Hello Hansm,
hansm wrote:
1. If I surun explorer (opening a folder with administrative rights) the changes that I make (ex. creating or removing a file) become visible only after refreshing the screen (F5).
This is a known Explorer bug. It appears in all other MakeMeAdmin-like tools.
I tried to make a workaround, but had no success yet.
hansm wrote:
Another thing is that folder icon customizations visible in my limited account and made HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons are not visible when I run as admin.
That's rather strange... How can I reproduce this behavior here? (XPize?)
hansm wrote:
2. If I run secpol.msc even with admin rights it displays an error.
This is a known issue.
SecPol checks the Token Authentication ID of the user token. And that is a limited ID.
"SuRun /RUNAS secpol.msc" works well without the need to use Windows' RunAs.
hansm wrote:
3. I've tested surun on a virtual machine and deliberately infected it with some .mp3.exe virus that I've found on DC P2P networks. The virus didn't write anything to C:\ but still managed to mess the HKCR\exefile key (changing the execution command to C:\command.exe %1).
How could it do this? Usually there's no write access for "Users" in this Key.
Just a guess: Is your limited user the creator/owner of HKCR\exefile?
hansm wrote:
Is there a way for surun to warn the user when an app (run even in limited account) tries to modify certain HKCR keys? These are shared by all users, affecting even admins, unless custom keys are provided in HKCU\Software\Classes.
Keys that need to be protected are at least those for executable files. Typically, a limited account app should not be able to change HKCR keys at all, but that's M$'s "trustworthy computing"...
Usually the virus should not be able to modify anything in HKCR or HKLM, except when you started it with Admin rights, what you never should do. So there should not be a need to check access to these keys.
Please note that SuRun is no protection or security software. It is a program launcher, no HIPS.
SuRun (hopefully) does not compromise system security more than Microsoft (through RunAs).
Setting up correct ACLs is up to the Administrator of the system.
hansm wrote:
4. IMHO the surun.exe process running in SYSTEM account should not be easy to kill (ex. a process from ZoneAlarm - vsmon.exe aka "TrueVector Internet Monitor" - cannot be killed by an admin).
ZoneAlarm must be running (like any HIPS or Virus scanner) to keep the system safe.
But this is not true for SuRun. No one can do any harm by killing the SuRun service.
To kill it you need to be Admin anyway, so what should the protection be good for?