Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Came accross a client with a badly virus infected computer.

One virus prevented the running of all programs except for those that the virus choose to allow.

Googling showed me how this might be done in respect of .exe programs but this virus also prevented .com programs running.

Strictly speaking I don't want to be able to do this myself, however I do want to know how it might be achieved and thereby how to this undesirable effect.

I assume that the trick will involve registry changes and therefore it might be possible to undo it by using regedit to work on the hard disk removed and attached to a correctly functioning PC. Would open the necessary file using open hive commands.

Any ideas?

Forgot to mention that the version of windows being run is Windows Home. It seems that the professional version is needed to run the group policy management console. Or can this be achieved indirectly via the registry anyway and if so how?

share|improve this question
    
How exactly did this prevention manifest? Did you get an error when double-clicking? When starting it in cmd.exe? When passing it to CreateProcess? –  Martin v. Löwis Sep 9 '09 at 12:00
    
When attempting to run a .exe or .com file not on the list a dialog was presented asking what to open the program file with and suggesting that it could be opened with Notepad etc.. Odd dialogs also came up during start-up suggesting that exe and dll files could not be located. –  DavidMax Sep 9 '09 at 16:39
add comment

migrated from stackoverflow.com Sep 14 '09 at 7:46

This question came from our site for professional and enthusiast programmers.

2 Answers

The Software Restriction Policies are a way to achieve this: you can define a policy which allows certain programs and disallows others; this is probably the simplest way.

You could also try hooking into the API functions - to put this simply, every time a program wants to do something, this request goes through your "hook" or handling program first. This is the way many viruses work. Read API Hooking Revealed for an introduction, or google hook CreateProcess (CreateProcess is the Windows API function used for starting programs) and go from there.

share|improve this answer
add comment

The virus probably used "software restriction policies": http://technet.microsoft.com/en-us/library/bb457006.aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.