Microsoft Warns About Bogus Vista Service Pack Site

Microsoft may have said no to large service packs for Vista, but that hasn't stopped some from compiling their own. Last week a HotFix.net blogger posted a collection of individual Windows Vista hotfixes as a supposed Windows Vista Service Pack 1, raising the ire of Microsoft who responded with the cease-and-desist letter.

HotFix complied with the letter and the so-called service pack has now been removed.

Ethan Allen, who runs the HotFix site and frequently blogs about Microsoft patches, claims that his so-called service pack is based on things likely to be contained in a Vista service pack, but of course his assumptions are largely based on smoke and mirrors like file naming conventions in Microsoft's Knowledge Base.

Hardly the sort of thing you want to depend on when it comes to patching your copy of Vista, which is why I'm not linking to the Hotfix site in this post.

A post on the official Windows Vista blog cautions:

Looking at the site, it seems to me the blogger compiled a list of previous mentions of SP1 (purely conjectural, and already discussed in other blogs) stitched together with another list of “hotfixes” mentioned in various KB (Knowledge Base) articles (again, already posted on our web site). You probably already know that we create and release hotfixes on a regular basis for very specific customer scenarios or for OEM-shipped machines, and that it's standard policy that all hotfixes are rolled into the next service pack release. However, a service pack is not just a compilation of hotfixes and security updates, so don't make the mistake of thinking that the set of fixes offered in this particular blogger's list represents a preview of the service pack itself.

It's worth mentioning that hotfixes not posted on Windows Update are not intended for individual installation unless the user is experiencing the specific symptoms mentioned in the corresponding KB article. These hotfixes represent specific fixes for specific customer scenarios and typically have not undergone full regression testing. When they are integrated into a future service pack, they will receive full regression testing and beta testing. So, installing a collection of unnecessary hotfixes may cause more problems than are fixed.

Allen has been putting together these suspicious collections and releasing them under the service pack moniker for some time. A couple years back he release something purporting to be SP3 for Windows XP which prompted Microsoft to issue a warning on the XP mailing list about installing updates from third parties.

The problem with Allen's fake service packs is that they contain hotfixes for issues most users don't experience and which haven't been thoroughly tested. While Allen is correct in arguing that all these patches can be obtained from Microsoft, the fact remains that most users will never need them and risk seriously messing up their systems by installing untested updates.

Although Microsoft has confirmed the existence of Vista SP1, it has not neither set a release date. Until the official update arrives we suggest you hold off on updating anything beyond what Windows Update recommends.