Re: Delete arbitrary files using Help and Support Center [MSRC 1198dg]

[Gary Flynn <flynngn () jmu edu>]

Shane Hird wrote:
> Temporary solutions may be;
>
> + delete/move the uplddrvinfo.htm file
> + edit the script of uplddrvinfo.htm to remove the offending code
> + unregister the hcp protocol handler

FYI. If a user runs across an exploit of this, a window titled
"Help and Support Center" will pop up with the text "Get Help
with Your Hardware Device". If this window is closed the specified
files are deleted.

The deletion can apparently be prevented by opening the Task Manager
and killing the HelpCtr.exe process.

-- 
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe