Would drop my rights have stopped the XP firewall virus?

Discussion in 'other anti-malware software' started by Klawdek, Mar 22, 2011.

Thread Status:
Not open for further replies.
  1. Klawdek

    Klawdek Registered Member

    Joined:
    Sep 27, 2010
    Posts:
    16
    I just got nailed by the XP firewall virus.
    I am running Windows XP with the latest updates.

    I am curious, if I had been using drop my rights, would it have prevented this virus from infecting my system?
     
  2. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,516
    Re: Woul drop my rights have stopped the XP firewall virus?

    Why did you put this under sandboxing and virtualization? DropMyRights doesn't include that feature.
     
  3. Klawdek

    Klawdek Registered Member

    Joined:
    Sep 27, 2010
    Posts:
    16
    Re: Woul drop my rights have stopped the XP firewall virus?

    I saw another post in here that asked a question about drop my rights.
     
    Last edited by a moderator: Mar 22, 2011
  4. kjdemuth

    kjdemuth Registered Member

    Joined:
    Jul 29, 2005
    Posts:
    2,960
    Location:
    Boston, MA
    Re: Woul drop my rights have stopped the XP firewall virus?

    I'm don't know how the virus executes itself. It would depend on what kind of restrictions you had on the sandbox and how the virus operates. If it starts looking for certain process that only the admin account can use, then yes dropmyrights would "stop" it. I've tested many a malware with sandboxie and it usually gets stopped cold. A lot of the time I'll execute a trojan and sandboxie will alert "unable to start netbios program has innsufficient access" or something like that. You'd have to look at how and what the virus replicates. If you have a sample of the file try running it through CAMAS. It will give you an idea on how the virus operates. Also dropmyrights doesn't work if you already run in a limited account.
     
Loading...
Thread Status:
Not open for further replies.