It's not quite that simple. The exploit works by using a flaw in the virus scanner to execute the code.

These sort of exploits will always exist but the heartening thing is how quickly Microsoft has reacted and pushed out a patch. Most users will never be aware that the exploit existed and will have been automatically patched. It really is impressive that it has been fixed so quickly.

+1
And that it was discovered in a lab not active in the field.

It was impressive how quick it was fixed, but i dont think they had a choice given the circumstances around it

In reply to a post by RobertoS:

I can't find and exe to try to establish its version,

.EXE is at "%ProgramFiles%\Windows Defender\MSASCui.exe".

Mine seems to be Antimalware Client Version: 4.10.14393.1066 on Win 10 Anniversary Edition.
EDIT: Duh! That's just the version of Windows itself!

Edited by XRaySpeX (Thu 11-May-17 03:03:14)

Is this problem for the Anniversary Edition, as Defender is totally different in Creators Edition. My exe is saying 4.11.15063, is this version affected? BBC article is not very clear.

See this Microsoft Advisory. This link posted earlier in the thread by David_W.

Given the products it is stated that have the vulnerability, and the very deep inside sort of bug it is, it would be strange if the Creators Edition version doesn't also have it. Even though the serial number seems much higher. It can't be that much up the development path surely, and even if it is, how "completely different" is it from the mainstream one? An entirely different source starting from scratch at some point in the past?

How often do you update for security patches?

I have checked Windows Update several times today and had several definition updates and yesterday I had the updates that Nick has posted but looking in WU history I cant see anything about engine update, nor can I find the engine serial number mentioned.

Edited by Banger (Thu 11-May-17 00:09:22)

I seem to have Windows Defender Security Center, with advanced network scanner. So I dont know if it is up to date or not. The exe seems to be the one with Creator Update as it is v4.11.15063.

Edit: It is up to date, found the Engine Version from an Article after googling the vulnerability and learning how to access the Security Centre about page. Phew.

Edited by Banger (Thu 11-May-17 00:34:12)

Great.

I thought there had to be an update for it, just not mentioned in the main advisory.

I expect that is because it isn't on full roll-out yet, is it? Available to anyone, but only manually by user download. Also doesn't preserve user settings, whereas the automatic upgrade should.

I downloaded the ISO, and did an Upgrade install. Auto roll out started 11th April, but you can get it now by getting the Windows Upgrade Assistant and that will download it straight away.

I have done several Upgrade installs and they always preserve settings so does the Upgrade Assistant.