5

I have recently installed an application called 'Deep Freeze' that works by "freezing" the state of an operating system and working off delta disks. Rebooting deletes the deltas and reverts back to the original frozen state.

How effective is this against virus, or other malware, infections?

7
  • 2
    A good rule of thumb is if you don't have physical access to the box...it isn't your box. I think this applies to deepfreeze and similar programs. If someone else has your box...there is nothing you can do to be 100% sure changes won't be made
    – user11869
    Commented Sep 10, 2012 at 17:37
  • 1
    @Rell3oT is referring to Law #3. However, I think Law #1 is probably more applicable to the question here.
    – Iszi
    Commented Sep 10, 2012 at 18:44
  • "How effective is this against virus, or other malware, infections?" - Pretty poor. You would only wipe said infections after a reboot, it wouldn't stop the image from being changed, while the system was actually running normally. Unless you are running a public terminal Deep Freeze is a waste of money.
    – Ramhound
    Commented Sep 11, 2012 at 14:36
  • so,, does that mean if you deepfreeze the whole system in its clean state, whatever virus or malware that will come, will the deep freeze wipe it of after you reboot your computer? or a virus or malware can stay somewhere in your computer eventhough you deepfreeze the whole of it?
    – user25064
    Commented Apr 23, 2013 at 0:03
  • 2
    Darn, why over think a simple question. Yes deep freeze does offer some protection but like anything else it is subject to filtration. So using a good antivirus & antimalware software with deep freeze will offer adequate protection for most computers.
    – user28253
    Commented Jul 13, 2013 at 22:04

6 Answers 6

13

There are oodles of non-local-harddisk places that malware could stay (although in practice, such is rare in viruses). A few, off the top of my head, the system BIOS (although rare, there is malware which does this), or the firmware of bootable PCI cards.

If a virus can get on to your system, though, preventing it from persisting won't help - it may simply re-infect you after your reboot. Some 'stealthy' malware will stay entirely memory-resident, and will not write to disk, in order to evade detection.

Maybe you need to examine what you're trying to prevent - instead of 'A virus', maybe the answer is 'damage to my documents' or 'exfiltration of my documents'... or even simply 'theft of my banking credentials'. This might help you focus on what threats you should be preventing.

2
  • 1
    One thing I would add: not only might malware re-infect you on reboot, but if you're using deep freeze any patches you apply to vulnerabilities will be overwritten on reboot. Eeek :)
    – user2213
    Commented Oct 8, 2012 at 14:00
  • I'm going to add one more to this - if Deep Freeze loads an image from a place that can be modified, you might as well not use Deep Freeze. I know a cybercafe owner who was very surprised when someone modified his disk image... Commented Apr 23, 2013 at 17:30
5

No, the "virus" can still run and read your (sensitive) files, just like if you are not using Deep Freeze. Only after you restart your computer, will the malware (virus) be gone and you will be presented with the clean state (whatever state was frozen).

3

In addition to the answer Matrix gave, there is the possibility of a virus modifying firmware allowing it to survive past complete drive content resets.

1
  • 5
    And lest people think this is only theoretical, there was a concrete example of this at BlackHat a few years back. See semiaccurate.com/2009/07/31/….
    – Levi
    Commented Sep 10, 2012 at 17:58
3

In the sense that you are reverting to a known good state before doing anything sensitive, yes this is a good avenue to take.

However, Deep Freeze appears to store images on disk, which can be modified, so an infection to your host system could happily infect images captured in the past, so you lose your known-good property.

You are much better off creating a live, bootable but not writable medium such as a knoppix CD. Provided the CD image download and burn process is done and checked securely, you can trust the CD forever more to provide a safe local software environment.

As others have mentioned, malware can reside in hardware/firmware. Anything from your keyboard to your laptop battery can be subverted against you. In this case, your safe sofware environment could be infected at run time by the hardware upon which you run it.

Once this is happening, you are pretty much sunk. However, you will likely be able to at least greatly reduce the risk of such firmware-based reinfection by running an entirely different OS as your host OS. For example, if you use Windows 7 for your day to day activities, and boot Knoppix only when you want to do some online banking. In my opinion it is quite unlikely that persistent firmware malware would be able to infect across two different operating systems, meaning that your local software environment is pretty safe once again.

This is assuming that the firmware malware is not autonomous, in that it requires the help of the OS to do nasty things, which they all (to my knowledge) do. One could imagine an infected network card that sends traffic reports to the bad guys regardless of the OS that is running locally, but we're starting to reach the limits of what is possible.

2

It is also possible for a virus to disable Deep Freeze. (If it can be disabled, there is no reason a virus can't do it)

Of course, this would have to be a targeted virus, but if a few 15 year old kids can figure out how to disable Deep Freeze, there is no reason any normal developer can't do it programmatically.

1

You can fight viruses by setting up a lower user-level access account, instead of using an Administrator account.

1
  • 5
    Not completely (or even very effectively), though. Commented Oct 7, 2012 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .