4

In various places (notably, the English Microsoft Answers forums1), people are quick to note that a Windows machine should not get connected to the internet without any anti-virus software installed. Otherwise, infections are said to happen within minutes by means of built-in security flaws.

At the same time, some anti-virus software is following the current trend of providing only online installers2. These installers are only tiny packages that will download the required installation data on the fly once started on the target machine. Obviously, these won't work without an internet connection.

What is a safe procedure for setting up malware protection on a new PC when I should not connect to the internet before having the malware protection in place, but cannot install the malware protection without connecting to the internet?


1: e.g. in this thread: "A computer should NEVER be connected to the internet for extended periods (i.e., long enough to run a manual check for updates or for Automatic Updates to download/install needed updates) without a valid, fully-updated anti-virus application installed."

2: e.g. Avira's Free Security Suite provides an installer for the suite umbrella control center, from where the single security tools can be installed - but only with an internet connection. Even the offline installer will install something that will remain disabled until you activate its license ... via the internet.

4
  • 1
    first of all, as much as this devalues this site: You're taking advice from internet strangers as if it's scientific facts. You really shouldn't; that's a very important factor in computer security: Users believing what they read online. Nov 19, 2017 at 9:03
  • @MarcusMüller: Not sure what you're referring at in particular. The part about online installers is not "advice" or an allegation by "internet strangers", it is simply a fact that I have verified first-hand. The part about an unprotected Windows getting infected within seconds of being online is from Microsoft's own support forum by an MVP, which seems to me like it's getting about as close to canonical information from the vendor as you can without any specific support contracts with MS. (With all this said, I am of course open to suggestions that they got it somehow wrong.) Nov 19, 2017 at 9:23
  • 1
    "by an MVP on Microsoft's forum", so, indeed, by an internet stranger! Well, point is, yes, there's a certain risk a new Windows installation is vulnerable to remote exploitation, but it's been quite a few years since windows machines exposed services to the internet by default (unless you configure them to think they're on a private network), so, the worst times are over. Nov 19, 2017 at 10:25
  • "A computer should NEVER be connected to the internet for extended periods [...] without a valid, fully-updated anti-virus application installed." This sounds like a relic of IT support from when Windows didn't come with Microsoft Security Essentials (re-branded to Windows Defender in Windows 8 and 10). Windows Vista and 7 came with their own Windows Defender which only removed spyware, and versions below XP didn't have any security software preinstalled at all.
    – user84120
    Nov 20, 2017 at 10:36

2 Answers 2

5

Disclosure: I work for an anti-virus vendor.

First, the answer. Most vendors which I'm familiar with usually offer "full" or "offline" installers of their products. Typically they are usually more difficult to find (i.e. no link on homepage - in some cases you might need to ask support), but they do have them. In my experience it is usually easier to find those files by Googling av-vendor-name offline install - the web sites it finds are usually not the vendor site (so make sure to do this on a machine with AV installed), but they usually provide direct links to the vendor's own website, and those you can download from.

Note that the main purpose for providing them is not a "chicken-and-egg problem", but to install on disconnected or very slow speed environments and to save traffic when you need to install the product on several machines - since the online installer would download it again and again.

Second, I would not agree with a premise that "Windows machine should not get connected to the internet without any anti-virus software installed". This is only true if your connection to Internet is direct - meaning you plug your DSL/cable modem, set in bridged mode, directly into your laptop Ethernet port, and it gives you the public IP address (and gets you blasted right away via EthernalBlue or something similar). This configuration is quite rare though.

If you are behind a NAT router, which does not forward any ports - which is more of a typical default configuration - your Windows machine is relatively safe as long as you are not doing anything dangerous on it, such as:

  • Browsing random web sites;
  • Setting up and opening emails;
  • Inserting various storage media (such as USB sticks or CD/DVD);

and so on (using Calculator or playing Solitary is unlikely to get you infected)

So after installing Windows, you do have the opportunity to open a website of the anti-malware vendor of your choice, and install the anti-virus without compromising security of your PC.

1
  • MS Windows has a good firewall and AV built-in for latest versions, even though you cannot expect it to protect your computer from threats 100% always. NAT, though not a firewall, hides your devices, and is as strong as how it's developers set it up.
    – Nikhil_CV
    Nov 21, 2017 at 6:46
1

It's all a question of risk tolerance. The risk in this case is very low, provided the following are true:

  • You have a firewall or router to prevent inbound scans
  • You take no action other than downloading software directly from the vendor, and especially no casual web browsing
  • You install all antivirus, OS, and browser updates immediately

In an ideal world, every system would be fully patched with updated malware protection before it ever touches a network. In practice, very few people or organizations behave ideally because the risk is too small to deal with the hassle.

The risk goes up substantially if you are doing this on a public network. Personally, I do this from home all the time, but I would never even consider it from wifi available at a Starbucks or an airport.

1
  • This looks a lot like the other answer. Did you mean to say somethign unique?
    – schroeder
    Mar 26, 2018 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .