I'm asking this question with the assumption that anything the user can do, so can malware.
I'm using a third party firewall on my system to control which programs are able to access the internet. However I notice that I - as a limited user - am able to change the firewall configuration without elevating through UAC. I notice the user interface is running as my user, but the agent is running as SYSTEM.
When I stop the software through the UI, it seems to block by default (ping blocked), which is of course good behaviour. However I can simply go to the UI and disable the firewall and other aspects without any extra privileges. There is an option to apply a password to the UI, but I'm not sure how secure the implementation is (so will assume it's weak).
So in the event of a malware infection, what's to stop the malware from simply disabling the firewall the same way as the user?
I'd like to find out more about how third party security products implement tamper protection and password protection, but I can't get any good results from my searches. Any pointing in the right direction would be greatly appreciated, thanks.