RE: W2k: Unkillable Applications

From: Andy Cristina (acristina@penta-corp.com)
Date: Tue Jul 17 2001 - 13:28:25 PDT

Next message: Support Info: "Security Update: [CSSA-2001-026.0] Linux - docview local httpd exploit"

Previous message: Marc Maiffret: "Initial analysis of the .ida "Code Red" Worm"
In reply to: Justin Nelson: "Re: W2k: Unkillable Applications"
Next in thread: Chad Loder: "Re: W2k: Unkillable Applications"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Greetings!  I created a simple win32 app named winlogon.exe... in win2k Adv
Server, I could end it as an application/task, but not as a process.  Maybe
this clears things up a bit...

-----Original Message-----
From: Justin Nelson [mailto:securityat_private]
Sent: Tuesday, July 17, 2001 9:21 AM
To: bugtraqat_private
Subject: Re: W2k: Unkillable Applications

> cannot confirm that. I renamed one of my applications to
> Winlogon.exe and succeeded to kill it without any problem
> with taskmanager.

Under Windows 2000 Pro, I made a copy of "notepad.exe" renamed to
"winlogon.exe", and could not kill it via the Task Manager. Both the 'kill'
command and the VC++ debugger were able to kill it.

Help-->About in Task Manager shows Windows version 5.0, build 2195, SP2.

- Justin Nelson

Next message: Support Info: "Security Update: [CSSA-2001-026.0] Linux - docview local httpd exploit"
Previous message: Marc Maiffret: "Initial analysis of the .ida "Code Red" Worm"
In reply to: Justin Nelson: "Re: W2k: Unkillable Applications"
Next in thread: Chad Loder: "Re: W2k: Unkillable Applications"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Jul 17 2001 - 11:58:34 PDT