How can winlock virus change Windows Registry without admin permission?

Question

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command.

So I'm interested in how does this virus works. How can it edit Shell and userInit in registry without asking any permission?

Answer 1

The user part of the registry(HKey_Current_User) is writable by unprivileged applications.
The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs.
Some subkeys might require different permissions, but this is true for most keys

To change the shell for the current user, you can modify HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, which is in the user part of the registry, and thus probably writable by unprivileged applications.

Answer 2

There are sections of the registry where users can write. This is it related to the ability to launch ResEdit itself. So the virus is writing there.

Answer 3

Regedit doesn't actually need admin rights in order to write the registry, but because there are so many commonly-accessed areas of the registry for which you DO need admin rights, it elevates privileges at startup more out of convenience than necessity.