How To Avoid Viruses At Windows Install Time?

reallocate writes "Can a home user install and update Windows without being attacked by a virus or worm? I'm a Linux user; have been since 1995. Recently, I needed to install Windows XP Pro on a home desktop machine with a Roadrunner cable connection. I tried twice. Both times, the machine was attacked and rendered unusable before I was able to pull down the first update from Windows Update." Read on for more details of what went wrong and when.

Here's a synopsis of my install method:

1. Put the Windows XP CD in the drive;
2. Disconnect the cable modem from the network card;
3. Reboot and install Windows;
4. The box remains off the net during the entire install: no registering, no setting up an ISP, no activation, no network configuration, no nothing. (BTW, the only networking component that I install is tcp/ip. All the other MS stuff never gets on the machine.)
5. Reboot; Windows runs and all is well;
6. Install the current version of Norton Internet Security Professional from a shrinkwrapped CD (firewall, anti-virus, etc.);
7. Configure the Roadrunner net connection and reboot to pick up a DHCP lease;
8. Launch the Norton update facility (per Norton's recommendation, the built-in XP firewall is turned off);
9. Complete the Norton update and reboot;
10. Launch Windows Update;
11. Start to pull down Service Pack One; per Microsoft's instructions, all firewalls are turned off.

That's as far I got. During the first attempt, I acquired a virus or worm before I could finish the Norton update (machine powered down). On the second attempt, I got as far as Windows Update and SP1(continual rebooting).

So...how would you do it?"

Comments

If you can stand waiting...

[foidulus]

You can get a cd from microsoft(more info here that would have a lot of the updates you are looking for. You could also download it from your linux machine, and then do the whole installation offline.

Re:If you can stand waiting...

[XaviorPenguin]

There is another way. If you go to Autopatcher.com, you can download all of Service Pack 1 and pre-Service Pack 2 updates with all critical and recommended updates. It is a hefty download (300MB +) but it is worth it. It comes with:
-Direct X 9.0b + Updates
-XP Powertoys
-SP1 Critical and Recommended Updates
-Pre SP2 Critical and Recommended Updates
- + More

I use it and it is updated every month. Get it while you can!

Re:If you can stand waiting...

[LoneIguana]

You can access the windows update catalog here: http://v4.windowsupdate.microsoft.com/catalog/en/d efault.asp There you can get secruity updates for all versions of windows. You actually download them to your computer rather then installing them. You could download them on another computer burn them to a CD, then install before connecting to the internet. The only problem is you need a computer with IE. Maybe get a friend to burn it for you?

Re:If you can stand waiting...

[TPS Report]

You can (with just a few mouse clicks) automatically create an up-to-date ISO of Windows XP/2000/2003 with XPCreate. It's a really nice utility.

Re:If you can stand waiting...

[zoloto]

DUDE THIS ROCKS!
Actually, what you can do is use Wine or WinEX and install Internet Explorer 5.5 from an old 5.5 installation CD on Linux,... download then burn to CD and you'll be great. I did that just now and i have to say thank you for the link.

It seems that any useful links, MS hides behind a rediculous naming scheme for some odd reason.

Thank you again, if I had MOD points, I'd certianly give them to you.

Re:If you can stand waiting...

[BollocksToThis]

The only problem is you need a computer with IE.

If you go to the Microsoft download center, you can download every patch with (almost?) any browser. I downloaded service pack 1 and every patch after that using nothing but Opera.

It was less convenient than using WindowsUpdate/IE, but it would still have worked on a linux machine. The best part is, when friends give me their computers to reinstall XP, I don't need to spend four hours downloading patches from scratch.

Re:If you can stand waiting...

[Condor7]

Autopatcher.com also has a Lite version and an UltraLite version.

The UltraLite version contains only Critical and Recommended updates, along with IE and Outlook patches, and weighs in at 89MB.

Re:If you can stand waiting...

[jonfelder]

Sure. But *CAN* you do this?

Absolutely. Just install the hotfixes that pertain to kernel vulnerabilities.

But it's the *RIGHT* thing to do from a security point of view. If you're file-server is running X & Gnome & KDE & Wine & Kazaa, you're *BEGGING* for trouble.

While you can't avoid installing the gui and what not in windows, you can turn off almost all of the running services. Technically, not that I'd advise it, you could avoid running IE, Outlook Express, etc...and forgo patching them in a server environment. Just don't run any apps either.

The hard part about microsoft is that it's really hard to do that, since (as the article pointed out) the default install has everything with all the holes pre-installed and running.

So does a default install of many distros...ones as old as XP even more so.

I'm not a Microsoft advocate, I dislike Microsoft products for multiple reasons, but the size of the patches isn't one of them. All I'm saying is that when comparing a default (normal size) linux distro install to a default windows one, the amount of patches you need to install are similar.

Re:If you can stand waiting...

[ComaVN]

MD5 is weak in the sense that it is possible to create two files with identical hash. It's NOT possible (at the moment) to create another file that has the same hash as an existing one.

So, for this purpose, MD5 is adequate.

You're right about SHA being better though.

SP1 From CD

[The Snowman]

When I install Windows it is behind a NAT firewall which helps (no open ports from the outside). The first thing I do is install SP1 from CD, next I update from Windows Update.

I recommend downloading SP1 and burning it in Linux, then using that CD to patch up the Windows box before connecting it to the network.

Re:SP1 From CD

[msobkow]

I run behind a firewall as well. Last time I did a WinXP install (not that long, unfortunately), I had no problems.

But I don't install or enable any services during an initial installation, just the core OS. I don't do anything but install manufacturer's drivers before installing an anti-virus product.

After the anti-virus is fully updated, then I start dealing with Windows updates.

At no point have I ever had to disable hardware or software firewalls to install Windows updates. I have no idea why they continue to insanely recommend you remove all your security just to download updates -- you don't need to.

In fact, the only time I shut down the antivirus is during a disconnected defrag. And there is no way to disable the hardware firewall.

If you're connecting directly to the net with a Windows box, you're just getting what you deserve. Either hide it behind a hardware firewall, or accept the fact that you're just another spambot-in-waiting.

Easy

[daveschroeder]

Do the installation behind a personal NAT/firewall device.

(Or, read all the posts about how you can put together some huge, convoluted update CD that's never completely up-to-date instead of just spending $35 on a little hardware firewall.)

Re:Easy

[Josh_Borke]

or install zonealarm. and don't turn off the firewall. I've never had to turn off my firewall when doing any windows update.

I would update windows before updating the firewall, that way you don't have to worry so much about being shutdown while the firewall is down.

my .02

Re:Easy

[Otter]

OR turn on the windows XP firewall under the advanced tab on your network connection's properties before you plug the network cable in.

I've installed Windows once (98, several years ago) and even I know about turning the firewall on. Why?

Because this is at least the fouth freaking article Slashdot has run on this question!!!

(Remember the one that linked to an article about "Installing Windows Safely" and all the posts were "Instead of linking to a large PDF, why not tell people to just turn the firewall off?"?)

Its easy...

[CyberBill]

Leave the software firewall turned on if you can, if not, get a cheap Linksys Cable/DSL router, it will block all of those viruses.

I have to reinstall most of my family's computers when I go home, I made all of them have routers. :P

-Bill

Firewall

[jpaz]

Keep the firewalling on, no matter what Microsoft says. I've never had an instance where having a firewall turned on kept windowsupdate from working properly.

Re:Firewall

[orin]

This is absolutely correct. You can even use the simple Internet Connection Firewall that is built into Windows XP

Easy

[Masami Eiri]

We do this all the time where I work.
Use another machine to burn a copy of the latest service pack, and the Sasser worm fix, and whatever other updates you want to include.
After installing, install the updates from the CD, then check windows update for anything else.

Probabl redundant at this point, but...

[__aavhli5779]

Yes, a firewall and/or NAT is all you really need. Evidently Norton Internet Security did not live up to its promise, which comes as little surprise to me, I must admit.

I've had success installing Windows XP and upgrading it with only Microsoft's Internet Connection Firewall enabled.

Firewall

[fremen]

...all firewalls are turned off.

Why don't you try turning the firewall on? It will block the RPC calls that are necessary to infect your machine with the most recent series of worms and allow you to install whatever patches are necessary worry free.

Plus, it just makes your PC safer in general.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Download the Service pack before install

[borwells]

Download the SP1 Network install before beginning your XP installation. Stick it on a CD or a Samba share and install it prior to connecting to the Internet.

External firewall?

[pilkul]

You say you're a Linux user; why not plug one of your Linux boxes to the 'net, use it as NAT-routing firewall using iptables, and download the updates from behind the firewall? It's always worked for me. Or if you only have one machine, you can buy a cheap NAT router for 50$ nowadays.

This solution seems so obvious to me that I wonder why you even bothered to ask. With your apparent technical knowledge, surely you must've thought of this. I'm inclined to think this question was just a veiled way to start an article bashing Microsoft about all the worms affecting their system.

Re:Simple, Get an external Router.

[yamla]

You don't believe you can get infected in 20 minutes? The record at the undergraduate department of Computing Science at the University of Alberta is SIX SECONDS from plugging in an installed, unprotected Windows XP system until the time it is infected.

It is highly unlikely that you could run an unprotected XP system with no firewall and no patches, hooked up via a cable modem or ADSL, for even ten minutes before getting infected.

Autopatcher!

[calebb]

I can't believe nobody's posted this yet!

Autopatcher

AutoPatcher was started in October of 2003. It was started by Jason Kelley and was a simple batch program that would install many updates silently. Upon reaching version 2.65, Jason was contacted by Antonis Kaladis, who offered to help make a VB front-end for the program. And thus, the current incarnation of AutoPatcher was born.

Not only does it install all your Windows updates with just one reboot, it can also (optionally) install many other programs such as the Windows XP Powertoys, IESpell, etc. There's even some registry config options such as increasing the max connections per server (IE) to something greater than 2.

Found at isc.incidents.org:

[BandwidthHog]

Windows XP: Surviving the First Day

but if you can't....

[Mydron]

There are a few guides out there explaining what to do. Most of them involve shutting off windows services (such as file sharing and the windows network client) and using the firewall included with Windows XP before connecting to the internet.

Here is a fairly comprehensive guide, aptly named: Windows XP: Surviving the First Day

Re:but if you can't....

[dknj]

This is a pretty poor Ask Slashdot article, IMHO. Here is how I do it within an hour and have nothing to worry about:

1. Unplug network cable
2. Install Windows XP
3. Upon first boot turn on the Windows Firewall and reconnect network cable
4. http://www.windowsupdate.com
5. Wait for patches to download, then remove network cable and reboot after patches have installed
6. Return to http://www.windowsupdate.com and download the remaining patches
7. Reboot (no need to unplug network cable this time) and install a Virus Scanner/Firewall Suite.

This takes an hour and isn't rocket science.

-dk

Re:but if you can't....

[innosent]

Problem is, the Windows Firewall is almost completely useless, and the average computer is probably hit by an attack every 20 minutes, which is far less time than it takes to download all of the patches, especially since the first reboot will only cover SP1, which only eliminates about 5% of the active exploits. The original (I'm told the SP2 version is better) windows firewall does not protect people from any of the attack vectors I've seen coming through my network so far this year. It is a "stateful firewall", it's just that the only state it maintains is an open one. It does not protect the computer from access to system services (most notably RPC), so it cannot protect people for long enough to patch their systems. There are only two methods for a clean install, either install and patch offline from CDs, or install from behind a stateful firewall (either a cheap linksys/dlink/netgear type or your network firewall). All installations we do at work are done initially on the private segment of the network, with packets sent through a NATd portion of the firewall (which by the nature of NAT accomplishes exactly what is needed). Of course, we also drop packets which have no legitimate purpose on our network, and log the supposed legitimate ones, which is probably a bit beyond the requirements for installing XP on granny's computer.

Re:but if you can't....

[dknj]

Except the firewall will block incoming connections. Don't go to other sites which will exploit old IE bugs and install spyware/viruses/etc, go straight to windows update after installing windows. That will patch up to SP1.. there is a known bug with the firewall that will leave the machine vulnerable for a few seconds (enough to get infected) during the boot before SP1 finishes (or it may be another patch that fixes it.. i don't remember), this is why you remove the network cable before you boot the second time. After you patch it completely, you can install your firewall suite and virus scanners (as i stated).

I used to do this on a daily basis, before I switched to a fully automated ris build, and never had an infected machine.

-dk

make sure you block all incoming ports

[steve.m]

sasser exploits a vulnerability in lsass.exe, which listens on 445. Some software firewalls leave this open, as it is required for Active Directory logins under some circumstances. If you do that and then go straight to windows update you should be fine.

OP: The 100% best answer

[Glonoinha]

Go to Best Buy and get a Linksys BEFSR41 router / firewall device.
Plug your computer into the LAN side.
Clone the MAC address of your computer.
Change the password on the router to something other than 'admin'.
Plug in your cablemodem into the WAN side.
Enjoy your new worm/virus/trojan free existance.

How many times do we need to spell it out??

This is exactly how to do it.

[Anonymous Coward]

1. Pull machine off net
2. Install box
3. Configure TCP/IP and enable windows firewall
4. Plug in network cable
5. Windows update
6. Repeat windows update

Job done.

router

[DerWulf]

Pick up a router from SMC ( I can recommend the 7008/4 ABR series). Even if you don't want to setup a home network, this is the best way to go I think. Even with the sygate firewall it could ( in theory) happen that the software silently crashed, leaving the icon still in the system tray until you move the mouse cursor over it. Also I wouldn't rely on Windows Update to keep your computer safe. If your unpatched version can get infected, your updates will not prevent infection when someday an exploit gets releases sooner than the patch. When using a router, all incoming connections will be refused by default since the router itself is only running the administration tool. Add a personal firewall for save measure in case the router gets compromised and you are set to go. Also you can seamlessly add computers to your network, all sharing the same internet connection and printer. As a side note, the Norton firewall has crappy configuration options and its all in baby talk. I didn't like it very much. Zonealarm doesn't work well with edonkey, overnet, emule, also, if you forbid all the notorios windows applications (explorer.exe, alg.exe, svchost.exe) all access to the network, you are in for a very unstable windows expierence. Sygate is still the best of the three.
I bought the router to finally rid me of the personal firewalls tedious configuration ( which btw, you have to do again on each install, with the router it stays with you forever ;)

Not associated with SMC, I just picked up the model mentioned above friday and I am very happy with it.

Enable the built in firewall

[cascadefx]

Enable the built-in firewall in Windows XP before going online. This will resolve a lot of your problems.

Also go into the widnows update site (on another connected computer) and click the update options to the right. There is an option to turn on the catalog view (or something like that... in Linux right now). This will allow you to search for all the updates of a particular Windows platform.

Use this to download the patches and burn them to a CD... Use this CD to patch your system.

Jim