AutoHotkey Community

@fragman:
No, but I know that when a certain keylogger hit my system, it replaced some .dll's in the System32 folder without showing a dialogue...
These were then injected into running processes to make the files undeleteable...
Using Process Monitor I was able to discover both .dll's and the .exe that were in use, then I booted from what I had at hand (an Ubuntu flash drive) and deletd them.

@#: definitely number 3, unless there's a way to modify System32 without admin rights? UAC was on at the time.


I did go for a happy several (4?) months without infection before turning off UAc

_________________
Autofire, AutoClick, Toggle, Spam • Window Control Tools
Recommended: AutoHotkey_L

That would be using an exploit then. This is nothing that UAC could have helped with.
If you have UAC turned off all programs will run as admin and will be able to do the things you mentioned without using exploits though.

fragman, I'm afraid I don't understand.
Your comment to me sounds like "It was an exploit. Therefore, it's not UAC's fault."
So there are exploits around UAC, which render it absolutely useless. I don't see how it's not UAC's fault for failing to protect the System32 folder...

_________________
Autofire, AutoClick, Toggle, Spam • Window Control Tools
Recommended: AutoHotkey_L

That's not an exploit around UAC but around the user management of windows.

UAC is mainly a mechanism that runs all processes as normal user (non-elevated) by default and provides a means for processes to request elevation.