blog: shut the door to malware

[JDlugosz]

The reality is that many programs don't run properly as "limited user", often for no good reason.  For example, getting a CD burning program to work required an hour's effort tracking down what it was trying to access.  Mostly its own registry keys, which I granted access to.  That's why Vista has the crazy new concept where Admin isn't really.

For my own computers, I run AV software and also watch out for changes to the system.  Most of the time "something breaks" is not due to an infection at all, and having hashes of all the Windows files is helpful in this case as well.  A long time ago, someone told me she just put the Windows directory under a version control system!

However, I find it interesting that the tricks used to hide evaluation timeout information is similar to tricks used by malware.  It all comes down to trusting the supplier of the software: ideally, if we were running as limited users except to install, and an installer does make "funny" changes or write things outside its area, you have to trust that he's merely protecting his interests and not doing anything (on purpose) that would hurt your machine.

And if you didn't notice the specifics during installation, you'll be alerted when registry cleaners, malware detectors, windir change monitoring, and checking file contents against their extensions turns up stuff later.  After removing false hits, everything "suspicious" is actually due to programs hiding stuff from the user for licensing etc. not for turning your machine into a zombie.  By its nature you don't know what crud belongs to what program, and it's just more stuff to keep track of.

--John

[wasker]

The reality is that many programs don't run properly as "limited user", often for no good reason.  For example, getting a CD burning program to work required an hour's effort tracking down what it was trying to access.

Well, that's not really true. It was a problem some time ago, but now it's a lesser pain in the rear end for sure.

And for God's sake throw away the software which doesn't run under LUA -- we have plently alternatives in Windows world, y'know...

[FrizzleFry]

"Ask not what Vista can do for you, ask what you can buy for Vista."

PC Guy on Mac commercials

[wasker]

Well, I feel the sarcasm, but the problem with apps which work only under Administrator, happened to happen back in Windows NT4/2000, where the "Users" group was introduced (NT 3.x anyone?). The group became more visible in XP and now ubiquitous in Vista. So if application fails to work under LUA, it deserves to be thrown away, not Vista.