Free, Near-Foolproof Way to Evade Windows Spyware

adam wenner writes "I have typed up instructions for 'non-computer people' on how to remove spyware and malware (and viruses for that matter). I have tested this procedure on about 40 computers and have never had any problems with any of it. Most people would say a nice 'format c:' would solve the problem, but for most people, that isn't good, and it's a headache reinstalling and migrating stuff over to a freshly formatted machine." I could have used this a few months ago while trying to mitigate malware damage to a friend's system.

Comments

Step 1

[lexarius]

Remove network card and modem.

Re:Step 1

[JamesTRexx]

I thought step 1 was to remove user... *cleans shotgun*

Re:I'd be the last to post something like this, bu

[timothy]

a) The good thing about the linked list is that it gives a step-by-step for those not much familiar with Windows (like me), but sometimes asked to help with someone else's crippled machine.

b) Not everyone's ready to give up Windows; the grandmother whose machine I (very slightly) helped clean up this winter likes Windows well enough, when it's working, and she brings home work from the office to do on it. Her husband's machine, though, I just replaced with one running Knoppix. Progress, progress. They both like the card games that come with a typical Linux install (and there are more than come with Windows).

c) This *is* educating users.

So ... what's the problem? :)

timothy

A couple of extra steps..

[Mike McCune]

1. Don't run as administrator. Create another account as restricted user for daily use. Most spyware requires administrator rights to install.

2. Download and install Microsoft Antispyware http://www.microsoft.com/athome/security/spyware/s oftware/default.mspx . Sure is is still beta but it works pretty well. For those anti MS types out there, MS bought this software from Giant Software.

Any other tips?

Re:Firefox is perfect

[OneDeeTenTee]

Firefox has zero bugs???

They're features.

BartPE

[zmedico]

It's called BartPE. There are many Plugins available. People involved with this seem to all be members of the CD Forum.

Not good enough, I'm afraid

[PurpleFloyd]

These instructions provide a good start, but they simply don't cut it against the newer strains of spyware. I am known as a "computer guy" among friends and family, and thus get called upon to solve spyware problems fairly regularly; the ingenuity of the spyware pushers continues to astound me. Here's a partial list of things I had to remove by hand on my last 4-hour session on one computer, after running Spybot S&D and Adaware:

• An Active Desktop background which displayed an ad for spyware removal. This was a pain since it was locked into place using the Group Policy security system, the tools for which aren't available on an XP Home system.
• A couple of processes which managed to get themselves into Safe Mode. I had to use a Bart-PE Windows LiveCD to kill them
• About 20 Browser Helper Objects, including one which inserted its own referrer links into Google results and 3 toolbars, and 50 startup processes that neither Spybot nor Adaware found

While automated tools are useful, and will likely become more useful as the market matures, they are certainly not a panacea. These days, the only way to eliminate spyware is to not get it in the first place; that's where we, as computer professionals, should be focusing our efforts.

Startup

[thing12]

And it's nice to have Mike Lin's StartupMonitor and Startup Control Panel installed. Helps to keep things from being added to start without your knowledge, and lets you disable them after the fact.

Re:An alternative way...

[moosesocks]

Nice, but not exactly practical or well-supported.

There's a product called DeepFreeze commonly used in academic computer labs that effectively has the same effect. Any changes written to disk are lost at the next reboot. You don't have the RAM limitations of a LiveCD, and you're immune to any virus or spyware under the sun.

As far as I know, it's a very secure piece of software. The company used to have a challange that they'd pay $500 anyone who could disable the software without the password or booting off of a floppy and reformatting the hard drive.

As you can imagine, it's a godsend for K-8 computer labs. Students can experiment and install whatever the heck they want, and if they screw something up, just shut down and reboot.

Running without admin rights?

[Alwin Henseler]

1. Don't run as administrator. Create another account as restricted user for daily use. Most spyware requires administrator rights to install. No. This works real well in Linux and OSX, but not in Windows. It produces way more headaches than it solves, because the concept of not running with admin rights is still fairly new in the Windows world (..)

I think I should point out some practical experience here, that suggests the opposite. A number of months ago, I helped clean spyware off my parents' PC. Installed Firefox, and my dad agreed to set it up as default browser, so that URL's opened by other programs use Firefox too. Don't underestimate the significance of this; if you can convince grandma to use the safer browser by default, make it so. If you need to, rename the "Firefox" icon as "Internet".

Installed recent versions of common plugins (Flash, Java & QuickTime IIRC), and asked my dad NOT to agree/install any other plugins after that, only make a note of what's felt as 'missing'. So you have Firefox, you have all common plugins (working! and recent versions). Not enough? Then either that site is badly designed and should be avoided, or additional 'plugins' may mean 'malware'. If I overlooked some popular plugin, my dad will let me know on my next visit.

Next, I setup separate user accounts, without passwords. I felt that asking my dad to enter a password each time was too much hassle, but he agreed that clicking on his name, once during bootup, was OK (you take what you can get). Account setup was easy, my dad knows how to use admin account if he needs to install something, but normal work is done as non-priviliged user.

Ofcourse I enabled automatic updates (WinXP), and in this case ignored the firewall setting, since there's a hardware-based firewall box between the ADSL connection and my dad's PC. Regardless of quality, a harder nut to crack than any software-based firewall (decent password set, and any outside-access options disabled on that thingie). A hardware-based firewall also makes OS reinstalls safer/easier.

The only changes my dad sees: a single click on his name on bootup, and a slightly different looking browser program. A couple of months later, I asked my dad what he had noticed lately. Only comments along the lines of 'one or two programs complaining about being unable to install something, but nothing that got in the way of normal use'. I explained him that there was a good chance, that these programs complaining where likely stuff he wouldn't want/need on his PC anyway, so these rare 'unable to install something' dialogue boxes could be regarded as positive signs. ;-)

It produces way more headaches than it solves (..)

Assuming the above scenario could work for many Joe Sixpacks and grandma's, your claim is obviously flawed. A priviliged admin account is needed either for installing software, running applications with special needs, or performing special tasks. Exactly the sort of thing Joe Sixpacks and grandma's DON'T DO (or SHOULDN'T be doing!). So they'll be fine with a non-priviliged user account.

For folks where this is not the case ('advanced/power user'), you can assume they know what they're doing. If not, those users only have themselves to blame for not RTFM.

So as you state, a couple of simple steps like this can prevent 99% of the problems. Read: not producing, but preventing headaches. All of the above was easy and took little time, and I don't expect to spend much effort on cleaning virus/spyware crap from that machine in the future. If anything, the next step would be buying a "Linux for dummies" book, and installing a newby-friendly distro a la Mandrake or Ubuntu. My dad already tried to install Linux once, so he's definitely interested. ;-)