Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command.

So I'm interested in how does this virus works. How can it edit Shell and userInit in registry without asking any permission?

share|improve this question
It uses a vulnerability most likely. Are you asking which one? :) – Steve Apr 28 '12 at 3:54
I just want to know where this vulnerability can exists: browser side or maybe registry? It is very old viruses, so I can't understand how they can still be effective. – Dracontis Apr 28 '12 at 8:56
@Dracontis - The changes it makes does not require admin permission. regedit allows you to change keys you don't normally have permission to change. – Ramhound Apr 30 '12 at 11:22
up vote 8 down vote accepted

The user part of the registry(HKey_Current_User) is writable by unprivileged applications.
The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs.
Some subkeys might require different permissions, but this is true for most keys

To change the shell for the current user, you can modify HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, which is in the user part of the registry, and thus probably writable by unprivileged applications.

share|improve this answer

There are sections of the registry where users can write. This is it related to the ability to launch ResEdit itself. So the virus is writing there.

share|improve this answer

Regedit doesn't actually need admin rights in order to write the registry, but because there are so many commonly-accessed areas of the registry for which you DO need admin rights, it elevates privileges at startup more out of convenience than necessity.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.