Hi,
My personal habit -- and there's been debate about whether that's necessary, or even recommended -- is to pause the Standard Shield (which is set at High) when checking WU. I've had occasional problems in the past with installation of upgrades appearing to lock up, particularly during the unpacking stage, if I leave the shield active.
Anyplace else I can scan the file after downloading and before running the installer, but of course WU treats download-and-install as essentially inseparable operations. I guess you just have to trust MS -- and of course don;t forget to resume the shield afterwards.