How do I know if an update is authentic?

[Kyle6256]

Hi, a message recently came thru the HP Assistant that read as follows:

Download an update to avoid a potential issue with your intel system
An important update is required for your PC. This update prevents potential customer security risk on your system. To update your PC, close all other applications and click the link at the bottom of this message. Do not use the PC or touch the screen during the update. Do not power off the PC during the update.
Installation Instructions
1. Download the file by clicking the Download Now button and saving the file to a folder on your hard drive (make a note of the folder where the downloaded file is saved).
2. Double-click the downloaded file and foow the on-screen instructions.

This seemed suspicious to me because it came thru the message section instead of the update section where all other updates to this point have always come thru.  Also the wording is rather vague.  I will not proceed with the update until I know that it is legitimate.  Does anyone know how to authenticate such?  Thank you. 

[AmpLighter · Accepted solution]

The best way to verify  if the update is authentic, one would need to log the HP site and download the updates direct from the manufacture. If no updates are avaible to you for your system, isolate each devices like the video card, sound board etc and extract these updates direct from their home pages. Do not download or download drivers or updates from third party sites. If you're getting an email stressing that you need this update, and it does not have an official HP.com Url I would submit this link or email to an HP representative for validation.

In other words, even with the HP assistant Even I avoid updates in this manner a d tend to locate any updates off HP site and head directly to the official site for all devices. I DO this because sometimes, even HP is a bit slow on keeping their system accurate as some of the HP links have not been updated themselves as indecated by several of the members of this forum.

[mdklassen]

I doubt that it is authentic.

Close all your web-browser windows.

If it is "bogus", then the window with the message probably will close.

Run Windows Update, to get "authentic" updates from Microsoft.

Run the HP Support Assistant (if installed) to get "authentic" updates from HP.

If you are careful, download the file, into a folder, and stop there.

Access:  www.VirusTotal.com

Select that file for uploading to that web-site.

It will run 60(!) anti-virus programs against the file, and give a "score".

Tell us the result.

[Kyle6256]

Thanks a million.   This is great info. 

[DELife]

Kyle 6256,

I received the same message  -

"Download an update to avoid a potential issue with your Intel system

An important update is required for your PC. This update prevents potential customer security risk on your system. To update your PC, close all other open applications and click the link at the bottom of this message. Do not use the PC or touch the screen during the update. Do not power off the PC during the update. "

- Thru the messge tab of HP Support Center not the Update tab, and had the same reservations.

Were you able to determine if it is real or not?

Thanks

[mdklassen]

> Thru [sic] the messge [sic] tab of HP Support Center 

That is a legitimate application program, from HP, that is installed on most HP systems.

Given all the publicity about the "Meltdown" and "Spectre" vulnerabilities in early 2018, it's quite possible that HP has released a security-update.

Note that Intel & HP first have remediated their newest computers, and now are working "backwards" through time to remediate computers from 2017, 2016, 2015, et cetera. 

So, exactly what model of HP computer do you have? 

When was it first released for sale? 

What processor is on the motherboard?

What operating system are you using?

[Kyle6256]

Not yet.  I'm leaving it alone for now. I think the best advice I've gotten so far is from a from of mine who's been working on computers for many years.  He said before he does any major updates he backs up his entire system in case something goes wrong.  So as soon as I get an external hard drive I plan to do just that, then go ahead and, as another responder said, download the update and before running it, submit it to virustotal.com.  Then if that says it's safe go ahead and run it.  Seriously though if it turns out that it's a genuine authentic update then they definitely NEED to stop wording these alerts so vaguely.  And send them consistently through the update tab.  Ugh!!

[Silverthunder]

I don't think that simply downloading directly from the manufacturer is a very bullet proof plan.  Maybe you could use waybackmachine and a check sum algorithm to check that the downloadable file has remained the same for a while?

(edited)*