Best i could tell was that MS was trying to update some drivers, this failed badly, had to be reverted, but that still left the relevant patch in the queue, and so Windows would try again on next reboot.
Finally had to resort to some kind of downloaded wizard from Microsoft to blacklist the patch. Not sure if that will be possible on the education version (or am i confusing it with the more recent S edition?).
You can really avoid like 90% of the shit by...
* Not going on shady sites
* Not getting scammed via Phishing
* Not pirating (you know, its really funny how most illegal 'patches' say, oh yeah patch is detected as trojan and its a false positive)
Sadly i have seen various legit tools trigger the same warnings, because the developer used similar low level techniques that malware use to hide their true nature.
Basic thing is that at the CPU level all instructions are legit. And then we pile code upon code on top to try to extract the context and intent of the programmer from the behavior of the code.
In a sense that can quickly devolve into computer "racism".