Comments on: Comments on 19928

Post number 19928

badstone — Wed, 11 Sep 2002 14:39:43 -0800

Help yourself to an exploit. No biting social commentary here, just spreading the word on an ooky Win XP exploit in the form of a malicious Help Center request. The patch has been silently rolled into SP1, and is otherwise unavailable. Of course, if you want to install SP1, you'll have to agree to that nasty Trojan EULA.

By: blueshammer

blueshammer — Wed, 11 Sep 2002 14:46:37 -0800

Wow. That's really terrible. If I were more of a conspiracy theorist, I'd claim it was intentional in order to make people feel that ungrading to SP1 (and thereby enabling the EULA) was mandatory.

By: quonsar

quonsar — Wed, 11 Sep 2002 14:49:32 -0800

no reason to be a conspiracy theorist where it comes to microsoft. microsoft IS one big conspiracy.

By: malphigian

malphigian — Wed, 11 Sep 2002 14:59:42 -0800

I love the last suggestion on ways to fix on this page, which uses the exploit to delete the offending file. This is a nasty flaw, for sure.

By: WolfDaddy

WolfDaddy — Wed, 11 Sep 2002 15:16:09 -0800

Argh. Not only do we have to agree to give our firstborn to the Gates family with SP1, I'm currently tracking an estimated 200 minute download time for a 50 MB file, over a T3! Bill needs bandwidth!

By: Dark Messiah

Dark Messiah — Wed, 11 Sep 2002 15:21:06 -0800

malphigan: just thought I'd point out the top line of the page you linked... Wow, Microsoft should hire some compitent staff.. Now I don't know who to trust!!

By: rogue

rogue — Wed, 11 Sep 2002 15:39:58 -0800

I was really surprised when it was mentioned on Tech TV's The Screen Savers Monday (same day SP1 was officially released via Windows Update). This is a very nasty bug indeed. Here's a BugTraq post that goes in to more detail about the Exploit. Like the article says, if you don't want to install SP1, at least rename or delete the file c:\windows\PCHEALTH\HELPCTR\System\DFS\uplddrvinfo.htm

By: quam

quam — Wed, 11 Sep 2002 15:45:56 -0800

A few days ago I read Microsoft intended to release free SP1 CDs, however, I cannot find such information on Microsoft's site. Is there information to confirm this is Microsoft's plan?

By: Dark Messiah

Dark Messiah — Wed, 11 Sep 2002 15:48:37 -0800

quam: I read the same thing in my local paper. Maybe SP1 isn't ready yet. I don't spend much time, keeping up on OS news. Mine's working fine right now -- why jinx it.

By: mark13

mark13 — Wed, 11 Sep 2002 16:08:14 -0800

I deal with Microsoft the same way my parents dealt with new car models. You never want to buy an "all new for year x" car the same way that you have to give Microsoft a couple of years to work out some of the major bugs in their crappy software. Upgrade to XP? What do you think I am, a complete idiot? Not to mention the fact that Microsoft "updates" seem to break Windows quite often, at least in my personal experience.

By: skallas

skallas — Wed, 11 Sep 2002 17:03:56 -0800

How can they legally attach different terms to the purchase for a fix? Its like buying a broken toaster and told you need to give your social security number for the replacement part. Software needs to be seen as a product and has to come with some warranty that isn't an excuse to further deepen MS's products. mark13: That's good advice, but good luck finding an OEM dealer willing to sell you W2K. MS is pushing XP hard and for reasons which probably don't make sense they're quickly phasing out W2K, arguably their best OS. The one XP laptop I've had to deal with has been nothing but trouble and thats using MS software on an MS network! Seriously, avoid XP if you can. I expect W2K to be pirated more than ever now when you can't order a W2K computer anymore. I think its fairly obvious XP was rolled out way too soon purely for profit and MS figured it could control the damage by quickly releasing hotfixes. Thanks, but no thanks.

By: daveadams

daveadams — Wed, 11 Sep 2002 19:08:18 -0800

I've found XP to be nothing but pure bliss in every way, compared to past Windows OSes. My only complaint is lack of drivers for my scanner, but that's Epson's fault, not Microsoft's. I haven't installed SP1 yet, but unless something has changed, the auto-update feature is easily disabled.

By: Pharkas

Pharkas — Wed, 11 Sep 2002 20:54:39 -0800

On the page linked from The Register, one of the "Easy Fixes" that he gives is to use a browser other than IE. He's wrong about this. I tried it in Mozilla and it still deleted files, so don't think that you're safe just because you're not using IE. The self-destructing link worked great though!

By: baylink

baylink — Wed, 11 Sep 2002 21:29:20 -0800

Then the answer isn't "get a real browser". It's "get a real operating system".

By: Tystnaden

Tystnaden — Wed, 11 Sep 2002 22:09:19 -0800

Personally, I am going to ride my Win2k box like an old Mac addict until the hardware itself dies. The machine (typically) works just fine. XP has no real compelling features for me. I boot, I browse, type, and game. I am giving up the ghost for the next upgrade. OS X sounds tastier every day.

By: rogue

rogue — Wed, 11 Sep 2002 22:46:25 -0800

Correct Pharkas... since the hcp:// protocol is registered in Windows and assigned to the help center, any application that's smart enough to forward requests it doesn't natively handle will launch it.

By: phylum sinter

phylum sinter — Thu, 12 Sep 2002 04:06:40 -0800

i'm with skallas, this seems completely outside legal means. it's like adding rules to a game after it's started... both illegal and immature.

By: McBain

McBain — Thu, 12 Sep 2002 07:54:41 -0800

I like XP for the most part. The only problem I have encountered is that WinMX transfers run at slower than modem speeds. I don't know if that is a problem with the new version 3.3 or if Microsoft has something in there to mess with P2P. All I know is that when WinMX is running, my bandwidth gets destroyed.