OSNews

Correction. There would be no problem if Microsoft's default user setup when the os is first installed is a limited user. But guess what? It isn't. Couple this with the fact that most typical users do not want to worry about securing their computers, and you have a very dangerous situation. Sometimes half-assed "security" is worse than none at all. This is one of those times, and so, so typical of Microsoft. They don't like their own security measures so they implement a backdoor and forget to put the key in the lock, so to speak. Pathetic.
Now the question is: What will be the result of this code being released? Will Microsoft hurry up and fix it before malware uses it, or will they delay yet again and close their eyes to a problem while people's computers are cracked?

microsoft does not install the OS on computers, OEM do and they chose to not default to normal user set up because they didnt want joe sixpack to call them and complain that he cant install the video codecs his newly found porn site tells him to ..

as far as i can tell, this "exploit" doesnt work if UAC setting is set to maximum, OEM can do that before pass the OS the joe if they care about his security...why arent they?

Except that the default user created in Windows is an Administrator. This is default behaviour in XP, Vista and Windows 7. And an extremely stupid decision made by Microsoft.

And running as limited user is not a solution, but merely a workaround. Though of course, the wiser solution is always to run as limited user (in win2k3 known as 'standard user').

In the mean time, if you have to run as Administrator, run at highest security level, even if UAC is annoying (which it is).

OSX's default user is admin, last I checked (Panther). Did they change that in Tiger or Leopard? If not, then is it really "extremely stupid"? If both Apple and Microsoft, and Ubuntu (according to google_ninja) all do the same thing, then there must be a good reason for it.