How to set up restrictions to get rid of viruses without antivirus?

Youri_M4U2011-06-30 16:55:48

Malware

Youri_M4U, 2011-06-30 16:55:48

The other day I read a story on IT happens about how a friend, thanks to setting up Windows, closes many holes through which viruses enter the system: ithappens.ru/story/6548
Alas, my knowledge is only enough to prohibit autorun from flash drives. I would be grateful if you tell me where you can read the instructions on this topic. Or write in the comments mini-tips on how to plug the main holes.
I would also be grateful for information about the difficulties that can lead to working with a system configured in this way.

Answer the question

In order to leave comments, you need to log in

10 answer(s)

MiXei4, 2011-06-30
@MiXei4

About windows without antivirus
habrahabr.ru/blogs/sysadm/97594/
habrahabr.ru/blogs/sysadm/102298/

inoname, 2011-06-30
@inoname

plug the main holes? install all updates of your OS in time.

svfoster, 2011-06-30
@svfoster

If you have Windows XP, use SRP (Software Restriction Policy) - prohibit the launch of any program that is not located on the standard paths (Windows, Program Files).
Windows 7 - AppLocker, Same, but slightly modified. The essence has not changed.
There are several pitfalls, write to me if you decide to use this method - I will advise.

Mikhail Shevtsov, 2011-06-30
@mshewzov

Many times I thought about completely getting rid of the antivirus. However, I still haven’t got rid of it because there are viri that do not need any admin access and other delights. They have enough rights. Encrypt everything nafig, for example.

fluxion, 2011-06-30
@fluxion

Above, mixei4 and svfoster have written everything exhaustively. However, I’ll throw , to the heap, a couple more links:
forum.sysadmins.su/index.php?showtopic=16346
sysadminz.ru/index.php?topic=114.0
since these settings obviously do not protect against scripts running in the browser. So, in my opinion, it would not be worth sitting without antivirus at all.

Aux, 2011-06-30
@Aux

In general, to be honest, you need to be well versed in the internals of the system used, as well as in security issues. If you yourself have never designed viruses and do not know how to check a binaric for infection by hand, then there is little point in doing this.

Airton, 2011-06-30
@Airton

From my own experience:
1) Set WinUpdate to "notify me of new updates" mode and install all security updates (or better, all updates in general) as they are released.
2) Install software only from official sites or reputable hosts, which are linked from official sites, for example - Download.com or Filehippo
3) check exe files received from unreliable sources on virustotal.com
Viruses have not bothered me for many years.

kostik450, 2011-06-30
@kostik450

I was somehow struck by a virus that lives in PDF, the first time I encountered this live.
And I didn’t do anything, I just walked around Vingrad.ru details here:
forum.vingrad.ru/forum/topic-326035/anchor-entry/0.html
This is me to the fact that you need to update not only Windows constantly, but everything popular programs too.

charon, 2011-07-01
@charon

I personally believe that if a person asks such a question, then he a priori will not be able to achieve a result. Such knowledge is not transferred, but acquired by experience. Security is more than once set and forgotten, security is a process.
PS: I myself use antivirus, but free. I know a little about the safe setting of Windows.

Solver, 2011-07-01
@solver

1. Disconnect the computer from the Internet. Fully. Pulling the cable out of it.
2. Cut off all USB ports so that flash drives cannot be used.
3. Chop off CD / DVD and all reading devices.
4. They hope that they have not yet come up with malware for computers that are transmitted by coughing, sneezing and shaking hands ...