« Vista KB938194 appears to install and is then reoffered | Main | Updates do not install after a Repair of XP »

An Explanation of the " Stealth " MS Updates

EDITED: 9/20
There's been a big to-do about the latest update to the Windows Update Agent/Client.

In late August the latest Version of the Windows Update Agent/Client was pushed out via Automatic Updates [Windows Update in Vista] and the Windows | Microsoft Update sites.

This has taken awhile to reach most of the Windows based systems around the world.
Unfortunately, MS never bothered to publish anything about this update until the shinola hit the fan.

The tin-foil crowd had a field day. The media delighted in bashing MS about installing updates when Automatic Updates had been disabled. Some journalists started braying that MS was updating your system without your knowledge and installing .exe's [exectuable files].
Well bunkies, all the update did was to install system files that are required to
be able to update the OS. Nothing more, nothing less.

For XP, there was ONE executable file that was updated, wuauclt.exe.
The rest were mostly .dll files. There were some .cat's installed [meow] and a .cpl file installed [Control Panel applet ]
In all, on my XP Pro box, there were 14 .cab files that contained the updated Windows Update Agent/Client.

An effort was made to explain just what was happening. IMHO, too late.
How Windows Update Keeps Itself Up-to-Date

To avoid creating such a false impression, the Windows Update client is configured to automatically check for updates anytime a system uses the WU service, independent of the selected settings for handling updates (for example, “check for updates but let me choose whether to download or install them”).

Before closing, I would like to address another misconception that I have seen publically reported. WU does not automatically update itself when Automatic Updates is turned off, this only happens when the customer is using WU to automatically install upgrades or to be notified of updates.
Then the Vista Team chimed in: An explanation of Windows Update automatic updating
This self-updating is done regardless of whether the user has enabled automatic checking, download and/or installation of updates. It does so in an effort to avoid WU misleading the user to think s/he is up-to-date simply because s/he was not receiving notification that updates are available. Put another way, WU cannot alert the user that there are security updates available if it is not in the necessary updated state that will allow it to recognize those updates (see "chicken and egg" dilemma).

However, we do recognize that we should have been clearer in our explanation of this process earlier in the game; the MU team's blog post is an effort to rectify that oversight.


Choosing to Disable automatic updating via the Automatic | Windows Update applet in the Control Panel will stop the updateing of the system files that are required in order for the system to be able to communicate with the Update server.

All of this could have easily been headed off by MS with some decent communication. They failed to do that and the subsequent explanations were late or incomplete.

The files required to update should now be at Version 7.0.6000.381
The previous Version was 7.0.6000.374

The files for XP are :

cdm.dll
wuapi.dll
wuauclt.exe
wuaucpl.cpl
wuaueng.dll
wucltui.dll
wups.dll
wups2.dll
wuweb.dll

Vista is not installed here. When I get a reliable list of the updated files, I'll post 'em.

EDITED: 9/18

The files for Vista are:

wuapi.dll
wuapp.exe
wuauclt.exe
wuaueng.dll
wucltux.dll
wudriver.dll
wups.dll
wups2.dll
wuwebv.dll

I did a little testing with a VPC installation of XP Pro [.vhd is the name of the virtual Hard Drive]
The OS had not been booted up since 4/07. The Windows Update Agent installed was an older version, V. 5.8.0.2469.
First it was booted to Safe Mode and the Automatic Updates options applet in the Control Panel
was set to " Turn off Automatic Updates ".
It was then rebooted to normal Windows mode. Since the Automatic Updates Service was not disabled, the OS attempted to connect to the Update servers. It failed to

2007-09-20 09:36:50 764 334 Misc = Process: C:\WINDOWS\Explorer.EXE
2007-09-20 09:36:50 764 334 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2007-09-20 09:36:50 764 334 Shutdwn Install at shutdown: no updates to install
2007-09-20 09:37:05 208 544 Misc =========== Logging initialized (build: 5.8.0.2469, tz: -0700) ===========
2007-09-20 09:37:05 208 544 Misc = Process: \??\C:\WINDOWS\system32\winlogon.exe
2007-09-20 09:37:05 208 544 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2007-09-20 09:37:05 208 544 Shutdwn FATAL: WUAutoUpdateAtShutdown failed, hr=8024000C
2007-09-20 09:40:42 964 198 Misc =========== Logging initialized (build: 5.8.0.2469, tz: -0700) ===========
2007-09-20 09:40:42 964 198 Misc = Process: C:\WINDOWS\System32\svchost.exe
2007-09-20 09:40:42 964 198 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2007-09-20 09:40:42 964 198 Service *************
2007-09-20 09:40:42 964 198 Service ** START ** Service: Service startup
2007-09-20 09:40:42 964 198 Service *********
2007-09-20 09:40:42 964 198 Agent * WU client version 5.8.0.2469
2007-09-20 09:40:42 964 198 Agent * SusClientId = '1cfadecf-3f60-4746-96f1-06209c953012'
2007-09-20 09:40:42 964 198 Agent * Base directory: C:\WINDOWS\SoftwareDistribution
2007-09-20 09:40:42 964 198 Agent * Access type: No proxy
2007-09-20 09:40:42 964 198 Agent * Network state: Disconnected
2007-09-20 09:41:39 964 198 Agent *********** Agent: Initializing Windows Update Agent ***********
2007-09-20 09:41:39 964 198 Agent *********** Agent: Initializing global settings cache ***********
2007-09-20 09:41:39 964 198 Agent * WSUS server:
2007-09-20 09:41:39 964 198 Agent * WSUS status server:
2007-09-20 09:41:39 964 198 Agent * Target group: (Unassigned Computers)
2007-09-20 09:41:39 964 198 Agent * Windows Update access disabled: No
2007-09-20 09:41:39 964 198 DnldMgr Download manager restoring 0 downloads
2007-09-20 09:41:39 964 198 AU ########### AU: Initializing Automatic Updates ###########
2007-09-20 09:41:39 964 198 AU # AU disabled through User preference
2007-09-20 09:41:39 964 198 AU # AU is disabled, not initializing any handlers
2007-09-20 09:44:40 964 47c Misc WARNING: Send failed with hr = 80072f8f. Meaning: ERROR_INTERNET_SECURE_FAILURE ErrorClockWrong One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server.
2007-09-20 09:44:40 964 47c Misc WARNING: SendRequest failed with hr = 80072f8f. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
2007-09-20 09:44:40 964 47c PT + Last proxy send request failed with hr = 0x80072F8F, HTTP status code = 0
2007-09-20 09:44:40 964 47c PT + Caller provided credentials = No
2007-09-20 09:44:40 964 47c PT + Impersonate flags = 0
2007-09-20 09:44:40 964 47c PT + Possible authorization schemes used =
2007-09-20 09:44:40 964 47c PT WARNING: GetCookie failure, error = 0x80072F8F, soap client error = 5, soap error code = 0, HTTP status code = 200
2007-09-20 09:44:40 964 47c Report Uploading 2 events using cached cookie, reporting URL = http://stats.update.microsoft.com/ReportingWebService/ReportingWebService.asmx
2007-09-20 09:44:42 964 47c Report Reporter successfully uploaded 2 events.
2007-09-20 09:51:28 1388 5c8 Misc =========== Logging initialized (build: 5.8.0.2469, tz: -0700) ===========
2007-09-20 09:51:28 1388 5c8 Misc = Process: C:\WINDOWS\Explorer.EXE
2007-09-20 09:51:28 1388 5c8 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2007-09-20 09:51:28 1388 5c8 Shutdwn Install at shutdown: no updates to install
2007-09-20 09:51:28 1388 5c8 Shutdwn FATAL: WUCheckForUpdatesAtShutdown failed, hr=8024A000 Meaning: Automatic Updates was unable to service incoming requests.
2007-09-20 09:51:38 964 594 AU AU Restart required....
2007-09-20 09:51:38 964 198 AU ########### AU: Initializing Automatic Updates ###########
2007-09-20 09:51:38 964 198 AU # AU disabled through User preference
2007-09-20 09:51:38 964 198 AU # AU is disabled, not initializing any handlers

I then updated the WUA to the last prior version, V. 7.0.6000.374
The system was then restarted.
The WUA was not updated, contrary to some published reports that it would be
Then I set the Automatic Updates option to " Notify me but don't automatically download or install them "
Right after closing the AU options, the system files were downloaded and installed without any interaction on my part. Here's a graphic of the System Event Viewer showing the update of the WUA had occurred
EventVwr.JPG

In summation, if one chooses to Disable any automatic updates from the
AU applet in the Control Panel, then there will be NO updating of the WUA.
If anyone says that behavior occurred on their systems, then they are liars. Period.

If one chooses to set AU to " Notify me ... " or " Download updates for me, but let me choose when to install them " then any subsequent update to the WUA will occur without any User interaction.

TrackBack

TrackBack URL for this entry:
http://busterbunny.castlecops.com/MT/mt-tb.cgi/1191

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)