Could it be a man in the middle that tries to install updates that aren't signed by Microsoft? It reminds me of this: http://www.leviathansecurity.com/blog/the-case-of-the-modifi... .