UAC Process Analyzer is a free portable software for Windows that can be used to analyze any running process of the Windows operating system. The program scans the system for running processes automatically to display them all in a selection menu at the top. You can use the menu to select a process that you want to analyze, or hit the refresh button to run the process identification scan again.

Once you have selected a process you need to click on the Analyze button to populate the information in the lower half of the screen.

The program displays the process’ name and file path next to security details. Listed there are the process’ Integrity level, UAC Virtualization, Trusted Directory and whether it is signed with a digital signature.

A link to open the publisher certificate is displayed if the process is signed with a digital signature. The information presented by the program are mostly useful for system administrators and not the average user.

UAC Virtualization for example is an advanced concept which basically redirects write attempts to protected storage to the user’s own directory. It is more complicated than that, and if you really want to know more about it you could read the introductory post over at Technet.

Interested users can download the latest version of UAC Process Analyzer from the official website. The program is compatible with both 32-bit and 64-bit editions of all versions of Windows since and including Windows Vista. (thanks Venkat)

Windows users have several options to get rid of UAC prompts. It is for instance possible to change the UAC level. This is usually not recommended as it results in a decrease in security.

UAC Trust Shortcuts for Windows Vista and Windows 7 offers another option. The program creates new shortcuts that execute programs without UAC prompts.

The application is offered as a 32-bit and 64-bit edition. It displays a minimalistic interface upon execution. New shortcuts are created by adding a program name and path. It is possible to copy and paste the path into the program window, or to use the file browser to select an executable manually. A click on Add Now adds the program shortcut to the Windows Desktop.

uac trust shortcuts

The newly created shortcuts have a blank icon, it might be a good idea to change the icon in the properties after creation to make the identification easier.

A double-click on a shortcut opens the linked program in a new application window. This also means that a program shortcut is placed in the taskbar, so that two icons (the shortcut and the started program) are present after an application has been started this way.

UAC Trust Shortcuts is a handy portable software for Windows 7 and Vista, and especially for users who have to start programs regularly that trigger an UAC prompt on every startup.

The software is available for download at the developer’s website.

The vulnerability afcects all versions of Windows including XP and Windows 7.   On Windows 7 the exploit can bypass the operating system’s security as it does not require administrative privileges to run.

In a statement Microsoft said…

Microsoft is investigating reports of limited, targeted attacks exploiting a vulnerability in Windows Shell, a component of Microsoft Windows. This advisory contains information about which versions of Windows are vulnerable as well as workarounds and mitigations for this issue.

The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut. This vulnerability is most likely to be exploited through removable drives. For systems that have AutoPlay disabled, customers would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited. For Windows 7 systems, AutoPlay functionality for removable disks is automatically disabled.

The exploit requires removable-media, such as a USB flash drive, and with auto-play enabled or with the user browsing manually to removable media. 

Affected Software

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

NeoWin have a video demonstrating the vulnerability which can be viewed here.

This is especially helpful if new applications have been installed on the system, but more of a nuisance if the program has to be used on a regular basis and is developed by a trusted developer.

uac prompt

There are quite a few ways to limit the UAC prompts further in Windows. One of the easiest ways for instance is to change a program’s properties to always run with administrative privileges.

Another option, less commonly known, is to use the Microsoft Application Compatibility Toolkit to whitelist applications so that they do not display an UAC prompt when they are run.

Windows users need to download the software program from the Microsoft website and install it afterwards.

It comes with both a 32-bit and 64-bit Compatibility Administrator. 32-bit programs need to be added to the 32-bit Compatibility Administrator while 64-bit apps in the 64-bit Compatibility Administrator.

application compatibility listing

Start with a right-click on the New Database(1), then Create New and Application Fix. This opens a new window where a program name, developer name and executable can be selected.

user account control

The next page lists the compatibility modes. Locate and select RunAsInvoker from the list and click the Test Run button afterwards to see how the program starts with that new compatibility mode. If it starts without UAC prompt click next, if an error message is displayed it won’t work at all. Most programs will however work without problems here.

run as invoker

Click Next two times after a successful test to add the application to the list. It should be displayed with its name underneath the database entry. Repeat the above steps for other applications that require an UAC prompt.

Save the database of programs by clicking on File > Save As in the menu, e.g. uac-whitelist.

uac whitelist

The Compatibility Administrator saves the database as an sdb file on the local computer system. The database needs to be installed once. This needs to be done from an elevated command prompt. Click the Windows start button, then All Programs > Accessories. Right-click the Command Prompt entry and select to Run as Administrator from the context menu.

Now issue the command

sdbinst pathToUAC-Whitelist.sdb

e.g.

sdbinst c:\users\martin\downloads\uac-whitelist.sdb

It is then possible to test the new setting immediately to see if the changes have been successful. Most programs should start now without UAC prompt while some might refuse to start. It is possible to revert the changes by deleting the non-working applications from the database and running the sdbinst command afterwards again.

Have a different way of automating UAC prompts in Windows? Let us know in the comments.

Most advanced users might not need the extra eye-opener when a program tries to change data on the computer system, especially not during software installations that have been initiated by the user.

Windows 7, and Windows Vista as well, provide an option to disable that UAC dims the desktop during prompts. This will still display a notification in the form of a normal window so that it is possible to interact with other elements on the desktop.

To change that setting type in UAC into the start menu run box. This will open the User Account Control Settings. All that needs to be done is to move the slider down one step from the default position .

This new setting is helpful for users who regularly install new software or make other changes to the operating system that display an UAC prompt.

Having only worked with Winamp under Windows XP I was unaware that Winamp was installing the files elevator.exe and elveatorps.dll for elevation in Windows Vista and apparently Windows 7 as well as this thread at the Winamp forum suggests.

The easiest way to get rid of the files in the same session is by using the following Windows commands in the command line after switching to the directory Winamp was installed in:


elevator.exe /unregserver
regsrv32 /U elevatorps.dll
regsrv32 /U nscrt.dll


It is likely that these files can also be deleted in Windows Explorer after a restart of the computer system. Users who have UAC disabled in Windows can also get rid of these files according to the forum post quoted above.

Smart UAC has been released recently and it did receive some praises from bloggers and is listed on several respected software portals like Softpedia which perform various checks on files before they are added to the portal itself.

Many users have shown skepticism about the program itself based on the previous programs developed by Security Stronghold.

The website itself for Smart UAC Replacement looks professional at first glance but sooner or later users will notice that the English on the product’s pages has not been written by a professional. It is far from perfect which would be understandable for a freeware or Open-Source project from a non-native speaker but the company apparently does not care that much about the language on their website.

A previous application of Security Stronghold with the name True Sword was classified by Symantec as “a Security Risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats.”

It might be a coincidence that one of Smart UAC Replacement’s main features is a scan of running programs with a large database.

Smart UAC Replacement is a free product on the other hand and there are not any reports of users (yet) who were told to buy another product to get rid of a threat that Smart UAC Replacement found on the user’s computer.

The question remains, would you install Smart UAC Replacement?

The advantage of this solution is that you can disable the User Account Control for selected applications. This is for instance useful if you use an application day in day out getting that irritating UAC popup whenever you start it. The following process has to be done only once but it takes some time, here are the steps:

1)Download and install the Application Compatibility Toolkit

2) In the Start menu, locate the new folder. Find the shortcut icon for Compatibility Administrator. Right click it and clik Run as administrator.

3) In the left hand pane, right-click on the database under Custom Databases and select Create New, and select Application Fix.

4) Enter the name and other details of the application you want to alter behavior on and then browse to it to select it. Click Next.

5) Click Next until you are in the Compatibility Fixes screen.

6) On the Compatibility Fixes screen, find the item RunAsInvoker, and check it.

7) Click Next and then Finish.

8) Select File and Save As. Save the file as a filename.SDB type file in a directory you will easily find it.

9) Copy the .sdb file to the Vista computer you want to alter the elevation prompt behavior on.

10) Click Start>All Programs>Accessories. Right click Command Prompt and click Run as administrator.

11) Run the command below:

sdbinst \.sdb

For example, if you saved the .SDB file as abc.sdb in the c:\Windows folder, the command should be like this:

sdbinst c:\windows\abc.sdb

It should prompt: Installation of complete.

Most Windows Vista users get really annoyed after a short while because those UAC popups open many times during a normal session. The only way so far to get rid of UAC was to disable it completely. While this got rid of the UAC popups it did also turn the security feature of completely. Not a big problem for users who know what they can and what they can’t do with their system but surely a problem for inexperienced users.

Tweak UAC is a small software that offers a third possibility. With it you can enable the Quiet Mode for UAC which leaves UAC on for all users but suppresses the UAC popups that pop up rather frequently.

This means that the benefits of UAC such as running programs like Internet Explorer in protected mode will still be available while the annoying UAC popups are removed.

Tweak UAC does not need to be installed on your PC. Just run it and select ‘Leave UAC operating in the Quiet Mode’ when the option appears.

Read More:

Tweak UAC Homepage
via ThinkTechno