Hmm...

http://vuln.sg/acerlunchapp-en.html

I saw this via slashdot and as I own an Acer laptop, I was curious.
An active x control distributed by default on Acer laptops.

From the website.

" Checking the interface of the control reveals it has a method named "Run()" as shown below. The method supports parameters "Drive", "FileName", and "CmdLine". Isn't it strange for a control that's marked "safe for scripting" to allow a method that is suggestive of possible abuse?"

Also...

"It isn't long before I'm using this control from a webpage to execute arbitrary commands on my notebook when the page is loaded in IE6. And it's too simple..."

I had a look on my own laptop and sure enough, there it is. I will need to look into this a little more I feel and perhaps, in the future, steer myself away from Acer if need be.