Drive by spyware installs

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Will "locking" down local permissions to "user" level prohibit the
installation of spyware on a destop?

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"Rodkey" <Rodkey@discussions.microsoft.com> wrote in message
news:77DF4651-C815-48F7-84F5-2C84F890735E@microsoft.com...
> Will "locking" down local permissions to "user" level prohibit the
> installation of spyware on a destop?


It would prevent the software from 'infecting' anything other than that one
user's profile.


--
Colin Nash
Microsoft MVP
Windows Shell/User

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"Carey Frisch [MVP]" <cnfrisch@nospamgmail.com> wrote in message
newsdH9QUzMFHA.1176@TK2MSFTNGP15.phx.gbl...

> | Will "locking" down local permissions to "user" level prohibit the
> | installation of spyware on a destop?

> No. Some types of spyware or malware will actually change
> permissions.

I find that difficult to believe. I've administered networks for some fifty
people at a time, all running as limited users, without one spyware incident
in two years running.

Are you saying that spyware can change a user's access level from Limited
User to Administrator? Hm, maybe if the following conditions were met:

* The built-in Administrator account's password was left blank, and
* The machine runs XP Pro and not XP Home (where Administrator is only
available in Safe Mode)

Seems to me the easy fix to prevent that, is to start the computer in Safe
Mode and change the built-in Administrator's password. But on XP Home it
shouldn't matter since Administrator can't log on "because of a policy
restriction" outside of Safe Mode (try pressing CTRL-ALT-DEL on the Welcome
screen and logging on as "Administrator" on XP Home).

Speaking of such, IS there a way to change the built-in admin account
password from not-safe-mode? Such as from a command line, like the "setpwd"
tool available for Win2K Domain Controllers?

--
PGP key (0x0AFA039E): <http://www.pan-am.ca/consulting@pan-am.ca.asc>
Prevent problems before they happen and help others avoid bad design.
<http://www.pan-am.ca/antiwindowscatalog/>