If you’re thinking of downloading a program or update (cough, Vista SP1, cough) from a source other than the official one, you really want to make sure you’re getting the real deal and not some virus-infested fake.
One way to increase your chances of getting a legitimate download is to compare the MD5 checksum of the file you download against an MD5 checksum for the file, published by a known and trusted source.
An MD5 checksum is a mathematical hash of a file that reduces it to a series of numbers and letters. If even a single bit is changed, the hash won’t match and you should be suspicious.
So, how do you compute an MD5 checksum? There are lots of tools available. I use Microsoft’s File Checksum Integrity Verifier, which is a command line tool. Unzip it into your downloads folder or some other easy-to-access location, open a Command Prompt window, and run the FCIV command, adding the name of the file you downloaded as the only argument. The result looks like this:

Compare that long alphanumeric string to the one from the known good source. If they match, you can be confident that the file you got is the same as the one you read about it. If they don’t match, hit the Delete button.
Hint: My Vista SP1 FAQ at ZDNet has the checksums for the x86 and x64 versions of the newly released Vista SP1 standalone updater.
Update: As Peter Ortner notes in the comments, you can (and should) also check the digital signature of any executable file to make sure it’s from the source it claims to be from. The signature doesn’t tell you the file is safe, only that it hasn’t been tampered with since it was signed. If you right-click an executable file that has been digitally signed, you’ll see a Digital Signatures tab:

Click the Details button for more information. For the Vista SP1 standalone installer, you should see this:

Digital signatures are definitely your friend.