App Review Ransom Buster by Trend Micro

[AtlBo]

OK. Noticed UAC Virtualization last night. Any plain and simple benefit to enabling UACV?

 

[Andy Ful]

OK. Noticed UAC Virtualization last night. Any plain and simple benefit to enabling UACV?

The below article has a good explanation:
Tales of Application Compatibility Weirdness – Demystifying UAC Virtualization
The UACV is only for compatibility with old applications that try to save data, config files, etc. in Program Files or Windows folders (UAC protected) or store some data in the HKLM registry hive, etc.. Such actions would fail due to insufficient access rights. There is no need to turn ON UACV If you do not use such old applications.
Some users complained that the malware could use UACV for hiding in unexpected disk/registry locations but I did not tested it. For example, some tools could miss malware entries in the registry virtual store:
HKU\<User SID>_Classes\VirtualStore\Machine\Software

 

[Prorootect]

Andy Ful wrote:
"But generally, the real danger is when using an Admin account."

Is there an add-on or software to easily switch from admin rights at any time?

 

[Andy Ful]

Andy Ful wrote:
"But generally, the real danger is when using an Admin account."

Is there an add-on or software to easily switch from admin rights at any time?

Yes. Windows built-in Software Restrictions Policies.
You can easily switch Default Deny Security Level to Unrestricted like I do in Hard_Configurator using SwitchDefaultDeny utility (see attachment). It works only with Hard_Configurator, but it is easy to make a GUI tool that can do the same for the standard SRP.
Also one can use Simple Software Restriction Policies tool, that has switch ON/OF option.

 

[Prorootect]

- addon or software.. button, Off/On switch, any?

 

[Andy Ful]

- addon or software.. button, Off/On switch, any?

Please, look at my previous post which I edited, so you could miss it.

 

[Prorootect]

haha, good this one, .png

 

[Andy Ful]

In fact, SRP on admin account do much more. If SRP are off, then you have the normal admin account. If SRP are ON, then new executables are blocked by default, except when run with admin rights or added to the white list.
The downside of the above (for many users) is adding the new applications to the white list when they installed untypically (outside Program Files) or use the executable image to execute in the Temp folder (wrapped launchers).

 

[AtlBo]

The UACV is only for compatibility with old applications that try to save data, config files, etc. in Program Files or Windows folders (UAC protected) or store some data in the HKLM registry hive, etc.. Such actions would fail due to insufficient access rights. There is no need to turn ON UACV If you do not use such old applications.

Thanks.

 

[Prorootect]

"Also one can use Simple Software Restriction Policies tool, that has switch ON/OF option."

Thank you Andy Ful for this software!

thewindowsclub.com: Simple Software Restriction Policy is a security add-on for Windows
ghacks.net: Lock-down your Windows system with Simple Software-restriction Policy - gHacks Tech News
bleepingcomputer.com: Is Simple Software-Restriction Policy safe? - General Security

"Heads up! ZenMate Web Firewall blocked this site from loading as it's classified under Security Threats.
Simple Software-restriction Policy "
- I've clicked "Continue anyway": (too cause TrafficLight says: "Safe page")

-so I could read sourceforge.net: Simple Software-restriction Policy

 

[Andy Ful]

...
-so I could read sourceforge.net: Simple Software-restriction Policy

Please, learn about SRP first, because this handy tool will allow you to blacklist anything you want. If you will do something wrong then you will not be happy.