Home Security Tip: Nuke It From Orbit
I say we take off and nuke the entire site from orbit. It's the only way to be sure. -Ripley (Sigourney Weaver) in Aliens
While working at home has some definite advantages, like the Executive Washroom, Executive Kitchen, and Executive HDTV, all this working at home alone can get a little isolating. I realized the other month that I spend more hours every day with my cats than any other human being, including my wife.
Thus I tend to work out of the local coffee shop a day or two a week. Nice place, free WiFi (that I help secure on occasion), and a friendly staff. Today I was talking with one of the employees about her home computer. A while ago I referred her to AVG Free antivirus and had her turn on her Windows firewall. AVG quickly found all sorts of nasties- including, as she put it, "47 things in that quarantine thing called Trojans. What's that?"
Uh oh. That's bad.
I warned her that her system, even with AV on it, was probably so compromised that it would be nearly impossible to recover. She asked me how much it would cost to go over and fix it, and I didn't have the heart to tell her.
Truth is, as most of you professional IT types know, it might be impossible to clean out all the traces of malware from a system compromised like that. I'm damn good at this kind of stuff, yet if it were my computer I'd just nuke it from orbit- wipe the system and start from scratch.
While I have pretty good backups, this can be a bit of a problem for friends and family. Here's how I go about it on a home system for friends and family:
- Copy off all important files to an external drive- USB or hard drive, depending on how much they have.
- Wipe the system and reinstall Windows from behind a firewall (a home wireless router is usually good enough, a cable or DSL modem isn't).
- Install all the Windows updates. Read a book or two, especially if you need to install Service Pack 2 on XP.
- Install Office (hey, maybe try OpenOffice) and any other applications.
- Double check that you have SP2, IE7, and the latest Firefox installed. Install any free security software you want, and enable the Microsoft Malicious Software removal tool and Windows firewall. See Security Mike for more, even though he hasn't shown me his stuff yet.
- Set up their email and such.
- Take the drive with all their data on it, and scan it from another computer. Say a Mac with ClamAV installed? I usually scan with two different AV engines, and even then I might warn them not to recover those files.
- Restore their files.
This isn't perfect, but I haven't had anyone get re-infected yet using this process. Some of the really nasty stuff will hide in data files, but especially if you hold onto the files for a few weeks at least one AV engine will usually catch it. It's a risk analysis; if they don't need the files I recommend they trash them. If they really need the stuff we can restore it as carefully as possible and keep an eye on things. If it's a REALLY bad infection I'll take the files on my Mac, convert them to plain text or a different file format, then restore them. You do the best you can, and can always nuke it again if needed. In her case, I also recommended she change any bank account passwords and her credit card numbers.
It's the only way to be sure...
—Rich
