2

I recently got an unwanted exe automatically downloaded by my browser, and on going to delete it my useless trackpad registered misplaced my click and I ran it. I got the usual dialog about making changes to my computer, and selected no. The program ran anyway, and I immediately closed it. It left me wondering whether I had compromised my machine, which in turn led me to a specific and concrete question of general interest...

Does selecting "no" on "Do you want to allow the following program from an unknown publisher to make changes to this computer" dialogues actually prevent programs doing any damage, or does it just protect a limited part of my system? In what way and to what extent does this choice protect me from malicious software?

1
  • it prevents major damage, but not all theoretical damage.
    – dandavis
    Oct 23, 2017 at 7:40

2 Answers 2

2

Clicking "no" on a prompt like that, usually means the program will still run, just not with administrator level privledges.

If the program was trying to access a directory which required admin privileges (such as Program Files) it would then crash, or re-prompt you.

The program can still access the files which your account has access to. For example: theoretically a piece of Ransomware which encrypts only your documents and pictures could still do it's job without being granted administrator privileges, as it's only interacting with files your standard user account has access to.

It's rather odd that your browser "automatically download an unwanted exe." That's usually a result of being on a dangerous website, or already having a piece of malware on your device. I'd recommend running a full scan using your antivirus. If you're extremely concerned, you could revert to a restore point before you downloaded the program.

2

If you are at such a prompt and actually wish to make sure that the program makes no changes, (or no further changes as it may have made some that did not require privileged user permissions), then you can kill the process using on windows the task manager or Process Explorer.

Personally I tend to use Process Explorer as it has a very hand facility to allow you to find the process by clicking anywhere on any of it's windows.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .