My limited user seems not so limited (XP)

Having a problem.. In an effort to better secure my home computer, I
created a new admin-level user (this is XP Home, by the way) with a
really long password, logged in as THAT user and changed my usual
account and my wife's account to "limited user" level. Then I shut
down and restarted the computer. Logged in as my usual self (now
LIMITED, mind you) and proceeded to test if I really was locked down
like I wanted.

So I went into my Norton antivirus and tried to change settings - no
dice. *Good* so far, right? I tried creating files on c:\ and got
access denied. GOOD, right? Well, next I downloaded some software off
the internet and installed it and it installed just fine, even making
registry entries all over the place.

WHY??? Why was the software install not blocked? I was able to
install both Google Earth and a Trojan simulator called
TrojanSimulator, which is now resident in memory (TServ.exe) AND has a
registry entry to help it start up next time I reboot (nice, huh?)

I thought the limited user in XP was supposed to prevent this crap!!

Re: My limited user seems not so limited (XP)

burnedtechie@yahoo.com wrote:
> WHY??? Why was the software install not blocked? I was able to
> install both Google Earth and a Trojan simulator called
> TrojanSimulator, which is now resident in memory (TServ.exe) AND has a
> registry entry to help it start up next time I reboot (nice, huh?)
> I thought the limited user in XP was supposed to prevent this crap!!

No.

Having limited user rights does not prevent from running malware.

Having limited user rights does prevent malware from doing too much harm
without an extra privilege elevation, though. And having limited user
rights does lead to a situation, that when malware is detected, you
don't need to flatten and rebuild the complete computer, but it's enough
to delete the infected user profile (if it is secure, that there was no
privilege elevation possible), so it's much faster to recover to a safe
state.

Yours,
VB.
--
Viel schlimmer als die Implementation von PHP ist jedoch das Design.

Rudolf Polzer in de.comp.security.misc