26

My grandfather is pretty tech-savy for his age and loves to send emails, use Photoshop, and browse the web. I've made his computer pretty secure by installing AdBlock and teaching him how not to download viruses but every once in a while he receives a flyer in the mail with a free trial for 'Avast antivirus'. He's the type of person who can't resist free and promptly installs it. This is pretty annoying because it slows down the computer a lot, prevents Firefox from opening, and does all sorts of other this-antivius-is-basically-a-virus things. It's also a real pain to uninstall.

My question: Can I set something up that prevents him from downloading, installing, or running an Avast installer?

I have Windows 7

13
  • First level of defense: install mail spam filter :-)
    – Bergi
    Dec 25, 2017 at 20:29
  • 12
    @Bergi, lol, it's not email though, it's actual physical letter mail!
    – Dragongeek
    Dec 25, 2017 at 20:33
  • 4
    This is not solving the issue... Educating him is the best solution...
    – Dave
    Dec 25, 2017 at 20:43
  • 6
    @Džuris I'm not a fan of antivirus software in general. You can block basically all malware by using AdBlock and windows built-in defender. Specifically Avast messed with Firefox settings (homepage), installed all sorts of browser plugins, and disabled adblocker (?!). Also, it slows down my grandfather's older computer to a crawl, especially during login.
    – Dragongeek
    Dec 26, 2017 at 9:49
  • 8
    Have you tried telling him that installing free software via mail and email adverts is the equivalent of of him ingesting a free jar of mayonnaise that's been sitting in the sun for 6 days? Additionally, check out thewindowsclub.com/…
    – MonkeyZeus
    Dec 26, 2017 at 17:37

3 Answers 3

29

If you want to prevent a specific software from installing, you can try importing its certificate (digital signature) to "Untrusted certificates". Then whenever he tries to install it, the UAC dialog will show "This software is untrusted" instead of prompting you to grant Administrator access to the installer program.

There is a safer way to use the installer's certificate, but may slow down the whole system by a little. You can import Avast's cert into the Group Policy, so even if it doesn't require Admin privileges, it won't run.

If you want to block all software installation, then give him a User account (without Admin privileges). It could be the only solution for blocking everything, though. You need to ensure that your grandfather doesn't need Admin privileges frequently.

If it allows, you can configure your current AV software so that it distrusts Avast's certificate, and may delete the installer immediately he downloads it. This is also a good option.


Anyway, I personally believe that educating your grandfather to learn to resist ads and those whatever free trials is the ultimate solution. Then you won't have to bother with this and that to prevent him from installing them.

5
  • "Anyway, I personally believe that educating your grandfather to learn to resist ads and those whatever free trials is the ultimate solution." <-- maybe installing an adblocker can help a bit? Dec 26, 2017 at 4:24
  • 4
    @IsmaelMiguel It won't block physical ads.
    – iBug
    Dec 26, 2017 at 4:26
  • But may help reduce another attack vector? Dec 26, 2017 at 13:22
  • @IsmaelMiguel Unlikely. The OP has already said email isn't the case.
    – iBug
    Dec 27, 2017 at 13:17
  • 2
    @IsmaelMiguel Question states adblocker is already in place.
    – user366447
    Dec 27, 2017 at 15:27
16

Prevent Execution of Downloaded Programs

In addition to @iBug's good suggestion to remove administrative rights from your grandfather's account (after making another account with admin rights first!) you should prevent execution of files (i.e. software installers) saved to the Downloads directory.

Do this by editing the NTFS permissions on the Downloads folder and clear the Traverse folder/execute file permission.

This will prevent any executable saved in this folder from being started. You may wish to do this to the Desktop folder as well.

The advantage of this method in combination with removing admin rights from the account is that it prevents running any installer, not just those that require admin rights. Many unwanted programs will still install if the user does not have admin rights, but if the program can't be executed in the first place, it doesn't matter.

5
  • Will this affect .msi installers? Dec 26, 2017 at 4:24
  • @IsmaelMiguel I'm not sure but according to my experience, .msi installers is likely unaffected.
    – iBug
    Dec 26, 2017 at 9:47
  • .MSI installers are unfortunately not affected by removing the Execute permission. Dec 26, 2017 at 14:26
  • 2
    @TwistyImpersonator Is it because .msi files are read by msiexec.exe, instead of themselves being executed, thus requiring only read permission?
    – iBug
    Dec 27, 2017 at 13:18
  • 1
    @iBug Yes. To the operating system, .MSI files aren't executable; they're just another file that needs to be opened with another application. But in this case that is an application that installs software. Dec 27, 2017 at 13:43
4

I've done this for both a tech-illiterate family friend (who thinks "hot_nympho_girls_movie.exe" is legitimate, even after a dozen reminders) and on laptops at work that are loaned out to students on a daily basis (we want them to install drivers and software they need, but don't want to reimage the machine at the end of each day)

We used Toolwiz Time Freeze which is a free product. You install it, set the machine up how you want it, then enable the software. When the computer is restarted, it's returned to the point at which you turned the software on. You can "unfreeze" specific files and folders (e.g. I unblocked Thunderbird's config folders so emails persisted between reboots) so you can give or take as much control as necessary.

This is probably a bit overkill, but it works great for us, because each machine we loan is "ready to go" the moment it's shut down at the end of the day. And our family friend hasn't complained about popups and toolbars mysteriously appearing.

3
  • Does this behave in a similar manner to a guest account? Dec 26, 2017 at 10:10
  • "even after a dozen reminders" There comes a point where you stop enabling the stupid.
    – RonJohn
    Dec 26, 2017 at 17:14
  • @WesToleman More like a guest computer. The entire machine, all guest accounts, everything but the folders you unfroze, are reset when you reboot.
    – Grayda
    Jan 4, 2018 at 6:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .