Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am interested in ways to achieve bulletproof reversible disabling of internet connection. E.g. I figure that if I just run "ipconfig /release" the smart trojan could reenable connection by doing the equivalent of "ipconfig /renew" via appropriate Windows api. Perhaps other programmatic methods of turning off connection could be defeated similarly by the trojan.

So would corrupting some underlying Windows dll work? First of all, is it even possible, without booting under Linux? Second, if it is possible, what dll would be a good target to mess up to get rid of networking while not affecting other essential Windows functionality?

ETA: thanks for the responses. I don't want to discuss the disabling the adapter approach because... because this question is not about that and because if I can programmatically enable/disable something, then so can the trojan. The idea with removing network connectivity is not doable because there is no physical way to shut off wifi adapter in my machine.

Downthread uSlackr said that Windows "will fix any system file". So, how would it fix it? Does it have backups in some identifiable location that could also be corrupted?

Are there other problems with the feasibility of this approach, other than Windows restoring the files?

ETA2: on second thought, would the wifi adapter's driver file, as opposed to the dlls of Windows itself, be a more convenient target?

share|improve this question

closed as not constructive by Oliver Salzburg, Dave M, Simon Sheehan, Renan, 8088 Jul 18 '12 at 0:07

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Just disable your network adapter and you won't have any problems. If you're truly concerned, there is no non-destructive (read: way to enable/disable dynamically) way to do what you ask. If you're willing to do so, create a Windows image using RT7Lite, and remove all essential networking components. – Breakthrough Mar 5 '12 at 16:35
Windows will fix any system file you corrupt. Physically disconnecting from the network is not reversible without physical access. – uSlackr Mar 5 '12 at 16:41
uSlackr, thanks for the response, please see additional questions in main body – EndangeringSpecies Mar 5 '12 at 17:04
if I can programmatically enable/disable something, then so can the trojan -- I doubt that trojans go that far. Probably switching the device off in BIOS would be enough. For a windows only approach, I would first disable automatic driver installation (I think policy editor allows doing that) and then uninstall the network device. – Frg Mar 5 '12 at 17:18
How about just remove the infection? – Ramhound Mar 5 '12 at 17:36

Disable the network adapter and there will be no access of any kind. All windows functions will work but no network access of any kind. If you need local communications, you will need another protocol. Not sure how booting to a Linix OS would help.

Given your reply perhaps you could share your goal. If you can't disable or turn off, please explain. Do you need TCP/IP?

As to teh malware turning something on, please explain how it would do so if there was no access? Does the malware arrive via a different vector? USB, CD, Etc? Also, the malware would need to have a component that enables the adapter. While some will have a component that tries to use a dialup connection, enabling a NIC is an unusual approach.

You could also set your IP to an address on a different subnet. If router and Internet are 192.168.x.x then set your IP to 10.10.10.X and set a subnet and gateway on 10.10.10.X

share|improve this answer
my goal is to achieve disabling of the network which is easy to reverse for me and hard to reverse for the attacker. The attacker already knows about programmatic enabling and disabling adapters, so the trojan might try doing that to restore connection. But the attacker does not know that the only way to restore the connection on my machine is "clap your hands twice during full moon and run MagicRestore" – EndangeringSpecies Mar 5 '12 at 17:16
Using an IP on a different network is easy to change and unlikley any attacker could guess the "correct" IP. It is quick and easy to do. Again, please explain how the attack arrives so everyone can understand the requirement more clearly. – Dave M Mar 5 '12 at 17:32
"attacker" is "malware" software on my machine that may try connecting to the web without my notice, for reasons either malicious or "helpful" (think Microsoft). For the purposes of this thread internet connection is through wifi network which is not under my control. Whereas I am aware of existence of various approaches to handling this issue, the approach I am discussing right now is, specifically, ways to "programmatically" shut down wifi internet access in a way that cannot be reversed by malware written by people unfamiliar with my system. Even if the malware is called "Windows" :) – EndangeringSpecies Mar 5 '12 at 18:25
If you have enough control to delete/change system files you can manage the WiFi connection in most cases. Are you saying you have no contriol over the software/hardware WiFi on the actual computer? – Dave M Mar 5 '12 at 19:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.