In 2011, Symantec reported on the use of the Windows Help File (.hlp) extension as an attack vector in targeted attacks.
The functionality of the help file permits a call to the Windows API which, in turn, permits shell code execution and the installation of malicious payload files. This functionality is not an exploit, but there by design.
Here's the malicious WinHelp files (
Bloodhound.HLP.2) detection heat map:
I would like to know if the Windows Help program exists on my Windows 8 machine by default, because if it does I might need to remove it for security reasons.
Does Windows 8 include the Windows Help program (WinHlp32.exe)?