Quick analysis of a webpage leveraging CVE-2010-1885 (aka the help and support center vulnerability)
Summary: Cisco Talos analyzed a webpage on goodgirlsbadguys.com, a domain registered July 19, 2010 with a registrant address in Cambodia, that loads an iframe invoking Microsoft's Help and Support Center with parameters exploiting CVE-2010-1885. The exploit drops a randomly named file such as bat.vbsautba in the user's Temp folder, then calls cmd.exe to run a script named D.vbs, and Microsoft had patched the vulnerability on July 13.
What you should know: The patch shipped July 13, yet this domain was registered six days later and still served the exploit, so unpatched machines remained the target; Snort sid 16665 and ClamAV signature BC.Exploit.CVE_2010_1885 are the detection points that have to be in place.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2010-1885
- Related
- Increase in attacks on CVE-2010-1885 Cyber Risks ·Special Delivery -- Phoenix Exploit Kit Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026