Question abt extending SRP policy by tlu

exus69 · Aug 4, 2011

tlu said:

I'd like to add one important aspect to further enhance the security of your system.

If you're logged on as limited user you don't have write access, e.g., to the systems and program files folders and to most branches of the registry. These include most of the about 50 autostart locations available in Windows (the most complete list cab be seen in Autoruns). This means that you are safe against most malware as they usually need admin rights - which you don't have as limited user

However, there are 7 autostart locations left where a limited user has write permission (please tell me if I forgot one). Here they are:

c:\documents and settings\<user>\start\program files\autostart
c:\documents and settings\all users\start\program files\autostart
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

Thus, user-mode malware is still able to install itself in those locations, e.g. a keylogger that doesn't need admin rights. But there is way to prevent that! Here's how (in XP Home you need to have FajoXP or filesecpatch installed to have the security tab available):

1. Start regedit and explorer respectively in your limited user account via SuRun (i.e. with admin rights) and deprive your user account of write access for the above mentioned autostart locations (see here).
2. Change the owner for these autostart locations from user to administrator (see here). This is important: Otherwise malware started with limited user rights could theoretically revise the changes made in step 1.
Click to expand...

Am using Windows XP SP3. I noticed that all those extra locations in registry and Documents and Settings are already without user write permissions? Is it because of Service Pack 3 that those changes have been done automatically and the LUA does not have write access
to ANY auto-start locations?

Please help

Log in or Sign up

Question abt extending SRP policy by tlu

exus69 Registered Member

Log in or Sign up

Question abt extending SRP policy by tlu

exus69 Registered Member

Useful Searches