You can't really blame Microsoft, but given that about 95% of existing software craps out in some way on Vista without elevated privileges, the average Vista user is getting so desensitized by the UAC prompt that it is pretty much useless already. Where I think we can point the finger at Microsoft, is the fact that you can just click on "continue", whereas on Mac and Linux platforms, privilege elevation usually requires entering a password. Were Microsoft to make UAC _more_ intrusive, the backlash against software vendors would probably more motivating to fix their crap. The simple fact of the matter is, that most (not all by any means) software that refuses to run as a non-privileged user would be a cinch to fix, if the developers actually paid a little attention to setting permissions on required registry keys and files properly.

What actually makes me grin with sick fascination, is that when you combine all factors is that Vista ends up being just as vulnerable to malware infections as any other Windows OS. In fact, in my personal experience is that the "increased security" in Windows Vista often makes it more difficult to remedy such infections, as well as the fact as that some malware breaks the OS in ways that the authors never intended, increasing the fun...

This just in: users are stupid.

UAC can't protect against social engineering, nor should it be expected to.

ms should make the next version of windows completely unusable, that way users will never have problems.

UAC gives you information about the program including publisher and digitial signature information, which would have changed for malware. So long as you read the UAC prompt and check, you're fine.

That's why people need to run themselves as non-administrators and the programmers need to get with the program and learn how to code without needing any elevated privileges. I think this will come with time, but I'll all for an accelerated development.

out of curiousity would this exploit be possible in linux or os x?

While it is an interesting vulnerability, I agree with Microsoft's response... it is not possible to account for every scenario such as when a user, deliberately or otherwise, downloads and executes malware.

Is this humor? It starts with a user downloading the trojan.... It would have been funnier if it said "INITIALLY the user gives away his or her credit card number.... or password... or bank account number....."