User rights assignment

Source
Concepts
Take ownership of files or other objects
Restore files and directories
Ownership

Take ownership of a file or folder

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

1. Open Windows Explorer, and then locate the file or folder you want to take ownership of.
   
2. Right-click the file or folder, click Properties, and then click the Security tab.
   
3. Click Advanced, and then click the Owner tab.
   
4. In the Change owner to box, do one of the following:
   
   
   • To change the owner to a user or group that is not listed, double-click Other users and groups and, in Enter the object name to select (examples), type the name of the user or group, and then click OK.
     
   • To change the owner to a user or group that is listed, click the new owner.
     
5. (Optional) To change the owner of all subcontainers and objects within the tree, select the Replace owner on subcontainers and objects check box.

==================================

• Access this computer from the network
  
  
• Act as part of the operating system
  
  
• Add workstations to domain
  
  
• Adjust memory quotas for a process
  
  
• Allow log on locally
  
  
• Allow log on through Terminal Services
  
  
• Back up files and directories
  
  
• Bypass traverse checking
  
  
• Change the system time
  
  
• Create a pagefile
  
  
• Create a token object
  
  
• Create global objects
  
  
• Create permanent shared objects
  
  
• Debug programs
  
  
• Deny access to this computer from the network
  
  
• Deny log on as a batch job
  
  
• Deny log on as a service
  
  
• Deny log on locally
  
  
• Deny log on through Terminal Services
  
  
• Enable computer and user accounts to be trusted for delegation
  
  
• Force shutdown from a remote system
  
  
• Generate security audits
  
  
• Impersonate a client after authentication
  
  
• Increase scheduling priority
  
  
• Load and unload device drivers
  
  
• Lock pages in memory
  
  
• Log on as a batch job
  
  
• Log on as a service
  
  
• Manage auditing and security log
  
  
• Modify firmware environment values
  
  
• Perform volume maintenance tasks
  
  
• Profile single process
  
  
• Profile system performance
  
  
• Remove computer from docking station
  
  
• Replace a process level token
  
  
• Restore files and directories
  
  
• Shut down the system
  
  
• Synchronize directory service data
  
  
• Take ownership of files or other objects

The command prompt has been disabled by your administrator

Press any key to continue . . . 

Source 

Start Menu - Run

then copy and paste either of the following lines:
rundll32 setupapi,InstallHinfSection DefaultInstall 128 %systemdrive%\SDFix\apps\Enable_Command_Prompt.inf
or
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg

If SDFix is unable to add its run key and does not load after reboot following its run in Safe Mode Run SDFix in either Mode and type F then press Enter for it to finish the final stage and produce the report

If the PC has been infected with the VirusAlert! malware and the Start Menu icons or drives are not visible Right click either the XP or W2K VirusAlert_Repair.inf (depending on the version of Windows) which are inside the SDFix folder and choose Install to restore the default settings, SDFix should then be run to remove the malware and VirusAlert! warning from the clock and product Id,

Both Inf files can also be downloaded below Windows 2000 - VirusAlert_Repair.inf

Windows XP - VirusAlert_Repair.inf
If the PC cannot boot in to Safe Mode as the SafeBoot registry key is either missing or damaged
Goto Start Menu > Run > then copy and paste one of the following lines to restore the default SafeBoot entries
Windows XP (SP2):
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Restore_SafeBoot_WindowsXP_SP2.reg
Windows XP (SP3):
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Restore_SafeBoot_WindowsXP_SP3.reg
Windows 2000 (SP4):
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Restore_SafeBoot_Windows2000_SP4.reg
If the Command Prompt window flashes on then off again on XP or Windows2000
Goto Start Menu > Run > then copy and paste the following line:
%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe

Click OK, then type Y and press Enter when prompted, Reboot and start SDFix againIf SDFix still doesnt run check the %comspec% variable

Goto Start Menu > Right click My Computer > click properties > click Advanced
Click Environment Variables and check that the ComSpec variable points to cmd.exe
%SystemRoot%\system32\cmd.exe
SDFix uses ERUNT to create a registry backup which can be restored using Start > Run:
%SystemRoot%\ERUNT\SDFix\ERDNT.EXE

Administrador sin editor del registro y sin administrador de tareas

Fuente (modificado y agregado)
Win32.Sality.aa 
AVG Free Malware Removal Tools

Básicamente se propaga infectando otros archivos, normalmente ejecutables, y que permite además a otro usuario acceder de forma no autorizada al ordenador infectado.
estas extenciones son las que contamina este bicho(.EXE, .SCR, .DLL).
El virus intenta desactivar procesos y servicios que contienen cadenas correspondientes a los principales antivirus.
El virus se conecta a diferentes direcciones para descargar otro software maliciosos, y el software que descargan de esas direcciones se desencripta en la carpeta temporal de Windows (%temp%) y se ejecuta.
Método de Propagación
Se copia a sí mismo en las unidades extraíbles y carpetas compartidas
(nombre aleatorio).exe
(nombre aleatorio).pif
(nombre aleatorio).cmd
Crea un fichero AUTORUN.INF en cada unidad extraible en la que se copien los ficheros, de forma que al acceder a ella, se ejecute una copia del virus.
Para solucionar el problema:
1) Desactivar temporalmente la Restauración del Sistema antes de eliminar el virus por otros medios, ya que podría haberse creado una copia de seguridad del virus.
2) Reinicie su ordenador en Modo Seguro o Modo a Prueba de Fallos.
3) Con un antivirus actualizado, localizar todas las copias del virus en el disco duro de su PC. Personalmente uso el KASPERSKY INTERNET SECURITY 2009, ya que otros antivirus no me dieron resultados.
Nota: A veces los antivirus informan de que 'no puede reparar un fichero' en el caso de gusanos o troyanos debido a que no hay nada que reparar, simplemente hay que borrar el fichero.
4)Si no se puede reparar la infección o borrar los ficheros, puede ser debido a que el fichero está en uso por estar el virus en ejecución (residente en memoria).
En el caso de que no se pueda eliminar el fichero del virus, tenes que terminar manualmente el proceso en ejecución del virus.Usando el administrador de tares. A continuación volver a intentar el borrado o reparación de los ficheros que se han creado por la acción del virus.
5) Debido a que el gusano deshabilita el acceso al editor del registro y al administrador de tareas, ejecuten los siguientes pasos para volver a habilitarlos:

Inicio - Ejecutar
cmd (elevated command en caso de Windows Vista y Windows 7)

Enter

Escribir las siguientes instrucciones:
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /f

O usar: 

• Remove Restrictions Tools
  
  To download Sergiwa Antiviral Toolkit click here
• regtools.vbs (Win 9X) Disable/Enable Registry Editing tools in Windows
    © Doug Knox - rev 01/10/2000
  This code may be freely distributed/modified.
  Usage: Download regtools.vbs Save the file to the folder of your choice. Double click the VBS file. The VB Script file will check for the appropriate value and if not found will create it. If the value was found, it will be toggled to its opposite state and you will be informed that you need to log off/back on or restart your computer. 
  Note: This change is made in
  HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
  Disabling the tools takes effect immediately. Enabling requires a restart. 
  This script can be viewed in Notepad or any text editor, as to the specific Registry key and value that are updated.
  Your antivirus software may report this script as potentially malicious, or a possible virus.
  This is because the script writes to the System Registry.
  This page last updated 11/25/2005

 A continuación hay que editar el registro para deshacer los cambios realizados por el virus. Hay que ser extremadamente cuidadoso al manipular el registro. Si modificas ciertas claves de manera incorrecta puede dejar el sistema inutilizable.

Eliminae las siguientes entradas del registro:
Clave: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Valor: GlobalUserOffline = 6684751
Clave: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system
Valor: EnableLUA = 6422625 (Desactiva el control de usuario en Windows Vista)
Clave: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\ StandardProfile\AuthorizedApplications\List
Valor: (Ruta del virus) = (ruta del virus):*:Enabled:ipsec
Clave: HKCU\Software\user914\1214104697
Valor: 1919251317 = 3276857
Clave: HKCU\Software\user914\1214104697
Valor: -456464662 = 3407926
Clave: HKCU\Software\user914\1214104697
Valor: 1462786655 = 3604530
Clave: HKCU\Software\user914\1214104697
Valor: -912929324 = 3735602
Clave: HKCU\Software\user914\1214104697
Valor: 1006321993 = 3342390
Clave: HKCU\Software\user914\1214104697
Valor: -1369393986=0600687474703A2F2F7777772E6D7573696B72616A742E736B2F6D61696
E662E67696600687474703A2F2F6D616365646F6E69612E6D79312E7275
2F6D61696E682E67696600687474703A2F2F6A7273782E6A7265
2E6E65742E636E2F6C6F676F732E67696600687474
Clave: HKCU\Software\user914\1214104697
Valor: 549857331 = 865E52A75BF33F5D5AA15DAFA722193EDDA8540E6C496C04CF49
2EF296AFD1AFD
EDBC79CEA25E0F6F53B2D9CC0FA963F3A4CC7456
15E85AFE1E18AEA7E620D11174F3892E84
B5B5DD288784938E304B2D65C454E833D6AF929
809110987E5B4B3E4D581071DA4948CB9F84
Clave: HKCU\Software\user914
Valor: u1_0 = 655360
Clave: HKCU\Software\user914
Valor: u2_0 = 655360
Clave: HKCU\Software\user914
Valor: u3_0 = 655360
Clave: HKCU\Software\user914
Valor: u4_0 = 655360
Clave: HKLM\Software\Microsoft\Tracing\FWCFG
Valor: EnableFileTracing = 7471188
Clave: HKLM\Software\Microsoft\Tracing\FWCFG
Valor: EnableConsoleTracing = 7471188
Clave: HKLM\Software\Microsoft\Tracing\FWCFG
Valor: FileTracingMask = 7209065
Clave: HKLM\Software\Microsoft\Tracing\FWCFG
Valor: ConsoleTracingMask = 7209065
Clave: HKLM\Software\Microsoft\Tracing\FWCFG
Valor: MaxFileSize = 7077993
Clave: HKLM\Software\Microsoft\Tracing\FWCFG
Valor: FileDirectory = %windir%\tracing
Clave: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
Valor: EnableFirewall = 7471209
Clave: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
Valor: DoNotAllowExceptions = 7340133
Clave: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Valor: Hidden = 4718592
Clave: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
Valor: DisableTaskMgr = 6357076
Clave: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
Valor: DisableRegistryTools = 7929970
Clave: HKLM\SOFTWARE\Microsoft\Security Center
Valor: AntiVirusOverride = 6619254
Clave: HKLM\SOFTWARE\Microsoft\Security Center
Valor: AntiVirusDisableNotify = 5111909
Clave: HKLM\SOFTWARE\Microsoft\Security Center
Valor: FirewallDisableNotify = 5111909
Clave: HKLM\SOFTWARE\Microsoft\Security Center
Valor: FirewallOverride = 6619254
Clave: HKLM\SOFTWARE\Microsoft\Security Center
Valor: UpdatesDisableNotify = 5111909
Clave: HKLM\SOFTWARE\Microsoft\Security Center
Valor: UacDisableNotify = 5111909
Clave: HKLM\SOFTWARE\Microsoft\Security Center\Svc
Valor: AntiVirusOverride = 6619254
Clave: HKLM\SOFTWARE\Microsoft\Security Center\Svc
Valor: AntiVirusDisableNotify = 5111909
Clave: HKLM\SOFTWARE\Microsoft\Security Center\Svc
Valor: FirewallDisableNotify = 5111909
Clave: HKLM\SOFTWARE\Microsoft\Security Center\Svc
Valor: FirewallOverride = 6619254
Clave: HKLM\SOFTWARE\Microsoft\Security Center\Svc
Valor: UpdatesDisableNotify = 5111909
Clave: HKLM\SOFTWARE\Microsoft\Security Center\Svc
Valor: UacDisableNotify = 5111909

6) Eliminar todos los archivos temporales del ordenador, incluidos los archivos temporales del navegador, vacíe también la Papelera de reciclaje.
7) Reiniciar el sistema y explorar todo el disco duro con un antivirus para asegurarse de la eliminación del virus. Si desactivaste la restauración del sistema, recordá de volver a activarla. Creá un punto de restauración, te será útil para recurrir a él en caso de posibles infecciones o problemas en el futuro.

DropMyRights

Source

If you are running Windows XP, you should install the free
DropMyRights program. Hopefully this posting will convince you of this.
DropMyRights is a free program that greatly increases the security of Windows XP and has not gotten the attention that I think it deserves. Everyone running Windows XP should use it. Yes, everyone.
Windows, Macs and Linux all support the concept of restricted and unrestricted users. Restricted users are limited in the changes they can make to the system, perhaps the biggest restriction being on installing software. Windows unrestricted users are called Administrators, with Macs and Linux the sole unrestricted user is called root.
A big reason that Macs and Linux are safer than Windows is that running as a restricted user is the norm. Trying to run Windows while logged on as a restricted user comes with a host of problems, so the reality is that almost everyone runs their Windows XP computer as an unrestricted (Administrator) user. This is a shame, because it meansthat malicious software can be surreptitiously installed and once running, it can modify or delete critical Windows system files.
The way DropMyRights makes Windows more secure is by running selected programs in a restricted environment (i.e. with lower rights) even when logged on to Windows XP as an Administrator.
Think you don't need it? I'm being alarmist? You're protected by antivirus software, so why bother?
A Windows XP computer can be surprisingly vulnerable to malicious software, especially if you are not up to date on installing bug fixes/patches to both Windows and all your applications. (Soon I plan a posting about the Secunia Software Inspector that makes it easier to keep up to date on bug fixes for many popular applications.)

• Did you know that Windows can get infected just by viewing a Web page? It can.
• The old rule about not opening e-mail attachments is not sufficient
  anymore. Simply reading an e-mail message can infect Windows.
• There have been instances where simply viewing a picture could have installed malicious software.

And, you're not safe if all you do is visit "good" Web sites.
Reputable sites get compromised by the bad guys in an attempt to install malicious software on your computer. The Web site owner might not realize this has happened for quite a while, if ever. There is no longer a good neighborhood on the Web that you can safely browse around in.
While you're safer with antivirus and antispyware programs installed, no one application catches everything (no two applications either). Got a firewall? Great, but the problems discussed here are not ones that a firewall can protect you from.
At the risk of repeating myself, everyone running Windows XP should use DropMyRights.

[More at the source]