Windows Modules Installer quirk?

[BobArch2]

My daily incremental backup (with ShadowProtect) is scheduled to run 7:30PM 6 days a week. Typically the incremental backup involves less than 1GB of changed data on my system drive C:. Today, (Saturday) the incremental backup recorded a whopping 15.1GB of changed data on C:. There was nothing special that I did today that would invoke such a massive change. Drive C: is reserved for the operating system and software applications only. All personal files are on other drives.

Fearing that an attack on the environment might have occurred, I performed a full scan with Malwarebytes, after updating it to the current version... no found issues. Then ran a full scan with ESET security and except for a false/positive associated with WinZip, no issues.

I ran an analysis of CCleaner and that only showed 154MB of data that could be eliminated.

I dug a little deeper and checked the System Restore Point log. Found that an SRP had been created before a Windows Modules Installer update at 2:08 this afternoon. I am assuming that it was just part of Windows 10 automatic update process. No restart had been called for.

Then checked the Control Panel | Programs and Features and found that in addition to the Malwarebytes update that I had performed, there were an additional 14 items that showed an install date of today (approximately 11GB). I can only assume that these applications were impacted by the Windows Modules Installer.

2016-04-16_21-06-38.gif

The question becomes... has anyone else noticed this anomaly? And if so, can you shed some light on what might be happening?

Strange things going bump in the night!

[JoeP]

Did you install a new build?

Joe

[BobArch2]

Did you install a new build?

Joe

Last Saturday, 2016.04.09, I removed Windows 10 Insider Preview from my dual boot environment, removed the dual boot manager completely, formatted the separate drive that Win10IP used and upgraded my Win 8.1 Pro to Win10 Pro. All has been working fine for the past week.

There was an accumulative update to Build 1511 4 days ago on the 12th. Nothing since then.

[JoeP]

Hmmm, that is strange. I haven't seen that unless a new build was installed.

Any automatically run third party maintenance?
Did you run anything that may have reset the Windows Update components?

Joe

[BobArch2]

Hmmm, that is strange. I haven't seen that unless a new build was installed.

'
No new build, just the initial install on April 9th Here's the Windows induced Update History.

UpdateHistory.gif

Any automatically run third party maintenance?

None run by me. Of Course ESET would update its definitions, and that is the only one I am aware of.

Did you run anything that may have reset the Windows Update components?

No.

Updates I performed:
2016.04.09: Upgrade Win 8.1 to Win 10
2016.04.11: Updated to newer version of Office 365 (v16.0.6709.2015)
2016.04.11: Win10 install had overlaid my NVIDIA driver v364.51 with v359.06, perform clean install of v364.72
2016.04.12: Updated Ashampoo Burning Studio 16
2016.04.12: MS performed its monthly Tuesday updates (automatically)
2016.04.13: Performed System Cleanup, removed Windows.old and install files (I have pre and post Win installs by ShadowProtect backups)
2016.04.16: Updated Malwarebytes before running full scan
2016.04.16: Updated to Firefox 45.0.2

I noticed that Windows Modules Installer that ran on 2016.04.16 had installed or updated two Window Apps - Calendar and Mail (which I do not use).

There might be an issue with SRPs. These are the only ones I have (none for the Tuesday accumulative update)

SRP.gif

Here are other Programs and Features modified by Windows during the period starting with the Win10 Upgrade:

ProgramsAndFeaturesPre.gif

Not sure where to go from here...

[JoeP]

Me either. Keep an eye on it I guess.

Joe