Prevent Windows XP running programs except for selected ones

Question

Came accross a client with a badly virus infected computer.

One virus prevented the running of all programs except for those that the virus choose to allow.

Googling showed me how this might be done in respect of .exe programs but this virus also prevented .com programs running.

Strictly speaking I don't want to be able to do this myself, however I do want to know how it might be achieved and thereby how to this undesirable effect.

I assume that the trick will involve registry changes and therefore it might be possible to undo it by using regedit to work on the hard disk removed and attached to a correctly functioning PC. Would open the necessary file using open hive commands.

Any ideas?

Forgot to mention that the version of windows being run is Windows Home. It seems that the professional version is needed to run the group policy management console. Or can this be achieved indirectly via the registry anyway and if so how?

Answer 1

The Software Restriction Policies are a way to achieve this: you can define a policy which allows certain programs and disallows others; this is probably the simplest way.

You could also try hooking into the API functions - to put this simply, every time a program wants to do something, this request goes through your "hook" or handling program first. This is the way many viruses work. Read API Hooking Revealed for an introduction, or google hook CreateProcess (CreateProcess is the Windows API function used for starting programs) and go from there.

Answer 2

The virus probably used "software restriction policies": http://technet.microsoft.com/en-us/library/bb457006.aspx