I was reading an article on .desktop files used to spread malware on Gnome and KDE. I just thought that the same could be applied to Windows.

On Windows:

  1. Malware is disguised as a picture by changing icon. >> Funny pic

  2. User opens it.

  3. Copies itself to a place without UAC (Admin) like My Documents.

  4. Replaces a shortcut like Firefox with its own location and retains the Icon.

  5. The user opens it. Asks for UAC. Even says unsigned.

  6. Windows user ignores the Unsigned warning gives it UAC.

  7. Malware opens Firefox. The user doesn't realise a thing.

  8. The computer is infected.

Would this work? Is UAC required for changing a shortcut of a protected location?

Edit: The whole point of this is to gain UAC without asking for it when it opens but trick the user into giving it UAC impersonating firefox or some other program.

1 Answer 1


The scenario you have described could possibly work. May not happen in the exact way that you depicted. .desktop files can sit in any location of the victim computer .

NOTE: It needs UAC to get inside a protected location.

Anyway it needs to be executed to starts its actual work. In case of windows just a double click (an execute command in case of Linux).

It can possibly impersonate/imitate any of the program that you recently used or a familiar software in your system.

When the user tries executing/clicking the impersonated file, it asks for UAC as you said. (This is highly detectable by this particular character). If given access then yes you are a successful victim and your computer is compromised.

However removing the .desktop files are not that difficult. Here's a good read about the .desktop files.

  • I know this works in Linux. I'm asking if the same can be implemented in Windows.
    – Ufoguy
    Commented Dec 5, 2013 at 9:27
  • @Ufoguy Yes it can be.
    – BlackMamba
    Commented Dec 5, 2013 at 9:38
  • Does it require UAC to change the Firefox shortcut to itself? The point of this is to bypass UAC silently. Good when you're spoofing extensions.
    – Ufoguy
    Commented Dec 6, 2013 at 7:46
  • It does not exactly replace the existing Firefox shortcut. It can show itself as any icon/shortcut(Firefox in your case). Remember it just has the outward appearance of Firefox shortcut(fake) and does not modifies your Firefox shortcut(original). Since it is not changing the existing file, the need of UAC goes out of the picture.
    – BlackMamba
    Commented Dec 6, 2013 at 8:35
  • Then how'd you delete the existing shortcut?
    – Ufoguy
    Commented Dec 7, 2013 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .