What's the URL of the latest Windows Update website?

Besides a Mac, I also have an old Windows XP 32-bit machine, with IE8, on my home network. Since Microsoft stopped supporting WinXP in 2013 for all but commercial versions, I've not used it for Web access, except for keeping Microsoft's 'Security Essentials' (MSE) antivirus utility up-to-date (I gather it's similar to Windows Defender and Microsoft have continued support for MSE under WinXP). I might emphasise that it's my Mac only that I use for browsing the Web and for e-mail. I keep the XP machine purely for running a couple of important third-party apps that can only be run on a Windows machine only.

Clearly, potentially my XP machine is vulnerable to the WannaCrypt attack, and news on Friday that Microsoft had issued an emergency update for not only Windows 8, 9, 10 etc but also for older WinXP users made me search - using my Mac - for where that update might be available. However, the only thing I could find was a link for the required update file (the version needed for WinXP x86) in this:

https://blogs.technet.microsoft.com/msrc/2017/05/12/...

The link in that blog article (for the required WinXP x86 file), one of many links there for different Windows editions, turned out to be a link to a Microsoft .exe file. (Remember, I was doing this on the Mac). I did nothing with it, incidentally. With many sites spoofed these days, I couldn't be 100% certain that that technet site was totally genuine, though the above URL looks okay, doesn't it?

The wording there seems to say that if you're running either Windows Defender or MSE and it's more up-to-date than v.1.243.297 you're safe; the antivirus will stop the infection from running. My MSE is, right now, v.1.243.338.0, so it rather looks as though my XP machine is covered in that respect. But some of you on these forums seem to be suggesting that that's not the whole story and that in fact the process will be triggered if an antivirus scan is run!

Clearly, I'll feel much safer about the whole thing if I can acquire that special WinXP update just issued by Microsoft and apply it. The problem, however, is that when I now try Windows Update on the XP machine, I just get a browser error page saying that the site cannot be accessed. Possibly, this is because of the IE8 being too out-of-date (as far as I can gather, since Microsoft stopped supporting XP no further IE's were possible for XP users). So, can anyone tell me the URL of the present-day Windows Update website (not the Microsoft Download Centre)? Is there one, as such, any longer?

Pity you and the NHS didn't take my advice back in January http://forums.thinkbroadband.com/security/t/4523671-...

Well, that's as may be, but the point I'm making is that all the publicity these last few days about Microsoft issuing an emergency patch for this piece of malware, and aimed not just at users of recent editions of Windows but also at users of legacy OSs like WinXP, counts for absolute nought if Microsoft simply doesn't inform WinXP users where they can download it! There's not much point in telling legacy XP users to use Windows Update to get it if the mechanism for getting updates has changed in the last few years.

I've long since stopped using my WinXP machine for interacting with the Web. In fact, it's powered off for about 98% of the time and is used only for offline work. Therefore, my need for protection against this kind of malware is perhaps questionable. However, I'd still feel a lot happier if I could obtain the genuine patch and apply it.

Of course, you can't access many Microsoft bulletins and the Windows Update website (if it still exists), to try to find out more, with a Mac, because those sites are designed to not respond to Macs and the Safari browser.

With the Mac, I managed to find a file 'WindowsXP-KB4012598-x86-Embedded-Custom-ENU.exe' (666KB), at https://www.microsoft.com/en-us/download/details.asp... but whether that's the patch referred to I simply don't know. If it is, I should be able to boot up my WinXP machine, go there, and download and install it.

I think if you apply the fix I posted about to your XP system you would be automatically be updated.

Or https://blogs.technet.microsoft.com/msrc/2017/05/12/...

http://www.catalog.update.microsoft.com/Search.aspx?...

In reply to a post by meditator:

Clearly, potentially my XP machine is vulnerable to the WannaCrypt attack

probably not - unless you have exposed Windows File and Print sharing directly to the internet from your XP machine. Assuming you haven't, the machine is no more or less vulnerable than any other OS really.

The vulnerability is how the virus replicates to other machines (generally) inside a corporate network. Consumer machines are not normally exposed in this manner and they are vulnerable in a different manner (the same manner thatt the malware makes initial entry onto a corporate network - i.e. by email or an internet link), stopping it via those manners is the job of the antivirus not an OS patch.

Banger, thanks for pointing me in the right direction.

Any idea what the difference is between WinXP and WinXP Embedded, as there are two instances there of the update file?

If you click on the FAQ there, at top-left, it's stated that updates in 'the catalog' are those designed for distribution across a corporate network; for non-corporate situations it's recommended instead to use Windows Updates from the PC itself. Unfortunately, clicking on Windows Updates on my machine simply gives me a blank screen with a selection of different reasons for it, all of no help. So, possibly the two instances we see in this catalog are not appropriate for me. However, since Microsoft has especially issued the update to protect legacy WinXP machines that otherwise wouldn't get that protection, perhaps it's safe to assume that the non-embedded version in the catalog is indeed the one I need?

What I'm particularly anxious to do is not to apply anything that could conceivably cause my WinXP SP3 to permanently malfunction or become unstable, because the integrity of the apps that I use are absolutely critical to the occasional offline project work that I do on that machine. Those apps certainly aren't replaceable any longer. If they become damaged or otherwise unusable, I won't be able to roll back to the prior situation because whereas some years ago I used to have a comprehensive backup arrangement for my WinXP machine, I removed that when I stopped using WinXP on the Web in 2013.

Edited by deleted (Sun 14-May-17 23:12:05)

The non-embedded version is what you need, seemed ok on my multi XP Win 10 boot machine, embedded is for ATMs.

I've known about the vulnerabilities of Windows File and Printer Sharing across networks for quite a number of years, and even well before XP went 'off air' in 2013 I had it disabled on my machine.

Banger,

How long ago was it when you downloaded that WinXP patch? Was it in the last few days? I've downloaded it (the non-embedded version) to the Desktops of both my Mac and my XP machine (for comparison purposes), but the name of the file in both cases is quite extraordinary:

windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe

Did you get a filename also consisting of that long string? Does this seem right to you? Might this length of filename perhaps be prevented from executing on my 32-bit machine?