Critical Update slipped in through the back door

[Dave M]

Bob;
7.0.6000.381 <==== is correct for XP wups.dll, (a copy and paste job)
See if just entering into Ms Update manually doesn't correct that for you,
although I found that you need to do a re-boot after it downloads for any
of them to be recognized by windows explorer.

 

[Anonymous Bob]

Bob;
7.0.6000.381 <==== is correct for XP wups.dll, (a copy and paste job)
See if just entering into Ms Update manually doesn't correct that for you,
although I found that you need to do a re-boot after it downloads for any
of them to be recognized by windows explorer.

I dual boot w2k and XP Pro with w2k my default startup. Although the rest of
the files properly updated wups.dll did not. However the new version was in
\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.600
0.381.

One more restart "healed" the problem.

Strange! Perhaps it was that they misspelled whoops.dll.<g>

Bob Vanderveen

 

[Guest]

My Windows Update is NOT automatic.

YOU ARE AN IDIOT!

 

[Guest]

BillD, I see that you post with helpful info to many others and i also see
that youv'e used that term a few other times also to other people, So do you
really think that was called for ?

 

[Bill Sanderson MVP]

I agree that if this update is not honoring the users choice of settings
about notification and application of updates, something is not right.

--

 

[Guest]

Ron,

I could not for the life of me figure out what you were talking about!
I searched and searched and could not find the post in question?

Then I remembered that I have, and have had for a Very Long Time, a "BillD
Troll" filter.

The only help he ever gives is something like,
Tools->options->blah->blah->reset
And that only works in about 1 out of 5 cases,
But it's the only answer he knows, very sad

Just ignore him, or better yet make a Troll filter

?
Tim

 

[Guest]

Your right, I'm Done.

Ron,

I could not for the life of me figure out what you were talking about!
I searched and searched and could not find the post in question?

Then I remembered that I have, and have had for a Very Long Time, a "BillD
Troll" filter.

The only help he ever gives is something like,
Tools->options->blah->blah->reset
And that only works in about 1 out of 5 cases,
But it's the only answer he knows, very sad

Just ignore him, or better yet make a Troll filter

?
Tim

 

[Guest]

Hi Engel,

Windows Update Software 7.0.6000.381 is an update to Windows Update itself.
It is an update for both Windows XP and Windows Vista. Unless the update is
installed, Windows Update won't work, at least in terms of searching for
further updates. Normal use of Windows Update, in other words, is blocked
until this update is installed.

In Vista, it updates the following System32 files to version 7.0.6000.381:

wucltux.dll
wuauclt.exe
wuaueng.dll
wups2.dll
wuapi.dll
wudriver.dll
wups.dll
wuapp.exe
wuwebv.dll

In XP, it updates the following system32 files to version 7.0.6000.381:

wuweb.dll
wuaueng.dll
wuapi.dll
wucltui.dll
wuaucpl.cpl
cdm.dll
wuauclt.exe
wups2.dll
wups.dll

Hope this helps.

Well, it certainly appears that Microsoft is installing updates without
permission or consent. I have Windows Update set to "Notify" (XP Pro SP2,
IE6), and I run WU manually. The date-time stamp of the directory where
wups.dll v7.0.6000.381 is loaded
(C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\
for the curious) is 8/24/07. When I check "Installed Updates" on the WU site
I see that I ran WU on 8/15 (for August's Black Tuesday) and again on 8/29
(for KB933360). I checked all of the updates that occurred after the 7/30
date-time stamp of wups.dll and wups2.dll, and none of them list either file
in the "File Information" section for Windows XP.

Interestingly a search at microsoft.com for "wups.dll 7.0.6000.381" turns up
NOTHING while a search for "wups.dll 7.0.6000.374" turns up a couple of hits,
one of which is a KB article (932494 "When you use Automatic Updates to scan
for updates or to apply updates to applications that use Windows Installer,
you experience issues that involve the Svchost.exe process")
http://support.microsoft.com/default.aspx/kb/932494 ...

I checked my Event Viewer log for anything interesting on 8/24 and I found
an entry at 3:34 AM where the Windows Update Agent installed something:

All of the other "Windows Update Agent" Event-19 entries in the System Log
include a KB number:

so this one is particularly disturbing. I find it both curious and very
annoying that Microsoft still hasn't learned not to sneak around behind
people's backs.

 

[Guest]

Hi Ron,

In XP, the following would be version 7.0.6000.381 after the Windows Update
software update:

wuweb.dell
wuaueng.dll
wuapi.dll
wucltui.dll
wuaucpl.cpl
cdm.dll
wuauclt.exe
wups2.dll
wups.dll

They are located in the C:\Windows\System32 folder. You can Copy and Paste
that path in Run, and click OK. If you view the folder by Details, and sort
the columns by Date Modified, they should be more or less grouped together.

It's actually even more sneaky of MS than at first glance. I did a complete
rebuild of this XP PC on 7/30/07. All the files above are present on my PC
with the new version of .381 and a "properties" date of 9/4 and 9/5.
HOWEVER, the 'Date Modifed' column shows 7/30/2007!

That is totally uncool and I'd like to now how they accomplished that!

 

[Guest]

Just checke don my virtual XP.
As soon as i truned on virtual machine, right after service loaded i got
silent update.

 

[Guest]

Just did a check on virtual XP.
As soon as i truned on virtual machine, right after service loaded i got
silent update.

 

[vicky]

hi all,

I want to tell you that if you want to download windows updates from
website then you must have the latest updating software installed in your
computer so that you could use the updating service.Microsoft istalls this
updating software from their website when you try to download updates and
without installing this update you can't download updates. You can find in
system32 a file named " wuauclt.exe " , this file is the same file for which
you all discuss about the version, if you will see the version of this file
then you find exactly the same as you and others said.Everytime you try to
download updates automatically or manully , this file wiil execute and you
can see this by going to task manager and then process.

 

[Randy Knobloch]

hi all,

I want to tell you that if you want to download windows updates from
website then you must have the latest updating software installed in your
computer so that you could use the updating service.Microsoft istalls this
updating software from their website when you try to download updates and
without installing this update you can't download updates. You can find in
system32 a file named " wuauclt.exe " , this file is the same file for which
you all discuss about the version, if you will see the version of this file
then you find exactly the same as you and others said.Everytime you try to
download updates automatically or manully , this file wiil execute and you
can see this by going to task manager and then process.

If this information is correct, Vicky - you are infected.
http://www.castlecops.com/modules.php?name=StartupList&query=wuauclt

Run your Anti-Virus Immediately!

Randy

 

[Randy Knobloch]

hi all,

I want to tell you that if you want to download windows updates from
website then you must have the latest updating software installed in your
computer so that you could use the updating service.Microsoft istalls this
updating software from their website when you try to download updates and
without installing this update you can't download updates. You can find in
system32 a file named " wuauclt.exe " , this file is the same file for which
you all discuss about the version, if you will see the version of this file
then you find exactly the same as you and others said.Everytime you try to
download updates automatically or manully , this file wiil execute and you
can see this by going to task manager and then process.

If this information is correct, Vicky - you are infected.
http://www.castlecops.com/modules.php?name=StartupList&query=wuauclt

Run your Anti-Virus Immediately!

Randy

 

[Bill Sanderson]

If this information is correct, Vicky - you are infected.
http://www.castlecops.com/modules.php?name=StartupList&query=wuauclt

Lots of if's, indeed:

I don't read this post as indicating an infected machine---\windows\system32
is the appropriate location for a legitimate wuauclt.exe on Windows XP.

 

[Tom Emmelot]

Hi Randy,

And also my Vista has the same file at that place with a windows
certification!

Regards >*< TOM >*<


Bill Sanderson schreef:

 

[Randy Knobloch]

Hi Randy,

And also my Vista has the same file at that place with a windows
certification!

Noted, Tom - thanks for the note.

Regards,
Randy