Windows shortcut security flaw

[stmok]

Something interesting for Windows users to ponder on...
=> http://www.h-online.com/security/news/i ... 38992.html
Apparently, the original intent of this malware was for industrial/Govt espionage purposes.

AND

Experts Warn of New Windows Shortcut Flaw
=> http://krebsonsecurity.com/2010/07/expe ... tcut-flaw/

Anyway...

Microsoft has posted a security advisory on the issue...
=> http://www.microsoft.com/technet/securi ... 86198.mspx
Please read the Mitigating Factors and Workarounds sections.

According to Microsoft, it affects all currently supported Windows versions:
* WinXP SP3
* WinXP Pro x64 Edition SP2
* Win2k3 Server SP2 (32bit, 64 bit, and Itanium-based versions)
* Win Vista SP1 and SP2 (Both 32bit and 64bit versions)
* Win2k8 Server and SP2 (32bit, 64 bit, and Itanium-based versions)
* Win2k8 Server R2 (64 bit and Itanium-based versions)
* Win7 (Both 32bit and 64bit versions)

ALSO NOTE!
=> Windows 7 Service Pack 1 Beta and Windows Server 2008 R2 Service Pack 1 Beta are affected by the vulnerability.

[stmok]

Microsoft to release fix for Windows Shortcut flaw on Monday
=> http://arstechnica.com/microsoft/news/2 ... monday.ars

There have been multiple malware families that have picked up the .LNK attack vector, including a highly virulent strain named Sality.AT. Not only is Sality a very large family, but it is known to infect other files (making full removal after infection challenging), copy itself to removable media, disable security, and then download other malware. Microsoft has seen an increase in attack attempts as well as a change in the geolocation of the attack attempts across the systems it protects. In short, this new attack vector is becoming more widespread. The security team at the company believes more families will continue to pick up the technique, leading it to get the patch out as soon as possible.

My question is:
Why did they wait (almost 2 weeks) until it became a widespread problem? Why didn't they nip this in the bud?
(Its a serious cause of concern when you look at it from the perspective of infection rate at electronic speeds.)

...Meanwhile, their paying customers/end-users either have to rely on their suggested "workaround" (assuming competent Admin or user) and make sure AV solution's signature is constantly up-to-date.

[stmok]

Patch can be found here...Or use Windows Update.

Microsoft Security Bulletin MS10-046 - Critical
=> http://www.microsoft.com/technet/securi ... 0-046.mspx