Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command.

So I'm interested in how does this virus works. How can it edit Shell and userInit in registry without asking any permission?

share|improve this question
1  
It uses a vulnerability most likely. Are you asking which one? :) –  SteveS Apr 28 '12 at 3:54
    
I just want to know where this vulnerability can exists: browser side or maybe registry? It is very old viruses, so I can't understand how they can still be effective. –  Dracontis Apr 28 '12 at 8:56
    
@Dracontis - The changes it makes does not require admin permission. regedit allows you to change keys you don't normally have permission to change. –  Ramhound Apr 30 '12 at 11:22
add comment

3 Answers

up vote 7 down vote accepted

The user part of the registry(HKey_Current_User) is writable by unprivileged applications.
The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs.
Some subkeys might require different permissions, but this is true for most keys

To change the shell for the current user, you can modify HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, which is in the user part of the registry, and thus probably writable by unprivileged applications.

share|improve this answer
add comment

There are sections of the registry where users can write. This is it related to the ability to launch ResEdit itself. So the virus is writing there.

share|improve this answer
add comment

Regedit doesn't actually need admin rights in order to write the registry, but because there are so many commonly-accessed areas of the registry for which you DO need admin rights, it elevates privileges at startup more out of convenience than necessity.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.