Back to newsletter listDate:
Thu, September 13, 2007 10:33:48 PMFrom:
Windows Secrets
Subject:
Microsoft updates Windows without users' consent [Newsletter Comp Version]
If your software garbles this newsletter, read
this issue
at WindowsSecrets.com.
|
YOUR NEWSLETTER PREFERENCES Change Delivery address: kallyorama@gmail.com Alternate address: 0 Locale: Reader number: 73359-13368 |
|
|
Windows Secrets Newsletter • Issue 122 • 2007-09-13 • Circulation: over 270,000 |
|
Contents TOP STORY: Microsoft updates Windows without users' consent KNOWN ISSUES: How to run Microsoft Update using Firefox WACKY WEB WEEK: Nintendo promises Wii bit of excitement PC TUNE-UP: Serious Visual Basic flaw remains unpatched PATCH WATCH: Only four patches this Patch Tuesday YOUR SUBSCRIPTION: How to change your address or *** |
|
For links to every topic in this issue, scroll down to the
Index |
|
ADS
|
|
TOP STORY Microsoft updates Windows without users' consent
Files changed with no notice to users In recent days, Windows Update (WU) started altering files on users' systems without displaying any dialog box to request permission. The only files that have been reportedly altered to date are nine small executables on XP and nine on Vista that are used by WU itself. Microsoft is patching these files silently, even if auto-updates have been disabled on a particular PC. It's surprising that these files can be changed without the user's knowledge. The Automatic Updates dialog box in the Control Panel can be set to prevent updates from being installed automatically. However, with Microsoft's latest stealth move, updates to the WU executables seem to be installed regardless of the settings — without notifying users. When users launch Windows Update, Microsoft's online service can check the version of its executables on the PC and update them if necessary. What's unusual is that people are reporting changes in these files although WU wasn't authorized to install anything. This isn't the first time Microsoft has pushed updates out to users who prefer to test and install their updates manually. Not long ago, another Windows component, svchost.exe, was causing problems with Windows Update, as last reported on June 21 in the Windows Secrets Newsletter. In that case, however, the Windows Update site notified users that updated software had to be installed before the patching process could proceed. This time, such a notice never appears. For users who elect not to have updates installed automatically, the issue of consent is crucial. Microsoft has apparently decided, however, that it doesn't need permission to patch Windows Updates files, even if you've set your preferences to require it. Microsoft provides no tech information — yet To make matters even stranger, a search on Microsoft's Web site reveals no information at all on the stealth updates. Let's say you wished to voluntarily download and install the new WU executable files when you were, for example, reinstalling a system. You'd be hard-pressed to find the updated files in order to download them. At this writing, you either get a stealth install or nothing. A few Web forums have already started to discuss the updated files, which bear the version number 7.0.6000.381. The only explanation found at Microsoft's site comes from a user identified as Dean-Dean on a Microsoft Communities forum. In reply to a question, he states:
System logs confirm stealth installs In his forum post, Dean-Dean names several files that are changed on XP and Vista. The patching process updates several Windows\System32 executables (with the extensions .exe, .dll, and .cpl) to version 7.0.6000.381, according to the post. In Vista, the following files are updated: 1. wuapi.dll 2. wuapp.exe 3. wuauclt.exe 4. wuaueng.dll 5. wucltux.dll 6. wudriver.dll 7. wups.dll 8. wups2.dll 9. wuwebv.dll In XP, the following files are updated: 1. cdm.dll 2. wuapi.dll 3. wuauclt.exe 4. wuaucpl.cpl 5. wuaueng.dll 6. wucltui.dll 7. wups.dll 8. wups2.dll 9. wuweb.dll These files are by no means viruses, and Microsoft appears to have no malicious intent in patching them. However, writing files to a user's PC without notice (when auto-updating has been turned off) is behavior that's usually associated with hacker Web sites. The question being raised in discussion forums is, "Why is Microsoft operating in this way?" How to check which version your PC has If a system has been patched in the past few months, the nine executables in Windows\System32 will either show an earlier version number, 7.0.6000.374, or the stealth patch: 7.0.6000.381. (The version numbers can be seen by right-clicking a file and choosing Properties. In XP, click the Version tab and then select File Version. In Vista, click the Details tab.) In addition, PCs that received the update will have new executables in subfolders named 7.0.6000.381 under the following folders: c:\Windows\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll c:\Windows\System32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll Users can also verify whether patching occurred by checking Windows' Event Log: Step 1. In XP, click Start, Run. Step 2. Type eventvwr.msc and press Enter. Step 3. In the tree pane on the left, select System. Step 4. The right pane displays events and several details about them. Event types such as "Installation" are labeled in the Category column. "Windows Update Agent" is the event typically listed in the Source column for system patches. On systems that were checked recently by Windows Secrets readers, the Event Log shows two installation events on Aug. 24. The files were stealth-updated in the early morning hours. (The time stamp will vary, of course, on machines that received the patch on other dates.) To investigate further, you can open the Event Log's properties for each event. Normally, when a Windows update event occurs, the properties dialog box shows an associated KB number, enabling you to find more information at Microsoft's Web site. Mysteriously, no KB number is given for the WU updates that began in August. The description merely reads, "Installation Successful: Windows successfully installed the following update: Automatic Updates." No need to roll back the updated files Again, it's important to note that there's nothing harmful about the updated files themselves. There are no reports of software conflicts and no reason to remove the files (which WU apparently needs in order to access the latest patches). The only concern is the mechanism Microsoft is using to perform its patching, and how this mechanism might be used by the software giant in the future. I'd like to thank reader Angus Scott-Fleming for his help in researching this topic. He recommends that advanced Windows users monitor changes to their systems' Registry settings via a free program by Olivier Lombart called Tiny Watcher. Scott-Fleming will receive a gift certificate for a book, CD, or DVD of his choice for sending in a comment we printed. I'll report further on this story when I'm able to find more information on the policies and techniques behind Windows Update's silent patches. Send me your tips on this subject via the Windows Secrets contact page.
Reader, please rate the above article: |
|
ADS
|
|
KNOWN ISSUES How to run Microsoft Update using Firefox
Firefox add-in runs Microsoft Update like IE Scott Dunn's article asserted that IE 7 is a requirement in order to run Microsoft Update. (MU is a Windows Update superset that patches Microsoft Office in addition to Windows itself.) However, ***a *** sends this useful tip:
To install the IE Tab, go to the add-ons site using the above link. Choose Install Now. The installer will restart Firefox when finished or prompt you to do so before the changes will take effect. To add the IE Tab button to your Firefox Toolbar, right-click the toolbar and choose Customize. Drag the IE Tab icon and drop it where you want it. When clicked, the IE Tab button will swap rendering engines. Once you've done this, you can use Firefox with Scheduled Tasks in XP; however, keep in mind that only administrators can install updates. The scheduling steps are slightly different from the ones provided in the last issue: Step 1: Choose Start, All Programs, Accessories, System Tools, Scheduled Tasks. Step 2: In the Scheduled Tasks window, double-click Add Scheduled Task. Step 3: In the Scheduled Task Wizard, click Next. Then click Browse. Step 4: Select Mozilla Firefox from the list. If you don't see it, use the Browse button to locate Firefox.exe and click Open. Step 5: In the next step of the wizard, select Monthly and click Next. Step 6: Specify a start time. Select the second radio button and specify the second Tuesday. Leave all months checked. Click Next. Step 7: Enter your account name and password for an administrator account. Click Next. Step 8: Check the box for opening advanced properties and click Finish. Step 9: When the Firefox Properties dialog box opens, click at the end of the line in the Run box. Type a space followed by the URLs for each tab you want to open, separated by spaces. For example, when you're done, the finished command should read something like this: "C:\Program Files\Mozilla Firefox\firefox.exe" www.update.microsoft.com secunia.com/software_inspector Step 10: Click OK. Enter your account name and password again, if prompted. Click OK. MyUninstaller is another removal-tool option Scott's article also provided a step-by-step guide on how to remove old software. For those of you who'd like a program that does much of the legwork for you, however, Joe de Fide has this advice:
Get reminders for Secunia Software Inspector When checking for unpatched software, it makes sense to run the latest version of Software Inspector. Timothy McGowan points out that Secunia offers an e-mail reminder:
Finding the hidden Secunia privacy policy Some readers expressed concerns over Secunia's difficult-to-find privacy policy. Jon Larimore criticizes Secunia for the omission:
The Known Issues column brings you readers' comments on our recent articles. Diane Korngiebel is assistant managing editor of WindowsSecrets.com. |
|
EDITOR'S BOOKSHELF
|
|
WACKY WEB WEEK Nintendo promises Wii bit of excitement
|
|
YOUR SUBSCRIPTION The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, plus the week of Thanksgiving and the last two weeks of August and December. Publisher: WindowsSecrets.com LLC, Attn: #120 Editor, 1700 7th Ave., Suite 116, Seattle, WA 98101-1323 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editorial Director: Brian Livingston. Editor-at-Large: Fred Langa. Associate Editor: Scott Dunn. Contributing Editors: Susan Bradley, Mark Edwards, Woody Leonhard, Chris Mosby, Ryan Russell. Research Director: Vickie Stevens. Program Director: Brent Scheffler. Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. YOUR SUBSCRIPTION PREFERENCES (change your preferences): Delivery address: kallyorama@gmail.com Alternate address: 0 Country: ZIP or postal code: Reader number: 73359-13368 Bounce count: 0 Your bounce count is the number of times your server has bounced a newsletter back to us since the last time you visited your preferences page. We cannot send newsletters to you after your bounce count reaches 3, due to ISP policies. If your bounce count is higher than 0 or blank, please visit your preferences page. This automatically resets your bounce count to 0. To change your preferences: Please visit your preferences page. To access all past issues: Please visit our past issues page. To upgrade your free subscription to paid: Please visit our upgrade page. To resend a missed newsletter to yourself: If your mail server filtered out a newsletter, you can resend the current issue to yourself. To do so, visit your preferences page and use the Resend link. To get subscription help by e-mail (fastest method): Visit our contact page. Subscription help by facsimile: 206-282-6312 (fax). Emergency subscription help by phone: 206-282-2536 (24 hours). HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page. WE GUARANTEE YOUR PRIVACY: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All *** requests are honored immediately, period. Privacy policy HOW TO ***: To *** kallyorama@gmail.com from the Windows Secrets Newsletter,
|
