103

I realize that virus-proof on a Windows PC is far fetched, but in the interest of keeping time spent as the "family-tech-support" to a minimum, I am looking for ideas to lock a computer down to the point that it is very hard to collect ad-ware/spyware, malware, or viruses.

Assume the user is my mom, who rarely, if ever, needs administrator access and mostly uses the computer for MS Office and web browsing.

11
  • 35
    Encase it in lead ;) Jul 29, 2009 at 10:56
  • 23
    I was thinking Kevlar!
    – Pauk
    Jul 30, 2009 at 15:00
  • 36
    Unplug the Internet connection.
    – Scott
    Jul 30, 2009 at 15:23
  • 31
    Unplug the power cable.
    – zildjohn01
    Aug 19, 2009 at 2:34
  • 7
    Switch to Ubuntu
    – Aki
    Nov 4, 2010 at 14:26

23 Answers 23

83

Probably the best advice I've ever heard on the topic is: Stop running as an administrator.

10
  • 1
    This is the easiest and fastest way. RANU.
    – user939
    Jul 28, 2009 at 14:17
  • 27
    Easiest? On Windows XP? You must be joking. (I once tried that.) Jul 28, 2009 at 15:35
  • 1
    @grawity: umm, try harder? :] Ok, sorry. Bad joke, just couldn't resist ;) Yes it is not as easy as it sounds, and requires some tweaking. But, imho, it has the greatest impact that only maybe hiding behind NAT and firewall may come close to. Jul 28, 2009 at 15:51
  • 5
    I disagree. I've tried it, but a lot of windows programs are poorly coded, and asume you've got the default windows with the default everything. I also tried moving the "my documents" folders to another drive, and some programs just wrote on C: ...
    – Manu
    Aug 9, 2009 at 22:04
  • 5
    It used to be a real problem to run without admin rights however since the annoying UAC prompt in vista a lot of the big companies have reengineered their software to not need admin rights so often. If you haven't tried it for a couple of years it might be time to try again.
    – Col
    Aug 25, 2009 at 12:54
51

I get very grumpy when I see these questions, because too many people just want to change the computer, and not the user (when it's the user that causes the issues, invariably).

Consider: Almost every network has a NAT device in place between the LAN and the Internet. This stops random crap from just wandering in, so the overwhelming majority of machines are going to be just fine.

Only when the user is in place is it an issue. My solution: fix the user.

My list to keep your Mom's PC bulletproof:

  1. Educate her on computer security, and computer usage:

    • Don't teach her how to accomplish certain tasks ('click here, etc'). Teach her WHAT and WHY. Think about when you open a new program for the first time. Most computer literate people will have a good idea about how to use it straight up. This is because you understand WHAT you want to achieve, and WHY you want to achieve it. The HOW follows very quickly after, because you are familiar with the HOW from other programs. Ever swapped email clients? You'll know what I mean.
    • The golden rule: If you don't know, don't do it.
    • Secondary to the golden rule: Read what the error message is telling you, and think about what you have done to cause it - don't just throw up your arms and swear
    • Educate her that just because something is free, she doesn't have sign up for it, or try and install it.
  2. Install Google Chrome - Fast, lean browsing machine.

  3. Install your choice of free anti-virus. Something with a low amount of harassment is good.

  4. Ensure automatic updates are turned on, and that your mother knows how to deal with them. Accept them, install them, reboot the computer.

My parents ran a Windows XP machine for 4 years with no software firewall - running just Firefox and AVG. They were checking their email, doing online banking, playing some Guild Wars online, and they had no viruses. I've had plenty of challenges from random people who tried to find viruses on my computers, but they always just end up wasting their time.

9
  • 17
    I agree that educating the user is ultimately the best thing to do, unfortunately it is not feasible in all situations. Jul 30, 2009 at 16:20
  • 5
    I'd disagree - the only time it's not feasible to educate someone is when they don't want to learn. Jul 30, 2009 at 17:26
  • 4
    knowledge > automation Aug 13, 2009 at 17:29
  • 1
    As a counterpart to educating the user, maybe if the user refuses education, you should just take the computer away. We don't just let any random yahoo jump in a car and drive it, do we? ...oh wait.
    – Jay R.
    Sep 18, 2009 at 18:18
  • 5
    In my experience, anything that pops up with an error message just provokes the "click to make it go away" reaction. Pending education, I'd still be looking at other solutions...
    – Benjol
    Apr 27, 2011 at 7:44
30

I don't like just providing links as answers but have a look at this comprehensive lock down guide.

Windows XP Professional Configuration Checklist Details

  • Verify that all disk partitions are formatted with NTFS
  • Protect file shares
  • Use Internet Connection Sharing for shared Internet connections
  • Enable Internet Connection Firewall
  • Make sure windows update runs regularly
  • Use software restriction policies
  • Use account passwords
  • Disable unnecessary services
  • Disable or delete unnecessary accounts
  • Make sure the Guest account is disabled
  • Set stronger password policies
  • Set account lockout policy
  • Install anti-virus software and updates
  • Keep up-to-date on the latest security updates
  • Do not run with administrator privileges by default
  • Don't use WEP for wireless networks
8
  • 9
    nsa.gov/ia/guidance/security_configuration_guides/… Has a host of guides on locking down different operating systems. Jul 28, 2009 at 14:06
  • Nice checklist!
    – Ivo Flipse
    Jul 28, 2009 at 14:29
  • 2
    Need to add "run as standard user" or "do not run with administrator privileges by default" Jul 28, 2009 at 14:51
  • 1
    That list has problems for home users... ICS behind most home routers leads to double NATing. SRP is pretty administration heavy (I believe it's better in win7). Also, not having an account password helps the account not be remotely accessable. Jul 28, 2009 at 15:20
  • @Doubt - your comment should be an answer. Jul 28, 2009 at 15:20
15

Besides teaching her to avoid installing silly things, I don't really see a way.

Of course, have the system updated and with an anti-virus (eventually a firewall).

But in general, if you want to avoid "family-tech-support", there is no real way. Because if you start adding things to block content, block what she can do, you won't be called for the "tech-support", but for the "why can't I do that ?".

1
  • Yes, probably your answer is better :] If user want's to install something, then he will do it... The most effective way is to educate a user. Unfortunately, that is also the most time and effort consuming way. I just some times run out of patience :( Jul 28, 2009 at 14:05
14

Buy her a Mac, seriously all of my family have moved over to Apple Mac's and it's so much easier to fix (if anything ever goes wrong, which doesn't happen often).

Alternatively if she/you can't afford that install Ubuntu.

You can mark this answer as "not useful" but when it comes down to it Windows isn't meant for mum's or anyone who's incompetent with computers.

3
  • 3
    +1 I did this as well a few years ago. Not only did it drop my tech support calls to ZERO (seriously!) my mom absolutely loves her iMac w/iTunes, FireFox, and Mail. Aug 18, 2009 at 17:05
  • 3
    I tell my friends and family that I refuse to help them with their computer troubles unless they use Mac or Linux. They complain that Macs are expensive, but then I explain that it's an illusion because it's only true if they consider my time worthless. Now almost all of them use Macs except for my one kid sister who uses Ubuntu. And I have a lot more free time :-) Apr 30, 2011 at 10:46
  • 1
    I would agree if someone said that this doesn't answer the actual question, but I think deserves to be in the list of solutions. I have switched 4 families (plus my fam of 7 to Ubuntu). I switched them not because they are computer geeks but because they are totally non-technical and I got tired of endless support calls. Once I find a distro upgrade that is worth it I bring them up to date, otherwise I just let them run day after day, month after month. They typically 1) Browse, 2) Music+Videos, 3) Office type work.
    – Dennis
    Oct 4, 2011 at 19:59
12

In general,

  • Run as a standard user (Not Admin)
  • Run Vista or higher
  • Leave UAC on
  • Run 64bit (more protections in 64 bit)
  • Set automatic update
  • Run a web browser that supports sandboxing (currently IE7/8 or Chrome).
3
  • out of curiosity.. how is x64 anymore secure than 32bit?
    – NoCarrier
    Jul 28, 2009 at 16:33
  • 4
    @NoCarrier, two reasons leap to mind. First, the 64-bit kernel requires that all device drivers be signed so it is much harder to inject hostile code into the kernel itself. Second, at the moment, there are fewer x64 machines out there, so there are fewer attacks against them in the wild. As more systems go 64-bit, the dynamics will change...
    – RBerteig
    Jul 28, 2009 at 23:15
  • Another factor is Kernel Patch Protection, which makes it harder for malware to bind to random points in the kernel. Aug 11, 2009 at 15:24
12

Well I would shy away from Norton - In my experience this just grinds the PC to a halt (McAfee isn't much better either!)

I have 4 computers in the house being used by myself, and the "kids" (14, 18 and 20) and I've installed the following;

  • AntiVirus: Avast Home Edtion (it's free and has trapped a number of suspect files)
  • Spyware: I've started to use SpyBot Search and Destroy which appears to work well (again, it's free)
  • AntiPorn: I'm using OpenDNS which is configured on the router and set up to block Porn, Adware, Gambling etc.
  • Firewall: If you're running a router then it should handle this for you but if not then ZoneAlarm is a good alternative to the Builtin Windows offering. Having said that, I've not had any problems with the Windows Firewall when dialled up via an ASDL Modem.
  • Permissions: Assuming you will be running a recent version of Windows then you can configure them as non-Admin users which will stop them poking around where they shouldn't.

At the end of the day I don't think there is a 100% foolproof solution to this one. My kids still manage to install toolbars and the like. If you lock the system down too far then it just becomes unusable.

3
  • Huh! How did this end up here - I was answering another (related) question ;-) Aug 13, 2009 at 15:32
  • @DilbertDave: I've flagged it for "moderator attention" for being a dupe, and apparently a mod has merged the two questions.
    – fretje
    Aug 13, 2009 at 15:40
  • That will explain it then - Hope my response still makes sense ;-) Aug 13, 2009 at 15:41
11

Install Ubuntu and all your problems will be healed!

I've had Ubuntu on my netbook for quite some time and just re-installed XP on my parents.

They got a virus just a week into using it.

8

Educate the users!

1
  • 2
    Said already several times, but I guess always nice to repeat.
    – Gnoupi
    Aug 18, 2009 at 17:34
7
  1. change her password, and don't tell her what it is
  2. unplug the machine from the internet
  3. unplug the machine from the wall
  4. change your phone number to an unlisted number
  5. put a GeekSquad sticker on her monitor

Seriously, if you lock the machine down for protection, the main thing you can do is set Internet Explorer (or whatever) to run with high security, which means that none of her favorite web sites will work, which means that you're going to get even more family-tech-support calls than before ("why won't TexasHoldem.com work any more?").

The best solution for both of you is to get out of the family-tech-support business. Plead ignorance, charge them for your time, be too busy, tell them GeekSquad will do a better job, refer them to Dell Support, whatever it takes to get out of this trap.

And it is a trap. Sure, you want to help your mom, but how about your sister? cousins? your mom's friends whom she told how great you were at it? Unless you intend for this to become a sideline business, best to nip it in the bud.

2
  • 4
    Friends don't let friends use GeekSquad. Oh wait. What you're doing is making her not a friend.
    – Kevin M
    Jul 29, 2009 at 15:33
  • 1
    @[Kevin]: GeekSquad is a lot cheaper than I am Jul 30, 2009 at 14:57
7

Here is what I usually do before turning a computer back in to someone who gave it to me to clear up spyware, etc:

  • Change account type to Limited; Create new Admin account if necessary
  • Install Firefox + Adblock Plus; Make default browser
  • Install Spybot Search & Destroy with schedules and realtime protection
  • Update Windows completely
  • Set automatic download and install for Windows updates

On the other hand, you could just install something like DeepFreeze which will revert the OS back the state it was when you installed it on each restart (not free, though).

Edit: As Keck pointed out in his answer, Microsoft has a free alternative to DeepFreeze called Windows SteadyState.

1
  • +1 for Deepfreeze. Works really good if you setup a second thawed partition and redirect the desktop/documents/data folders to the thawed partition.
    – Zoredache
    Jul 13, 2010 at 21:41
4

Here is another one. Maybe it's not exactly what you want, but it takes less time and effort.

Have you considered virtualization? Just let her trash that system, and restore from a snapshot when it is no longer usable. Quick and clean.

And hope she will eventually learn. Or stop trying to learn, 'cause it's easier... It depends on the person, I suppose :)

3
  • 14
    Where did all my grandkids pictures go?
    – user939
    Jul 28, 2009 at 14:18
  • This method is perfect for some people. I have encountered people who seem to forget everything you teach them. So it is brand new every single time. These folks could spin your wheels for hours if you let them. Virtualization and Imaging are a good way to cap your level of effort supporting someone like this.
    – Axxmasterr
    Jul 28, 2009 at 14:18
  • 1
    @Will: Yessss, grandkids pictures... :] Well, I can tell about VMWare: you can set up a shared folder with the hosting OS where you can drop of all of the user files. You can do it after it is screwed up to backup all user data, or before to let user save his data there. Plus, you can do snapshots often. So there will always be some state saved with all files intact. Jul 28, 2009 at 14:26
4

Block obscene online material (they don't know that the Internet is for porn).

Your best bet may be Net Nanny or something similar. Here are reviews of the top Internet Filters

Prevent rogue installations of applications. Prevent them from unknowingly changing the security settings or uninstalling applications.

For these two the best thing might be to make yourself an administrator of the computer and have them log in as guest (or any non-admin login). Use admin settings to disallow installing applications or changing system settings.

Keeping the computer/anti-virus software up to date.

I'd install AVG antivirus and Zone Alarm firewall and activate their automatic updating features, along with AVGs automatic scanning.

For GP you may want to run a Flash-blocker or ad-blocker, they're both easy plug-ins for Firefox.

1
  • What is GP? General Protection? Aug 18, 2009 at 16:09
4

Might want to consider reboot-to-restore softwares such Deep Freeze or Windows SteadyState and create another partition to store data only. So when problems crop up, just reboot the PC.

4

Running Windows as a limited user is definitely the best way to keep out malware. Limited user is preferable to anti-virus software and I haven't heard of a single browser vulnerability that was exploitable in limited user mode.

The problem with Windows limited user privilege is that runas works in a completely different user context -- the one that is used to supply the credentials to runas. This breaks down in all kinds of ways that Mom just isn't going to grok. Even getting Mom to understand how to enter runas commands in cmd.exe is going to twist her knickers.

Linux has the right answer and it comes in two parts: first is software repositories and the second is called "sudo" (insert xkcd comic here) which stands for "super user do". sudo runs in the current user context which tends to make things work right. There is a sudo for Windows that I like called surun.exe available from http://kay-bruns.de/download/surun.zip, but I'm not sure I recommend it for Mom unless you tweak it for her. But it does have the nice capability to let Windows Update or Microsoft Update run in limited user mode and it allows limited users to change power options and set the clock.

If you set Mom up in limited user mode, you need to create an Administrator account to use for installing and tweaking. I suggest you remote logon and do the heavy lifting for Mom, but check out surun.exe if only to allow AU and the other features it includes by default for limited users.

Another option is to have Mom run her browser in a sandbox, like sandboxie.exe. I can't recommend it, unless you want to prevent Mom from downloading and uploading personal stuff like photos and chain letter jokes. But if Mom doesn't do downloading and uploading, a sandbox is the best way to get limited privilege to apply to the most vulnerable application on Mom's machine.

3
  1. partition the hard disk.

  2. install Windows and all necessary programs.

  3. point user folders (desktop, documents, favorites, emails, etc.) to another partition.

  4. create a an image of the system drive (usually C:)

something goes wrong, you can restore the computer with a minimum effort to the state it should be in.

if you want to take it to the next level, try this:

  1. install a RAM disk (size depending on the requirements and available system memory).

  2. install Sandboxie and point the container folder to the RAM disk (drop rights if on an admin account) and add the desired download folders to 'Quick Recovery'

it's getting even better if you want to pay the little registration fee for Sandboxie (which allows you to install the software on any computer your own).

  1. now that you have Sandboxie registered, force the web browser to run inside a Sandbox all the time (if you're using a web browser that is mad for updates, disable auto update!)

alternatively you may consider DeepFreeze, even more efficient but possibly a bit too restrictive for Mum's taste. good luck and enjoy the time you have just saved from being the in-house tech support! :)

2

Make her profile read-only.

2

My choice as an old time Usenet hacker (white hat, software hacker, etc.)...

Windows XP:

1st drive or partition: install Windows and all needed stuff (you won't be able to touch it after, only the real administrator can do that) Security software is less needed. Remember OpenDNS!

2nd drive or partition: put my documents and a 2nd program files folder in it, portable applications and all files that you want to keep, like music, pictures, etc. (tell everyone that they have to save and install their stuff there because they lose all they have done if not done) > an installation is simple, you change the C for a D (the 2nd drive), C:/Program Files/. Also link My Documents folder to the one in the 2nd drive.

Now put Windows steady state at all settings, it will reset the computer as you installed it for the 1st drive only at each restart.

For Linux: Also note that the Linux idea is not all-wrong, it's also bulletproof! Ubuntu (Big up for Edubuntu - Ubuntu project for education for not very rich nations) is simple but she use her computer so little but SliTaz 2 a little modded (with help or by learning - it's worth it!) should be more than enough 30 Mo only for a Linux desktop that will be faster than any Windows version but you have a downside and OpenDNS work with it also.

The real deal: the family is ready if it has a real value: money, learning, help good projects, being part of a real team that really work for them or keep up with Microsoft that don't understand the need of peoples that slave them blocking their reals thoughts, that make a product that sometime miss more than win ... For me, it's why I gave Linux a chance. It's not perfect, but I have found some parts that I can live without now, mostly human, though.

My Linux passion came from people that work for the freedom of the knowledge like Didier Roche, a writer and secretary from the French Ubuntu team and the knopmyth developer so I wish luck to both of you, if you read me ... That's the real Linux life, even Linux stars are just like normal people and they will help you, like they have been helped by someone before. I want to be a part of this chain, that's all! The true beauty of the world is sharing!

0

Install Opera and/or FireFox. Install NoScript in FireFox.

Make sure (with shortcuts, etc.) that Opera/FireFox is easier to start/find than Internet Explorer. Try to make Internet Explorer unsusable, like directing it to a non-existing proxy-server, etc.

Make Opera/FireFox the default browser.

The following makes use inconvenient, but the question was about security:

Block JavaScript for all sites (e.g. set in Preferences in Opera and using NoScript in FireFox), except for the ones you explicitly allow. Most of these will need to be set later by the (inexperienced) user. This is where it becomes inconvenient.

Allow JavaScript for some common sites, e.g. YouTube and Gmail. Test that it actually works.

1
  • 2
    You'll probably get more calls running with NoScript than you would every 3-6 months when something bad happens. "Why doesn't [every internet site] work?" Jul 30, 2009 at 16:09
0

Install Ubuntu :) It will silently update itself, it never breaks, Firefox is the same as in Windows, MS Office will work under Wine. I had really positive experience with it and really negative one with Windows XP in the same situation.

4
  • -1 - Not an answer to this question. Jul 30, 2009 at 16:08
  • Changing OS is not going minimize the family tech support required, quite the opposite.
    – David Webb
    Aug 18, 2009 at 14:34
  • 5
    I'm not so sure about that. If I was setting up a computer for an older family member with little to no computer skills, I would strongly consider a minimal Ubuntu or other Linux-type OS install with OpenOffice and a single browser (or just teach them to use Google Docs). For many, many people, a computer is 99.9% of the time a machine for running a browser (and 0.1% of the time a machine for playing solitaire - which can be played in a browser). Or make her buy a Mac.
    – CMPalmer
    Aug 18, 2009 at 16:10
  • 1
    yes, firefox is the same everywhere. Non-techie people don't care that much how button they have to click to start it look. They don't really see the difference. And simple fact that there are no viruses and nothing can go wrong except hardware failure makes it so much easier to work with.
    – vava
    Aug 19, 2009 at 4:41
0

Install A-SquaredAntiMalware (paid) and make sure that it updates and scans automatically. Also set all "Surf Protection" settings to "Block Silently. Add MVP Hosts file, OpenDNS, and WinPatrol. Explain that if Scotty barks it's important and read it carefully. WinPatrol warnings are the only ones she'll get, and those very infrequently. Also explain that she will see a lot of 404's as her protection works for her- and that's a good thing.

This is the way I protect my 83-year old mother's Windows XP system, and she has had absolutely no malware issues at all.

0
  1. Check your local library (or bookstore) for computer security books (Dewey-Decimal section 005.8). Look specifically for books about “hardening Windows and networks”.
  2. Don’t connect her system directly to the Internet, connect it through a router. Even with the default settings, it will be much more secure than connecting it directly to the Internet.
  3. Give her a brief crash-course on using the system and the Internet.

enter image description here enter image description here enter image description here enter image description here

0

Try Sandboxie

Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

enter image description here

Benefits of the Isolated Sandbox

  • Secure Web Browsing: Running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded trivially.

  • Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't leak into Windows.

  • Secure E-mail: Viruses and other malicious software that might be hiding in your email can't break out of the sandbox and can't infect your real system.

  • Windows Stays Lean: Prevent wear-and-tear in Windows by installing software into an isolated sandbox.

Not the answer you're looking for? Browse other questions tagged .