Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I realize that virus-proof on a Windows PC is far fetched, but in the interest of keeping time spent as the "family-tech-support" to a minimum, I am looking for ideas to lock a computer down to the point that it is very hard to collect ad-ware/spyware, malware, or viruses.

Assume the user is my mom, who rarely, if ever, needs administrator access and mostly uses the computer for MS Office and web browsing.

share|improve this question

closed as not constructive by random Aug 26 '12 at 16:48

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

35  
Encase it in lead ;) –  DisgruntledGoat Jul 29 '09 at 10:56
21  
I was thinking Kevlar! –  Pauk Jul 30 '09 at 15:00
34  
Unplug the Internet connection. –  Scott Jul 30 '09 at 15:23
28  
Unplug the power cable. –  zildjohn01 Aug 19 '09 at 2:34
4  
Switch to Ubuntu –  Aki Nov 4 '10 at 14:26
show 6 more comments

24 Answers

up vote 80 down vote accepted

Probably the best advice I've ever heard on the topic is: Stop running as an administrator.

share|improve this answer
1  
This is the easiest and fastest way. RANU. –  Will Jul 28 '09 at 14:17
25  
Easiest? On Windows XP? You must be joking. (I once tried that.) –  grawity Jul 28 '09 at 15:35
1  
@grawity: umm, try harder? :] Ok, sorry. Bad joke, just couldn't resist ;) Yes it is not as easy as it sounds, and requires some tweaking. But, imho, it has the greatest impact that only maybe hiding behind NAT and firewall may come close to. –  Slink84 Jul 28 '09 at 15:51
5  
I disagree. I've tried it, but a lot of windows programs are poorly coded, and asume you've got the default windows with the default everything. I also tried moving the "my documents" folders to another drive, and some programs just wrote on C: ... –  Manu Aug 9 '09 at 22:04
4  
It used to be a real problem to run without admin rights however since the annoying UAC prompt in vista a lot of the big companies have reengineered their software to not need admin rights so often. If you haven't tried it for a couple of years it might be time to try again. –  Col Aug 25 '09 at 12:54
show 5 more comments

I don't like just providing links as answers but have a look at this comprehensive lock down guide.

Windows XP Professional Configuration Checklist Details

  • Verify that all disk partitions are formatted with NTFS
  • Protect file shares
  • Use Internet Connection Sharing for shared Internet connections
  • Enable Internet Connection Firewall
  • Make sure windows update runs regularly
  • Use software restriction policies
  • Use account passwords
  • Disable unnecessary services
  • Disable or delete unnecessary accounts
  • Make sure the Guest account is disabled
  • Set stronger password policies
  • Set account lockout policy
  • Install anti-virus software and updates
  • Keep up-to-date on the latest security updates
  • Do not run with administrator privileges by default
  • Don't use WEP for wireless networks
share|improve this answer
7  
nsa.gov/ia/guidance/security_configuration_guides/… Has a host of guides on locking down different operating systems. –  Kenneth Cochran Jul 28 '09 at 14:06
2  
Need to add "run as standard user" or "do not run with administrator privileges by default" –  Joel Coehoorn Jul 28 '09 at 14:51
1  
That list has problems for home users... ICS behind most home routers leads to double NATing. SRP is pretty administration heavy (I believe it's better in win7). Also, not having an account password helps the account not be remotely accessable. –  Ari Pernick Jul 28 '09 at 15:20
show 4 more comments

Besides teaching her to avoid installing silly things, I don't really see a way.

Of course, have the system updated and with an anti-virus (eventually a firewall).

But in general, if you want to avoid "family-tech-support", there is no real way. Because if you start adding things to block content, block what she can do, you won't be called for the "tech-support", but for the "why can't I do that ?".

share|improve this answer
show 1 more comment

Here is another one. Maybe it's not exactly what you want, but it takes less time and effort.

Have you considered virtualization? Just let her trash that system, and restore from a snapshot when it is no longer usable. Quick and clean.

And hope she will eventually learn. Or stop trying to learn, 'cause it's easier... It depends on the person, I suppose :)

share|improve this answer
14  
Where did all my grandkids pictures go? –  Will Jul 28 '09 at 14:18
1  
@Will: Yessss, grandkids pictures... :] Well, I can tell about VMWare: you can set up a shared folder with the hosting OS where you can drop of all of the user files. You can do it after it is screwed up to backup all user data, or before to let user save his data there. Plus, you can do snapshots often. So there will always be some state saved with all files intact. –  Slink84 Jul 28 '09 at 14:26
show 1 more comment

It won't make it bulletproof, but makes it recovery foolproof.

Check out Windows SteadyState, it's free, it's designed for that type of application.

share|improve this answer
1  
Too bad it was discontinued! –  Mauricio Scheffer Apr 30 '11 at 19:02
show 4 more comments

Might want to consider reboot-to-restore softwares such Deep Freeze or Windows SteadyState and create another partition to store data only. So when problems crop up, just reboot the PC.

share|improve this answer
add comment

Here is what I usually do before turning a computer back in to someone who gave it to me to clear up spyware, etc:

  • Change account type to Limited; Create new Admin account if necessary
  • Install Firefox + Adblock Plus; Make default browser
  • Install Spybot Search & Destroy with schedules and realtime protection
  • Update Windows completely
  • Set automatic download and install for Windows updates

On the other hand, you could just install something like DeepFreeze which will revert the OS back the state it was when you installed it on each restart (not free, though).

Edit: As Keck pointed out in his answer, Microsoft has a free alternative to DeepFreeze called Windows SteadyState.

share|improve this answer
show 1 more comment

In general,

  • Run as a standard user (Not Admin)
  • Run Vista or higher
  • Leave UAC on
  • Run 64bit (more protections in 64 bit)
  • Set automatic update
  • Run a web browser that supports sandboxing (currently IE7/8 or Chrome).
share|improve this answer
4  
@NoCarrier, two reasons leap to mind. First, the 64-bit kernel requires that all device drivers be signed so it is much harder to inject hostile code into the kernel itself. Second, at the moment, there are fewer x64 machines out there, so there are fewer attacks against them in the wild. As more systems go 64-bit, the dynamics will change... –  RBerteig Jul 28 '09 at 23:15
show 2 more comments
  1. change her password, and don't tell her what it is
  2. unplug the machine from the internet
  3. unplug the machine from the wall
  4. change your phone number to an unlisted number
  5. put a GeekSquad sticker on her monitor

Seriously, if you lock the machine down for protection, the main thing you can do is set Internet Explorer (or whatever) to run with high security, which means that none of her favorite web sites will work, which means that you're going to get even more family-tech-support calls than before ("why won't TexasHoldem.com work any more?").

The best solution for both of you is to get out of the family-tech-support business. Plead ignorance, charge them for your time, be too busy, tell them GeekSquad will do a better job, refer them to Dell Support, whatever it takes to get out of this trap.

And it is a trap. Sure, you want to help your mom, but how about your sister? cousins? your mom's friends whom she told how great you were at it? Unless you intend for this to become a sideline business, best to nip it in the bud.

share|improve this answer
4  
Friends don't let friends use GeekSquad. Oh wait. What you're doing is making her not a friend. –  Kevin M Jul 29 '09 at 15:33
1  
@[Kevin]: GeekSquad is a lot cheaper than I am –  Steven A. Lowe Jul 30 '09 at 14:57
add comment

Install Ubuntu :) It will silently update itself, it never breaks, Firefox is the same as in Windows, MS Office will work under Wine. I had really positive experience with it and really negative one with Windows XP in the same situation.

share|improve this answer
5  
I'm not so sure about that. If I was setting up a computer for an older family member with little to no computer skills, I would strongly consider a minimal Ubuntu or other Linux-type OS install with OpenOffice and a single browser (or just teach them to use Google Docs). For many, many people, a computer is 99.9% of the time a machine for running a browser (and 0.1% of the time a machine for playing solitaire - which can be played in a browser). Or make her buy a Mac. –  CMPalmer Aug 18 '09 at 16:10
1  
yes, firefox is the same everywhere. Non-techie people don't care that much how button they have to click to start it look. They don't really see the difference. And simple fact that there are no viruses and nothing can go wrong except hardware failure makes it so much easier to work with. –  vava Aug 19 '09 at 4:41
show 2 more comments

Install Opera and/or FireFox. Install NoScript in FireFox.

Make sure (with shortcuts, etc.) that Opera/FireFox is easier to start/find than Internet Explorer. Try to make Internet Explorer unsusable, like directing it to a non-existing proxy-server, etc.

Make Opera/FireFox the default browser.

The following makes use inconvenient, but the question was about security:

Block JavaScript for all sites (e.g. set in Preferences in Opera and using NoScript in FireFox), except for the ones you explicitly allow. Most of these will need to be set later by the (inexperienced) user. This is where it becomes inconvenient.

Allow JavaScript for some common sites, e.g. YouTube and Gmail. Test that it actually works.

share|improve this answer
2  
You'll probably get more calls running with NoScript than you would every 3-6 months when something bad happens. "Why doesn't [every internet site] work?" –  DavidWhitney Jul 30 '09 at 16:09
add comment

I get very grumpy when I see these questions, because too many people just want to change the computer, and not the user (when it's the user that causes the issues, invariably).

Consider: Almost every network has a NAT device in place between the LAN and the Internet. This stops random crap from just wandering in, so the overwhelming majority of machines are going to be just fine.

Only when the user is in place is it an issue. My solution: fix the user.

My list to keep your Mom's PC bulletproof:

  1. Educate her on computer security, and computer usage:

    • Don't teach her how to accomplish certain tasks ('click here, etc'). Teach her WHAT and WHY. Think about when you open a new program for the first time. Most computer literate people will have a good idea about how to use it straight up. This is because you understand WHAT you want to achieve, and WHY you want to achieve it. The HOW follows very quickly after, because you are familiar with the HOW from other programs. Ever swapped email clients? You'll know what I mean.
    • The golden rule: If you don't know, don't do it.
    • Secondary to the golden rule: Read what the error message is telling you, and think about what you have done to cause it - don't just throw up your arms and swear
    • Educate her that just because something is free, she doesn't have sign up for it, or try and install it.
  2. Install Google Chrome - Fast, lean browsing machine.

  3. Install your choice of free anti-virus. Something with a low amount of harassment is good.

  4. Ensure automatic updates are turned on, and that your mother knows how to deal with them. Accept them, install them, reboot the computer.

My parents ran a Windows XP machine for 4 years with no software firewall - running just Firefox and AVG. They were checking their email, doing online banking, playing some Guild Wars online, and they had no viruses. I've had plenty of challenges from random people who tried to find viruses on my computers, but they always just end up wasting their time.

share|improve this answer
16  
I agree that educating the user is ultimately the best thing to do, unfortunately it is not feasible in all situations. –  Andrew Garrison Jul 30 '09 at 16:20
4  
I'd disagree - the only time it's not feasible to educate someone is when they don't want to learn. –  EvilChookie Jul 30 '09 at 17:26
4  
knowledge > automation –  Paul Nathan Aug 13 '09 at 17:29
1  
As a counterpart to educating the user, maybe if the user refuses education, you should just take the computer away. We don't just let any random yahoo jump in a car and drive it, do we? ...oh wait. –  Jay R. Sep 18 '09 at 18:18
4  
In my experience, anything that pops up with an error message just provokes the "click to make it go away" reaction. Pending education, I'd still be looking at other solutions... –  Benjol Apr 27 '11 at 7:44
show 4 more comments

Well I would shy away from Norton - In my experience this just grinds the PC to a halt (McAfee isn't much better either!)

I have 4 computers in the house being used by myself, and the "kids" (14, 18 and 20) and I've installed the following;

  • AntiVirus: Avast Home Edtion (it's free and has trapped a number of suspect files)
  • Spyware: I've started to use SpyBot Search and Destroy which appears to work well (again, it's free)
  • AntiPorn: I'm using OpenDNS which is configured on the router and set up to block Porn, Adware, Gambling etc.
  • Firewall: If you're running a router then it should handle this for you but if not then ZoneAlarm is a good alternative to the Builtin Windows offering. Having said that, I've not had any problems with the Windows Firewall when dialled up via an ASDL Modem.
  • Permissions: Assuming you will be running a recent version of Windows then you can configure them as non-Admin users which will stop them poking around where they shouldn't.

At the end of the day I don't think there is a 100% foolproof solution to this one. My kids still manage to install toolbars and the like. If you lock the system down too far then it just becomes unusable.

share|improve this answer
4  
+1 for staying away from Norton/McAfee! –  fretje Aug 13 '09 at 15:20
show 3 more comments

Block obscene online material (they don't know that the Internet is for porn).

Your best bet may be Net Nanny or something similar. Here are reviews of the top Internet Filters

Prevent rogue installations of applications. Prevent them from unknowingly changing the security settings or uninstalling applications.

For these two the best thing might be to make yourself an administrator of the computer and have them log in as guest (or any non-admin login). Use admin settings to disallow installing applications or changing system settings.

Keeping the computer/anti-virus software up to date.

I'd install AVG antivirus and Zone Alarm firewall and activate their automatic updating features, along with AVGs automatic scanning.

For GP you may want to run a Flash-blocker or ad-blocker, they're both easy plug-ins for Firefox.

share|improve this answer
show 1 more comment

Install A-SquaredAntiMalware (paid) and make sure that it updates and scans automatically. Also set all "Surf Protection" settings to "Block Silently. Add MVP Hosts file, OpenDNS, and WinPatrol. Explain that if Scotty barks it's important and read it carefully. WinPatrol warnings are the only ones she'll get, and those very infrequently. Also explain that she will see a lot of 404's as her protection works for her- and that's a good thing.

This is the way I protect my 83-year old mother's Windows XP system, and she has had absolutely no malware issues at all.

share|improve this answer
add comment

Buy her a Mac, seriously all of my family have moved over to Apple Mac's and it's so much easier to fix (if anything ever goes wrong, which doesn't happen often).

Alternatively if she/you can't afford that install Ubuntu.

You can mark this answer as "not useful" but when it comes down to it Windows isn't meant for mum's or anyone who's incompetent with computers.

share|improve this answer
3  
+1 I did this as well a few years ago. Not only did it drop my tech support calls to ZERO (seriously!) my mom absolutely loves her iMac w/iTunes, FireFox, and Mail. –  Matt Rogish Aug 18 '09 at 17:05
3  
I tell my friends and family that I refuse to help them with their computer troubles unless they use Mac or Linux. They complain that Macs are expensive, but then I explain that it's an illusion because it's only true if they consider my time worthless. Now almost all of them use Macs except for my one kid sister who uses Ubuntu. And I have a lot more free time :-) –  KaptajnKold Apr 30 '11 at 10:46
show 1 more comment

Educate the users!

share|improve this answer
2  
Said already several times, but I guess always nice to repeat. –  Gnoupi Aug 18 '09 at 17:34
add comment

My choice as an old time Usenet hacker (white hat, software hacker, etc.)...

Windows XP:

1st drive or partition: install Windows and all needed stuff (you won't be able to touch it after, only the real administrator can do that) Security software is less needed. Remember OpenDNS!

2nd drive or partition: put my documents and a 2nd program files folder in it, portable applications and all files that you want to keep, like music, pictures, etc. (tell everyone that they have to save and install their stuff there because they lose all they have done if not done) > an installation is simple, you change the C for a D (the 2nd drive), C:/Program Files/. Also link My Documents folder to the one in the 2nd drive.

Now put Windows steady state at all settings, it will reset the computer as you installed it for the 1st drive only at each restart.

For Linux: Also note that the Linux idea is not all-wrong, it's also bulletproof! Ubuntu (Big up for Edubuntu - Ubuntu project for education for not very rich nations) is simple but she use her computer so little but SliTaz 2 a little modded (with help or by learning - it's worth it!) should be more than enough 30 Mo only for a Linux desktop that will be faster than any Windows version but you have a downside and OpenDNS work with it also.

The real deal: the family is ready if it has a real value: money, learning, help good projects, being part of a real team that really work for them or keep up with Microsoft that don't understand the need of peoples that slave them blocking their reals thoughts, that make a product that sometime miss more than win ... For me, it's why I gave Linux a chance. It's not perfect, but I have found some parts that I can live without now, mostly human, though.

My Linux passion came from people that work for the freedom of the knowledge like Didier Roche, a writer and secretary from the French Ubuntu team and the knopmyth developer so I wish luck to both of you, if you read me ... That's the real Linux life, even Linux stars are just like normal people and they will help you, like they have been helped by someone before. I want to be a part of this chain, that's all! The true beauty of the world is sharing!

share|improve this answer
add comment
  1. partition the hard disk.

  2. install Windows and all necessary programs.

  3. point user folders (desktop, documents, favorites, emails, etc.) to another partition.

  4. create a an image of the system drive (usually C:)

something goes wrong, you can restore the computer with a minimum effort to the state it should be in.

if you want to take it to the next level, try this:

  1. install a RAM disk (size depending on the requirements and available system memory).

  2. install Sandboxie and point the container folder to the RAM disk (drop rights if on an admin account) and add the desired download folders to 'Quick Recovery'

it's getting even better if you want to pay the little registration fee for Sandboxie (which allows you to install the software on any computer your own).

  1. now that you have Sandboxie registered, force the web browser to run inside a Sandbox all the time (if you're using a web browser that is mad for updates, disable auto update!)

alternatively you may consider DeepFreeze, even more efficient but possibly a bit too restrictive for Mum's taste. good luck and enjoy the time you have just saved from being the in-house tech support! :)

share|improve this answer
add comment

Running Windows as a limited user is definitely the best way to keep out malware. Limited user is preferable to anti-virus software and I haven't heard of a single browser vulnerability that was exploitable in limited user mode.

The problem with Windows limited user privilege is that runas works in a completely different user context -- the one that is used to supply the credentials to runas. This breaks down in all kinds of ways that Mom just isn't going to grok. Even getting Mom to understand how to enter runas commands in cmd.exe is going to twist her knickers.

Linux has the right answer and it comes in two parts: first is software repositories and the second is called "sudo" (insert xkcd comic here) which stands for "super user do". sudo runs in the current user context which tends to make things work right. There is a sudo for Windows that I like called surun.exe available from http://kay-bruns.de/download/surun.zip, but I'm not sure I recommend it for Mom unless you tweak it for her. But it does have the nice capability to let Windows Update or Microsoft Update run in limited user mode and it allows limited users to change power options and set the clock.

If you set Mom up in limited user mode, you need to create an Administrator account to use for installing and tweaking. I suggest you remote logon and do the heavy lifting for Mom, but check out surun.exe if only to allow AU and the other features it includes by default for limited users.

Another option is to have Mom run her browser in a sandbox, like sandboxie.exe. I can't recommend it, unless you want to prevent Mom from downloading and uploading personal stuff like photos and chain letter jokes. But if Mom doesn't do downloading and uploading, a sandbox is the best way to get limited privilege to apply to the most vulnerable application on Mom's machine.

share|improve this answer
add comment

Install Ubuntu and all your problems will be healed!

I've had Ubuntu on my netbook for quite some time and just re-installed XP on my parents.

They got a virus just a week into using it.

share|improve this answer
add comment

Try Sandboxie

Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

enter image description here

Benefits of the Isolated Sandbox

  • Secure Web Browsing: Running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded trivially.

  • Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't leak into Windows.

  • Secure E-mail: Viruses and other malicious software that might be hiding in your email can't break out of the sandbox and can't infect your real system.

  • Windows Stays Lean: Prevent wear-and-tear in Windows by installing software into an isolated sandbox.

share|improve this answer
add comment
  1. Check your local library (or bookstore) for computer security books (Dewey-Decimal section 005.8). Look specifically for books about “hardening Windows and networks”.
  2. Don’t connect her system directly to the Internet, connect it through a router. Even with the default settings, it will be much more secure than connecting it directly to the Internet.
  3. Give her a brief crash-course on using the system and the Internet.

enter image description here enter image description here enter image description here enter image description here

share|improve this answer
add comment

protected by studiohack Apr 28 '11 at 10:14

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.