1

I have a windows 10 account with administrative privileges. I eventually need to download things that have a potential of having viruses on them, so to prevent them from reaching my account and files, I thought about creating another local restricted account so that if this account gets infected, I won't need to format the computer but just delete the account and its files. How likely is that to work, what are the risks and how to address them?

Improve this question
3
  • That will only work in some cases. A more reliable solution would be to use a virtual machine.
    – Tesseract
    Oct 10, 2017 at 2:24
  • 1
    Extremely unsafe. A normal account downloading malicious software can still make your system unbootable. Use a VM or a sandbox that isolated the program from your system. Even those solutions are not 100% safe but safer then your idea
    – Ramhound
    Oct 10, 2017 at 2:25
  • 2
    I agree with the other comments. In theory, a limited account can do less damage to the system, but if the malicious software is taking advantage of a vulnerability that results in an escalation of privilege, you're sunk. But then, some malware is aware that it is being executed in a VM and adjusts behavior to appear innocuous. You can't win. :)
    – Patrick Seymour
    Oct 10, 2017 at 3:10

3 Answers 3

Reset to default
1

I would recommend just doing this in a virtual machine. You can use built in Hyper-V or something like VM Workstation Player for free. This would minimize the risk to your comupter.

Improve this answer
1
  • 1
    A virtual machine does add a bit of protection, however, there are a couple of things to be aware of. It's possible for software to detect whether it's running on a virtual machine in several ways, including the presence of APIs specific to that VM and the combination of hardware the VM emulates. This means that malware might not do bad things if it's run within a VM. A more important concern is attacks designed to escape from a VM. While virtualization software is typically hardened, it's not immune to vulnerabilities, and, there have been some notable ones over the years.
    – Stephanie
    Oct 10, 2017 at 6:21
1

As mentioned above a VM would be a good choice.

As addition when using a Virtual Machine:

Don't use Shared folders, disable it.

Take a Snapshot of your clean vm to work on it.

Don't use Bridged Mode as Network configuration, if you use network

Don't use your regular account on your Host. To use the VM-Guest use a guest account which are restricted and maybe harden it.

Not sure, but maybe use the VM in a second sandbox ?

Improve this answer
0

This is not a great idea.

It will work in many cases, but definitely not all.

Where malware takes advantage of an unpatched vulnerability it can bypass the user limits - and there are a number of known vulnerabilities - including (off the top of my head) the Wannacry - but there are plenty of others which don't require file sharing. (Have a look here)

Another potential problem would be shared resources - for example if you have a shared public fileserver it could still delete files.

As @aMofo suggested, doing this kind of testing in a VM is a much safer idea.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .