  • Defined by its malicious intent? My opinion: it is trying really hard to be.
  • Acting against the requirements of the computer user? It definitively do.


  • Malware does not include software that causes unintentional harm due to some deficiency. Its operations definitively are intentional and carefully planed.

So objectively it subjectively can be a malware and it definitively objectively is a badware ;)

| improve this answer | |
  • 1
    One could easily argue that forcing/tricking everyone onto Windows 10, whether they want it or not (which seems to be the intent of GWX) is malicious. – user253751 Dec 12 '15 at 20:57
  • @user20574 That's why I have used: IMO, my opinion and subjectively ;) – g2mk Dec 12 '15 at 21:55

It is technically not malware (causes no damage), but I call it Potentially unwanted program. It is an advertising tool to annoy users to upgrade to their latest Windows.

| improve this answer | |
  • 9
    Of course it causes damage, if your internet connection has a data cap, Microsoft has effectively stolen your data. And no the argument of "get an unlimited connection" isn't a valid one as a these can be either more expensive or not available or may just not be needed and perfectly adequate otherwise. – DetlevCM Dec 12 '15 at 14:48
  • 1
    And what is a time lost on paying attention to accidentally don't install W10?!? Aren't an unwanted installation (especially in production environment or without drivers in W10), bandwidth and diskspace lost to download W10 a damages? – g2mk Dec 12 '15 at 18:20
  • And time spent waiting for the installer, then the uninstaller, with which you could be doing something productive. – user253751 Dec 12 '15 at 20:55
  • Stealing 6GB of my available disk space is hardly "no damage" either. – Lightness Races in Orbit Dec 12 '15 at 23:39
  • "...It is technically not malware (causes no damage)..." -the Morris Worm did not cause any damage, either. But Robert Morris was tried and convicted of violating United States Code: Title 18 (18 U.S.C. § 1030). – jww Dec 27 '15 at 1:29

No, this program does not fall into the malware category, as the program does zero damage against your computer, does not breach any privacy.

| improve this answer | |
  • 9
    It entices users to degrade their own privacy by installing Windows 10. – user253751 Dec 12 '15 at 11:50
  • 6
    Of course it causes harm - it uses up your data allowance by downloading Windows 10 in the background. Some people have a limited data allowance - and in this case, Microsoft has actively stolen from their data allowance WITHOUT advising the user they would do so. (The associated Windows Update only claims 400-700 odd KB of size) – DetlevCM Dec 12 '15 at 14:50
  • It may also have non-obvious costs. I've seen it on many, many, many Windows 7 computers in institutions such as universities and hospitals, where it's eating up hard drive space. Sure, you could blame the administrators, but it doesn't meant that it's not doing damage. – AndrejaKo Dec 12 '15 at 15:30
  • How do you know that it isn't breaching privacy?  For that matter, isn't there plenty of evidence that it does breach privacy? – Scott Dec 13 '15 at 3:14
  • "...as the program does zero damage against your computer..." -the Morris Worm did not cause any damage, either. But Robert Morris was tried and convicted of violating United States Code: Title 18 (18 U.S.C. § 1030). I have spent countless hours removing it because of the endless stream of nags it produces. This malware has likely caused millions of users hundreds of millions of hours of lost productivity and endless frustration. – jww Dec 27 '15 at 1:27

the way it subverts the owner and tries to force itself on us. it is very much like a Trojan down loader and indefinably is legalized malware, any process that behaves in a way that reduces the usability of a system.. is a malicious program gwx.exe creates hidden folders and then prevents the removal of said folders by ordinary means. it also is installed without consent of the user/owner of the system and that is not ethical or acceptable. it also intentionally slows down the system i have done a lot of experimenting on this. the longer you ignore it the more it slows down the system i tested this on a system with two 3.6 ghz quad core processors, the other dirty thing it does is if you do disable it it messes with the trusted installer and make-cab processes. this results in the trusted installer taking over all the ram or cpu bandwidth or both at the same time rendering the system useless my system with dual quads @3.6 ghz and 32gb of ddr3 ram was rendered useless by this thing for 29 hours. and it results in logs in the cbs logs folder that reach sizes as big as 26gb and its not one log file that size. it makes many of them and will do so until the drive is full (verified by allowing this crap to run undisturbed for 76 hours it finally stopped when it ran out of space on a 3 tb drive and crashed the system)

| improve this answer | |
  • 2
    This is more of a rant than an answer. – DavidPostill Dec 13 '15 at 0:05
  • 1
    well i was a bit cross about it mostly because like the majority of people im happy with my windows 7. and dont appreciate having to spend almost 2 weeks trying to get rid of Microsoft hostage ware. that should never have been on my systems in the first place? i think everyone can agree that this UN invited spam in a can is pretty low even for Microsoft. – Arion Mitutoyo Dec 13 '15 at 0:48
  • the exe file is a tool i dug up off the web that disables silent os upgrades and also gets rid of the gwx problem. and no that file is not hosted from a local drive its hosted from a nas server i manage at work its also available by email request. <skysongsf.es@gmail.com) i have used this on all the systems i manage with only a few issues on some of the more abused units. – Arion Mitutoyo Dec 13 '15 at 1:49
  • 1
    Additional note: Disabling automatic updates appears to trigger a bug in Windows Update where, after some time, it will eat all your memory and slow your computer to a crawl. (The only workaround I know is to stop the Windows Update service when/if this happens, and start it again later if you want to install updates) – user253751 Dec 13 '15 at 1:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.