Windows 7 UAC replacer

[TheAnimus]

constrained observation! lol

UAC is a pain in the butt unless you haven't a clue how to use a PC. Then it should probably be left active.

No need for me to activate it. Never did in Vista. Never had any issues. Maybe that isn't normal for you Ani but i even don't have an AV running. Been years since i installed one. Again, never had any issues. Even when i have run the odd scan, always comes up clean. Lucky? Not really. Just careful what i do with PC. Plus i only use it for a limited amount of surfing and work related stuff.

Do you not get my point, saying "oh its OK here mate" does nothing for the estimated millions of botnet infected PCs. This isn't a dick waving contest, your not uber 1337 for turning off UAC.

Myself, on some of my PCs they have no anti-virus (really can cause quirks with some of the coding i'm doing atm) and one even runs without UAC (virtualization can confuse the crap out of locally running n-teir app debugging.)

I would NEVER advocate the advise to others, on my primary laptop which does little dev work, UAC and antivirus, media pc, uac + antivirus, ultra portable just UAC because its too week to handle AV comfortably, and i run as a very restricted user all the time.

UAC dosen't really slow down the system in a remotely noticeable fashion. If your bringing up a UAC prompt every 30 seconds, you have to ask WHY? Odds are, your doing it wrong.

Same story here. No UAC for me, no anti-virus, and when I have run a scanner (which I've usually only done to prove the point that AV is useless), my system's always come out clean. I did suffer the Blaster worm, although that was due to a security hole in Windows, and wasn't something I recall any of the AV apps of the time doing much to stop. And that's the thing with AV, isn't it? It's got about a 90% chance of catching existing and known problems, and is generally rather useless at catching the new stuff. So if you're sensible enough to be careful, there's just no point in AV.

AV apps at the time stopped blaster dead. Virtually all of them, at the time Sophos was my one of choice.

The thing is you say your PC is clean. Give me 30 minuites alone with it, and you will still think its clean, this isn't because i'm an amazing security researcher, i just read this book:
http://www.amazon.co.uk/Rootkits-Sub.../dp/0321294319

Besides, it seems to me that all AV does is promote viruses. How many times do you come across a PC with AV software that's crawling with them? People just seem to think that being "protected" means they can be negligent. Not quite how it works out for them, though.

This is very true, people must be vidglent no matter what protection they have. However if you have things like ASLR,DEP,UAC and a virus scanner, you can stop 99.999% meaning if you let your gaurd down you have a very good chance.

[dangel]

Just turn UAC off. I have. No regrets.

I don't - at least not at home - because I actually understand what it does and why (i'm paid to). There's a message in there somewhere

[aidanjt]

Agreed with many of the above sentiments, disabling UAC is...... illadvised.

[blackbirds]

UAC would have stopped that though.

If they'd existed at the same time, how would it have? There was a security update that would've stopped it, and at the time, that was the only thing that could.

[lodore]

btw if you insist on running ccleaner at everystartup think outside the box at least a bit. use the task scheduler. create a new task tick the box run as administrator for that task. locate ccleaner exe file and in the command box type /auto and use the option run at login.
this will run ccleaner at startup without the UAC prompt. it took me around 2minutes to think of that and i done a quick google search for the parameters.

you maybe able to do the same with the other applications you mention but then again once the overclock is done you wont need them installed anymore.

[blackbirds]

The thing is you say your PC is clean. Give me 30 minuites alone with it, and you will still think its clean, this isn't because i'm an amazing security researcher, i just read this book:
http://www.amazon.co.uk/Rootkits-Sub.../dp/0321294319

I'll take the bait. Can you do it by Remote Desktop?

[blackbirds]

Btw, a question for the pro-UAC guys. When I first tried Vista out way back in 2006, the gaping hole I found in UAC is that, well:

1) "Windows needs your permission to continue. [Insert genuine component of Windows here]"

2) "Windows needs your permission to continue. [Insert something named the same as or cunningly disguised as a genuine component here]"

How could any n00b tell the difference? One of malware's favourite tricks is to name its executables after Windows components ("Whuh, but, that's Windows.exe. Won't deleting it mean that my PC won't work anymore?", etc) and bury itself within the Windows directory. How can UAC protect against that?

[TheAnimus]

I'll take the bait. Can you do it by Remote Desktop?

Click the book link.

The topic is how to have a 'rootkit' or how to invade at the kernel level. Once done, there is no way to detect it without knowing enough about the threat, most anti-viruses fail on this.

Marc did a tool for playing about called rootkit revielar.

If you really want to learn more, I can send you a VHD image, see if you can find it.

Btw, a question for the pro-UAC guys. When I first tried Vista out way back in 2006, the gaping hole I found in UAC is that, well:

1) "Windows needs your permission to continue. [Insert genuine component of Windows here]"

2) "Windows needs your permission to continue. [Insert something named the same as or cunningly disguised as a genuine component here]"

How could any n00b tell the difference? One of malware's favourite tricks is to name its executables after Windows components ("Whuh, but, that's Windows.exe. Won't deleting it mean that my PC won't work anymore?", etc) and bury itself within the Windows directory. How can UAC protect against that?

Very simply, the microsoft files are signed, and the GUI looks different.

Also most people can be told to never click it when seaking porn etc.

[PeteSmith]

The thing is you say your PC is clean. Give me 30 minuites alone with it, and you will still think its clean, this isn't because i'm an amazing security researcher, i just read this book:
http://www.amazon.co.uk/Rootkits-Sub.../dp/0321294319

Do they do a pop-up version?

[this_is_gav]

If they'd existed at the same time, how would it have? There was a security update that would've stopped it, and at the time, that was the only thing that could.

Because it was a non-administrative command attempting to execute a process which would have needed elevated privileges.

Either it would have just failed outright, or it would have raised a query.

[TheAnimus]

actually DEP and ASLR would have stopped it dead in its tracks before UAC was needed.

[rushholme]

What's the best rootkit detector ATM?

I have used gmer,blacklight and rootkit-unhooker on XP...

[blackbirds]

Click the book link.

The topic is how to have a 'rootkit' or how to invade at the kernel level. Once done, there is no way to detect it without knowing enough about the threat, most anti-viruses fail on this.

Marc did a tool for playing about called rootkit revielar.

If you really want to learn more, I can send you a VHD image, see if you can find it.

That'd be magic, actually. I'm always up for a challenge, and with rootkits being a relatively alien concept to me, I'd love a chance to tackle one. If it wouldn't be too much trouble for yourself, I'd very much appreciate it.

[TheAnimus]

That'd be magic, actually. I'm always up for a challenge, and with rootkits being a relatively alien concept to me, I'd love a chance to tackle one. If it wouldn't be too much trouble for yourself, I'd very much appreciate it.

I'm done with the book actually, i've not gone back to it in years as i'm so far into financial maths now it wouldn't make sense to go to security (which was what i thought i'd be doing for a while when leaving uni).

£10 to a decent charity (ie not PETA) and its yours next time i go to the post office.

[blackbirds]

I'm done with the book actually, i've not gone back to it in years as i'm so far into financial maths now it wouldn't make sense to go to security (which was what i thought i'd be doing for a while when leaving uni).

£10 to a decent charity (ie not PETA) and its yours next time i go to the post office.

Sounds like a deal to me. Would the National Trust be alright with you?

[pipTheGeek]

Well it is, and its easy to observe, whilst for security via obsecurity sakes UAC dosen't detail these heuristics, they exist. Open notepad, it won't prompt for UAC, open installer.exe it will prompt before it tries to do anything if its worked.

Hmmm, hadn't thought of that. I take back that part of my previous post. In fact there is a document here that gives some detail on what UAC looks for, and details on how to turn the check off using secpol.msc or a regedit.

Signature, what signature. These aren't .Net.

Installers are still signed though, and there is a certificate chain that will hopefully lead to a trusted CA. That is how the publisher is confirmed. There is even an issue in the validator that means it can't check the signature on large files.

But if you've set the shortcut to always be admin, isn't it a tiny bit of a flaw in security?

Windows would have to prompt when the shortcut was first changed, and yes, it would be a security risk, but security is always a tradoff between security and convenience and I think it would be nice to have a little more granular control of this balance.
Don't get me wrong here, I think UAC is a good thing and the balance that MS have achived on Windows 7 is good, this is just a suggestion for future enhancements.