Windows XP Help attacks on the rise

An unpatched bug in the Windows XP Help and Support system is being increasingly attacked by  virus and malware writers, as reported by the BBC.

Microsoft has reported it’s seen more than 10,000 PCs hit by the attack so far and it’s still not been able to find a fix for the problem.

The effect of the vulnerability can give hackers complete control over a PC.  It initially came about when a Google Engineer discovered it was possible to exploit Windows XP’s ability to send and receive remote help from another computer.

Initially, Microsoft said it only saw “innocuous” attacks by a few researchers but now hi-tech criminals are exploiting it as well.

Writing on the Microsoft Security Centre blog, Holly Stewart said it had started seeing “seemingly-automated, randomly-generated” web pages that host the exploit.

A senior security researcher at Trend Micro, Rik Ferguson, said  ”It’s certainly very serious and is now being actively exploited by what appears to be several different groups as you can see form the multiple payloads being delivered.” and Carole Thierault, senior security consultant as security firm Sophos has described the attacks as a “nightmare”.

Microsoft is still working on a fix for the problem but Engadget have reported that…

Microsoft says the only current work around to the issue is to Unregister the HCP Protocol which disables hcp:// style links

The vulnerability does not affect Windows Vista or Windows 7.

Windows XP and Windows Server 2003 users can read the following guide to find out how to protect their system from the attack: Windows XP And Windows Server 2003 Zero-Day Vulnerability

Related Articles:

Author: Mike Halsey MVP, Thursday July 1, 2010 -
Tags:exploit, malware, Security, virus, xp

Responses so far:

1. dan says:

   July 1, 2010 at 5:20 pm

   It would be helpful to supply a link to the ghacks blog entry that supplied a registry fix to this vulnerability.

   Reply
   • Martin says:

     July 1, 2010 at 5:50 pm

     You are right, done that.

     Reply
2. Chris says:

   July 1, 2010 at 5:49 pm

   What is the point of the BBC and this article?

   The fix was posted by M$ weeks ago:
   http://support.microsoft.com/kb/2219475

   Reply
   • Martin says:

     July 1, 2010 at 5:49 pm

     It was also posted by us at that time: http://www.ghacks.net/2010/06/16/windows-xp-and-windows-server-2003-zero-day-vulnerability/

     Reply
3. Mike J says:

   July 3, 2010 at 5:06 pm

   Couldn’t a person just disable the Help and Support service, and be safe? Who ever uses it?? Outside of a business context, I suppose.

   Reply
4. Windows XP Help says:

   July 15, 2011 at 8:29 pm

   pretty crazy, it is probably worth switching to Windows 7 just to avoid this

   Reply