Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In 2011, Symantec reported on the use of the Windows Help File (.hlp) extension as an attack vector in targeted attacks.

The functionality of the help file permits a call to the Windows API which, in turn, permits shell code execution and the installation of malicious payload files. This functionality is not an exploit, but there by design.

Here's the malicious WinHelp files (Bloodhound.HLP.1 & Bloodhound.HLP.2) detection heat map:

enter image description here

I would like to know if the Windows Help program exists on my Windows 8 machine by default, because if it does I might need to remove it for security reasons.

Does Windows 8 include the Windows Help program (WinHlp32.exe)?

share|improve this question
    
It was my impression that Microsoft discontinued the use of this file format several years ago. They moved to a new similar file format, you should use that format, I seriously doubt this attack vector can even be used currently. –  Ramhound Nov 5 '12 at 14:23

3 Answers 3

up vote 14 down vote accepted

C:\Windows\winhlp32.exe installed with Windows 8 is a stub only (~10KB). It does not shows or open .hlp files! You have no need to erase this file.

There is optional update KB917607 (.msu) for Windows 8 which allows to work with .hlp files, but this update may be installed manually by the user only. After installing this update C:\Windows\winhlp32.exe will be more than 100KB (can't say exactly).

share|improve this answer
    
On x64 Windows Enterprise after applying that update, winhlp32.exe is 287,744 bytes. –  Mark Allen Nov 5 '12 at 18:53
1  
This is true on Win 7 as well (at least the Win 7 pro 64-bit I have here). Unfortunately, a fair number of programs I use haven't got the memo and updated to the newer help system. Hey, its only been a decade.... –  RBerteig Nov 5 '12 at 23:18
    
I edited your post for just get back my downvote and for make it +1. I had misunderstood it but now I realize it that I was wrong. :P –  avirk Nov 13 '12 at 2:36
1  
This has been true since Vista, and yea they introduced KB917607 as an optional add-on to restore Winhlp32 if it is needed. –  Yuhong Bao Nov 25 '12 at 6:22

Clean Install Windows Pro RTM OEM, all the winhlp32 stub does is open the Help and support window. Right click open with or double click gets the support window.

It must be manually installed

enter image description here

.

enter image description here

share|improve this answer
    
That is what I'm talking about in my answer :P –  avirk Nov 5 '12 at 16:27
2  
@avirk: Actually Moab's answer confirms what Maximus said, that while the EXE might exist by default, it is just a mere stub and will not actually open .HLP files, and thus cannot act as an attack vector. After installing the update the EXE is replaced with a bigger one that's not a stub and actually works, which is when it could pose a threat if infected .HLPs were opened. –  Karan Nov 5 '12 at 17:03

I have just tried running it on windows 8 and it works, so it's definitely there.
There are also references to windows 8 on MSDN.

Before you delete it, you might want to check if this "functionality" has been toned down so that it cannot be used maliciously anymore.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.