I'm an intern who writes malware samples to later be tested. A rather basic piece I wrote in C++ kills explorer.exe, taskmgr.exe and repeats this every second. I used a bit of code to add my application to the registry under HKLM\Software\Microsoft\Windows\CurrentVersion\Run so that it runs automatically when the test machine is started. Because the test machine a VM, I can restore to the last snapshot and be on my merry way. If this happened in a real world situation, how would one fix this problem? Killing explorer and task manager leaves the user with only the desktop with no icons to look at. I know Windows 7 will do a system restore before the boot but is this true for XP? BIOS? Or would they have to try and reinstall Windows cleanly?
In Microsoft's documentation about run keys on Windows XP, it is stated that:
If not added under RunOnce with the force character, one could start in Safe mode and remove the key.