News

Microsoft Alters Windows Files Regardless of Update Settings

Microsoft's update system is changing files on both Windows XP and Windows Vista -- even if a user disables automatic updates. Microsoft, however, calls it built-in behavior and no cause for alarm.

• By Keith Ward
• September 13, 2007

As reported by Scott Dunn of the Windows Secrets Web site, Windows Update recently made changes to nine files on each OS, without the usual dialog box asking for permission to alter files.

Dunn quoted a poster on a Microsoft communities forum detailing the patches. The poster said:

"In Vista, the following files are updated:

1. wuapi.dll
2. wuapp.exe
3. wuauclt.exe
4. wuaueng.dll
5. wucltux.dll
6. wudriver.dll
7. wups.dll
8. wups2.dll
9. wuwebv.dll

In XP, the following files are updated:

1. cdm.dll
2. wuapi.dll
3. wuauclt.exe
4. wuaucpl.cpl
5. wuaueng.dll
6. wucltui.dll
7. wups.dll
8. wups2.dll
9. wuweb.dll"

The updates are upgrades to the Windows Update service itself, and are not harmful to a system.

Nate Clinton, program manager for Windows Update, admitted in a blog posting that Windows Update can bypass user-defined behavior. "The Windows Update client is configured to automatically check for updates anytime a system uses the WU service, independent of the selected settings for handling updates (for example, 'check for updates but let me choose whether to download or install them'). This has been the case since we introduced the automatic update feature in Windows XP. In fact, WU has auto-updated itself many times in the past," Clinton wrote.

Eric Schultze, chief security architect at Saint Paul, Minn.-based Shavlik Technologies, isn't thrilled with Microsoft's lack of disclosure. "As an IT admin, it would concern me that my machines were waking up and connecting to Microsoft without my knowledge," said Schultze, himself a former Microsoft employee.

Schultze also said that "Microsoft should have announced this and let people know ... Shame on Microsoft for not documenting the fact that the updating service can update itself."

It's a point that Clinton concedes in his post: "The point of this explanation is not to suggest that we were as transparent as we could have been; to the contrary, people have told us that we should have been clearer on how Windows Update behaves when it updates itself. This is helpful and important feedback, and we are now looking at the best way to clarify WU's behavior to customers so that they can more clearly understand how WU works."

Although Schultze said he has problems with Microsoft's communications in this case, he doesn't think the auto updating without permission is necessarily a bad thing for a corporation. "They're not installing updates; they're simply correcting the issue of updating the update infrastructure," he said. "IT administrators at corporations wouldn't be particularly upset at what happened here."

Dunn, of Windows Secrets, sees it differently: "For users who elect not to have updates installed automatically, the issue of consent is crucial. Microsoft has apparently decided, however, that it doesn't need permission to patch Windows Updates files, even if you've set your preferences to require it," he wrote.