"Malicious script" upon opening Help & Support center

[Guest]

When I try to access the Help and Support Center on my Computer, what ever I
choose from the menu, there appears a warning from Norton:


MaliciousScript detected
High Risk
Your computer is halted and needs to do something about this script

OBJECT FileSystem Object
ACTIVITY GetFile
FILE helpctr.exe

then It automatically chooses "stop this script(recommended)"


the other options to choose from are:
Allow this activity once
Allow the entire script once
Authorize this script

When I click OK, it turns off the help center so that I can not access
anything else! As long as I don't press the OK button on the Norton warning,
I can access somewhat...not much. Is it possible that this is a precautionary
warning and that Norton is flagging it as a malicious file because it is
using an HTA file (see below)? If so what do I do to stop this warning so
that I can use the Help Center?

I bought my system last december and did not need to use the help center
until this past summer and the first time I went to use it I got the
Malicious script warning.

I use WinXP w/o pack2

Does the following advice apply to my situation?

Thanks




Subject: Re: Restore Settings Question 8/18/2004 12:51 PM PST

By: Doug Knox MS-MVP In: microsoft.public.windowsxp.security_admin


Choose the Allow the entire script, this time option. Many components of
Windows XP use HTA files (HyperText Applications) rather than executables.
HTA files can modify the registry and access the file system. This is why
McAfee is flagging it as potentially malicious. In this case RSTRUI.EXE is
calling an HTA file to do its tasks.

 

[Doug Knox MS-MVP]

Help and Support uses HTA (Hypertext Application) files to do its job. Since these files can read/write the system Registry and file system, they can be considered "potentially" malicious. You need to allow Help and Support to execute the scripts that it needs to.

 

[Guest]

Doug, Thank you so much for answering,
I want to make sure that I am making the correct moves :The next time I try
to use help, do I choose "authorize this script" (which I interpret to mean,
allow the script and don't show this warning again)? Thanks again, will post
back results.

 

[Doug Knox MS-MVP]

If in doubt, just allow it to run the one time. If everything behaves as expected, then the next time you need it, tell it to let it run every time.