Chicken-and-egg-problem: What's the intended secure way of installing anti-virus software with online installers?

Question

In various places (notably, the English Microsoft Answers forums¹), people are quick to note that a Windows machine should not get connected to the internet without any anti-virus software installed. Otherwise, infections are said to happen within minutes by means of built-in security flaws.

At the same time, some anti-virus software is following the current trend of providing only online installers². These installers are only tiny packages that will download the required installation data on the fly once started on the target machine. Obviously, these won't work without an internet connection.

What is a safe procedure for setting up malware protection on a new PC when I should not connect to the internet before having the malware protection in place, but cannot install the malware protection without connecting to the internet?

---

¹: e.g. in this thread: "A computer should NEVER be connected to the internet for extended periods (i.e., long enough to run a manual check for updates or for Automatic Updates to download/install needed updates) without a valid, fully-updated anti-virus application installed."

²: e.g. Avira's Free Security Suite provides an installer for the suite umbrella control center, from where the single security tools can be installed - but only with an internet connection. Even the offline installer will install something that will remain disabled until you activate its license ... via the internet.

Answer 1

Disclosure: I work for an anti-virus vendor.

First, the answer. Most vendors which I'm familiar with usually offer "full" or "offline" installers of their products. Typically they are usually more difficult to find (i.e. no link on homepage - in some cases you might need to ask support), but they do have them. In my experience it is usually easier to find those files by Googling av-vendor-name offline install - the web sites it finds are usually not the vendor site (so make sure to do this on a machine with AV installed), but they usually provide direct links to the vendor's own website, and those you can download from.

Note that the main purpose for providing them is not a "chicken-and-egg problem", but to install on disconnected or very slow speed environments and to save traffic when you need to install the product on several machines - since the online installer would download it again and again.

Second, I would not agree with a premise that "Windows machine should not get connected to the internet without any anti-virus software installed". This is only true if your connection to Internet is direct - meaning you plug your DSL/cable modem, set in bridged mode, directly into your laptop Ethernet port, and it gives you the public IP address (and gets you blasted right away via EthernalBlue or something similar). This configuration is quite rare though.

If you are behind a NAT router, which does not forward any ports - which is more of a typical default configuration - your Windows machine is relatively safe as long as you are not doing anything dangerous on it, such as:

• Browsing random web sites;
• Setting up and opening emails;
• Inserting various storage media (such as USB sticks or CD/DVD);

and so on (using Calculator or playing Solitary is unlikely to get you infected)

So after installing Windows, you do have the opportunity to open a website of the anti-malware vendor of your choice, and install the anti-virus without compromising security of your PC.

Answer 2

It's all a question of risk tolerance. The risk in this case is very low, provided the following are true:

• You have a firewall or router to prevent inbound scans
• You take no action other than downloading software directly from the vendor, and especially no casual web browsing
• You install all antivirus, OS, and browser updates immediately

In an ideal world, every system would be fully patched with updated malware protection before it ever touches a network. In practice, very few people or organizations behave ideally because the risk is too small to deal with the hassle.

The risk goes up substantially if you are doing this on a public network. Personally, I do this from home all the time, but I would never even consider it from wifi available at a Starbucks or an airport.