26

My grandfather is pretty tech-savy for his age and loves to send emails, use Photoshop, and browse the web. I've made his computer pretty secure by installing AdBlock and teaching him how not to download viruses but every once in a while he receives a flyer in the mail with a free trial for 'Avast antivirus'. He's the type of person who can't resist free and promptly installs it. This is pretty annoying because it slows down the computer a lot, prevents Firefox from opening, and does all sorts of other this-antivius-is-basically-a-virus things. It's also a real pain to uninstall.

My question: Can I set something up that prevents him from downloading, installing, or running an Avast installer?

I have Windows 7

  • First level of defense: install mail spam filter :-) – Bergi Dec 25 '17 at 20:29
  • 12
    @Bergi, lol, it's not email though, it's actual physical letter mail! – Dragongeek Dec 25 '17 at 20:33
  • 4
    This is not solving the issue... Educating him is the best solution... – Dave Dec 25 '17 at 20:43
  • 6
    @Džuris I'm not a fan of antivirus software in general. You can block basically all malware by using AdBlock and windows built-in defender. Specifically Avast messed with Firefox settings (homepage), installed all sorts of browser plugins, and disabled adblocker (?!). Also, it slows down my grandfather's older computer to a crawl, especially during login. – Dragongeek Dec 26 '17 at 9:49
  • 8
    Have you tried telling him that installing free software via mail and email adverts is the equivalent of of him ingesting a free jar of mayonnaise that's been sitting in the sun for 6 days? Additionally, check out thewindowsclub.com/… – MonkeyZeus Dec 26 '17 at 17:37
29

If you want to prevent a specific software from installing, you can try importing its certificate (digital signature) to "Untrusted certificates". Then whenever he tries to install it, the UAC dialog will show "This software is untrusted" instead of prompting you to grant Administrator access to the installer program.

There is a safer way to use the installer's certificate, but may slow down the whole system by a little. You can import Avast's cert into the Group Policy, so even if it doesn't require Admin privileges, it won't run.

If you want to block all software installation, then give him a User account (without Admin privileges). It could be the only solution for blocking everything, though. You need to ensure that your grandfather doesn't need Admin privileges frequently.

If it allows, you can configure your current AV software so that it distrusts Avast's certificate, and may delete the installer immediately he downloads it. This is also a good option.


Anyway, I personally believe that educating your grandfather to learn to resist ads and those whatever free trials is the ultimate solution. Then you won't have to bother with this and that to prevent him from installing them.

  • "Anyway, I personally believe that educating your grandfather to learn to resist ads and those whatever free trials is the ultimate solution." <-- maybe installing an adblocker can help a bit? – Ismael Miguel Dec 26 '17 at 4:24
  • 4
    @IsmaelMiguel It won't block physical ads. – iBug Dec 26 '17 at 4:26
  • But may help reduce another attack vector? – Ismael Miguel Dec 26 '17 at 13:22
  • @IsmaelMiguel Unlikely. The OP has already said email isn't the case. – iBug Dec 27 '17 at 13:17
  • 2
    @IsmaelMiguel Question states adblocker is already in place. – user366447 Dec 27 '17 at 15:27
15

Prevent Execution of Downloaded Programs

In addition to @iBug's good suggestion to remove administrative rights from your grandfather's account (after making another account with admin rights first!) you should prevent execution of files (i.e. software installers) saved to the Downloads directory.

Do this by editing the NTFS permissions on the Downloads folder and clear the Traverse folder/execute file permission.

This will prevent any executable saved in this folder from being started. You may wish to do this to the Desktop folder as well.

The advantage of this method in combination with removing admin rights from the account is that it prevents running any installer, not just those that require admin rights. Many unwanted programs will still install if the user does not have admin rights, but if the program can't be executed in the first place, it doesn't matter.

  • Will this affect .msi installers? – Ismael Miguel Dec 26 '17 at 4:24
  • @IsmaelMiguel I'm not sure but according to my experience, .msi installers is likely unaffected. – iBug Dec 26 '17 at 9:47
  • .MSI installers are unfortunately not affected by removing the Execute permission. – Twisty Impersonator Dec 26 '17 at 14:26
  • 2
    @TwistyImpersonator Is it because .msi files are read by msiexec.exe, instead of themselves being executed, thus requiring only read permission? – iBug Dec 27 '17 at 13:18
  • 1
    @iBug Yes. To the operating system, .MSI files aren't executable; they're just another file that needs to be opened with another application. But in this case that is an application that installs software. – Twisty Impersonator Dec 27 '17 at 13:43
4

I've done this for both a tech-illiterate family friend (who thinks "hot_nympho_girls_movie.exe" is legitimate, even after a dozen reminders) and on laptops at work that are loaned out to students on a daily basis (we want them to install drivers and software they need, but don't want to reimage the machine at the end of each day)

We used Toolwiz Time Freeze which is a free product. You install it, set the machine up how you want it, then enable the software. When the computer is restarted, it's returned to the point at which you turned the software on. You can "unfreeze" specific files and folders (e.g. I unblocked Thunderbird's config folders so emails persisted between reboots) so you can give or take as much control as necessary.

This is probably a bit overkill, but it works great for us, because each machine we loan is "ready to go" the moment it's shut down at the end of the day. And our family friend hasn't complained about popups and toolbars mysteriously appearing.

  • Does this behave in a similar manner to a guest account? – Wes Toleman Dec 26 '17 at 10:10
  • "even after a dozen reminders" There comes a point where you stop enabling the stupid. – RonJohn Dec 26 '17 at 17:14
  • @WesToleman More like a guest computer. The entire machine, all guest accounts, everything but the folders you unfroze, are reset when you reboot. – Grayda Jan 4 '18 at 6:30

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.