Windows security recommendations

by Jim Prall, May, 2010
back to my main page

This page is directed at users who manage their own computer or laptop running Microsoft Windows. Many different software risks threaten the reliable and secure use of Windows: viruses, trojans, network worms, spyware, browser "hijacks", and deceptive "phishing" websites. Anyone who uses Windows with administrator rights needs to pay attention to managing and mitigating these risks.

Software intrusions involve some computer code installing itself in your system without your consent or knowledge. These may arrive any number of ways (roughly in order they arose historically):

Route 1 was prevalent in early days when people shared files by floppy disk; antivirus software now checks for this, and far fewer floppy disks are being exchanged; unfortunately it has come back with the advent of USB memory sticks.
Route 2 became less prevalent since Microsoft removed the option to write macros that could execute silently on opening with no option for the user to agree or disagree.
The risk from route 3, email attachments, is being mitigated by email service providers either scanning or just removing attachments types that are a potential threat: .EXE, .SCR, .BAT and even .ZIP (potentially hiding a .EXE inside). This has inconvenienced users sometimes. If you are collaborating via email in developing code, you can email source code but not Windows executables - they will have to recompile from the source at their end.
Both #4 and #5 create the need for "real time" anti-virus scanning, where each request to create a new file triggers an AV scan of the content of the new file. This imposes some performance penalty on normal use - but nothing compared to the loss of use when an infection gets through. User judgment is also called for: think twice before downloading and steer clear of P2P file sharing - the latter is not permitted over UofT and ECE network facilities.
Threat #6 calls for two precautions: (a) only connect to the internet with a firewall - most home routers and wireless APs include one; and (b) keep your system patched at all times with the free Windows Update / Microsoft Update service. Set the updates to install automatically. If you leave it on manual, the risk is that you'll keep postponing them, and then the latest network intrusion will be able to get into your PC - patching after that is too late. Threat #7 is very prevalent currently. It relies on the fact that you don't have to take any action to download executable code embedded in a website in the form of ActiveX, javascript, and the like. These "drive-by downloads" take effect just from viewing a page, including content added in from a separate site such as by ad syndication. It may not be an obviously risky site such as "hackers haven" or "pirate cove" - sites with legitimate content may have been attacked and had the exploit code hidden within their normally benign pages.
This is happening more often lately, and it is creating a lot of extra support calls as Windows PCs keep getting infected, even when they have antivirus and anti-spyware software working. Antivirus software generally does not come into play when a web-based code exploit is running - the AV does not scan javascripts or ActiveX.
There are browser plug-ins available to restrict the activity of such active content, such as NoScript for Firefox; you may find you need to allow javascript on pages where it is legitimately needed; the difficulty is deciding when it is safe, which these tools cannot tell you.

What you can do

The usual advice applies, of course: have good antivirus and anti-spyware programs installed, keep them current with live updates, and monitor their status (are the updates still working? Is there anything showing up in the logs or 'threat history'?) Also keep your browsers up to the latest version, as all browsers have security flaws discovered from time to time, and the update is the only way to secure them. But perhaps the one thing you can control, which so many users overlook, is this:

DO NOT BROWSE THE WEB AS ADMINISTRATOR

Let me state that another way:

To use a web browser in an account with administrator rights is a recipe for infection

Or another way:

If the account you use to browse the web has administrator rights, your PC has spyware. Now. Already.

Q. What is the right way to operate in Windows?
A. Have a standard/limited user account as your main account, and only browse the web in that account. Keep all your documents there. Use Administrator only to install or update software and system components. Reading email, browsing and downloading documents should only be done within the standard user account. The key difference is that when Administrator happens on a page with hidden intrusive code in active content such as javascript or ActiveX, the code has full access to modify C:\Windows, update the registry, etc. By contrast, a standard user account viewing the same page will leave the exploit code unable to make the changes it tries to apply.

Another reason to keep Windows secure

Do you take your laptop back and forth between the office and home or other locations? Do you use a USB memory key or portable HD to move data between Windows computers? If so, any virus that infects your USB key or your laptop elsewhere could potentially spread through our network when you connect here, impacting your colleagues and costing time and effort to remove. The ECE firewall can block network intrusions from outside, but it is powerless to stop people carrying infected media or laptops inside its perimeter.

Steps to keeping Windows intrusions out

If Already Infected

If you suspect an infection, unplug the network cable immediately. If you need internet access to work on the infection, use any other computer available if at all possible. Check your USB keys for a hidden "Autorun.inf" file. One tool offered to remove this worm is the F-Secure removal tool at: F-Downadup The current update of the Windows Malicious Software Removal Tool, delivered via Windows Update, also claims to be able to remove it. Bear in mind that this worm is polymorphic and uses the internet for self-updating with unknown additional malicious code, potentially always varying depending on the decisions of the worm's remote operators. This also helps them evade defenses like Antivirus, firewall rules, etc. It is best not to reconnect to the internet until you're sure the worm is removed. Watch out for cache, System Restore, and files that hide in memory and keep replacing any bad files as they are removed.