2

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command.

So I'm interested in how does this virus works. How can it edit Shell and userInit in registry without asking any permission?

3
  • 1
    It uses a vulnerability most likely. Are you asking which one? :)
    – Steve
    Apr 28, 2012 at 3:54
  • I just want to know where this vulnerability can exists: browser side or maybe registry? It is very old viruses, so I can't understand how they can still be effective.
    – Dracontis
    Apr 28, 2012 at 8:56
  • @Dracontis - The changes it makes does not require admin permission. regedit allows you to change keys you don't normally have permission to change.
    – Ramhound
    Apr 30, 2012 at 11:22

3 Answers 3

9

The user part of the registry(HKey_Current_User) is writable by unprivileged applications.
The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs.
Some subkeys might require different permissions, but this is true for most keys

To change the shell for the current user, you can modify HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, which is in the user part of the registry, and thus probably writable by unprivileged applications.

3

There are sections of the registry where users can write. This is it related to the ability to launch ResEdit itself. So the virus is writing there.

2

Regedit doesn't actually need admin rights in order to write the registry, but because there are so many commonly-accessed areas of the registry for which you DO need admin rights, it elevates privileges at startup more out of convenience than necessity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .