“It’s a best effort to raise the bar and stop malware from making changes to the operating system but it’s not a security boundary,” Russinovich said of UAC, the oft-criticized mechanism that requires that all users run without full admin rights.
If I was a mischievous hacker, I’d much appreciate Mark for his hard work of giving direct examples of how people could trick others into allowing their computers to be hi-jacked. That aside, Vista is not invulnerable. The only OS that could be would have no functionality.
Source: ZD Net Blogs