Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 785856" data-attributes="member: 32260">I thought about it, because those Registry keys are often used to run the malware after reboot.Unfortunately, also many legal software and sometimes Windows processes (especially after updates) can also use RunOnce or Run keys to do something after reboot on the particular user account. That would be a problem, because removing user write access would block silently any changes in those keys.So, they are not blocked in Hard_Configurator, but the payload which would try to start with Windows, will be blocked in the UserSpace.Yet, monitoring/checking those Registry keys and some others would be an important security layer. I usually do this via Sysinternals Autoruns.Regards.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 785856, member: 32260"] I thought about it, because those Registry keys are often used to run the malware after reboot. Unfortunately, also many legal software and sometimes Windows processes (especially after updates) can also use RunOnce or Run keys to do something after reboot on the particular user account. That would be a problem, because removing user write access would[COLOR=rgb(184, 49, 47)][B] block silently[/B][/COLOR] any changes in those keys.So, they are not blocked in Hard_Configurator, but the payload which would try to start with Windows, will be blocked in the UserSpace. Yet, monitoring/checking those Registry keys and some others would be an important security layer. I usually do this via Sysinternals Autoruns. Regards.(y) [/QUOTE]

Verification