Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I was browsing through my website access logs recently, and noticed several attempts to do things like this


Of course, I'm not completely stupid and this had no affect on my server or the software, but I thought for the hell of it, I'd see what's actually on that domain. When it loaded, Chrome attempted to change a registry key according to Comodo. Is there any way to actually change a registry key from code that a browser runs or was it an unusual coincidence that Chrome, for the first time I've seen, tried to change a registry key.

Edit: 4 attempts at modification were made of different keys in HKLM/SYSTEM/ControlSet001/Services/ESENT

share|improve this question
up vote 1 down vote accepted

I'd say it was a conicidence, although clever security holes cannot be ruled out either. It might help if you told us what the registry key was.

OK, I see your edit. (And why did Jeff change the registry key?) Let me rephrase - can we find out which exact registry keys they were and what exact values did it want to set?

Anyway, ESENT turns out to be some built-in database engine in Windows.

Now, it is possible, that the webpage used some security hole in Chrome and trough it attempted to hijack ESENT to gain full control of the system. Sounds fairly logical.

It is also possible that Chrome (or some plugin of it - say a video player) used ESENT in a legitimate way, and it was ESENT itself that wanted to change some of its registry keys.

share|improve this answer

The _SERVER[DOCUMENT_ROOT] makes me think it's trying to change what PHP believes the webserver's document root is in order to execute the PHP in the linked file. I wasn't aware you could do this, but maybe there's an exploit in some specific version of PHP?

Is it possible that Chrome modifies registry keys with or without visiting the URL, and that it's completely unrelated?

share|improve this answer
That seems logical. – Cheeso Aug 1 '09 at 18:16

Chrome has built in storage (Google Gears). Is it possible that its trying to store its local database in the registry?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.