Windows XP flaw opens door to Trojan attack

The 'Phel' program works through Internet Explorer's 'Help' controls to allow an infection passed from a Web site to open up an infected computer to external control.

Online miscreants have released a Trojan horse that can infect computers running Microsoft's Windows XP, installing programs to remotely control a victim's system.

Symantec warned in an advisory this week that the program -- dubbed "Phel", an anagram of "Help" -- infects visitors to a maliciously created Web site through Internet Explorer's Help controls. A bug in the malicious program may prevent it from infecting some computers, the security company said.
The Symantec advisory can be found on the company's Web site.
The Trojan horse exploits a vulnerability, found in October, in how Internet Explorer and Windows XP Service Pack 2 handle help files called from Web pages.
The flaw is unrelated to the recent help-file flaws outed by a Chinese security company last week. In that instance, Microsoft took the Chinese security group to task for disclosing the vulnerability without giving the company a chance to develop a way to fix the problem.
A company spokesperson said: "Microsoft is working to forensically analyse the malicious code in Phel and will work with law enforcement to identify and bring to justice those responsible for this malicious activity."
A patch is not yet available from Microsoft for the October flaw, nor the most recent flaws, but the software giant said its programmers are working on the issue.
"Microsoft is taking this vulnerability very seriously, and an update to correct the vulnerability is currently in development," the spokesperson said. "We will release the security update when the development and testing process is complete, and the update is found to effectively correct the vulnerability."