Hacker News Reader

I don't know if HTTP.SYS is included in every install, but you do not need to be running MS's webserver to use it. Instead of letting apps bind to port 80/443/whatever and doing HTTP themselves, MS encourages using their special interface to make the kernel listen for you. So yes, people might be accidentally running this.

Does Remote PowerShell bind to HTTP.SYS or do its own thing?

WinRM (AKA PowerShell Remoting) uses HTTP.sys and is on by default on server SKUs.

WinRM and PowerShell Remoting do not use Kernel Mode Caching, and are therefore not vulnerable.

this mean that certain versions of windows run Http servers by default that users can't disable

Apparently yes; this is on Windows 7 and above:

http://www.mikeplate.com/2011/11/06/stop-http-sys-from-liste...

So those on Vista or below aren't affected unless they explicitly running IIS or something else that's using HTTP.sys; and I can confirm that nothing is listening on port 80 on my XP box (nor is HTTP.sys loaded.)

If you have Windows Media Player then you have DLNA and everything and there you have to use HTTP.sys to listen on a http port.

That's called Home Sharing IIRC