UAC Bypassable or not?

[Deleted member 178]

But for someone who has solid knowledge and backup it is just doesn't worth the headache of running this.
and I'm not the only one my boss told me first of all make sure to,
Disable, UAC, firewall,
Enable remote desktop, and remote registry.
fully update the system.

Wowowowowoo !!! i am the only one to see sth wrong here ?

Now I'm asking someone who work in this field not someone that play in forums this.
how many infected pc's with up to date os did you and how many that are not up to date?
The real answer should be almost the same.

from my professional experience :

ALL seriously infected PCs i came across were unpatched ,while patched ones were sometimes infected but with less virulent malwares.

 

[cruelsister]

I wonder for a brief time if we can concentrate on UAC abilities as I think that we are confusing some here. The basic question was "Can you get infected with UAC maxxed out", and not "Will I only get infected if malware shuts off UAC first".

UAC is NOT an anti-exe. It will react to requests of elevated privilege (high integrity process), but as most malware will work fine in Standard Mode (medium integrity process) when these are run (like Ransomware) UAC will ignore them and the system will be infected.

So:

1). Is it easy for malware to shut off (bypass) UAC?
No.
2). Will UAC protect from malware that need elevated privilege (Admin)?
Yes.
3). Will UAC in any way protect against malware that does not need elevated privilege?
NO.

 

[nissimezra]

I wonder for a brief time if we can concentrate on UAC abilities as I think that we are confusing some here. The basic question was "Can you get infected with UAC maxxed out", and not "Will I only get infected if malware shuts off UAC first".

UAC is NOT an anti-exe. It will react to requests of elevated privilege (high integrity process), but as most malware will work fine in Standard Mode (medium integrity process) when these are run (like Ransomware) UAC will ignore them and the system will be infected.

So:

1). Is it easy for malware to shut off (bypass) UAC?
No.
2). Will UAC protect from malware that need elevated privilege (Admin)?
Yes.
3). Will UAC in any way protect against malware that does not need elevated privilege?
NO.

The best answer so far!

 

[Nico@FMA]

The best answer so far!

Well well well Nissimezra, if this is your final reply to everything that has been said here, then i think that its time for you to MOVE on.
Your total disregard for all the info and tips and help given to you here in this forum is just shocking.
I think that i speak for most of us who have tried to educate you and help you that if this is a preview to what we might expect from you during your stay here on the forum, then (And i should not be saying this) but i think that it might be better if you join some clueless forum.
As MT is NOT clueless, we got better things to do then combat your ignorance.
Please take my advise change your attitude, change the way how you reply to info and try to make an effort to understand what has been said to you and if this is to much for you then ask us to explain.
But don't act like you know it all and have us explain everything twice and then fail to even comment on it in a proper way.

That being said, i hope you accept my advise and change your future actions, and if you cannot do such thing then please ask yourself the question: Why did you join MT in the first place.

@cruelsister
Totally correct m8.

 

[nissimezra]

Well well well Nissimezra, if this is your final reply to everything that has been said here, then i think that its time for you to MOVE on.
Your total disregard for all the info and tips and help given to you here in this forum is just shocking.
I think that i speak for most of us who have tried to educate you and help you that if this is a preview to what we might expect from you during your stay here on the forum, then (And i should not be saying this) but i think that it might be better if you join some clueless forum.
As MT is NOT clueless, we got better things to do then combat your ignorance.
Please take my advise change your attitude, change the way how you reply to info and try to make an effort to understand what has been said to you and if this is to much for you then ask us to explain.
But don't act like you know it all and have us explain everything twice and then fail to even comment on it in a proper way.

That being said, i hope you accept my advise and change your future actions, and if you cannot do such thing then please ask yourself the question: Why did you join MT in the first place.

@cruelsister
Totally correct m8.

My friend u r taking things way to hard.
I'm not disregarding anything, I am learning from everything that said, however I don't have to agree with everything that you r saying, if that the case there is no point at all to make this form open to everyone, just close it for average users and leave it for the expert.
that being said, doesn't mean that I'm right and you are wrong it is just my opinion, I am not telling anyone what to do I just explained what I'm doing or the right way for me, it doesn't have to be the right way but yes it is my way.

as I said you don't have to agree with me, hell no but don't tell me what to say, your advice is more then welcome and I'm not saying it's wrong advice I'm just saying that I'm doing things differently.

Best regards

 

[Nico@FMA]

My friend u r taking things way to hard.
I'm not disregarding anything, I am learning from everything that said, however I don't have to agree with everything that you r saying, if that the case there is no point at all to make this form open to everyone, just close it for average users and leave it for the expert.
that being said, doesn't mean that I'm right and you are wrong it is just my opinion, I am not telling anyone what to do I just explained what I'm doing or the right way for me, it doesn't have to be the right way but yes it is my way.

as I said you don't have to agree with me, hell no but don't tell me what to say, your advice is more then welcome and I'm not saying it's wrong advice I'm just saying that I'm doing things differently.

Best regards

Hello Nissimezra,

Thanks for your reply.
You are right that you do not have to agree with me, and neither do you have to agree with what others say.
And you hit the nail spot on by saying that this community is for both noobish users, average users and semi & full professionals, education and online support are some of the services offered by the community.
So we deal day in day out with all kinds of people, some smart and some plain dumb and obviously some that just do not know as they do not have much exp with computers.
And there is really no shame in that, i would be most happy and willing to spend hours educating people, and if you see my track record here on the forum then you will notice that i have done my fair share of educating, but thats just me.
How about Umbra, or littlebits or some of the other members.... they have educated people so much that they practicly rewrote the internet.

If you read back your replies in this topic, then you see that your comments where just... well let me put it in a nice way your comments where not so smart and certainly out of place.

Now please take notice of the fact none wants you to agree on anything, however if something is being said that is true on all accounts and is accepted by the internet community and industry then you do not have to agree as facts are facts.
And what caused such a outrage is the fact you went on a rampage against some stated FACTS and replaced them with your own.
There is no shame to challenge info, please challenge all you want, but at least maintain some respect to those who are willing to help you and to provide you with all the knowledge you got wish for.
Now this sounds kinda funny, but you would be amazed how much people there are here on the forum with a proven industry track record.
And perhaps you noticed or perhaps you did not but ask the people here in the forum, if for example my info is BS or rock solid, or ask the members about any other "well known" member and the community will tell you that if some of us are sharing info to educate you or anyone else, then harshly said: "You might wanna shut it and listen for a second" (Did not mean that in a rude way) as solid info just got presented on a golden plate.

So thats being said if you want to do things your way, then great i can accept that however i just hope that you are willing to listen from time to time if someone has something sensible to say that could greatly help you.
So how about this: Lets forget the whole thing and reboot... alright?

And i am sure we all can get along fine, just do me a favor ok? Next time read and think and then post.


Cheers

 

[BoraMurdar]

Just let

join this party.

as I said you don't have to agree with me, hell no but don't tell me what to say, your advice is more then welcome and I'm not saying it's wrong advice I'm just saying that I'm doing things differently.

Well, If advice is not wrong (means is right) and you are doing things not differently, but opposite, by simple mathematical operation we can conclude that your way(s) are wrong. But what I cannot deduce is that you are aware of that

it doesn't have to be the right way but yes it is my way.

and don't want to change it.
What's the purpose then?

We just want to help, but if you don't want help then... there's no problem at all.

 

[Ink]

We just want to help, but if you don't want help then... there's no problem at all.

Antivirus: "I just want to help"
User: "I don't want help"
Windows XP SP3: "No problem"

Couldn't resist.

 

[BoraMurdar]

Antivirus: "I just want to help"
User: "I don't want help"
Windows XP SP3: "No problem"

Couldn't resist.

Actually I would be surprised if you didn't

 

[nissimezra]

Hello Nissimezra,

Thanks for your reply.
You are right that you do not have to agree with me, and neither do you have to agree with what others say.
And you hit the nail spot on by saying that this community is for both noobish users, average users and semi & full professionals, education and online support are some of the services offered by the community.
So we deal day in day out with all kinds of people, some smart and some plain dumb and obviously some that just do not know as they do not have much exp with computers.
And there is really no shame in that, i would be most happy and willing to spend hours educating people, and if you see my track record here on the forum then you will notice that i have done my fair share of educating, but thats just me.
How about Umbra, or littlebits or some of the other members.... they have educated people so much that they practicly rewrote the internet.

If you read back your replies in this topic, then you see that your comments where just... well let me put it in a nice way your comments where not so smart and certainly out of place.

Now please take notice of the fact none wants you to agree on anything, however if something is being said that is true on all accounts and is accepted by the internet community and industry then you do not have to agree as facts are facts.
And what caused such a outrage is the fact you went on a rampage against some stated FACTS and replaced them with your own.
There is no shame to challenge info, please challenge all you want, but at least maintain some respect to those who are willing to help you and to provide you with all the knowledge you got wish for.
Now this sounds kinda funny, but you would be amazed how much people there are here on the forum with a proven industry track record.
And perhaps you noticed or perhaps you did not but ask the people here in the forum, if for example my info is BS or rock solid, or ask the members about any other "well known" member and the community will tell you that if some of us are sharing info to educate you or anyone else, then harshly said: "You might wanna shut it and listen for a second" (Did not mean that in a rude way) as solid info just got presented on a golden plate.

So thats being said if you want to do things your way, then great i can accept that however i just hope that you are willing to listen from time to time if someone has something sensible to say that could greatly help you.
So how about this: Lets forget the whole thing and reboot... alright?

And i am sure we all can get along fine, just do me a favor ok? Next time read and think and then post.


Cheers

no prob at all bro, I enjoyed this discussion, I even learned something from it and I'm sure other users as well.
Hy I even turned on on UAC and auto update in my pc, Not my wife's pc coz she'll divorce me.

just to mention one thing, just imagine if there were no viruses how many people \ companies \ technicians \ internet providers \ and more and more would be without a job. that's huge money industry and almost everyone is trying to make people scared so they buy their products thats including big names companies.

to end this discussion I'll say, if people don't have knowledge and using online banking, protect yourself with good av product and fully update your sys, for people with good knowledge, well they probably know what to do

best regards bro

 

[ifacedown]

Hello everyone!

This thread has become so much inclined towards UAC.

My anti-exeuctable developer friend just updated his Windows 7 64-bit, set UAC to the MAX, and still, malware given by CruelSis still bypassed the UAC. But his program (will I tell it?) blocked the malware.

 

[ifacedown]

No UAC itself cannot directly be bypassed without your explicit authorization so right now there is NO malware known to the industry that can directly infect UAC.
However indirectly UAC can be turned down, by malware, for example UAC needs a few system files to work, most of them are considered critical by windows OS so they will be protected so a exploit (or other malware) cannot inject them, BUT as i said "most" as some of them can be injected directly and they can execute a harmfull code forcing your pc to reboot, and by forcing it it automaticly changes the base policy and security parameters within windows itself (Windows core is at its weakest & unprotected during shutdown and boot)
And this will be totally hidden from you, infact UAC will still show up as working it will even ask you in the same way as it did before infection if a program can run, however it does not have the stopping power and 90% of its ability to secure your system is totally gone.
Giving you the idea UAC is still working but in reality its just a cosmetic thing.

So the correct reply is that NO UAC cannot be turned of DIRECTLY but indirectly it certainly can.

Inregards to the UAC being updated or not, it is public knowledge that there where a few rootkits and specific exploits that could exploit some bugs in windows OS which would give them the ability to turn of UAC using bugs within the policy register.
MS released various patches to adress these critical bugs and thus UAC should be save from exploits. But that only applies to a updated windows.

If you are running stone age windows (aka vanilla or unpatched) then UAC and any other feature that windows did bring from your windows dvd should be VERY vulnerable to exploits and direct injections.

Thats being said on a updated windows UAC cannot be bypassed directly and it should be VERY rare that a malware can indirectly inject it. But that is more thanks to running windows update and proper security software.

On a unpatched windows is like a open briefcase in the middle of wallstreet with a 100 million dollar in it.
And in this scenario your UAC can be directly switched off using one of the 2000 known bugs in windows 7.
* Windows 7 shipped with 2000 known bugs. However offical MS figures indicate that after shipping another 11k bugs and exploits where patched (This means 1 out of 8 files in windows OS was open to exploits)
* Windows 2000 did have over 20000 known bugs during shipping.

So let me ask you a question: Do you think UAC can be bypassed?

Kind Regards Nico

Hello,

This is NOT based from my knowledge or experience (I admit that), but from a friend who develops an anti-executable software.

Here's what I say:

YES, UAC could be bypassed, even if it set to the MAX, even if Windows is updated. Bypassed in the sense not triggering any user prompt.

 

[nissimezra]

Hello,

This is NOT based from my knowledge or experience (I admit that), but from a friend who develops an anti-executable software.

Here's what I say:

YES, UAC could be bypassed, even if it set to the MAX, even if Windows is updated. Bypassed in the sense not triggering any user prompt.

well as I said it happened to me, I haven't done any thing but pressing a link, uac was on default setting, however my system was not fully update. I am still thinking how it happen, and still didn't find an answer.

 

[cruelsister]

Once again, if the malware doesn't need administrator privileges to work UAC will ignore it. And great majority of all malware does not need such elevated levels to trash a computer.

 

[nissimezra]

Once again, if the malware doesn't need administrator privileges to work UAC will ignore it. And great majority of all malware does not need such elevated levels to trash a computer.

Thnx, so like I said it is possible to bypass it.

 

[ifacedown]

Once again, if the malware doesn't need administrator privileges to work UAC will ignore it. And great majority of all malware does not need such elevated levels to trash a computer.

...THAT is why UAC could be bypassed.

 

[ifacedown]

I will post a video link on this UAC-bypassing malware, as soon my friend uploads the video.

UAC-MAX,
Windows 7 Pro 64-bit UPDATED,
No flash of JAVA installed...

but still UAC bypassed.

Thanks.

 

[Ink]

I got a white screen with the UAC-bypass sample, is that what's supposed to happen?

 

[nissimezra]

in my case I had java and flash instal and at least java was not up to date.

 

[Ink]

Once again, if the malware doesn't need administrator privileges to work UAC will ignore it. And great majority of all malware does not need such elevated levels to trash a computer.

Applies to all software. For example; Firefox can be installed without administrative rights on a standard user account. Doesn't mean it has bypassed UAC, the software just doesn't require those rights. Correct me if I'm wrong. @cruelsister


IMO, while UAC isn't fool-proof, it should serve you fine if you use UAC as part of layered security (ie. AV), with an updated OS including any third-party software. A reckless user will probably run everything they download without checking online resources, ie. VirusTotal etc.