Title: Prevent Windows XP running programs except for selected ones
Tags: windows-xp;anti-virus;windows-registry;file-association
Question: Came accross a client with a badly virus infected computer.
One virus prevented the running of all programs except for those that the virus choose to allow.
Googling showed me how this might be done in respect of .exe programs but this virus also prevented .com programs running.
Strictly speaking I don't want to be able to do this myself, however I do want to know how it might be achieved and thereby how to this undesirable effect.
I assume that the trick will involve registry changes and therefore it might be possible to undo it by using regedit to work on the hard disk removed and attached to a correctly functioning PC. Would open the necessary file using open hive commands.
Any ideas?
Forgot to mention that the version of windows being run is Windows Home. It seems that the professional version is needed to run the group policy management console. Or can this be achieved indirectly via the registry anyway and if so how?
Comment: How exactly did this prevention manifest? Did you get an error when double-clicking? When starting it in cmd.exe? When passing it to CreateProcess?

Comment: When attempting to run a .exe or .com file not on the list a dialog was presented asking what to open the program file with and suggesting that it could be opened with Notepad etc..
Odd dialogs also came up during start-up suggesting that exe and dll files could not be located.


Here is another answer: The virus probably used "software restriction policies": http://technet.microsoft.com/en-us/library/bb457006.aspx

Here is another answer: The Software Restriction Policies are a way to achieve this: you can define a policy which allows certain programs and disallows others; this is probably the simplest way.
You could also try hooking into the API functions - to put this simply, every time a program wants to do something, this request goes through your "hook" or handling program first. This is the way many viruses work. Read API Hooking Revealed for an introduction, or google hook CreateProcess (CreateProcess is the Windows API function used for starting programs) and go from there.

{'source': 'StackExchangeDataset', 'subset': 'superuser.com', 'metadata': {'AnswerCount': 2, 'CommentCount': 2, 'ContentLicense': 'CC BY-SA 2.5', 'CreationDate': '2009:00:09/09/09', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<windows-xp><anti-virus><windows-registry><file-association>', 'Title': 'Prevent Windows XP running programs except for selected ones', 'ViewCount': 607, 'id': 40828, 'user_AboutMe': None, 'user_AccountId': None, 'user_DisplayName': None, 'user_Reputation': None, 'user_Views': None, 'user_id': None}}