&gt; Well, KeePass.exe is signed, which prevents the malware replacing&#x2F;modifying the exe<p>Windows doesn&#x27;t require executable to be signed, strip the signature from the PE file and unless the user verifies it they&#x27;re still dead in the water. Not good enough? Okay, install a new certificate for code signing the patched PE file and sign it yourself.<p>As for user isolation, it&#x27;s a great idea but you could take advantage of this isolation with the filesystem method too simply by making the files only readable by an administrator and running a text editor or search tool as an admin so I&#x27;d still say this is not an advantage over the encrypted disk image method.<p>EDIT: Cleaned up.