[Joker]

Don't disable Vista's UAC, which people have called an annoyance and people love to talk about disabling it right away, in their articles. Here's a very good reason not to, recent tests show Vista's UAC do not allow rootkits to get installed! - Joker

---

Love or hate its nagging prompts, Vista's Account Control feature (UAC) has a security feature that marks it out from any other type of Windows security programme -- it can spot rootkits before they install.

This is one finding buried in a report published in two German computer magazines some months ago after testing by the respected AV-Test.org, which set out to find out how well antivirus programs fared against known rootkits.

The answer was not particularly well at all, either for Windows XP, or Vista-oriented products. Of 30 rootkits thrown at XP anti-malware scanners, none of the seven AV suites found all 30, a similar story to the six web-based scanners assessed. Only four of the 14 specialized anti-rootkit tools managed a perfect score.

Best Protection

The best of the all-purpose suites was Avira AntiVir Premium Security Suite, which found 29 active rootkits, with Norton finding as few as 18. The anti-rootkit tools fared better, with AVG Anti-Rootkit Free, GMER, Rootkit Unhooker LE, and Trend Micro Rootkit Buster achieving perfect scores. The scores for removal were patchy, however, with all failing to remove any of the rootkits they had found.

The results for Vista products were harder to assess because only six rootkits could run on the OS, but the testers had to turn off UAC to get even this far. Vista's UAC itself spotted everything thrown in front of it.

Only three of the 17 AV tools for Vista managed to both detect and successfully remove them, F-Secure Anti-Virus 2008, Panda Security Antivirus 2008, and Norton Antivirus 2008.

Once on a PC, rootkits can bury themselves quietly, but they have to get to that point first. As long as users interpret prompts from the UAC system attentively, or those messages haven't in some way been spoofed, rootkits struggle to jump to the PC without drawing attention to themselves.

That UAC can tell a user when a rootkit is trying to install itself is not in itself surprising, as Vista is supposedly engineered from the ground up to intercept all applications requests of any significance.

Danger of Rootkits

Rootkits matter. By their nature, they set out to bypass the operating system. Once installed, they can do whatever they like, including loading other malware from a position of privilege. The question is, how can one be sure that a scanner is spotting a type of program built on the principle of extreme stealth?

An interesting footnote to the XP rootkit testing was that the samples chosen included three 'professsional' rootkits, apparently legitimate programs designed to enforce things such as copy protection. The most infamous example of this category included is the Sony XCP/First4Internet rootkit, which caused the company so much embarrassment when it was discovered in 2005.

But in a period of weeks when Vista has received criticism for its rate of vulnerabilities, Microsoft's programmers can at least point to evidence that UAC is efficient at stopping those infections from happening automatically.

Source: PC World - Business Center: Vista's Despised UAC Nails Rootkits, Tests Find

[SkyFuser]

Uhhh... do you know how hard it is to be getting rootkits if you aren't doing anything you're not supposed to? If you have a top-grade firewall (I go with Comodo ), use a secure browser like Opera or Firefox, and don't go on crack sites, adult sites, etc. You should never even have the opportunity to have a rootkit.

But I never knew this at all O.O Thanks for posting

[ChrisTheFeral]

Originally Posted by Joker

Don't disable Vista's UAC, which people have called an annoyance and people love to talk about disabling it right away, in their articles. Here's a very good reason not to, recent tests show Vista's UAC do not allow rootkits to get installed! - Joker

---

Love or hate its nagging prompts, Vista's Account Control feature (UAC) has a security feature that marks it out from any other type of Windows security programme -- it can spot rootkits before they install.

This is one finding buried in a report published in two German computer magazines some months ago after testing by the respected AV-Test.org, which set out to find out how well antivirus programs fared against known rootkits.

The answer was not particularly well at all, either for Windows XP, or Vista-oriented products. Of 30 rootkits thrown at XP anti-malware scanners, none of the seven AV suites found all 30, a similar story to the six web-based scanners assessed. Only four of the 14 specialized anti-rootkit tools managed a perfect score.

Best Protection

The best of the all-purpose suites was Avira AntiVir Premium Security Suite, which found 29 active rootkits, with Norton finding as few as 18. The anti-rootkit tools fared better, with AVG Anti-Rootkit Free, GMER, Rootkit Unhooker LE, and Trend Micro Rootkit Buster achieving perfect scores. The scores for removal were patchy, however, with all failing to remove any of the rootkits they had found.

The results for Vista products were harder to assess because only six rootkits could run on the OS, but the testers had to turn off UAC to get even this far. Vista's UAC itself spotted everything thrown in front of it.

Only three of the 17 AV tools for Vista managed to both detect and successfully remove them, F-Secure Anti-Virus 2008, Panda Security Antivirus 2008, and Norton Antivirus 2008.

Once on a PC, rootkits can bury themselves quietly, but they have to get to that point first. As long as users interpret prompts from the UAC system attentively, or those messages haven't in some way been spoofed, rootkits struggle to jump to the PC without drawing attention to themselves.

That UAC can tell a user when a rootkit is trying to install itself is not in itself surprising, as Vista is supposedly engineered from the ground up to intercept all applications requests of any significance.

Danger of Rootkits

Rootkits matter. By their nature, they set out to bypass the operating system. Once installed, they can do whatever they like, including loading other malware from a position of privilege. The question is, how can one be sure that a scanner is spotting a type of program built on the principle of extreme stealth?

An interesting footnote to the XP rootkit testing was that the samples chosen included three 'professsional' rootkits, apparently legitimate programs designed to enforce things such as copy protection. The most infamous example of this category included is the Sony XCP/First4Internet rootkit, which caused the company so much embarrassment when it was discovered in 2005.

But in a period of weeks when Vista has received criticism for its rate of vulnerabilities, Microsoft's programmers can at least point to evidence that UAC is efficient at stopping those infections from happening automatically.

Source: PC World - Business Center: Vista's Despised UAC Nails Rootkits, Tests Find

Wow, it looks like a nice guide, possibly for beginner users I suspect, I haven't had any troubles with viruses or any of that kinda thing, as SkyFuser said "...do you know how hard it is to be getting rootkits if you aren't doing anything you're not supposed to?..." and with Mcafee SiteAdvisor on your side, I think I personally would be safe to turn that off once I do get the Dragon - I've never used Vista like this I'm a little excited about Vista, I have heard to many problems, meh - I'm going to have XP and Ubuntu on it too.

Anyway, for beginner users, I would probably leave it on, but for more advanced users who only visit sites knowing that they are safe, I think it is reasonably fair to say you could turn it off if you haven't had many troubles.

Very nice guide though, I'm going to re-read through that incase I missed something.

[Vipralion]

Have heard many problems about Vista? Ignore most of 'em. Really, it's just negativity about the OS. There's really nothing wrong with it all. UAC has a purpose, a reason, it wasn't put in place for nothing. Just read the original post in this thread.

However, the problem you would have had most would have been with drivers, especially with Vista x64 running on the notebook you've won, however, because it is a notebook, and comes direct from the manufacturer, you won't have those problems and should have a great time with Vista.

[SkyFuser]

Probably most of it IS negativity, but I don't see preventing rootkits as a sudden kickass reason to leave UAC on. That's like mounting a hunting rifle on your shoulder 24/7 so in case the house should suddenly have a rat invasion you'll be ready.

I mean, ok, awesome. It can detect rootkits. But what're the chances we have good security protection, a secure browser, don't visit pr0n or crack sites, don't open suspicious .exe or .jpg files, and still get a rootkit? Almost zero.

[ChrisTheFeral]

Originally Posted by Vipralion

Have heard many problems about Vista? Ignore most of 'em. Really, it's just negativity about the OS. There's really nothing wrong with it all. UAC has a purpose, a reason, it wasn't put in place for nothing. Just read the original post in this thread.

However, the problem you would have had most would have been with drivers, especially with Vista x64 running on the notebook you've won, however, because it is a notebook, and comes direct from the manufacturer, you won't have those problems and should have a great time with Vista.

I was talking to my mate at school today who brings his laptop to class (actually the only person at our school that does) and he says he as only had one problem with it! I have used Vista for a ltitle while when helping out my sister with things, I must admit there aren't bugs as such but many new annoyances that I have to work around, which I guess in the long run, most of these will be easier for the beginner user but annoying to relearn as it would be when any OS changes something.

Originally Posted by SkyFuser

Probably most of it IS negativity, but I don't see preventing rootkits as a sudden kickass reason to leave UAC on. That's like mounting a hunting rifle on your shoulder 24/7 so in case the house should suddenly have a rat invasion you'll be ready.

I mean, ok, awesome. It can detect rootkits. But what're the chances we have good security protection, a secure browser, don't visit pr0n or crack sites, don't open suspicious .exe or .jpg files, and still get a rootkit? Almost zero.

I'm going to leave it on for a few weeks and see if it is really THAT annoying, I'll probably turn it off, I personally don't think I need it.

[Vipralion]

Originally Posted by SkyFuser

Probably most of it IS negativity, but I don't see preventing rootkits as a sudden kickass reason to leave UAC on. That's like mounting a hunting rifle on your shoulder 24/7 so in case the house should suddenly have a rat invasion you'll be ready.

I mean, ok, awesome. It can detect rootkits. But what're the chances we have good security protection, a secure browser, don't visit pr0n or crack sites, don't open suspicious .exe or .jpg files, and still get a rootkit? Almost zero.

UAC should only kick in when you're doing installation programs and other things that require a bit deeper access into your system files. While you get things all setup and going, you'll probably see it a lot. However, once you get to the point where you're being mostly productive, you'll hardly ever see the UAC unless you're trying out new software or dun dun dun... a rootkit or other malware pops up.

So a more proper analogy would be having a smart house that asks you to confirm that you're adding a new room, modifying the security system, or letting someone else in by asking for the password that only you know. Meanwhile, you work in the office, watch movies in the living room, etc. with no hassles from your smart house. Then when something bad comes knocking at your door, your smart house asks you if it's ok to let them in.


What was really interesting to read in the article was the fact that they actually had to disable UAC to even get a rootkit running on Vista deliberately. Vista FTW!

[ChrisTheFeral]

Originally Posted by Vipralion

UAC should only kick in when you're doing installation programs and other things that require a bit deeper access into your system files. While you get things all setup and going, you'll probably see it a lot. However, once you get to the point where you're being mostly productive, you'll hardly ever see the UAC unless you're trying out new software or dun dun dun... a rootkit or other malware pops up.

So a more proper analogy would be having a smart house that asks you to confirm that you're adding a new room, modifying the security system, or letting someone else in by asking for the password that only you know. Meanwhile, you work in the office, watch movies in the living room, etc. with no hassles from your smart house. Then when something bad comes knocking at your door, your smart house asks you if it's ok to let them in.


What was really interesting to read in the article was the fact that they actually had to disable UAC to even get a rootkit running on Vista deliberately. Vista FTW!

Wow, my sister gets the message all the time, I assume it is configurable(?) when ever she opens a program.

[Vipralion]

Wow. Quick reply. Hehe. Didn't realize anyone was on. 4:30am.

What kind of programs is she opening? Only software that isn't developed as well as it could have been should be prompting everytime it launches.

The tool and program that Long Zheng is promoting through his Dragon contest helps Microsoft analyze when UAC is activated, and gives them better data to work with when modifying how and when it should trigger.

[ChrisTheFeral]

Originally Posted by Vipralion

Wow. Quick reply. Hehe. Didn't realize anyone was on. 4:30am.

What kind of programs is she opening? Only software that isn't developed as well as it could have been should be prompting everytime it launches.

The tool and program that Long Zheng is promoting through his Dragon contest helps Microsoft analyze when UAC is activated, and gives them better data to work with when modifying how and when it should trigger.

8:41pm here I get notified of a the second of when I get a new email as I am subscribed to this thread - I found out instantly, trying to do the thank you video but not working out well :/

Just anything, like just opening a picture downloaded from the web. Her screen goes black for 10 seconds and the popup appears, I think her Compaq computer isn't QUITE powerful enough for vista.