How did Kaspersky replicate UAC overlay on Windows XP? Here is the screenshot to what I relate to,

Vbox screenshot

Upon encountering the overlay,

  • If you click outside the "attention" Window, system will beep and flicker the "Attention" window

  • All shortcuts, such as "Win+R", "Ctrl+Shift+Esc" or "Ctrl+Q" are disabled

  • (seemingly) the system won't process on doing anything until you "Continue" or "Cancel"

Here is how to replicate the behaviour,

  1. Get a Windows XP VM

  2. Download Kaspersky suite compatible with XP. I worked on the following version, download

  3. Install the app onto XP VM.

  4. [Possibly optional] After installation, request a trial licence

  5. Go to Settings (bottom-right corner) -> General (first tab) -> Protection - Untick . You should get the same Windows as in the screenshot

  • 1
    Hi and welcome to RE.SE. SuRun is an open source application for a wide range of Windows versions and it does something similar. So you could inspect its source. It opens its settings dialog (or the prompt for credentials) on a separate desktop. This is meant to prevent other entities (such as certain window hooks) from having an effect. It's similar to the SAS desktop. But this doesn't appear to be about reverse engineering, does it?
    – 0xC0000022L
    Dec 20, 2019 at 9:15
  • @0xC0000022L misread your message initially, thanks for the heads-up
    – TAbdiukov
    Dec 21, 2019 at 8:07

1 Answer 1


Sounds like you want to reproduce a system modal dialog box on a more modern Windows OS. It looks like someone took the steps to reproduce this behavior as closely as possible. Not sure about keyboard accelerators, etc though.


Not the answer you're looking for? Browse other questions tagged or ask your own question.