space

Microsoft quietly unveils Vista-to-XP downgrade

Microsoft has reportedly begun offering a downgrade option to PC makers who want to allow their customers to have the option of using XP over the pre-installed Vista software.

Computer manufacturers including Fujitsu, Lenovo, and HP now mainly offer PCs exclusively with Vista pre-installed. Customers who would prefer to have XP can request a downgrade disc for computers that come with Vista Business and Vista Ultimate. These two versions allow downgrading as part of the software licensing, but the process is difficult without a specifically coded disc.

Several big PC makers never stopped offering XP as an option for custom-built computers. However, the standalone operating system software has nearly vanished from all retail outlets.

The new policy dates back to June, when Microsoft caved in to allow the manufacturers to include a special XP downgrade CD with systems that come pre-loaded with one of the two high-end Vista packages. Per Microsoft's licensing terms, it is not obligated to supply earlier versions of its operating system to consumers or manufacturers.

Alice Hill’s Real Tech News - Independent Tech

Stealth Microsoft update breaks Windows Update on “repaired” XP Blog Archive Alice Hill’s Real Tech News - Independent Tech

While Microsoft said the “stealth install” of updated Windows update files — even when users had disabled automatic updating — which we wrote about earlier, was harmless, it turns out it wasn’t quite that simple. For XP users, if you happened to do a “repair” using a repair CD, you would no longer be able to use Windows update … period.

The basic reason for this was that the aforementioned stealth update replaced certain Windows update files. When a repair is done, that file is replaced, and Windows Update is no longer able to function. Nate Clinton, program manager for Windows Update, said on the Windows Update blog:

Here’s what we found: when an XP repair CD is used, it replaces all system files (including Windows Update) on your machine with older versions of those files and restores the registry. However, the latest version of Windows Update includes wups2.dll that was not originally present in Windows XP. Therefore, after the repair install of the OS, wups2.dll remains on the system but its registry entries are missing. This mismatch causes updates to fail installation.

I was confused at first, but what he means is the registry entries for the new wups2.dll are missing — I think. BTW, this is the same Nate Clinton who initially said the stealth update was harmless. I’m being a little harsh here; it’s really the combination of the update and the repair that cause the issue.

How do you fix it? There’s a Microsoft KB article on it, KB943144. Unfortunately, while people like you and I won’t have issues with the procedure, it’s certainly nothing most users would be comfortable with.

RESOLUTION

To resolve this problem, register the Wups2.dll file in Windows. To do this, follow these steps:

1. Stop the Automatic Updates service. To do this, follow these steps:
   • Click Start, click Run, type cmd, and then click OK.
   • At the command prompt, type the following command, and then press ENTER:
     net stop wuauserv
2. Register the Wups2.dll file. To do this, follow these steps
• At the command prompt, type the following command, and then press ENTER:
  regsvr32 %windir%\system32\wups2.dll
  Note: For a computer that is running Windows XP Professional x64 Edition, type the following command, and then press ENTER:
  regsvr32 %windir%\syswow64\wups2.dll
• Click OK on each verification message that you receive.
3. Start the Automatic Updates service. To do this, type the following command at the command prompt, and then press ENTER:
   net start wuauserv
4. Exit the command prompt. To do this type exit, and then press ENTER.

We Say: This just goes to show why why it is important that Microsoft shouldn’t force undocumented updates upon users — though I will admit that if a notification popped up with an update centered around Windows Update, I most likely would have downloaded and installed it anyway.

Hey There Delilah

i can never go home

Microsoft admits to stealth updates

• Date: September 17th, 2007
• Blogger: Paul Mah
• Category: News, Security
• Tags: Microsoft Windows Update, Microsoft Windows, Microsoft Corp., Paul Mah

• Blog Post
• 5 Comments
• Permalink
• 
  

• Save to my Workspace
• E-mail This
• Print This

+1

Worthwhile?

Over the last few weeks, and without user approval of any kind, Windows Update has updated nine executable files on both Windows XP as well as Windows Vista.

We first reported about this last week in Microsoft caught doing stealth updates, in which a user noticed files being modified by Windows Update despite automatic update being disabled. This has since been echoed by various users and reports around the web.

Well, it is now official. Microsoft has now came clean and admitted to the ’stealth’ updates.

To their credit, the updates in question were actually limited to updating Windows Update’s own files. Also, the only reason this update occurred is because the alternative would mean that Windows Update itself would stop functioning properly, according to Microsoft.

Wrote Nate Clinton, Windows Update program manager on the Windows Update team blog:

“That result would not only fail to meet customer expectations but even worse, would lead users to believe that they were secure even though there was no installation and/or notification of upgrades.”

However, Microsoft is adamant that there is no wrong here and that the entire issue is more a matter of Microsoft not being clearer. Microsoft Windows programmer Nick White wrote:

We do recognize that we should have been clearer in our explanation of this process earlier in the game…

Note that this issue only affects computers that use Windows Update. Most large businesses will probably be using Windows Server Update Services or a feature in Systems Management Server to perform their updates. They are not affected by this snafus.

Still, Microsoft seems to be missing the bigger picture here. As mentioned in my earlier post, if Microsoft is able to ‘push’ updates to a computer with automatic update disabled, what is there to stop a hacker from figuring out how to do the same.

Is this silent update ‘ability’ a major security vulnerability waiting to explode in our faces?