September 13, 2007 at 12:32Windows starts updating without permission
Experts report unusual behavior in Windows XP and Vista in recent days. Some of them, on a command in the middle of the night, started updating system files bypassing the traditional auto-update procedure. Moreover, the files were updated even if the automatic update function was disabled in the system. The program Windows Update (WU) took over all the powers and without any dialogs with the user replaced nine files on their own.
Generally speaking, this is a very significant event. If Microsoft makes the forced update procedure standard, then we will have to review the entire security strategy for personal computers. Such a self-updating computer can no longer be called completely controlled by its owner.
Of course, Microsoft does this for the security of the users themselves, but such an attitude towards users as a herd of sheep is quite offensive. In addition, by implementing a similar procedure for global updating of systems in a homogeneous environment, the company itself becomes a source of potential danger.
The following files were updated under the XP SP2 operating system: cdm.dll, wuapi.dll, wuauclt.exe, wuaucpl.cpl, wuaueng.dll, wucltui.dll, wups.dll, wups2.dll, wuweb.dll.
Under Vista, wuapi.dll, wuapp.exe, wuauclt.exe, wuaueng.dll, wucltux.dll, wudriver.dll, wups.dll, wups2.dll, wuwebv.dll were updated.
The first reports of an unusual update appeared on August 24, but on some machines the update took place even last week.
Security experts do not hide their bewilderment. “At least we were warned before,” said Scott Duncan, Windows Secrets mailing list editor , about an unusual Windows update. It has never been that Windows did not ask for user consent, even if it was the most critical security update.
“We do not fully understand WU technology, but it is clear that this time the procedure did not check Auto Update settings,” says Brian Livingston, founder of Windows Secrets. “Many companies are very sensitive to changes in their computers, and although Microsoft has not noticed any attempts to introduce malicious code, in which case very serious reasons for concern may appear.”
You can verify the update on your system by opening the system log of the operating system. Under XP, this is done through the "Start" - "Run" - eventvwr.msc.
Generally speaking, this is a very significant event. If Microsoft makes the forced update procedure standard, then we will have to review the entire security strategy for personal computers. Such a self-updating computer can no longer be called completely controlled by its owner.
Of course, Microsoft does this for the security of the users themselves, but such an attitude towards users as a herd of sheep is quite offensive. In addition, by implementing a similar procedure for global updating of systems in a homogeneous environment, the company itself becomes a source of potential danger.
The following files were updated under the XP SP2 operating system: cdm.dll, wuapi.dll, wuauclt.exe, wuaucpl.cpl, wuaueng.dll, wucltui.dll, wups.dll, wups2.dll, wuweb.dll.
Under Vista, wuapi.dll, wuapp.exe, wuauclt.exe, wuaueng.dll, wucltux.dll, wudriver.dll, wups.dll, wups2.dll, wuwebv.dll were updated.
The first reports of an unusual update appeared on August 24, but on some machines the update took place even last week.
Security experts do not hide their bewilderment. “At least we were warned before,” said Scott Duncan, Windows Secrets mailing list editor , about an unusual Windows update. It has never been that Windows did not ask for user consent, even if it was the most critical security update.
“We do not fully understand WU technology, but it is clear that this time the procedure did not check Auto Update settings,” says Brian Livingston, founder of Windows Secrets. “Many companies are very sensitive to changes in their computers, and although Microsoft has not noticed any attempts to introduce malicious code, in which case very serious reasons for concern may appear.”
You can verify the update on your system by opening the system log of the operating system. Under XP, this is done through the "Start" - "Run" - eventvwr.msc.