22

Given that the WannaCry ransomware exploit is going around I wanted to check if my computer has the specific security update that should stop the vulnerability - apparently, MS17-010, assuming I'm understanding the vulnerability and that is indeed the right patch. How would one check that detail?

Microsoft tries to give some detail but it's gibberish to someone who's not well versed with registry keys (I think I touched them once before to dig out a stubborn virus back when XP was still a thing - that's it.) Other searches give some clues regard command line options but they're not all that clear and I don't like running commands I don't understand.

4

Here is a way to check this for windows 10 (Version 1607): As noted here https://support.microsoft.com/en-us/help/4013389/title in section "Windows 10 (all editions)", the security update file name for MS17-010 must be Windows10.0-KB4013429-x64.msu, so the kb number for this patch will be KB4013429.

enter image description here

Then in the windows 10 update history check for an entry containing the KB4013429. At my system this patch was successfully installed in the mid of march and is named cumulative update for windows 10 version 1607 for x64 based systems (KB4013429).

enter image description here

| improve this answer | |
  • 1
    For Windows 10 x64 are three KB patches listed on that site: KB4012606 (for all versions?), KB4013198 (Windows Version 1511) and KB4013429 (Windows version 1607). The current Windows build (creators update) is 1703. So, which one is the right? – nixda May 13 '17 at 8:26
  • @nixda The patch that applies to your installation. – Ramhound May 13 '17 at 13:08
  • To know what version of windows you are running go to, Start Menu > Settings > System > About > 'Version'. The first two digits of version number are the year of release, and last two digits are month. If your Windows 10 version number is 1607, then your it was released on 2016 July. Also you do not need to update to 'Creators update' to get this patch automatically. – Quazi Irfan May 14 '17 at 22:37
  • Here is the download link to the MS17-010 Security Update. – Quazi Irfan May 15 '17 at 5:02
  • If in doubt, download the patch installer for your version of Windows and run it. If the patch is already installed, it'll say so and stop. – Steve Rindsberg May 17 '17 at 15:42
19

Checking for a specific KB is BAD, because Updates get replaced with newer updates and the disk cleaner deletes such old replaced/superseded Windows Updates.

You need to check the KB page and look for file version data of the update for each Windows you use and now look if the user has at least this file version or a newer one.

This will always return the correct result. If the update gets replaced and removed the check always shows "you are insecure", but the issue is already fixed.

If you use Windows 10, make sure you have the latest Update rollup installed

http://i.imgur.com/sJqJvBi.jpg

In May 2017 those are

The last Update rollup always includes all older updates so here you are safe.

Pro tip: to quickly check your Windows version, just type winver in the Windows 10 search or 'Run' command and hit Enter.

| improve this answer | |
  • 1
    If I were the op, I'd select this answer as the correct one. Most home users get their updates freshly, right from Microsoft's ovens, thus updates are replaced with newer rollups (things aren't like in vista where every update is listed). The virus only targets those devices in networked areas like companies who are illiterate on cyber security, if not illiterate on computers, and don't want to put some cash in Microsoft's pockets for newer Windows – Sanny May 15 '17 at 18:12
  • @Sanny the OP has choosen the other one – magicandre1981 May 16 '17 at 16:38
  • Probably if you add some screenshots you might get accepted 😜 – Sanny May 16 '17 at 16:54
  • While this is good advice (that updates get replaced) keeping track of which update replaced what is a lot of work - I'd need some very specific examples of how to know what replaced what for this to be an acceptable answer. – dluxcru May 16 '17 at 19:02
  • no, this is NOT hard, I added the link which always shows the history of updates. run winver and look if the buildnumber is the latest & you're fine. you can install a clean Win10 and the latest rollup and you are fine. – magicandre1981 May 17 '17 at 15:19
6

You have given the answer yourself. Open a powershell prompt and type this:

get-hotfix | out-string -stream | select-string   "KB00112233"

This snippet will only read datas, so nothing wrong can happen with it.

You only have to adjust with the KB you want to check. As specified in the MS Security bulletin MS17-010 (https://technet.microsoft.com/en-us/library/security/ms17-010.aspx), the KB number depends of your OS.

For example, the KB number for Windows 10 v1607 is KB4013429

As mentionned in https://superuser.com/a/1209007/264313, hotfix are regularly replaced by newer one. So a specific fix might be present but the original hotfix be missing.

| improve this answer | |
  • 1
    Doesn't work reliably. For example, on a machine where the update history shows KB4012216, this script does not detect KB4012216. Probably because a newer update has already been installed. See superuser.com/a/1209007/333024 – Florian Winter May 16 '17 at 15:28
  • 1
    This is shorter and more precise: get-hotfix -Id KB00112233. It still doesn't list some installed older updates, though. – Florian Winter May 16 '17 at 15:38
  • Works on Windows 7 as well. – user3356885 Jan 30 '18 at 19:10
0

For Lansweeper users: Lansweeper released a report that can be used to find machines that do not have the hotfixes installed to mitigate the SMB vulnerability.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.