24

According to the answer on another post, we should not have been receiving any more updates for Windows XP.

But I am receiving updates:

enter image description here

Is this indicative that my system is bugged or compromised (some malicious program trying to trick me into clicking "Download" which downloads their software)?

Improve this question
9
  • 1
    The notice I received from Microsoft said that although they are no longer providing updates for Windows XP, they are going to continue to provide security updates.
    – L.B.
    May 25, 2014 at 1:58
  • 9
    The real question is why you are still using Windows XP?
    – Cole Tobin
    May 25, 2014 at 21:32
  • If a malicious program was trying to trick you into installing their software, it wouldn't look like a native window. If it was a native window, why would the malware bother asking you to install their software?
    – Cole Tobin
    May 25, 2014 at 21:33
  • 3
    @ColeJohnson I agree that malware wouldn't ask for permission to install but the idea that malware doesn't try to look like native windows is dangerously wrong. It does try to look like native windows, to mislead people into using it, just like phishing emails try to look like actual emails from eBay/PapPal/your bank.
    – David Richerby
    May 26, 2014 at 12:33
  • 1
    I'm still getting those updates as well on my dad's XP system - I'd guess OS updates are gone, but stuff like .net will keep being updated
    – Journeyman Geek ♦
    Jun 18, 2014 at 11:14

3 Answers 3

Reset to default
18

Both answers given say it, but I don't consider them clear enough. This lead me to add an answer of my own, just to clarify things.

Microsoft stopped providing updates for Windows XP since april 1st 2014. The updates excluded are security hotfixes for Windows XP and updates to Microsoft Security Essentials.

The Windows Update functionality won't stop, but no updates that fix security leaks in Windows XP will be patched, meaning that the longer you use Windows XP the bigger the chances are that your pc becomes infected with spyware and a hacker can take over your pc installing randsomware and other crap.

Especially old pc's had a problem because updating to a newer OS meant that it just would not be possible due to the performance. Luckily, since the recent Windows 8.1 update, if you install Windows 8.1 32 bit (given that you have less than 4 GB of ram) it will actually perform better than Windows XP will. I experienced this first hand myself when I was forced to update my old pc. Not to mention that a full install of Windows 8.1 requires less free diskspace than Windows XP does.

Improve this answer
7
  • 6
    From your answer: "The updates included are security hotfixes for windows xp", and later: "no updates that fix security leaks in windows xp will be patched". Aren't those opposite?
    – gronostaj
    May 24, 2014 at 20:56
  • @gronostaj you're right. I meant the updates excluded are... I'll edit my post.
    – LPChip
    May 24, 2014 at 21:00
  • 1
    To be clear, you can still download old updates, but new ones will generally not be produced.
    – Michael Hampton
    May 25, 2014 at 19:03
  • 1
    @LPChip, that's still unclear. Are they providing updates to security fixes or not? The second paragraph seems to say it is, but the third says otherwise.
    – Keavon
    May 25, 2014 at 19:31
  • 2
    @danielBeck Windows Malicious Software is not Microsoft Security Essentials, so no.
    – LPChip
    May 26, 2014 at 12:14
27

The updates shown on your screenshot are not Windows XP updates. They are related to .NET Framework, Office 2007, Office 2010 and the Malicious Software Removing tool that's why you're receiving it.

I don't think your system is compromised (at the moment) but I strongly advise you to upgrade it to at least Windows 7 because Windows XP is no longer supported.

http://windows.microsoft.com/en-us/windows/end-support-help

Improve this answer
7

The key thing to understand is that no NEW updates will be released for Windows XP after the EOS date. All previous updates will still be made available, so check the release date of the updates you're seeing. They should all be prior to the EOS date with the exception of the update for IE related to CVE-2014-1776. I'm not sure if the Windows Malicious Software Removal Tool qualifies as an update but what you're seeing is legitimate, as shown here in the Applies to section:

https://support.microsoft.com/kb/890830

Additionally, I would find it very hard to believe that malware could inject itself into the Automatic Updates engine and masquerade as an update advertised alongside legitimate updates.

Improve this answer
4
  • 1
    Well the update dates in the screenshot above clearly shows May 2014 which is after EOS...
    – Pacerier
    May 24, 2014 at 16:19
  • Yes, which is why I clearly stated that I wasn't sure whether or not the Windows Malicious Software Removal Tool qualifies as an update, but the KB clearly states that it applies to Windows XP.
    – joeqwerty
    May 24, 2014 at 16:22
  • 1
    "Additionally, I would find it very hard to believe that malware could inject itself into the Automatic Updates engine and masquerade as an update advertised alongside legitimate updates." That sounds like a brilliant idea for malware writers. I'm sure it can be done too. Why not?
    – Brandon
    May 25, 2014 at 3:08
  • Updates are signed with a certificate. You'd need to retrieve the private key somehow. I do believe there was a case of it being successfully brute forced to deliver malware, though.
    – kirb
    May 26, 2014 at 8:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .