Microsoft is blocking Windows 7 and Windows Server 2008 R2 updates from being installed if they are code signed using a SHA-2 certificate and the machine has Symantec or Norton antivirus installed. This is because the antivirus software is deleting the updates during installation and causing Windows to not start. […]

from https://www.bleepingcomputer.com/news/microsoft/windows-7-sha-2-updates-blocked-if-symantec-norton-avs-installed/