19

I recently reinstalled the OS (Windows XP Home) on a friend's heavily spyware/adware infected machine. It appears as though his kids (7 and 11 years I believe) were visiting sites that offered downloads for search bars, screensavers, and "cute" cartoony animations that anyone with safety in mind would never download.

Some of the concerns I noted on the machine were:

  • The main account was Administrator
  • Expired anti-virus software
  • Lack of Windows updates
  • Multiple firewalls installed

Basically, I'm looking for a guide for non tech-savvy users that would help them avoid getting infected again.

Improve this question
4

11 Answers 11

Reset to default
20
+50
  • Have non-tech users accounts be non-admin
  • Teach safe browsing habits
  • Never download anything that isn't from an 'official' source
  • Use Firefox/Chrome/Safari/Opera instead of Internet Explorer
  • Run malware scans regularly
  • Set Windows to update automatically
  • Install virus protection and scan automatically/regularly
  • Install a firewall
  • And again, smart browsing habits.

For firewall, either don't use one (and use Windows Firewall instead) or install one free one, like ZoneAlarm.

Edit: I see in your question you mentioned expired anti virus. Use AVG instead. It's free and will never expire and updates automatically.

Edit2: As others have mentioned, you could install software that basically locks the computer down. I have to disagree with this. I would much rather take the time and teach the users (especially the children) about how to properly use the computer to the fullest, rather than block them out.

Improve this answer
4
  • After the reinstall I have setup a non-admin account for them, setup auto-update, installed Firefox, purchased McAfee AV, and currently utilize Windows Firewall. I explained that the kids shouldn't really download anything at all. In retrospect, AVG is probably all that they needed anyway...
    – John Rasch
    Sep 18, 2009 at 18:51
  • If using firefox some of the addins like no script can help block certain types of attack (cross site scripting in particular)
    – Col
    Sep 25, 2009 at 7:49
  • In theory yes, but in practice you'll find that out that none of that will really help you in the long run. I've had a setup just like that, but ended up getting infected by a movie file! A kid downloaded a movie, that movie required a new code, which Media Player automatically downloaded and install. That codec turned out to be an exploit... I know that is fixed now, but there are countless things like that in Windows. I just abandoned all hope when it comes to security on Windows.
    – Zoran
    Sep 25, 2009 at 21:43
  • I wouldn't recommend ZoneAlarm, that's much more hassle than security. It was always problematic in my experience. We used to use it at work, but just dropped the thing after wasting hours on random problems induced by it...
    – Zoran
    Sep 25, 2009 at 21:44
12

Best solution I found: gave my kids a Mac mini with parental controls on... No virus problems, they can't really install any crapware even if their friends point them to some. Also, game choice is limited, which is a big plus. With that, they spend much more time exploring the web, experimenting with making music or videos than playing games.

Plus, the mini makes 0 noise and fits anywhere, it's perfect for a bedroom. Kids love it too, don't miss games much, they prefer to play on the Wii anyway...

So, my advice: forget XP, it's a lost cause. There are much better things out there. If you want to reuse you machine and don't want to buy a new one, install Linux on it. The desktop effects on the new Ubuntu are amazing (see http://www.youtube.com/watch?v=dlhD_4pK4MM for example), kids always get excited with that. Plus they'll have tons of things to explore with Linux, much more interesting than old grandpa's Windows XP clunker :) With linux, you're basically also virtually guaranteed to remain crapware-free.

I'm moving away slowly from Windows (started late last year), and I am very glad I did so far, I refuse to waste any more time fixing Windows installs.

Improve this answer
2
  • 1
    I wish I could give this 100+ up votes. I have 2 Mac Minis both on the internet, without any virus software. The only rule that I give my 2 teenagers (other than reasonable parenting of content) is if they are asked to type their password, see me. We have never had an infection of any type. Wish I could say that for our WinXP laptop. Within a month of our Norton subscription expiring, the thing was unusable and I have to reinstall the OS and pay another year of the virus industry's extortion. Linux would get you the same protection, but Mac OSX is more "consumer friendly".
    – dacracot
    Sep 24, 2009 at 15:48
  • 1
    If you buy a Mac Mini, keep it for yourself, don't give it to the kids (at least, that's what I would do). For the kids, just give them your old windows machine and install Linux Mint on it. Give each child their own user account and keep the root account for yourself. And place the computer in the family room with the screen facing everyone, so you can keep an eye on what they're doing.
    – Stephan Branczyk
    Aug 25, 2013 at 15:03
9

If the question is really to help them avoid getting infected again, and it is a computer for the kids, I recommend you to do some research on deploying Windows SteadyState for that particular computer.

Improve this answer
2
  • Steady state is the way to go in my opinion. It's simple to set up and easy enough to disable if you want to make permanent changes. Kiddies turd up the machine, reboot and it is back to pristine.
    – Daddy Su
    Sep 19, 2009 at 14:24
  • The best thing about the solution described by caliban is that the end user can do almost whatever they want, without any consequences. It also eliminates the need to teach people about what to do and what not to do.
    – alex
    Sep 21, 2009 at 20:07
7

Run the web browser in an isolated environment (e.g. with Sandboxie) and be done with malware attacks, 'accidental' toolbar installations, and the like.

PS: In the registered version you can force a program to run always inside the sandbox. If system memory is not a scarce commodity, you might as well use a RAM disk as 'container'.

Improve this answer
4
  • Neat, I'll definitely look into this - sounds similar to SteadyState
    – John Rasch
    Sep 18, 2009 at 18:45
  • Sandboxie is different, but if you're looking for a porgram like 'SteadyState' that is actually worth your while (and the money), then get Faronic's 'DeepFreeze'.
    – Molly7244
    Sep 18, 2009 at 19:06
  • 1
    Sandboxie's not only good for web browsers, but also for trying out software recommended by other people, especially if you don't want them leaving traces on your system or if you're afraid they might contain adware/spyware.
    – Isxek
    Sep 18, 2009 at 19:18
  • 1
    yep, Sandboxie is a real killer application and well worth the few quid for the registration, considering that you can use it on any computer you own.
    – Molly7244
    Sep 18, 2009 at 19:27
5

Ask your friend to browse/ do his work in a virtual machine (VM), and prepare a backup image so that whenever that VM is infected, you can always delete it and restore from the backup image.

Or, maybe you can use Sanboxie to isolate the browsing and BitTorrent software.

Improve this answer
5

Here is a simple answer:

Avoid using the Internet.

And another simple answer:

Don't install anything.

Improve this answer
2
  • 2
    lol - though so very very true, that would make their computer essentially worthless
    – John Rasch
    Sep 18, 2009 at 18:10
  • 1
    The second would be fine if you pre-installed all the software they ever needed.
    – Breakthrough
    Sep 18, 2009 at 18:13
4

The top rated advice here is all good, but there is no perfect solution. Not yet covered:

I would emphasize training above all else. Most spyware / adware is invited into the computer. Whatever your computer / OS & your religious beliefs about them, your web browser is your weakest point in the system. Surfing the web is analogous to driving randomly around town asking strangers if they want a ride. Keep in mind most people using Outlook have HTML mail enabled by default, effectively turning their email client into a web browser.

Consider using Firefox and installing NoScript. It's a solid plugin that by default prevents all scripts running. It's easy to add exceptions for sites you trust.

All the machines in my house were Windows NT / XP / Vista for years. I finally shifted to Ubuntu to simplify my life. I was tired of being the family systems administrator. I picked Ubuntu largely for these reasons:

  1. No root account by default
  2. No open ports by default
  3. Huge software repository
  4. Easy updates with a long support cycle
  5. My favorite price. Free.
Improve this answer
0
3

Exactly what do your friend and his family use the computer for? It might be that they can do just fine with Ubuntu or some other user-friendly Linux distro, and that would drastically cut down on these problems.

There are mail clients, web browsers, and office suites suitable for home use included in Ubuntu. It would very likely annoy the children by not running games, but your friend might consider that a good idea.

It's very possible that your friend is using something that won't run on Ubuntu, and that there's no good replacement for, of course, and in that case you shouldn't change the OS. However, I know computer users that would be just as happy with it, and your friend might be one.

Improve this answer
1
  • 1
    Good suggestion, but I've already tried to get him to switch, no dice :)
    – John Rasch
    Sep 21, 2009 at 21:33
3

One of my standard answers to this kind of question is to use OpenDNS, because it allows users to block sites that are known to host malicious software from the router so that it keeps all connected PCs clean.

If they're the kind of users who won't renew AV software for expense reasons they are better off with a current free AV solution than an out-of-date commercial one.

Improve this answer
3

Particularly if the main OS is Windows XP, I would recommend setting up a virtual machine (VirtualBox is free and good) and putting a Linux distribution inside the VM. Do web browsing from Linux and run other programs from Windows.

You could also set up a dual boot - Wubi is a dead simple way to install a Linux "virtual partition", but the VM makes it simpler to switch between operating systems.

While Windows Vista and Windows 7 can be very secure OSes, Windows XP has enough holes that trying to make it secure is very difficult.

Improve this answer
2

My issue is about having the kids grow up learning. SteadyState styled solutions, which so far sound like the most attractive, will either A) be a limitation to what the kids can learn, or B) will be worked around at some point by the kids. Either way, you're limiting the kids' ability to be become good computer users.

I'd recommend that you basically setup a state rollback that is voluntary, I don't know if SteadyState offers this choice. This is something you'd do from a safe start. You then teach the kids to do that, and explain to them why they need to, what they lose when they do it, and how to avoid having to do it. Additionally if it ever happens that your friend chooses to rollback, he should use the opportunity to show the kids what's wrong with the machine, theorize on why it happened, and have one of them pull the trigger on the rollback, while possibly letting them keep some of the misplaced files and such that invariably they will have and want to keep.

Improve this answer
2
  • I think the responsibility is on the OS design end. Sometimes it makes sense to "teach a man to fish" but this is an arms race that should be fought between the OS and spyware makers (spyware vs anti-spyware vs better-spyware vs better-anti-spyware). The rules for good browsing habits evolve too quickly for any lesson to be effective for long. And it only takes 1 misstep to open the floodgates. Maybe give the kids their own machine and say "dad only reformats once per year". If they have to deal with a crippled, polluted system for several months, they'll learn not to be so clicky.
    – hyperslug
    Sep 24, 2009 at 1:58
  • While I generally agree that better OS design would be in order the majority of ad/spyware gets in directly due to a user's actions. The race is not with the OS but with gullible users, which is why users need to learn a bit about it. Certainly it would be nice if you could trust everyone.
    – dlamblin
    Sep 24, 2009 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .