February 24, 2016 By Larry Loeb 2 min read

Windows 10 performed a forced update to KB 3135173 on Feb. 9, resetting the default associations established on certain documents and making it impossible to change them back. Many users found this mandatory update caused major problems and could have a negative impact on overall security.

A User Moans

After rebooting the machine following the update, one user on Windows 10 Forums noted that the Action Center started to issue constant pop-up alerts stating, “An app default was reset. An app caused a problem with the default setting for .avi files so it was reset to Films & TV,” although the file extensions would vary to include MP4s, PDFs and more. The user also said that custom context menu items for file types were deleted.

“I started manually changing the associations back to the way I had them,” the user wrote on the forum. “However, each time I finished making a change, within seconds the Action Center would fire the same message as before at me for the file type I’d just changed and it would be reset back to the MS default again.”

InfoWorld reported that this has happened to other users, as well. The changelog for this update doesn’t mention that anything like this should be happening, leaving many to wonder whether it’s a bug of some kind.

Microsoft acknowledged the situation but had no solutions yet. “We are aware of this issue that some customers are experiencing and are actively working to resolve it,” a spokesperson told Security Intelligence.

A Possible Solution

Ramesh Srinivasan at the Winhelponline blog figured out a way to stop Microsoft Edge, Photos, 3D Builder, Zune Music and Zune Video from taking over file associations for various file types through a registry edit.

Changing the registry file does not impair the functionality of the apps after the edit is applied. Several other industry experts have endorsed this registry-based approach for rectifying the problem, at least in the short term.

InfoWorld noted that there is an alternative way to deal with this, reporting that some users uninstalled the update and blocked it from running again with the help of a Windows utility tool.

Bigger Problems With Windows 10

A forced update to an operating system is expected to not display this type of behavior. As long as Microsoft makes bug fixes and security updates that are rolled into one nonoptional package, Windows 10 users cannot take only the part of an upgrade that fits their needs — and they have to deal with the consequences.

More from

FYSA — VMware Critical Vulnerabilities Patched

< 1 min read - SummaryBroadcom has released a security bulletin, VMSA-2025-0004, addressing and remediating three vulnerabilities that, if exploited, could lead to system compromise. Products affected include vCenter Server, vRealize Operations Manager, and vCloud Director.Threat TopographyThreat Type: Critical VulnerabilitiesIndustry: VirtualizationGeolocation: GlobalOverviewX-Force Incident Command is monitoring activity surrounding Broadcom’s Security Bulletin (VMSA-2025-0004) for three potentially critical vulnerabilities in VMware products. These vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, have reportedly been exploited in attacks. X-Force has not been able to validate those claims. The vulnerabilities…

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today