How a malicious help file can install a spyware keylogger

[Dermot7]

Do you think that Windows help file is safe? Think again.
Malware authors can create boobytrapped .HLP files, designed to infect your computer.

http://nakedsecurity.sophos.com/2012...ger-help-file/

[Rmus]

Pretty clever!

The use of creating boobytrapped files to load or run malicious executables goes back quite a few years.

While today's exploits rely mostly on social engineering tactics, at least 8 years ago, cybercriminals were using different file types in remote code execution exploits. Here are a few from that period:

http://urs2.net/rsj/computing/tests/files_exec


----
rich

[CloneRanger]

Actually the use of .HLP for malware etc purposes dates back quite a number of years. I don't have specifics to hand, but due to my hearing about such a vector, i've selected ProcessGuard to block/prompt me each & every time



If i DENY it, then i get this



Personally i don't expect to be infected in such a way but it pays to be cautious. Plus after a disguised .HLP was alowed to run, it would need to also run the other files, such as .EXE/SYS/DLL etc. PG & other protection would automatically also block/prompt me each & every time, to those too

People with similar software/solutions can/could do the same.

[Rmus]

Originally Posted by CloneRanger

Actually the use of .HLP for malware etc purposes dates back quite a number of years. I don't have specifics to hand,

Here are a couple:

http://blog.trendmicro.com/calling-w...-vulnerability

http://www.virusbtn.com/news/2011/09_14.xml

Originally Posted by CloneRanger

but due to my hearing about such a vector, i've selected ProcessGuard to block/prompt me each & every time

With PG set up the way you show, can you run a legitimate Help file on your system?


----
rich

[CloneRanger]

Originally Posted by Rmus

Here are a couple:

Good examples

With PG set up the way you show, can you run a legitimate Help file on your system?

Yes, by clicking ALLOW. But whenever i Allow something that's normally Prompted, i do NOT also tick Always perform this action as that would make the action from then on allowed on All such files, unless i reconfigured the permissions back again.

As it only takes a few seconds to Allow or Deny, it's no big deal for me, & unless i'm installing or running something new etc, i don't get prompted all the time. I'm sure you are in a similar situation with DeepFreeze.

[Mrkvonic]

Originally Posted by Dermot7

http://nakedsecurity.sophos.com/2012...ger-help-file/

I don't want to think again.
Sensational shock info from a company selling security for money.
Boring.
Mrk

[PJC]

After PDFs and Images, Help files...
What's next?

[safeguy]

Just a FYI. Windows Help format is not supported in Vista and later. You have to manually obtain the Windows Help program (WinHlp32.exe) if you want it.

-http://support.microsoft.com/kb/917607-