The mystery continues: Why are Windows machines automatically updating themselves?

http://blogs.zdnet.com/microsoft/?p=832

A (slight) update on last week's report that some Windows users are seeing
their Vista PCs automatically update themselves and reboot.

From Nate Clinton, a Microsoft Update Program Manager, via the Microsoft
Update Product Team blog:
"We have been hearing some questions recently regarding Tuesday's update
release changing automatic updating settings. We have received some logs
from customers, and have so far been able to determine that their AU
settings were not changed by any changes to the AU client itself and also
not changed by any updates installed by AU.

"We are still looking into this to see if another application is making this
change during setup with user consent, or if this issue is related to
something else. We are continuing the investigation, and as I have more
information I will update this post.
"If you are running into this issue, your help would be greatly appreciated.
You can contact support, and they can walk you through the steps necessary
to provide logs and other useful data."

So, it doesn't seem to be Automatic Update (AU) or the patches themselves at
fault. So what caused last Past Tuesday's patches to be installed
automatically and machines to be rebooted for a group of users who had
chosen not to allow automatic installation of patches - as originally
reported on the AeroXperience site? It's still not clear whether it is Vista
only (or also XP) that is affected and whether Windows Software Update
Services (WSUS) users have seen the same problem.
More to come when there's new info to share.

Update (3:30 p.m. EST): I've gotten notes from a few users saying that XP is
also affected. Microsoft officials had declined to comment on which versions
of Windows were affected by this update glitch. So far it seems to be XP and
Vista. Other users of other Windows releases out there having the same
trouble?

Taibear ios wrote:
> http://blogs.zdnet.com/microsoft/?p=832
>
> A (slight) update on last week's report that some Windows users are seeing
> their Vista PCs automatically update themselves and reboot.
>
> From Nate Clinton, a Microsoft Update Program Manager, via the Microsoft
> Update Product Team blog:
> "We have been hearing some questions recently regarding Tuesday's update
> release changing automatic updating settings. We have received some logs
> from customers, and have so far been able to determine that their AU
> settings were not changed by any changes to the AU client itself and also
> not changed by any updates installed by AU.
>
> "We are still looking into this to see if another application is making this
> change during setup with user consent, or if this issue is related to
> something else. We are continuing the investigation, and as I have more
> information I will update this post.
> "If you are running into this issue, your help would be greatly appreciated.
> You can contact support, and they can walk you through the steps necessary
> to provide logs and other useful data."
>
> So, it doesn't seem to be Automatic Update (AU) or the patches themselves at
> fault. So what caused last Past Tuesday's patches to be installed
> automatically and machines to be rebooted for a group of users who had
> chosen not to allow automatic installation of patches - as originally
> reported on the AeroXperience site? It's still not clear whether it is Vista
> only (or also XP) that is affected and whether Windows Software Update
> Services (WSUS) users have seen the same problem.
> More to come when there's new info to share.
>
> Update (3:30 p.m. EST): I've gotten notes from a few users saying that XP is
> also affected. Microsoft officials had declined to comment on which versions
> of Windows were affected by this update glitch. So far it seems to be XP and
> Vista. Other users of other Windows releases out there having the same
> trouble?
>
>


Some worm using the now known BITS backdoor "Updating" the system and in
so doing causing the OS to also install other updates in the cache?

Since "Most" users never noticed the official "Stealth" updates it makes
an excellent attack vector, most users will never notice...

This damned thing is evolving it seems hourly...

http://arstechnica.com/news.ars/post...to-botnet.html

Imagine injecting that into millions of BITS enabled machines in one
night...