i guess there is no consistency across this type of issue either. my experience (and this would make sense from microsoft’s perspective) has generally been, no validaton = no updates (after a certain point).

the only other things i can think of are:

- maybe windows update is messed up on your system and reporting no updates when there are still updates (i’ve seen this before, a bug in some old update causes inaccurate reading of new updates resulting in always seeming up to day. the only solution i could think of at the time was to confirm each update was applied by comparing in “add/remove programs” and the non-express windows update page)

- different builds of windows xp, and xp service pack 2 itself, seem to have different criteria for receiving updates (some machines with sp2 installed still required 20+ updates while others need only 2-3 updates)

- for some systems (although i’ve only seen this with xp sp1 and earlier versions of windows) if you don’t manually go to the WU homepage and install Windows Update v6 (the new windows update agent/client) you’ll get “no new updates to install” every time.

that being said, patches and updates can be manually downloaded and installed without validating and maybe certain security patches (ie: WMF) do still get installed via WU. just not always. feel safe yet?

are we talking about automatic updates or manually applying patches?

sounds to me like you’ve cut right to the heart of the matter here..

security is about more than getting that zero-day patch that everyone’s talking about and applying it before the sky falls on your head.

the fact of the matter is (and i have seen this personally on dozens of windows machines):

1. tons of people have auto updates “on” but set to download and not install. (great, but they never click install)
2. i have seen machines with “download and install” set but at a crazy time like 3am (the machine is turned off and thus updates are never applied)
3. without validating windows xp you’re not getting any updates. nothing.
4. even after validating, if you don’t manually go to WU Site and download the New Version of the Windows Update Client, you’re not getting any updates past a certain point (the old client doesn’t find new updates).

so, to make a long story short (or offer a straight answer):

-the people in your scenario will not be getting any updates from microsoft not tonight or tomorrow or ever.

and

-yes, you’d think that microsoft would promote the importance of validating windows xp a little more (at least as an aspect of ensuring greater overall security) but then again, they also tried to keep the WMF thing as low profile as possible by holding off a few days for testing before releasing a patch to the public.

at the very least, Microsoft needs to smooth out the whole update process. it’s just screwy, broken, and way too complicated. maybe they need to give everyone a lesson on how to “manually” use their “automatic” updates and all the quirks that surround it.. [ apply sarcastic patch here ]

Most non-techies haven’t gone through the genuine software validation. But lets assume they have SP2 and automatic updates are turned on… what are they missing by not doing the validation and manually updating?

Everyone says to go to WU and get this patch. If non-techs don’t read this blog and elsewhere, but again, have SP2 and automatic updates, would they get the patch tonight or tomorrow night? and what else from the express list of updates would they be missing by not manually updating / walking through the validation?

I would think if they are msising anything, MSFT should be really promoting the validation and telling people the HAVE to do it to keep their machine safe? Thanks!

i’m going to assume you’re refering to the patch issued by Microsoft.

i’d be interested to know how the second trial run goes. though i’m not sure why you’re machine was infected.. if you got the patch direct from Windows Update.

which patch did you install?

- Microsoft Official Update
- Ilfak Guilfanov version1.4
- SANS .msi installer
- ESET version1.1