Vista Banter - View Single Post - can a key logger program steal admin password when you install program from limited user account

permalink

In article , dave-
says...

.........

Keyloggers can run as a limited user but will only be able to intercept
activity that happens within that user's context and won't see what
happens in other contexts, including UAC elevated applications.

Short answer:

It should not be able to. The elevation prompt is not in your limited
user account, but in the "secure desktop" instead (like your logon
desktop). The system takes a snapshot of your current desktop, darkens
it, and switches to the secure desktop and displays it there - and then
displays the credentials prompt.

Don't forget the number of folks who set UAC to not use a secure
desktop, these people may not even have this level of protection.

Sofisticated malware can abuse
security vulnerabilities of various software, including OS,
related to privilege escalation.

All OSs, not limited to Windows, and many of applications
publish often, or time by time security patches,
addressing privilege escalation threat.

Some of them are publicly known among hackers for longer time
before getting fixed.

--
Poutnik