Obtaining a list of all programs that are run with elevated privileges

[sojkovec]

Anybody has any idea, how to obtain a complete list of EXEs that have the setting "run as an administrator" enabled? Obviously checking them manually one by one isn't a solution. Just point me in general direction (registry path, group policies, file attribute...). I'm stuck. Thanks.

 

[LMiller7]

Welcome to the forum.

Most executable files, including exe, cpl, msc, and more, will have this option. The context menu provides the option based on the file extension. This includes old DOS executables that predate UAC.

 

[sojkovec]

Thank you, I know that. But the setting does not modify the binary itself. It has to be saved somewhere and by that I do not mean a tick box in GUI, I mean where this mark is physically saved, e.g. some registry key, or within NTFS itself (like compression and/or encryption, etc.). That is what I need to know and am unable to google out.

 

[sojkovec]

I decribe my problem more generally: I have a Win7 PC to fix, which after malware infection remains in a state when various executables have "elevated rights" option enabled. Randomly over all hard drive. That causes UAC prompt to pop up, when running Word, for example. I will not resort to turning UAC off because of security, nor can't I let it in this state either, for same reason. Manually unticking them all one-by-one would inflame my index finger.. So I am looking for some easy way, short of complete reinstall (which is not needed, PC is clean and runs fine, except for this).

 

[sojkovec]

So, I have found it! How could I miss it? For info, it's here:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

for current user

and

HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

for all users. You can close this thread.

 

[Layback Bear]

Just a thought.

You might consider a Clean Install again. Any infection that has changed that many permission settings can be lingering in your system.

I know you posted your system is clean. I personally would not take the chance.
I would also change all passwords to everything. (Banking, credit cards ect.) With all those permissions changed, your passwords may already be gathered.

I would change the passwords using another known clean computer.