Broadband Tech > Security > Security > How did someone with a limited account install Antivirus XP

How did someone with a limited account install Antivirus XP

Safe Mode will let you install programs sometimes

OR

They may have watched over a shoulder to find the Admin Password

OR

There are Linux Boot CDs that can be burned to a blank, placed in the drive so that when rebooted the CD shows all passwords used on the system.

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

reply to goofy01

Re: How did someone with a limited account install Antivirus XP

reply to goofy01
Running in a Limited User account is a good way to help potentially reduce the degree malware effects a system. Here's some information we have on Limited User accounts under Windows XP, which includes a link for information on Windows Vista:

Microsoft Security At Home
Limited User accounts can protect your Windows XP computer when you browse the Web
»www.microsoft.com/protect/comput···unt.mspx

Hope this helps,
Aaron
--
Aaron Hulett | Senior Spyware Researcher | Microsoft Malware Protection Center
This posting is provided "AS IS" without warranty, and confers no rights.

reply to goofy01
If it installed globally or changed system policies like it usually does to prevent changing preferences, then it wasn't a limited account. Safe mode won't make a limited account an administrator. An account in both "Users" and "Administrators" group will make it an administrator.

Otherwise you could have just deleted the profile folder from another account and been done with it, or it had failed from installing altogether.

reply to goofy01
Just curious .. what security software is installed on the machine?

And, what tool did you employ to rid the machine of the infection?
--
"Fast is fine, but accuracy is everything" --Wyatt Earp

reply to goofy01
Dr. Olds, he didn't do any of that, he was browsing and said something like "It said to update my player, so I clicked on it"
I know before I have had to log into the admin account just to install Adobe before since another account needed to read a PDF and they were set up the same way.
I will look into adding no-script. Thanks Aaron, will read that in a bit.
It was installed across all accounts, since there was a desktop icon on my admin desktop.
The computer has McAfee Security Center from Comcast on it, fully updated. This did catch the desktop hijack part of the program. I used Malwarebytes to remove it.

I would seriously consider installing the free Microsoft product SteadyState on this computer. The link below has a fairly extensive set of links to discussions as to what it is, how to obtain it, and why it could help: »aumha.net/viewtopic.php?f=26&t=27570

quote:

---

What state is your shared computer in at the end of the day?

• Hard disk filled with downloaded files?
• Strange options configured?
• Programs installed that you don't want?
• System infected with viruses and spyware?
• Computer bogged down for unknown reasons?

Windows SteadyState, successor to the Shared Computer Toolkit, is designed to make life easier for people who set up and maintain shared computers.

An easy way to manage multiple users
You can manage whole groups of users as single user accounts. The new Windows SteadyState console makes it easier than ever to create and modify user profiles.

A locked-down platform for stable shared computing
Not every computer user should have access to every software capability. Your system can be more stable and consistent when you limit user access to control panel functions, network resources, and other sensitive areas.

Set it and forget it
Once you have everything set up the way you want it, you can share the computer and rest easy. Any changes a user might make to the configuration or hard disk can be undone by simply restarting the machine

---

reply to goofy01

quote:

---

he was browsing and said something like "It said to update my player, so I clicked on it"

---

reply to goofy01
This is why I've warned from time to time a limited account alone is not a magic bullet. A limited user account can infect himself with malware and also a compromised program under a limited user account can destroy all of the data that account has write access to.

So, if you're the only user of your system, and run under a single limited account for most of your work, are you really better off? I would make the argument that no, you're not much better off... At least to me, losing all my documents is probably a bigger inconvenience than having to reload the OS.

This day and age, we need more fine-grained limited permissions, possibly to the point of sandboxing each application to its own account or security sandbox context.
--
Ubuntu MOTU Developer and Forums Council

reply to goofy01

reply to goofy01
This just happen to a coworker of mine and to make matters worse the desktop background gets hijacked and Display properties are missing tabs so you can't switch your desktop now. Does anyone know what Antivirus XP 2008 installs and how to get rid of it.

Thanks.
--
"If it ain't broke don't fix it."

Thanks Google.

»www.xp-vista.com/spyware-removal···rus-2008

»www.2-spyware.com/remove-antivirus-xp.html

»fix-computer-problem.com/rogue-a···rus.html

»www.bleepingcomputer.com/malware···-xp-2008
--
Skin colour is only skin deep.
Everybody wants to be Loved and give Love.

reply to Lanik
XP Antivirus 2008 Removal Instructions (XP Antivirus 2008)
»www.windowsvistaplace.com/xp-ant···-removal
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

reply to goofy01
More on Antivirus XP:

»What is this Antivirus XP?

reply to iam x
I've already been through them guys, thanks.

I can't unregister these files shlwapi.dll, wininet.dll there is no unregister information.
--
"If it ain't broke don't fix it."

reply to La Luna
That did it thanks.

reply to goofy01
It wasn't a limited account if it could place a shortcut outside the limited account; and hijack your desktop, if you mean it prevented you from making changes.

Or not using NTFS.

reply to goofy01
Wrong Red. When this one hit me, it placed the icon in the shared desktop folder, so this icon came up on all users desktops. It didn't hijack the backgrounds on all users though, just on the one that was logged in.