Security Incidents: RE: IE Malware / Spyware Control Methods

["Orlando Richards" <orlando.richards () ed ac uk>]

> Meta question: does anyone know if [and if so, how] to use 
> the security 
> auditing machinery to figure out what a program needs?  The usual 
> situation is that you install a program [runas/admin] and 
> then you try to 
> run it from your limited account and it just won't run...  I 
> have this 
> feeling that I should be able to turn on some sort of event 
> logging or 
> some such in XP and then just go to a log to see what the 
> program tried 
> to do that it was denied access to, but I haven't been able 
> to figure out 
> how to do it...
FileMon and RegMon from sysinternals usually do the trick.

http://www.sysinternals.com/ntw2k/utilities.shtml

--
Orlando.