Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a trainee who writes malware samples to later be tested. A basic piece I wrote in C++ kills explorer.exe, taskmgr.exe and repeats this every second. I used a bit of code to add my application to the registry under HKLM\Software\Microsoft\Windows\CurrentVersion\Run so that it runs automatically when the test machine is started.

Because the test machine is a VM, I can restore to the last snapshot and be on my merry way. If this happened in a real world situation, how would one fix this problem? Killing explorer and task manager leaves the user with only the desktop with no icons to look at. I know Windows 7 will do a system restore before the boot but is this true for XP? BIOS? Or would they have to try and reinstall Windows cleanly?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

In Microsoft's documentation about run keys on Windows XP, it is stated that:

By default, Run keys are ignored when the computer starts in Safe mode. Under the RunOnce keys, you can prefix a value name with an asterisk (*) to force the associated program to run even in Safe mode.

If not added under RunOnce with the force character, one could start in Safe mode and remove the key.

share|improve this answer
    
And if he adds the force character, the user is doomed? –  Lohoris Jun 29 '13 at 7:25
2  
As far as my knowledge goes, it seems so. One user suggested to hit Win+R command, which lets you open an application, file or folder but it is dependent of the explorer.exe process. –  Simon Jun 29 '13 at 14:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.