AntiVirus Vulnerability- Detection after Execution

http://www.n00bz.net/antivirus-cve/

Presented at HackerHalted... This proof of concepts walks through a method of attack that AV products detect only after a known malicious payload is executed.  It is one attack that happens to work against multiple vendors; and it's not a Windows problem, it's that each vendor product allows the execution of a program before detecting the malware, by leveraging an unusual behavior of Help and Support Center through the hcp:// protocol handler.

The exploit used to trigger this behavior is CVE-2010-1885 (HelpCenter) released by Tavis Ormandy.  While this exploit is used, this is NOT a rehash of the Microsoft Helpcenter Exploit.  The purpose of this write up is to walk though the discovery and document the method used to effectively bypass AntiVirus and execute a malicious payload on a victims machine.