doubt you will find squat on the SP2..you might on the Sp3 if you have been updating it all along...anyway this is the stuff
Certification path of the certificate that was used to sign WUSetupV.exe used by the Flame malware.
»
twitpic.com/9sqhqh/full