Dear SkyOut, I see no security impact here.
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting", 0, KEY_SET_VALUE, &hKey); requires administrative privileges. If user has ones, you can achieve better results by deleting task manager of trojaning it. You can also use HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debug key to launch notepad.exe instead of taskmgr.exe. --Friday, March 14, 2008, 10:49:31 PM, you wrote to full-disclosure@lists.grok.org.uk: S> Dear list, S> after weeks of total ignorance by Microsoft I decided to finally S> release all information S> related to a bug, that has to do with the Windows XP SP2 Taskmanager. S> Manipulating S> a Registry key makes it possible to disable the Taskmgr. On the next S> startup it will crash with S> an error message. It is possible to backup the key and repair the S> Registry doing so, but S> the attack scenario is clear: A virus uses this code, the user can't S> open the Taskmgr anymore S> and your process is somehow "hidden". S> The full information about this bug, can be found here: S> http://core-security.net/archive/2008/march/index.php#14032008 S> And the exploit is available here: S> http://core-security.net/releases/exploits/taskmgr_dos.c.txt S> Greets, S> SkyOut S> --- S> core-security.net S> --- -- ~/ZARAZA http://securityvulns.com/ ЭНИАКам - по морде! (Лем) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/