Microsoft was warned of a vulnerability in Windows 2000 and XP (and in some configurations of Server 2003) that can be exploited by tricking the user into pressing the F1 key.

As Microsoft puts it, "Windows Help files are an inherently unsafe file format. That means these files can run arbitrary code".

So if an attacker can find a way of getting a malicious .HLP file onto a computer or simply make it available from an SMB or WebDAV source, the only problem is getting the user to consult that file.

All that's necessary is to tell the user to press the F1 (Help) key. If they comply, they're pwned.

The vulnerability has been publicly disclosed, but Microsoft is not aware of any active attacks.

So what steps should you take? Please read on.

---

The first thing to do is avoid pressing F1 in the context of a dialog presented by a web page or other type of Internet content, especially if you're being nagged to do so.

Microsoft has suggested preventing the legacy Windows Help system from loading by using this command:
cacls "%windir%\winhlp32.exe" /E /P everyone:N
That measure can be reversed with:
cacls "%windir%\winhlp32.exe" /E /R everyone

The company also suggests setting the Internet and Local intranet security zone settings to High, and adding trusted sites to the Internet Explorer Trusted sites zone.

"Our teams are working to address the issue and once we complete our investigation, we will take appropriate action to protect customers. This may include releasing an update out-of-band. We will provide further updates as they become available," said Jerry Bryant, senior security communications manager lead at Microsoft.

Vista, Windows 7 and Windows Server 2008 are not vulnerable.