Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am worried when I re-install OS on my machine while it is still connected to the internet.

Is it possible for malicious users on the internet to gain access to my machine while I am installing OS on it?

share|improve this question
up vote 4 down vote accepted

During the OS install, there's not likely to be much risk since most of the actual installation is generally done without network connectivity or with very limited functionality enabled. After the OS is installed though, and you're working on the first system boot, the system will be vulnerable.

However, for all practical purposes, Internet connectivity is a must in order to get the system updated - which is a fundamental first measure towards securing the machine.

Steps you can take to make the system as secure as possible during the re-install:

  • Never connect the system directly to the internet - always have a NAT router/firewall between it and the modem.
  • Prior to first boot, do not connect the network cable unless the OS install process has built-in updating features you would like to leverage.
  • Immediately after first boot (and preferably before connecting the network cable) install antivirus and firewall software. Make sure both are properly configured before connecting to the network.
    • Most antivirus vendors offer offline installation packages, and offline update installers.
  • Immediately after connecting to the network, update the OS and all pre-loaded software via known-good and trusted websites or built-in updating mechanisms.
share|improve this answer

Unless you have an installer that connects to the Internet, no. And even if you do, none run anything by default that could be exploited externally.

share|improve this answer

It's possible, and it has happened.

An OS is patched often against vulnerabilities. If you're doing a vanilla installation (without the latest patches and/or Service Packs), there's a chance that the installation gets infected while connected to internet.

The "Blaster" worm exploited computers on the internet, simply by spamming itself to large numbers of random IP addresses:

The worm spread by exploiting a buffer overflow discovered by the Polish cracking group Last Stage of Delirium in the DCOM RPC service on the affected operating systems, for which a patch had been released one month earlier in MS03-026 and later in MS03-039. This allowed the worm to spread without users opening attachments simply by spamming itself to large numbers of random IP addresses.

Although the worm can only spread on systems running Windows 2000 or Windows XP (32 bit) it can cause instability in the RPC service on systems running Windows NT, Windows XP (64 bit), and Windows Server 2003. In particular, the worm does not spread in Windows Server 2003 because it was compiled with the /GS switch, which detected the buffer overflow and shut the RPCSS process down.When infection occurs, buffer overflow makes RPC service crash, leading Windows to display following message and then automatically reboot, usually after 60 seconds. (default RPC service failure behaviour).

share|improve this answer
And are the vulnerable services running during installation? – Ignacio Vazquez-Abrams Jun 7 '11 at 20:17
@Ignacio: Define "vulnerable services". There are programs running in the background during an installation, for various purposes. Any of these programs can be vulnerable. – TFM Jun 8 '11 at 5:27

Depends whether your machine is directly connected to the internet (like a single client device ADSL or Cable modem, or being behind a NAT, but chosen as DMZ). If it's behind a NAT it's unlikely to get infected.

If you have XP SP0 and port TCP/139 forwarded to your system, don't complain if you get infections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.