0

My current problem is that I am trying to prevent a program from changing the attributes(specifically Write permissions) of its own files in order to stop the program from updating itself since it's connected to the Internet. What I have tried so far is denying the user under which the program is being executed to write(meaning modify/change) to the program's executable and all of its files with the help of icacls.exe. This built-in system tool can modify user permissions on files/folders. To start of, I granted Full Access to the program's executable and its files to clear all restrictions, then, I denied the followings:DE,WD,WDAC,WO,AS,WEA,WA (refer to the manual of icacls.exe to see what they stand for) but after relaunching the program, the attributes were reset to the program's advantage and it immediately began to update. After this failed attempt, I denied additional permissions such as: D but I could no longer start the program since I couldn't even dir the directory the program was located in. The same behaviour could be noticed with other additional denied permissions including, but not limited to, M, W, GW. I have also tried hiding away attrib.exe from the program since I noticed conhost.exe is always being called by the program at startup with the help of which it can pass an attrib.exe command to modify the attributes unless the user under which the program is running is denied to change attributes but again, denying M, W, GW permissions I mentioned previously restricts me from viewing the directory in which the program and its files are located let alone executing it. Could it be that the program is using the Windows API to change the attributes of its files? What are other methods to prevent this program from modifying attributes besides what I've already mentioned?

3

1. DO NOT work in administrative account. Create standard account and work there. Use administrative account only to set security permission on files you need or for installation/deinstallation of new programs or adjusting system settings. If your account is administrative then program can easily overwrite all your restrictions since it works in administrative account too.

2. Block outgoing connection in firewall for your stubborn program in advanced firewall settings.

You can try to revoke ownership from files you want to be unwritable and assign restricted user as an different owner (not an account that run program) but I guess functionality of program would be broken.

| improve this answer | |
  • The user under which the program is executed is not a member of Administrators group therefore no console commands can be executed with administrative priviliges. I should also state that that user which executes the program is run inside my own user environment which is a member of Administrators group but with the help of UAC I can block any attempt to run a command with admin priviliges. Blocking connections is not something I want because the program should remain connected to the Internet to allow me to use its necessary functions even if it tries to download patch updates & other stuff. – computationalprince Jul 27 '18 at 18:54
  • "user which executes the program is run inside my own user environment which is a member of Administrators group" - then this program can use system API as administrator. Try to track function calls, what it use. You can use ProcessMonitor (technet.microsoft.com/en-us/sysinternals/bb896645.aspx) or WinAPIOverride32 (jacquelin.potier.free.fr/winapioverride32) or APImonitor (rohitab.com/apimonitor) – Alex Jul 27 '18 at 19:07
  • Great that you mention ProcMon as I use it quite frequently although I am not experienced enough with it. Is the monitoring of function calls documented anywhere? By the way, I've just logged in to the user account with standard priviliges to run the program and witnessed the same behaviour - the attributes still get reset to the program's advantage. – computationalprince Jul 27 '18 at 19:52
  • 2
    "Is the monitoring of function calls documented anywhere?" Yes, official here: msdn.microsoft.com/en-us/library/ms123401.aspx and you can also find unofficial API on countless hacker's sites. Try to revoke permission "OWNER/Creator" since usually it has full access – Alex Jul 27 '18 at 20:08
  • I am back with a small update to tell that the permission revoke trick solved the problem. That program now can't modify the attributes provided that the program's executable and its files(probably the executable alone is enough) have denied permissions on: (DE,WD,WDAC,WO,AS,WEA,WA). Thank you Alex for your time and effort. – computationalprince Jul 27 '18 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.