25

Given that the WannaCry ransomware exploit is going around I wanted to check if my computer has the specific security update that should stop the vulnerability - apparently, MS17-010, assuming I'm understanding the vulnerability and that is indeed the right patch. How would one check that detail?

Microsoft tries to give some detail but it's gibberish to someone who's not well versed with registry keys (I think I touched them once before to dig out a stubborn virus back when XP was still a thing - that's it.) Other searches give some clues regard command line options but they're not all that clear and I don't like running commands I don't understand.

3

4 Answers 4

4

Here is a way to check this for windows 10 (Version 1607): As noted here https://support.microsoft.com/en-us/help/4013389/title in section "Windows 10 (all editions)", the security update file name for MS17-010 must be Windows10.0-KB4013429-x64.msu, so the kb number for this patch will be KB4013429.

enter image description here

Then in the windows 10 update history check for an entry containing the KB4013429. At my system this patch was successfully installed in the mid of march and is named cumulative update for windows 10 version 1607 for x64 based systems (KB4013429).

enter image description here

6
  • 1
    For Windows 10 x64 are three KB patches listed on that site: KB4012606 (for all versions?), KB4013198 (Windows Version 1511) and KB4013429 (Windows version 1607). The current Windows build (creators update) is 1703. So, which one is the right?
    – nixda
    May 13, 2017 at 8:26
  • @nixda The patch that applies to your installation.
    – Ramhound
    May 13, 2017 at 13:08
  • To know what version of windows you are running go to, Start Menu > Settings > System > About > 'Version'. The first two digits of version number are the year of release, and last two digits are month. If your Windows 10 version number is 1607, then your it was released on 2016 July. Also you do not need to update to 'Creators update' to get this patch automatically. May 14, 2017 at 22:37
  • Here is the download link to the MS17-010 Security Update. May 15, 2017 at 5:02
  • If in doubt, download the patch installer for your version of Windows and run it. If the patch is already installed, it'll say so and stop. May 17, 2017 at 15:42
20

Checking for a specific KB is BAD, because Updates get replaced with newer updates and the disk cleaner deletes such old replaced/superseded Windows Updates.

You need to check the KB page and look for file version data of the update for each Windows you use and now look if the user has at least this file version or a newer one.

This will always return the correct result. If the update gets replaced and removed the check always shows "you are insecure", but the issue is already fixed.

If you use Windows 10, make sure you have the latest Update rollup installed

http://i.imgur.com/sJqJvBi.jpg

In May 2017 those are

The last Update rollup always includes all older updates so here you are safe.

Pro tip: to quickly check your Windows version, just type winver in the Windows 10 search or 'Run' command and hit Enter.

8
  • 1
    If I were the op, I'd select this answer as the correct one. Most home users get their updates freshly, right from Microsoft's ovens, thus updates are replaced with newer rollups (things aren't like in vista where every update is listed). The virus only targets those devices in networked areas like companies who are illiterate on cyber security, if not illiterate on computers, and don't want to put some cash in Microsoft's pockets for newer Windows
    – Sanny
    May 15, 2017 at 18:12
  • @Sanny the OP has choosen the other one May 16, 2017 at 16:38
  • Probably if you add some screenshots you might get accepted 😜
    – Sanny
    May 16, 2017 at 16:54
  • While this is good advice (that updates get replaced) keeping track of which update replaced what is a lot of work - I'd need some very specific examples of how to know what replaced what for this to be an acceptable answer.
    – dluxcru
    May 16, 2017 at 19:02
  • no, this is NOT hard, I added the link which always shows the history of updates. run winver and look if the buildnumber is the latest & you're fine. you can install a clean Win10 and the latest rollup and you are fine. May 17, 2017 at 15:19
6

You have given the answer yourself. Open a powershell prompt and type this:

get-hotfix | out-string -stream | select-string   "KB00112233"

This snippet will only read datas, so nothing wrong can happen with it.

You only have to adjust with the KB you want to check. As specified in the MS Security bulletin MS17-010 (https://technet.microsoft.com/en-us/library/security/ms17-010.aspx), the KB number depends of your OS.

For example, the KB number for Windows 10 v1607 is KB4013429

As mentionned in https://superuser.com/a/1209007/264313, hotfix are regularly replaced by newer one. So a specific fix might be present but the original hotfix be missing.

3
  • 1
    Doesn't work reliably. For example, on a machine where the update history shows KB4012216, this script does not detect KB4012216. Probably because a newer update has already been installed. See superuser.com/a/1209007/333024 May 16, 2017 at 15:28
  • 1
    This is shorter and more precise: get-hotfix -Id KB00112233. It still doesn't list some installed older updates, though. May 16, 2017 at 15:38
  • Works on Windows 7 as well. Jan 30, 2018 at 19:10
-1

For Lansweeper users: Lansweeper released a report that can be used to find machines that do not have the hotfixes installed to mitigate the SMB vulnerability.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .