This article provides a way to determine if a host system is patched with a critical Microsoft patch MS17-010.
The following sections are covered:
Operating systems Microsoft Windows XP, 7, Vista,10(Except Build 1703+) Microsoft Windows Server 2003, 2008 and R2, 2012 and R2, 2016
EternalBlue is an exploit which takes advantage of a vulnerability in Microsoft’s SMB v1.0. This exploit is now commonly used in malware to help spread it across a network. Some malware it has been used in is WannaCry, Trickbot, WannaMine and many others. Machines that aren’t patched against this vulnerability are at high risk of attack.
The driver file srv.sys handles majorly SMB v1.0 traffic. The updated SMB driver srv2.sys can be spotted on your machines under C:\Windows\system32\drivers which handles SMB v2.0 and v3.0 traffic.
C:\Windows\system32\drivers
The script basically verifies the File Version of srv.sys as outlined by Microsoft in this article.
If you see any of the detection names in SAV.TXT as listed below, there are high chances that either the host itself is vulnerable or there's another infected vulnerable host on the network which is infecting other machines including this one:
PUA detected: 'Equation Group' at 'C:\Windows\System32\tpmagentservice.dll' Malware detected: 'Troj/Equatio-Q' at 'C:\Windows\SecureBootThemes\Microsoft\tibe-1.dll' Malware detected: 'Troj/Equation-G' at 'C:\Windows\SecureBootThemes\Microsoft\spoolsv.exe' Malware detected: 'Troj/Eqdrug-AC' at 'C:\Windows\SecureBootThemes\Microsoft\adfw-2.dll' Malware detected: 'Troj/Eternal-A' at 'C:\Windows\SecureBootThemes\Microsoft\svchost.exe'
Additionally, if the customer is using Intercept X or Exploit Prevention, an event for APC Violation might possibly indicate the presence of EternalBlue in the network. On the Central Dashboard you may see events such as:
May 9, 2018 11:28 PM Nothing found to clean up: 'Services and Controller app' at 'C:\Windows\System32\services.exe' May 9, 2018 11:20 PM 'APCViolation' exploit prevented in Services and Controller app
When you see these detection on a machine, please inform the customer that Sophos is successfully preventing further infection of the host but in order to regain normalcy of the situation, they need to patch all the systems on the network which is spreading malware using this exploit.
Verify_MS17-010.ZIP
On a Vulnerable machine the output would be something like this:
On a non-vulnerable machine, the output should look something like this:
NOTE: By default you may not have the ability to execute Powershell scripts. You can change the execution policy by running this command on an Administrative Powershell window:
Set-ExecutionPolicy <parameter>
The parameters can be any of the following: Unrestricted, RemoteSigned, AllSigned, Restricted, Default, Bypass, Undefined
You can selectively bypass the ExecutionPolicy for a single script using this command -
powershell.exe -ExecutionPolicy ByPass -File Verify_MS17-010.ps1
There is an easier way to execute this script out-of-the-box:
powershell.exe -EncodedCommand JABzAHIAdgBzAHkAcwBQAGEAdABjAGgAZQBkACAAPQAgACcAMAAnAA0ACgAkAHMAcgB2AHMAeQBzAFYAZQByAHMAaQBvAG4AIAA9ACAAIgAwACIADQAKAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAA0ACgBXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBBACAAUwBjAHIAaQBwAHQAIAB0AG8AIABkAGUAdABlAHIAbQBpAG4AZQAgAGkAZgAgAGEAIABtAGEAYwBoAGkAbgBlACAAaQBzACAAcABhAHQAYwBoAGUAZAAgAHcAaQB0AGgAIABNAFMAMQA3AC0AMAAxADAAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABHAHIAZQBlAG4ADQAKAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAA0ACgBbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACIAUwB5AHMAdABlAG0ALgBWAGUAcgBzAGkAbwBuACIAKQANAAoAJABvAHMAIAA9ACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYwBsAGEAcwBzACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ADQAKACQAbwBzAE4AYQBtAGUAIAA9ACAAJABvAHMALgBDAGEAcAB0AGkAbwBuAA0ACgAkAHMAIAA9ACAAIgAlAHMAeQBzAHQAZQBtAHIAbwBvAHQAJQBcAHMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABzAHIAdgAuAHMAeQBzACIADQAKACQAcwAyACAAPQAgACIAJQBzAHkAcwB0AGUAbQByAG8AbwB0ACUAXABzAHkAcwB0AGUAbQAzADIAXABkAHIAaQB2AGUAcgBzAFwAcwByAHYAMgAuAHMAeQBzACIADQAKACQAdgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACQAcwApAA0ACgAkAHYAMgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACQAcwAyACkADQAKAEkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAiACQAdgAiACkADQAKACAAIAAgACAAewANAAoAIAAgACAAIABUAHIAeQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAHYAZQByAHMAaQBvAG4ASQBuAGYAbwAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAdgApAC4AVgBlAHIAcwBpAG8AbgBJAG4AZgBvAA0ACgANAAoAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG8AcwBOAGEAbQBlAC4AQwBvAG4AdABhAGkAbgBzACgAIgBXAGkAbgBkAG8AdwBzACAAMQAwACIAKQApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAFYAZQByAHMAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AVgBlAHIAcwBpAG8AbgAoACQAdgBlAHIAcwBpAG8AbgBJAG4AZgBvAC4AUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAFIAYQB3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAIAAoACQAbwBzAE4AYQBtAGUALgBDAG8AbgB0AGEAaQBuAHMAKAAiADIAMAAxADYAIgApACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGYAaQBsAGUAVgBlAHIAcwBpAG8AbgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBWAGUAcgBzAGkAbwBuACgAJAB2AGUAcgBzAGkAbwBuAEkAbgBmAG8ALgBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AUgBhAHcAKQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AGUAcgBzAGkAbwBuAFMAdAByAGkAbgBnACAAPQAgACIAJAAoACQAdgBlAHIAcwBpAG8AbgBJAG4AZgBvAC4ARgBpAGwAZQBNAGEAagBvAHIAUABhAHIAdAApAC4AJAAoACQAdgBlAHIAcwBpAG8AbgBJAG4AZgBvAC4ARgBpAGwAZQBNAGkAbgBvAHIAUABhAHIAdAApAC4ADQAKACQAKAAkAHYAZQByAHMAaQBvAG4ASQBuAGYAbwAuAEYAaQBsAGUAQgB1AGkAbABkAFAAYQByAHQAKQAuACQAKAAkAHYAZQByAHMAaQBvAG4ASQBuAGYAbwAuAEYAaQBsAGUAUAByAGkAdgBhAHQAZQBQAGEAcgB0ACkAIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAFYAZQByAHMAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AVgBlAHIAcwBpAG8AbgAoACQAdgBlAHIAcwBpAG8AbgBTAHQAcgBpAG4AZwApAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoADQAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJAB2AGUAcgBzAGkAbwBuAEkAbgBmAG8ADQAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABmAGkAbABlAFYAZQByAHMAaQBvAG4ADQAKACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIABDAGEAdABjAGgADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABzAHIAdgBzAHkAcwBQAGEAdABjAGgAZQBkACAAPQAgACcAMAAnAA0ACgAgACAAIAAgACAAIAAgACAAJABzAHIAdgBzAHkAcwBWAGUAcgBzAGkAbwBuACAAPQAgACIAVQBuAGEAYgBsAGUAIAB0AG8AIAByAGUAdAByAGkAZQB2AGUAIABmAGkAbABlACAAdgBlAHIAcwBpAG8AbgAgAGkAbgBmAG8ALAAgAHAAbABlAGEAcwBlACAAdgBlAHIAaQBmAHkAIAB2AHUAbABuAGUAcgBhAGIAaQBsAGkAdAB5ACAAcwB0AGEAdABlACAAbQBhAG4AdQBhAGwAbAB5AC4AIgANAAoAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEUAcgByAG8AcgAuACAAVQBuAGEAYgBsAGUAIAB0AG8AIAByAGUAdAByAGkAZQB2AGUAIABmAGkAbABlACAAdgBlAHIAcwBpAG8AbgAgAGkAbgBmAG8ALAAgAHAAbABlAGEAcwBlACAAdgBlAHIAaQBmAHkAIAB2AHUAbABuAGUAcgBhAGIAaQBsAGkAdAB5ACAAcwB0AGEAdABlACAAbQBhAG4AdQBhAGwAbAB5AC4AIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABZAGUAbABsAG8AdwANAAoACQBSAGUAYQBkAC0ASABvAHMAdAAgACIAUAByAGUAcwBzACAARQBOAFQARQBSACIADQAKACAAIAAgACAAIAAgACAAIABSAGUAdAB1AHIAbgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoADQAKAGUAbABzAGUAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAiACQAdgAyACIAKQANAAoAewANAAoADQAKAAkAJABjAHUAcgByAGUAbgB0AE8AUwAgAD0AIAAiACQAbwBzAE4AYQBtAGUAIgANAAoACQAkAHYAZQByAHMAaQBvAG4ASQBuAGYAbwAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAdgAyACkALgBWAGUAcgBzAGkAbwBuAEkAbgBmAG8ADQAKAAkAJABmAGkAbABlAFYAZQByAHMAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AVgBlAHIAcwBpAG8AbgAoACQAdgBlAHIAcwBpAG8AbgBJAG4AZgBvAC4AUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAFIAYQB3ACkADQAKAAkAVwByAGkAdABlAC0ASABvAHMAdAAgACQAdgBlAHIAcwBpAG8AbgBJAG4AZgBvAA0ACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACQAZgBpAGwAZQBWAGUAcgBzAGkAbwBuAA0ACgAJAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgBDAHUAcgByAGUAbgB0ACAATwBTADoAIAAkAGMAdQByAHIAZQBuAHQATwBTACAAKABCAHUAaQBsAGQAIABOAHUAbQBiAGUAcgAgACQAKAAkAG8AcwAuAEIAdQBpAGwAZABOAHUAbQBiAGUAcgApACkAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAA0ACgAJAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgBWAGUAcgBzAGkAbwBuACAAbwBmACAAcwByAHYAMgAuAHMAeQBzADoAIAAkACgAJABmAGkAbABlAFYAZQByAHMAaQBvAG4ALgBUAG8AUwB0AHIAaQBuAGcAKAApACkAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAA0ACgAJAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgBTAHkAcwB0AGUAbQAgAGkAcwAgAHAAYQB0AGMAaABlAGQAIAB3AGkAdABoACAATQBTADEANwAtADAAMQAwACAAYQBuAGQAIABpAHMAIAB0AGgAZQByAGUAZgBvAHIAZQAgAG4AbwB0ACAAdgB1AGwAbgBlAHIAYQBiAGwAZQAgAHQAbwAgAEUAdABlAHIAbgBhAGwAQgBsAHUAZQAuACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAA0ACgAJAFIAZQBhAGQALQBIAG8AcwB0ACAAIgBgAG4AUAByAGUAcwBzACAARQBOAFQARQBSACIADQAKAAkAYgByAGUAYQBrAA0ACgANAAoAfQANAAoADQAKAEUAbABzAGUADQAKACAAIAAgACAAewANAAoAIAAgACAAIAAkAHMAcgB2AHMAeQBzAFAAYQB0AGMAaABlAGQAIAA9ACAAJwAwACcADQAKACAAIAAgACAAJABzAHIAdgBzAHkAcwBWAGUAcgBzAGkAbwBuACAAPQAgACIAUwByAHYALgBzAHkAcwAgAGQAbwBlAHMAIABuAG8AdAAgAGUAeABpAHMAdAAsACAAcABsAGUAYQBzAGUAIAB2AGUAcgBpAGYAeQAgAHYAdQBsAG4AZQByAGEAYgBpAGwAaQB0AHkAIABzAHQAYQB0AGUAIAB2AGkAYQAgAFAAYQB0AGMAaAAgAEsAQgAgAG4AdQBtAGIAZQByAC4AIgANAAoAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBFAHIAcgBvAHIALgAgAFUAbgBhAGIAbABlACAAdABvACAAbABvAGMAYQB0AGUAIABTAHIAdgAuAHMAeQBzAC8AZgBpAGwAZQAgAGQAbwBlAHMAIABuAG8AdAAgAGUAeABpAHMAdAAsACAAcABsAGUAYQBzAGUAIAB2AGUAcgBpAGYAeQAgAHYAdQBsAG4AZQByAGEAYgBpAGwAaQB0AHkAIABzAHQAYQB0AGUAIAB2AGkAYQAgAFAAYQB0AGMAaAAgAEsAQgAgAG4AdQBtAGIAZQByAC4AIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABZAGUAbABsAG8AdwANAAoAIAAgACAAIABSAGUAYQBkAC0ASABvAHMAdAAgACIAUAByAGUAcwBzACAARQBOAFQARQBSACIADQAKACAAIAAgACAAUgBlAHQAdQByAG4ADQAKACAAIAAgACAAfQANAAoAaQBmACAAKAAkAG8AcwBOAGEAbQBlAC4AQwBvAG4AdABhAGkAbgBzACgAIgBWAGkAcwB0AGEAIgApACAALQBvAHIAIAAoACQAbwBzAE4AYQBtAGUALgBDAG8AbgB0AGEAaQBuAHMAKAAiADIAMAAwADgAIgApACAALQBhAG4AZAAgAC0AbgBvAHQAIAAkAG8AcwBOAGEAbQBlAC4AQwBvAG4AdABhAGkAbgBzACgAIgBSADIAIgApACkAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgAGkAZgAgACgAJAB2AGUAcgBzAGkAbwBuAFMAdAByAGkAbgBnAC4AUwBwAGwAaQB0ACgAJwAuACcAKQBbADMAXQBbADAAXQAgAC0AZQBxACAAIgAxACIAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQATwBTACAAPQAgACIAJABvAHMATgBhAG0AZQAgAEcARABSACIADQAKACAAIAAgACAAIAAgACAAIAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFYAZQByAHMAaQBvAG4AKAAiADYALgAwAC4ANgAwADAAMgAuADEAOQA3ADQAMwAiACkADQAKACAAIAAgACAAIAAgACAAIAB9ACAADQAKACAAIAAgACAAZQBsAHMAZQBpAGYAIAAoACQAdgBlAHIAcwBpAG8AbgBTAHQAcgBpAG4AZwAuAFMAcABsAGkAdAAoACcALgAnACkAWwAzAF0AWwAwAF0AIAAtAGUAcQAgACIAMgAiACkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABjAHUAcgByAGUAbgB0AE8AUwAgAD0AIAAiACQAbwBzAE4AYQBtAGUAIABMAEQAUgAiAA0ACgAgACAAIAAgACAAIAAgACAAJABlAHgAcABlAGMAdABlAGQAVgBlAHIAcwBpAG8AbgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBWAGUAcgBzAGkAbwBuACgAIgA2AC4AMAAuADYAMAAwADIALgAyADQAMAA2ADcAIgApAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIABlAGwAcwBlAA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAYwB1AHIAcgBlAG4AdABPAFMAIAA9ACAAIgAkAG8AcwBOAGEAbQBlACIADQAKACAAIAAgACAAIAAgACAAIAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFYAZQByAHMAaQBvAG4AKAAiADkALgA5AC4AOQA5ADkAOQAuADkAOQA5ADkAOQAiACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0ADQAKAGUAbABzAGUAaQBmACAAKAAkAG8AcwBOAGEAbQBlAC4AQwBvAG4AdABhAGkAbgBzACgAIgBXAGkAbgBkAG8AdwBzACAANwAiACkAIAAtAG8AcgAgACgAJABvAHMATgBhAG0AZQAuAEMAbwBuAHQAYQBpAG4AcwAoACIAMgAwADAAOAAgAFIAMgAiACkAKQApAA0ACgAgACAAIAAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AE8AUwAgAD0AIAAiACQAbwBzAE4AYQBtAGUAIABMAEQAUgAiAA0ACgAgACAAIAAgACQAZQB4AHAAZQBjAHQAZQBkAFYAZQByAHMAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AVgBlAHIAcwBpAG8AbgAoACIANgAuADEALgA3ADYAMAAxAC4AMgAzADYAOAA5ACIAKQANAAoAIAAgACAAIAB9AA0ACgBlAGwAcwBlAGkAZgAgACgAJABvAHMATgBhAG0AZQAuAEMAbwBuAHQAYQBpAG4AcwAoACIAVwBpAG4AZABvAHcAcwAgADgALgAxACIAKQAgAC0AbwByACAAJABvAHMATgBhAG0AZQAuAEMAbwBuAHQAYQBpAG4AcwAoACIAMgAwADEAMgAgAFIAMgAiACkAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACQAYwB1AHIAcgBlAG4AdABPAFMAIAA9ACAAIgAkAG8AcwBOAGEAbQBlACAATABEAFIAIgANAAoAIAAgACAAIAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFYAZQByAHMAaQBvAG4AKAAiADYALgAzAC4AOQA2ADAAMAAuADEAOAA2ADAANAAiACkADQAKACAAIAAgACAAfQANAAoAZQBsAHMAZQBpAGYAIAAoACQAbwBzAE4AYQBtAGUALgBDAG8AbgB0AGEAaQBuAHMAKAAiAFcAaQBuAGQAbwB3AHMAIAA4ACIAKQAgAC0AbwByACAAJABvAHMATgBhAG0AZQAuAEMAbwBuAHQAYQBpAG4AcwAoACIAMgAwADEAMgAiACkAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACQAYwB1AHIAcgBlAG4AdABPAFMAIAA9ACAAIgAkAG8AcwBOAGEAbQBlACAATABEAFIAIgANAAoAIAAgACAAIAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFYAZQByAHMAaQBvAG4AKAAiADYALgAyAC4AOQAyADAAMAAuADIAMgAwADkAOQAiACkADQAKACAAIAAgACAAfQANAAoAZQBsAHMAZQBpAGYAIAAoACQAbwBzAE4AYQBtAGUALgBDAG8AbgB0AGEAaQBuAHMAKAAiAFcAaQBuAGQAbwB3AHMAIAAxADAAIgApACkADQAKACAAIAAgACAAewANAAoAIAAgACAAIABpAGYAIAAoACQAbwBzAC4AQgB1AGkAbABkAE4AdQBtAGIAZQByACAALQBlAHEAIAAiADEAMAAyADQAMAAiACkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABjAHUAcgByAGUAbgB0AE8AUwAgAD0AIAAiACQAbwBzAE4AYQBtAGUAIABUAEgAMQAiAA0ACgAgACAAIAAgACAAIAAgACAAJABlAHgAcABlAGMAdABlAGQAVgBlAHIAcwBpAG8AbgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBWAGUAcgBzAGkAbwBuACgAIgAxADAALgAwAC4AMQAwADIANAAwAC4AMQA3ADMAMQA5ACIAKQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAZQBsAHMAZQBpAGYAIAAoACQAbwBzAC4AQgB1AGkAbABkAE4AdQBtAGIAZQByACAALQBlAHEAIAAiADEAMAA1ADgANgAiACkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABjAHUAcgByAGUAbgB0AE8AUwAgAD0AIAAiACQAbwBzAE4AYQBtAGUAIABUAEgAMgAiAA0ACgAgACAAIAAgACAAIAAgACAAJABlAHgAcABlAGMAdABlAGQAVgBlAHIAcwBpAG8AbgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBWAGUAcgBzAGkAbwBuACgAIgAxADAALgAwAC4AMQAwADUAOAA2AC4AOAAzADkAIgApAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABvAHMALgBCAHUAaQBsAGQATgB1AG0AYgBlAHIAIAAtAGUAcQAgACIAMQA0ADMAOQAzACIAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQATwBTACAAPQAgACIAJAAoACQAbwBzAE4AYQBtAGUAKQAgAFIAUwAxACIADQAKACAAIAAgACAAIAAgACAAIAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFYAZQByAHMAaQBvAG4AKAAiADEAMAAuADAALgAxADQAMwA5ADMALgA5ADUAMwAiACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAA0ACgAgACAAIAAgACMAIwAgAEIAdQBpAGwAZABzACAAMQAwADIANAAwACwAIAAxADAANQA4ADYAIABhAG4AZAAgADEANAAzADkAMwAgAGMAbwB1AGwAZAAgAGIAZQAgAGEAZgBmAHQAZQBjAHQAZQBkACAAYQBuAGQAIABoAGUAbgBjAGUAIAB0AGgAbwBzAGUAIABoAGEAdgBlACAAYgBlAGUAbgAgAGEAZABkAGUAZAAgAGEAYgBvAHYAZQAuAA0ACgAgACAAIAAgACMAIwAgAFAAbABlAGEAcwBlACAAbgBvAHQAZQAgAHQAaABhAHQAIABpAGYAIAB0AGgAZQAgAFcAaQBuAGQAbwB3AHMAIAAxADAAIABCAHUAaQBsAGQAIABpAHMAIAAxADcAMAAzACAAbwByACAAbABhAHQAZQByACwAIAB0AGgAZQByAGUAIAB3AGkAbABsACAAYgBlACAAYQBuACAAZQByAHIAbwByAC4AIABXAGUAIABuAGUAZQBkACAAdABvACAAYQBkAGQAIAAyAC0AMwAgAG0AbwByAGUAIABiAHUAaQBsAGQAIAB2AGUAcgBzAGkAbwBuAHMAIABzAG8AIAB0AGgAYQB0ACAAdABoAGUAIABjAG8AZABlACAADQAKACAAIAAgACAAIwAjACAAYwBhAG4AIABiAHIAZQBhAGsAIABmAHIAbwBtACAAdABoAGUAcgBlACAAYgB5ACAAcwBpAG0AcABsAHkAIABzAGgAbwB3AGkAbgBnACAAYQAgAGwAaQBuAGUAIAB0AGgAYQB0ACAAdABoAGUAIABzAHkAcwB0AGUAbQAgAGkAcwAgAHAAYQB0AGMAaABlAGQALgAgAA0ACgAgACAAIAAgAGUAbABzAGUAaQBmACAAKAAkAG8AcwAuAEIAdQBpAGwAZABOAHUAbQBiAGUAcgAgAC0AZQBxACAAIgAxADYAMgA5ADkAIgApAA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAYwB1AHIAcgBlAG4AdABPAFMAIAA9ACAAIgAkAG8AcwBOAGEAbQBlACIADQAKACAAIAAgACAAIAAgACAAIAAkAHMAcgB2AHMAeQBzAFAAYQB0AGMAaABlAGQAIAA9ACAAJwAxACcADQAKAAkAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAEMAdQByAHIAZQBuAHQAIABPAFMAOgAgACQAYwB1AHIAcgBlAG4AdABPAFMAIAAoAEIAdQBpAGwAZAAgAE4AdQBtAGIAZQByACAAJAAoACQAbwBzAC4AQgB1AGkAbABkAE4AdQBtAGIAZQByACkAKQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ADQAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBgAG4AUwB5AHMAdABlAG0AIABpAHMAIABwAGEAdABjAGgAZQBkACAAdwBpAHQAaAAgAE0AUwAxADcALQAwADEAMAAgAGEAbgBkACAAaQBzACAAdABoAGUAcgBlAGYAbwByAGUAIABuAG8AdAAgAHYAdQBsAG4AZQByAGEAYgBsAGUAIAB0AG8AIABFAHQAZQByAG4AYQBsAEIAbAB1AGUALgAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEcAcgBlAGUAbgANAAoACQBSAGUAYQBkAC0ASABvAHMAdAAgACIAYABuAFAAcgBlAHMAcwAgAEUATgBUAEUAUgAiAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4ADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgANAAoAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABvAHMALgBCAHUAaQBsAGQATgB1AG0AYgBlAHIAIAAtAGUAcQAgACIAMQA1ADAANgAzACIAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQATwBTACAAPQAgACIAJABvAHMATgBhAG0AZQAiAA0ACgAgACAAIAAgACAAIAAgACAAJABzAHIAdgBzAHkAcwBQAGEAdABjAGgAZQBkACAAPQAgACcAMQAnAA0ACgAJAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgBDAHUAcgByAGUAbgB0ACAATwBTADoAIAAkAGMAdQByAHIAZQBuAHQATwBTACAAKABCAHUAaQBsAGQAIABOAHUAbQBiAGUAcgAgACQAKAAkAG8AcwAuAEIAdQBpAGwAZABOAHUAbQBiAGUAcgApACkAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAA0ACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAFMAeQBzAHQAZQBtACAAaQBzACAAcABhAHQAYwBoAGUAZAAgAHcAaQB0AGgAIABNAFMAMQA3AC0AMAAxADAAIABhAG4AZAAgAGkAcwAgAHQAaABlAHIAZQBmAG8AcgBlACAAbgBvAHQAIAB2AHUAbABuAGUAcgBhAGIAbABlACAAdABvACAARQB0AGUAcgBuAGEAbABCAGwAdQBlAC4AIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABHAHIAZQBlAG4ADQAKAAkAUgBlAGEAZAAtAEgAbwBzAHQAIAAiAGAAbgBQAHIAZQBzAHMAIABFAE4AVABFAFIAIgANAAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAB9AA0ACgBlAGwAcwBlAGkAZgAgACgAJABvAHMATgBhAG0AZQAuAEMAbwBuAHQAYQBpAG4AcwAoACIAMgAwADEANgAiACkAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACQAYwB1AHIAcgBlAG4AdABPAFMAIAA9ACAAIgAkAG8AcwBOAGEAbQBlACIADQAKACAAIAAgACAAJABlAHgAcABlAGMAdABlAGQAVgBlAHIAcwBpAG8AbgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBWAGUAcgBzAGkAbwBuACgAIgAxADAALgAwAC4AMQA0ADMAOQAzAC4AOQA1ADMAIgApAA0ACgAgACAAIAAgAH0ADQAKAGUAbABzAGUAaQBmACAAKAAkAG8AcwBOAGEAbQBlAC4AQwBvAG4AdABhAGkAbgBzACgAIgBXAGkAbgBkAG8AdwBzACAAWABQACIAKQApAA0ACgAgACAAIAAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AE8AUwAgAD0AIAAiACQAbwBzAE4AYQBtAGUAIgANAAoAIAAgACAAIAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFYAZQByAHMAaQBvAG4AKAAiADUALgAxAC4AMgA2ADAAMAAuADcAMgAwADgAIgApAA0ACgAgACAAIAAgAH0ADQAKAGUAbABzAGUAaQBmACAAKAAkAG8AcwBOAGEAbQBlAC4AQwBvAG4AdABhAGkAbgBzACgAIgBTAGUAcgB2AGUAcgAgADIAMAAwADMAIgApACkADQAKACAAIAAgACAAewANAAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQATwBTACAAPQAgACIAJABvAHMATgBhAG0AZQAiAA0ACgAgACAAIAAgACQAZQB4AHAAZQBjAHQAZQBkAFYAZQByAHMAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AVgBlAHIAcwBpAG8AbgAoACIANQAuADIALgAzADcAOQAwAC4ANgAwADIAMQAiACkADQAKACAAIAAgACAAfQANAAoAZQBsAHMAZQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACQAcwByAHYAcwB5AHMAUABhAHQAYwBoAGUAZAAgAD0AIAAnADAAJwANAAoAIAAgACAAIAAkAHMAcgB2AHMAeQBzAFYAZQByAHMAaQBvAG4AIAA9ACAAIgBVAG4AYQBiAGwAZQAgAHQAbwAgAGQAZQB0AGUAcgBtAGkAbgBlACAATwBTACAAYQBwAHAAbABpAGMAYQBiAGkAbABpAHQAeQAsACAAcABsAGUAYQBzAGUAIAB2AGUAcgBpAGYAeQAgAHYAdQBsAG4AZQByAGEAYgBpAGwAaQB0AHkAIABzAHQAYQB0AGUAIAB2AGkAYQAgAFAAYQB0AGMAaAAgAEsAQgAgAG4AdQBtAGIAZQByAC4AIgANAAoAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBFAHIAcgBvAHIALgAgAFUAbgBhAGIAbABlACAAdABvACAAZABlAHQAZQByAG0AaQBuAGUAIABPAFMAIABhAHAAcABsAGkAYwBhAGIAaQBsAGkAdAB5ACwAIABwAGwAZQBhAHMAZQAgAHYAZQByAGkAZgB5ACAAdgB1AGwAbgBlAHIAYQBiAGkAbABpAHQAeQAgAHMAdABhAHQAZQAgAG0AYQBuAHUAYQBsAGwAeQAuACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAWQBlAGwAbABvAHcADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AE8AUwAgAD0AIAAiACQAbwBzAE4AYQBtAGUAIgANAAoAIAAgACAAIAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFYAZQByAHMAaQBvAG4AKAAiADkALgA5AC4AOQA5ADkAOQAuADkAOQA5ADkAOQAiACkADQAKACAAIAAgACAAUgBlAGEAZAAtAEgAbwBzAHQAIAAiAFAAcgBlAHMAcwAgAEUATgBUAEUAUgAiAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAEMAdQByAHIAZQBuAHQAIABPAFMAOgAgACQAYwB1AHIAcgBlAG4AdABPAFMAIAAoAEIAdQBpAGwAZAAgAE4AdQBtAGIAZQByACAAJAAoACQAbwBzAC4AQgB1AGkAbABkAE4AdQBtAGIAZQByACkAKQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ADQAKACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAEUAeABwAGUAYwB0AGUAZAAgAFYAZQByAHMAaQBvAG4AIABvAGYAIABzAHIAdgAuAHMAeQBzADoAIAAkACgAJABlAHgAcABlAGMAdABlAGQAVgBlAHIAcwBpAG8AbgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAKQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ADQAKACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAEEAYwB0AHUAYQBsACAAVgBlAHIAcwBpAG8AbgAgAG8AZgAgAHMAcgB2AC4AcwB5AHMAOgAgACQAKAAkAGYAaQBsAGUAVgBlAHIAcwBpAG8AbgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAKQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ADQAKAEkAZgAgACgAJAAoACQAZgBpAGwAZQBWAGUAcgBzAGkAbwBuAC4AQwBvAG0AcABhAHIAZQBUAG8AKAAkAGUAeABwAGUAYwB0AGUAZABWAGUAcgBzAGkAbwBuACkAKQAgAC0AbAB0ACAAMAApAA0ACgAgACAAIAAgAHsADQAKACAAIAAgACAADQAKACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAFMAeQBzAHQAZQBtACAAaQBzACAATgBPAFQAIABQAGEAdABjAGgAZQBkACAAdwBpAHQAaAAgAE0AUwAxADcALQAwADEAMAAgAGEAbgBkACAAaQBzACAAdABoAGUAcgBlAGYAbwByAGUAIAB2AHUAbABuAGUAcgBhAGIAbABlACAAdABvACAARQB0AGUAcgBuAGEAbABCAGwAdQBlACEAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABSAGUAZAANAAoAIAAgACAAIAAkAHMAcgB2AHMAeQBzAFAAYQB0AGMAaABlAGQAIAA9ACAAJwAwACcADQAKACAAIAAgACAAJABzAHIAdgBzAHkAcwBWAGUAcgBzAGkAbwBuACAAPQAgACIAUwB5AHMAdABlAG0AIABkAG8AZQBzACAAbgBvAHQAIABhAHAAcABlAGEAcgAgAHQAbwAgAGIAZQAgAHAAYQB0AGMAaABlAGQALAAgAHAAbABlAGEAcwBlACAAdgBlAHIAaQBmAHkAIAB2AHUAbABuAGUAcgBhAGIAaQBsAGkAdAB5ACAAcwB0AGEAdABlACAAdgBpAGEAIABQAGEAdABjAGgAIABLAEIAIABuAHUAbQBiAGUAcgAuACAAVgBlAHIAcwBpAG8AbgAgAG8AZgAgAHMAcgB2AC4AcwB5AHMAOgAgACQAKAAkAGYAaQBsAGUAVgBlAHIAcwBpAG8AbgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAKQAsACAARQB4AHAAZQBjAHQAZQBkACAAdgBlAHIAcwBpAG8AbgA6ACAADQAKACQAZQB4AHAAZQBjAHQAZQBkAFYAZQByAHMAaQBvAG4AIABvAHIAIABoAGkAZwBoAGUAcgAuACIADQAKACAAIAAgACAADQAKACAAIAAgACAAUgBlAGEAZAAtAEgAbwBzAHQAIAAiAGAAbgBQAHIAZQBzAHMAIABFAE4AVABFAFIAIgANAAoAIAAgACAAIAB9AA0ACgBFAGwAcwBlAA0ACgAgACAAIAAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuACIADQAKACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwB5AHMAdABlAG0AIABpAHMAIABQAGEAdABjAGgAZQBkACAAdwBpAHQAaAAgAE0AUwAxADcALQAwADEAMAAgAGEAbgBkACAAaQBzACAAdABoAGUAcgBlAGYAbwByAGUAIABuAG8AdAAgAFYAdQBsAGUAcgBhAGIAbABlACAAdABvACAARQB0AGUAcgBuAGEAbABCAGwAdQBlACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAA0ACgAgACAAIAAgACQAcwByAHYAcwB5AHMAUABhAHQAYwBoAGUAZAAgAD0AIAAnADEAJwANAAoAIAAgACAAIAAkAHMAcgB2AHMAeQBzAFYAZQByAHMAaQBvAG4AIAA9ACAAIgBTAHkAcwB0AGUAbQAgAGkAcwAgAHAAYQB0AGMAaABlAGQAIAB3AGkAdABoACAATQBTADEANwAtADAAMQAwACAAYQBuAGQAIABpAHMAIAB0AGgAZQByAGUAZgBvAHIAZQAgAG4AbwB0ACAAVgB1AGwAbgBlAHIAYQBiAGwAZQAgAHQAbwAgAEUAdABlAHIAbgBhAGwAQgBsAHUAZQAuACAAVgBlAHIAcwBpAG8AbgAgAG8AZgAgAHMAcgB2AC4AcwB5AHMAOgAgACQAKAAkAGYAaQBsAGUAVgBlAHIAcwBpAG8AbgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAKQAuACAARQB4AHAAZQBjAHQAZQBkACAAdgBlAHIAcwBpAG8AbgA6ACAAJABlAHgAcABlAGMAdABlAGQAVgBlAHIAcwBpAG8AbgAgAG8AcgAgAGgAaQBnAGgAZQByAC4AIgANAAoAIAAgACAAIABSAGUAYQBkAC0ASABvAHMAdAAgACIAUAByAGUAcwBzACAARQBOAFQARQBSACIADQAKACAAIAAgACAAfQANAAoAIwANAAoA
How to verify that MS17-010 is installed
How to list all of Windows and Software Updates applied on a computer
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.