How can I make a Windows PC bullet-proof for home users?

Question

I realize that virus-proof on a Windows PC is far fetched, but in the interest of keeping time spent as the "family-tech-support" to a minimum, I am looking for ideas to lock a computer down to the point that it is very hard to collect ad-ware/spyware, malware, or viruses.

Assume the user is my mom, who rarely, if ever, needs administrator access and mostly uses the computer for MS Office and web browsing.

Answer 1

Probably the best advice I've ever heard on the topic is: Stop running as an administrator.

Answer 2

I get very grumpy when I see these questions, because too many people just want to change the computer, and not the user (when it's the user that causes the issues, invariably).

Consider: Almost every network has a NAT device in place between the LAN and the Internet. This stops random crap from just wandering in, so the overwhelming majority of machines are going to be just fine.

Only when the user is in place is it an issue. My solution: fix the user.

My list to keep your Mom's PC bulletproof:

1. Educate her on computer security, and computer usage:

   • Don't teach her how to accomplish certain tasks ('click here, etc'). Teach her WHAT and WHY. Think about when you open a new program for the first time. Most computer literate people will have a good idea about how to use it straight up. This is because you understand WHAT you want to achieve, and WHY you want to achieve it. The HOW follows very quickly after, because you are familiar with the HOW from other programs. Ever swapped email clients? You'll know what I mean.
   • The golden rule: If you don't know, don't do it.
   • Secondary to the golden rule: Read what the error message is telling you, and think about what you have done to cause it - don't just throw up your arms and swear
   • Educate her that just because something is free, she doesn't have sign up for it, or try and install it.

2. Install Google Chrome - Fast, lean browsing machine.

3. Install your choice of free anti-virus. Something with a low amount of harassment is good.

4. Ensure automatic updates are turned on, and that your mother knows how to deal with them. Accept them, install them, reboot the computer.

My parents ran a Windows XP machine for 4 years with no software firewall - running just Firefox and AVG. They were checking their email, doing online banking, playing some Guild Wars online, and they had no viruses. I've had plenty of challenges from random people who tried to find viruses on my computers, but they always just end up wasting their time.

Answer 3

I don't like just providing links as answers but have a look at this comprehensive lock down guide.

Windows XP Professional Configuration Checklist Details

• Verify that all disk partitions are formatted with NTFS
• Protect file shares
• Use Internet Connection Sharing for shared Internet connections
• Enable Internet Connection Firewall
• Make sure windows update runs regularly
• Use software restriction policies
• Use account passwords
• Disable unnecessary services
• Disable or delete unnecessary accounts
• Make sure the Guest account is disabled
• Set stronger password policies
• Set account lockout policy
• Install anti-virus software and updates
• Keep up-to-date on the latest security updates
• Do not run with administrator privileges by default
• Don't use WEP for wireless networks

Answer 4

Besides teaching her to avoid installing silly things, I don't really see a way.

Of course, have the system updated and with an anti-virus (eventually a firewall).

But in general, if you want to avoid "family-tech-support", there is no real way. Because if you start adding things to block content, block what she can do, you won't be called for the "tech-support", but for the "why can't I do that ?".

Answer 5

Buy her a Mac, seriously all of my family have moved over to Apple Mac's and it's so much easier to fix (if anything ever goes wrong, which doesn't happen often).

Alternatively if she/you can't afford that install Ubuntu.

You can mark this answer as "not useful" but when it comes down to it Windows isn't meant for mum's or anyone who's incompetent with computers.

Answer 6

In general,

• Run as a standard user (Not Admin)
• Run Vista or higher
• Leave UAC on
• Run 64bit (more protections in 64 bit)
• Set automatic update
• Run a web browser that supports sandboxing (currently IE7/8 or Chrome).

Answer 7

Well I would shy away from Norton - In my experience this just grinds the PC to a halt (McAfee isn't much better either!)

I have 4 computers in the house being used by myself, and the "kids" (14, 18 and 20) and I've installed the following;

• AntiVirus: Avast Home Edtion (it's free and has trapped a number of suspect files)
• Spyware: I've started to use SpyBot Search and Destroy which appears to work well (again, it's free)
• AntiPorn: I'm using OpenDNS which is configured on the router and set up to block Porn, Adware, Gambling etc.
• Firewall: If you're running a router then it should handle this for you but if not then ZoneAlarm is a good alternative to the Builtin Windows offering. Having said that, I've not had any problems with the Windows Firewall when dialled up via an ASDL Modem.
• Permissions: Assuming you will be running a recent version of Windows then you can configure them as non-Admin users which will stop them poking around where they shouldn't.

At the end of the day I don't think there is a 100% foolproof solution to this one. My kids still manage to install toolbars and the like. If you lock the system down too far then it just becomes unusable.

Answer 8

Install Ubuntu and all your problems will be healed!

I've had Ubuntu on my netbook for quite some time and just re-installed XP on my parents.

They got a virus just a week into using it.

Answer 9

Educate the users!

Answer 10

Here is what I usually do before turning a computer back in to someone who gave it to me to clear up spyware, etc:

• Change account type to Limited; Create new Admin account if necessary
• Install Firefox + Adblock Plus; Make default browser
• Install Spybot Search & Destroy with schedules and realtime protection
• Update Windows completely
• Set automatic download and install for Windows updates

On the other hand, you could just install something like DeepFreeze which will revert the OS back the state it was when you installed it on each restart (not free, though).

Edit: As Keck pointed out in his answer, Microsoft has a free alternative to DeepFreeze called Windows SteadyState.

Answer 11

1. change her password, and don't tell her what it is
2. unplug the machine from the internet
3. unplug the machine from the wall
4. change your phone number to an unlisted number
5. put a GeekSquad sticker on her monitor

Seriously, if you lock the machine down for protection, the main thing you can do is set Internet Explorer (or whatever) to run with high security, which means that none of her favorite web sites will work, which means that you're going to get even more family-tech-support calls than before ("why won't TexasHoldem.com work any more?").

The best solution for both of you is to get out of the family-tech-support business. Plead ignorance, charge them for your time, be too busy, tell them GeekSquad will do a better job, refer them to Dell Support, whatever it takes to get out of this trap.

And it is a trap. Sure, you want to help your mom, but how about your sister? cousins? your mom's friends whom she told how great you were at it? Unless you intend for this to become a sideline business, best to nip it in the bud.

Answer 12

Here is another one. Maybe it's not exactly what you want, but it takes less time and effort.

Have you considered virtualization? Just let her trash that system, and restore from a snapshot when it is no longer usable. Quick and clean.

And hope she will eventually learn. Or stop trying to learn, 'cause it's easier... It depends on the person, I suppose :)

Answer 13

Might want to consider reboot-to-restore softwares such Deep Freeze or Windows SteadyState and create another partition to store data only. So when problems crop up, just reboot the PC.

Answer 14

Block obscene online material (they don't know that the Internet is for porn).

Your best bet may be Net Nanny or something similar. Here are reviews of the top Internet Filters

Prevent rogue installations of applications. Prevent them from unknowingly changing the security settings or uninstalling applications.

For these two the best thing might be to make yourself an administrator of the computer and have them log in as guest (or any non-admin login). Use admin settings to disallow installing applications or changing system settings.

Keeping the computer/anti-virus software up to date.

I'd install AVG antivirus and Zone Alarm firewall and activate their automatic updating features, along with AVGs automatic scanning.

For GP you may want to run a Flash-blocker or ad-blocker, they're both easy plug-ins for Firefox.

Answer 15

Running Windows as a limited user is definitely the best way to keep out malware. Limited user is preferable to anti-virus software and I haven't heard of a single browser vulnerability that was exploitable in limited user mode.

The problem with Windows limited user privilege is that runas works in a completely different user context -- the one that is used to supply the credentials to runas. This breaks down in all kinds of ways that Mom just isn't going to grok. Even getting Mom to understand how to enter runas commands in cmd.exe is going to twist her knickers.

Linux has the right answer and it comes in two parts: first is software repositories and the second is called "sudo" (insert xkcd comic here) which stands for "super user do". sudo runs in the current user context which tends to make things work right. There is a sudo for Windows that I like called surun.exe available from http://kay-bruns.de/download/surun.zip, but I'm not sure I recommend it for Mom unless you tweak it for her. But it does have the nice capability to let Windows Update or Microsoft Update run in limited user mode and it allows limited users to change power options and set the clock.

If you set Mom up in limited user mode, you need to create an Administrator account to use for installing and tweaking. I suggest you remote logon and do the heavy lifting for Mom, but check out surun.exe if only to allow AU and the other features it includes by default for limited users.

Another option is to have Mom run her browser in a sandbox, like sandboxie.exe. I can't recommend it, unless you want to prevent Mom from downloading and uploading personal stuff like photos and chain letter jokes. But if Mom doesn't do downloading and uploading, a sandbox is the best way to get limited privilege to apply to the most vulnerable application on Mom's machine.

Answer 16

1. partition the hard disk.

2. install Windows and all necessary programs.

3. point user folders (desktop, documents, favorites, emails, etc.) to another partition.

4. create a an image of the system drive (usually C:)

something goes wrong, you can restore the computer with a minimum effort to the state it should be in.

if you want to take it to the next level, try this:

6. install a RAM disk (size depending on the requirements and available system memory).

7. install Sandboxie and point the container folder to the RAM disk (drop rights if on an admin account) and add the desired download folders to 'Quick Recovery'

it's getting even better if you want to pay the little registration fee for Sandboxie (which allows you to install the software on any computer your own).

8. now that you have Sandboxie registered, force the web browser to run inside a Sandbox all the time (if you're using a web browser that is mad for updates, disable auto update!)

alternatively you may consider DeepFreeze, even more efficient but possibly a bit too restrictive for Mum's taste. good luck and enjoy the time you have just saved from being the in-house tech support! :)

Answer 17

Make her profile read-only.

Answer 18

My choice as an old time Usenet hacker (white hat, software hacker, etc.)...

Windows XP:

1st drive or partition: install Windows and all needed stuff (you won't be able to touch it after, only the real administrator can do that) Security software is less needed. Remember OpenDNS!

2nd drive or partition: put my documents and a 2nd program files folder in it, portable applications and all files that you want to keep, like music, pictures, etc. (tell everyone that they have to save and install their stuff there because they lose all they have done if not done) > an installation is simple, you change the C for a D (the 2nd drive), C:/Program Files/. Also link My Documents folder to the one in the 2nd drive.

Now put Windows steady state at all settings, it will reset the computer as you installed it for the 1st drive only at each restart.

For Linux: Also note that the Linux idea is not all-wrong, it's also bulletproof! Ubuntu (Big up for Edubuntu - Ubuntu project for education for not very rich nations) is simple but she use her computer so little but SliTaz 2 a little modded (with help or by learning - it's worth it!) should be more than enough 30 Mo only for a Linux desktop that will be faster than any Windows version but you have a downside and OpenDNS work with it also.

The real deal: the family is ready if it has a real value: money, learning, help good projects, being part of a real team that really work for them or keep up with Microsoft that don't understand the need of peoples that slave them blocking their reals thoughts, that make a product that sometime miss more than win ... For me, it's why I gave Linux a chance. It's not perfect, but I have found some parts that I can live without now, mostly human, though.

My Linux passion came from people that work for the freedom of the knowledge like Didier Roche, a writer and secretary from the French Ubuntu team and the knopmyth developer so I wish luck to both of you, if you read me ... That's the real Linux life, even Linux stars are just like normal people and they will help you, like they have been helped by someone before. I want to be a part of this chain, that's all! The true beauty of the world is sharing!

Answer 19

Install Ubuntu :) It will silently update itself, it never breaks, Firefox is the same as in Windows, MS Office will work under Wine. I had really positive experience with it and really negative one with Windows XP in the same situation.

Answer 20

Install Opera and/or FireFox. Install NoScript in FireFox.

Make sure (with shortcuts, etc.) that Opera/FireFox is easier to start/find than Internet Explorer. Try to make Internet Explorer unsusable, like directing it to a non-existing proxy-server, etc.

Make Opera/FireFox the default browser.

The following makes use inconvenient, but the question was about security:

Block JavaScript for all sites (e.g. set in Preferences in Opera and using NoScript in FireFox), except for the ones you explicitly allow. Most of these will need to be set later by the (inexperienced) user. This is where it becomes inconvenient.

Allow JavaScript for some common sites, e.g. YouTube and Gmail. Test that it actually works.

Answer 21

Install A-SquaredAntiMalware (paid) and make sure that it updates and scans automatically. Also set all "Surf Protection" settings to "Block Silently. Add MVP Hosts file, OpenDNS, and WinPatrol. Explain that if Scotty barks it's important and read it carefully. WinPatrol warnings are the only ones she'll get, and those very infrequently. Also explain that she will see a lot of 404's as her protection works for her- and that's a good thing.

This is the way I protect my 83-year old mother's Windows XP system, and she has had absolutely no malware issues at all.

Answer 22

1. Check your local library (or bookstore) for computer security books (Dewey-Decimal section 005.8). Look specifically for books about “hardening Windows and networks”.
2. Don’t connect her system directly to the Internet, connect it through a router. Even with the default settings, it will be much more secure than connecting it directly to the Internet.
3. Give her a brief crash-course on using the system and the Internet.

Answer 23

Try Sandboxie

Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

Benefits of the Isolated Sandbox

• Secure Web Browsing: Running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded trivially.

• Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't leak into Windows.

• Secure E-mail: Viruses and other malicious software that might be hiding in your email can't break out of the sandbox and can't infect your real system.

• Windows Stays Lean: Prevent wear-and-tear in Windows by installing software into an isolated sandbox.