If a system has been patched in the past few months, the nine executables in Windows\System32 will either show an earlier version number, 7.0.6000.374, or the stealth patch: 7.0.6000.381. (The version numbers can be seen by right-clicking a file and choosing Properties. In XP, click the Version tab and then select File Version. In Vista, click the Details tab.)

In addition, PCs that received the update will have new executables in subfolders named 7.0.6000.381 under the following folders:

c:\Windows\System32\SoftwareDistribution\Setup\Ser viceStartup\wups.dll
c:\Windows\System32\SoftwareDistribution\Setup\Ser viceStartup\wups2.dll

Users can also verify whether patching occurred by checking Windows’ Event Log:

Step 1. In XP, click Start, Run.

Step 2. Type eventvwr.msc and press Enter.

Step 3. In the tree pane on the left, select System.

Step 4. The right pane displays events and several details about them. Event types such as “Installation” are labeled in the Category column. “Windows Update Agent” is the event typically listed in the Source column for system patches.