When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command.

So I'm interested in how does this virus works. How can it edit Shell and userInit in registry without asking any permission?

  • 1
    It uses a vulnerability most likely. Are you asking which one? :) – Steve Apr 28 '12 at 3:54
  • I just want to know where this vulnerability can exists: browser side or maybe registry? It is very old viruses, so I can't understand how they can still be effective. – Dracontis Apr 28 '12 at 8:56
  • @Dracontis - The changes it makes does not require admin permission. regedit allows you to change keys you don't normally have permission to change. – Ramhound Apr 30 '12 at 11:22

The user part of the registry(HKey_Current_User) is writable by unprivileged applications.
The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs.
Some subkeys might require different permissions, but this is true for most keys

To change the shell for the current user, you can modify HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, which is in the user part of the registry, and thus probably writable by unprivileged applications.

| improve this answer | |

There are sections of the registry where users can write. This is it related to the ability to launch ResEdit itself. So the virus is writing there.

| improve this answer | |

Regedit doesn't actually need admin rights in order to write the registry, but because there are so many commonly-accessed areas of the registry for which you DO need admin rights, it elevates privileges at startup more out of convenience than necessity.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.