Re: RFP9903: AeDebug vulnerability

[stnor () SWEDEN HP COM (Stefan Norberg)]

> One other thing to consider is that when user processes crash, they can
> sometimes create a user.dmp file, which like UNIX-style core files can
> sometimes contain information useful to an attacker.  There is a way to
> turn this off, but I don't recall what it is at the moment.

Run drwtsn32.exe and uncheck "Create Crash Dump File" or just edit the
registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DrWatson\CreateCrashDump = 0

/stefan