I was playing with Vista's WRP last night and found that it does not completely protect many system files that you would expect it to protect. Win ME's System File Protection and 2000 and XP's Windows File Protection protected about 99% of the files that were installed or upgraded by Windows. Delete, modify, or rename one of the protected files and the file would come right back. SFP and WFP didn't always restor I was playing with Vista’s WRP last night and found that it does not completely protect many system files that you would expect it to protect. Win ME’s System File Protection and 2000 and XP’s Windows File Protection protected about 99% of the files that were installed or upgraded by Windows. Delete, modify, or rename one of the protected files and the file would come right back. SFP and WFP didn’t always restore the file with the correct permissions (it restored the parent permissions), but it indirectly stopped computer viruses from infecting most Windows system files. It stopped hoax virus victims from deleting protected files, and it even helped out last month when one of the popular antivirus programs was going around deleting legitimate Windows files accidentally. Sadly, on my initial review it appears that WRP isn’t nearly as protective as WFP. I looked forward to WRP because it protects registry keys too, and prevents protected files from being modified in the first place. SFP and WFP allowed the modification, but then undid it.I demo’d this recovery behavior in WFP all the time in classes and presentations. I’d delete wscript.exe, wait a few seconds, and then watch it “magically” re-appear. Classes and audiences loved it. Linux didn’t have that. In Vista, it’s much harder to delete a system file because of WFP and because all files are owned by the TrustedInstaller service by default. But if you are an Admin-level person, and Take Ownership of a file, add the appropriate ACE, then you can modify, rename, or delete protected resources. In Vista last night, I took ownership of wscript.exe and then deleted it. Then I waited for it to re-appear. It never did. My friend Jesper Johansson told me that only Windows system files involved in the start-up are stored in the cache and replaced automatically. And he’s right. Here’s a list of what WRP protects.In checking WindowsWinsxsbackup, I found nearly 2000 files (long names, but the file names they represent are in the longer file name). You’d be surprised as to what is and isn’t covered. In WFP, if a protected file wasn’t in the cache, the system would normally prompt you for an installation CD. In WRP, if the file isn’t in the backup cache (and you can’t modify or add to what’s in the backup cache), you’re out of luck.I’m perplexed. In Vista we have a potentially better mechanism, that prevents modifications and protects registry keys, but it doesn’t replace all modified or deleted system files? What is Windows Resource Protection when it doesn’t fully protect a significant amount of Windows system files?Yes, it takes a lot to mess with a System file in the first place, but I can see a virus, worm or bot automating what I did manually. Or an updated hoax virus warning with ” removal instructions”. Ah, I’m just upset that a good demo is gone using a file I didn’t mind losing if it didn’t work in the first place. Related content analysis The 5 types of cyber attack you're most likely to face Don't be distracted by the exploit of the week. Invest your time and money defending against the threats you're apt to confront By Roger Grimes Aug 21, 2017 7 mins Phishing Malware Social Engineering analysis 'Jump boxes' and SAWs improve security, if you set them up right Organizations consistently and reliably using one or both of these approaches have far less risk than those that do not. By Roger Grimes Jul 26, 2017 13 mins Authentication Access Control Data and Information Security analysis Attention, 'red team' hackers: Stay on target You hire elite hackers to break your defenses and expose vulnerabilities -- not to be distracted by the pursuit of obscure flaws By Roger Grimes Dec 08, 2015 4 mins Hacking Data and Information Security Network Security analysis 4 do's and don'ts for safer holiday computing It's the season for scams, hacks, and malware attacks. But contrary to what you've heard, you can avoid being a victim pretty easily By Roger Grimes Dec 01, 2015 4 mins Phishing Malware Patch Management Software Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe