Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have installed Windows XP SP3 with all default options and created a guest account(without any password). I was wondering, if this is enough to prevent any user from corrupting the main Windows account(such as introduce a virus), while being logged into the guest account. Assuming these users don't know about BIOS Startup and will just log in as Guest, now much harm can such account inflict on the main account.

share|improve this question

2 Answers 2

up vote 7 down vote accepted

Can a Guest Windows XP account infect the overall system with Virus?

Yes. This is possible through various security exploits. Windows Updates help close design flaws that exploits exploit. So run that frequently and that'll help prevent this kind of abuse.

Under regular use, a guest account should be fairly incapable of ruining the system. However, if they have physical access to the machine, then they can easily boot off another device (usb, for ex).. Then use easily available utilities to crack your admin password and do other entertaining things you'd rather prevent.

-- Ammendment --

I'll add that a under-skilled user can do this inadvertently. So the integrity of the content they consume matters. If they're going to really sketchy websites, they could unknowningly run an exploit that owns the system and uses it for whatever (like a spam botnet).

share|improve this answer
1  
yup if someone can walk-up to the computer, in about 3 minutes on most of these systems, they could render it inert, without even cracking hacking or trying really hard, I believe there is no such thing as walk-up security, unless its an Atm :-) –  Psycogeek Oct 5 '11 at 1:33
1  
The only walk-up secure device I can think of, is one that was launched successfully in to the centre of a star mere moments before it hit the event horizon of a singularity, in an alternate dimension, infinity years in the past.... Guarded by 1,337 slightly-staving ninjas –  Doc Oct 5 '11 at 1:51
    
Thanks for the reply. As for physical security, I am cool with that. The user I am talking about doesn't have malicious intent :). Only his naive experience with computing will introduce any possible virus. –  Shamim Hafiz Oct 5 '11 at 6:08

I know that the answer is yes, from a guest account it's possible to affect the main windows account (let's say, the admin one).

But I was searching for specific examples of it and couldn't find any, just general ones:

  • from guest account you can run brute-force attack against any other account;
  • you can have some kind of memory leak attack, buffer overflow attack. Couldn't find any virus that did that in windows xp, etc, but probably because no one mentionates exactly how that's done
  • one guest account can save some malicious program that you'll end up executing as another account
share|improve this answer
2  
The trick with getting specific answers is that it's a moving target - as exploits are discovered, they're patched.. Metasploit and its community would be where I'd look for current examples. –  Doc Oct 4 '11 at 23:46
    
Thanks for the reply. I was more concerned about unintentional damages, such as malicious program downloaded and executed during adventurous browsing. Looks like, I have little to worry about. –  Shamim Hafiz Oct 5 '11 at 6:11
    
@Gunner: you know, doing that will keep you safe in general, but someday the guest might infect your computer, and you'll deal with that. If you don't need that protection in your computer (you're not saving the coke-secret-formula in it), them you'll be ok. –  woliveirajr Oct 5 '11 at 11:58
    
@woliveirajr: Hmm :). I just want to prevent the annoying of a memory resident virus, keeping my app files hidden and replacing it with it's own code. –  Shamim Hafiz Oct 5 '11 at 12:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.