Scott Dunn of the Windows Secrets Web site recently reported that the Windows Update service made changes to nine files on both Windows XP and Vista, without prompting the user for permission using the usual dialog box to alter files.

Dunn quoted a poster on a Microsoft communities forum detailing the patches. The poster said:

“In Vista, the following files are updated:

1. wuapi.dll
2. wuapp.exe
3. wuauclt.exe
4. wuaueng.dll
5. wucltux.dll
6. wudriver.dll
7. wups.dll
8. wups2.dll
9. wuwebv.dll
 

In XP, the following files are updated:

1. cdm.dll
2. wuapi.dll
3. wuauclt.exe
4. wuaucpl.cpl
5. wuaueng.dll
6. wucltui.dll
7. wups.dll
8. wups2.dll
9. wuweb.dll”

 
The updates are upgrades to the Windows Update service itself, and are not harmful to a system, but it does confirm that Windows Update can bypass user-defined behaviour

Dunn stated: “For users who elect not to have updates installed automatically, the issue of consent is crucial. Microsoft has apparently decided, however, that it doesn’t need permission to patch Windows Update files, even if you’ve set your preferences to require it.”

.