Signature Detail

POP3: .HLP

This signature detects e-mail attachments that have the extension .hlp and were received through POP3. Because .HLPs (Help File) files can contain macros, this can indicate an incoming e-mail virus. Attackers can create malicious scripts, tricking users into executing the macros and infecting the system.

Extended Description

Since .hlp files contain macros, malware writers can exploit this by inserting malicious macros into these files. A target system is compromised if an unsuspecting user opens a malicious .hlp file, which is usually received by e-mail.The impact on the target system is dependent on the instructions contained in the malicious .hlp file.

References

• URL: http://www.novatone.net/mag/mailsec.htm
• URL: http://support.microsoft.com/?kbid=235309