How can I keep my son's laptop from gettin' the cooties?
December 15, 2014 6:43 AM Subscribe
My son is about to get his first laptop, a Windows machine. I'd like to install the necessary software to keep it free from all the nasty stuff Windows machines can catch. We're a Mac family so my knowledge of personal A/V software is minimal.
He'll be getting a Lenovo with Windows 8.1 installed, which I'm not really familiar with. He's a gamer and he's always going to sketchy download sites to get mods for Minecraft. I'd like to make sure he doesn't get any viruses or malware. He'll also be using this machine for school so of course I don't want him spreading anything across the school's network.
My knowledge of protecting Windows machines is limited. At work we use McAfee enterprise, which of course would be overkill for a personal laptop. I have a Windows XP VM on my Mac that has a very outdated copy of Avast on it.
So, in short, I would like:
Free or inexpensive software (<$50) that will:
Protect from viruses or malware
Get regular updates automatically, or via prompting.
Ideally send ME an alert (via email) if anything gets infected
Not bloat the machine too badly
Be mostly invisible and not interfere too badly with the use of the machine.
I'm not interested in blocking his activity, though it would be nice if there was a log I could refer to if I had to.
He's been well schooled in on-line safety and we're generally aware of what he's doing so I don't need advice in that area.
I'm also interested in general best practices for setting up a laptop for a 12 year old. He's pretty computer savvy, though mostly on Macs, but I don't think he's fully aware of how vulnerable Windows machines can be.
I will have an admin account on the laptop. Do I give him admin rights? I don't want him to need me to install things for him.
What about Windows updates? Best to just set it for automatic? How does that work on a laptop, will it start updating every time he opens it up?
tl;dr: How do I keep a 12 year-old's new Windows laptop from getting bogged down with viruses and malware while still allowing him to freely use it and download and install things without my intervention?
He'll be getting a Lenovo with Windows 8.1 installed, which I'm not really familiar with. He's a gamer and he's always going to sketchy download sites to get mods for Minecraft. I'd like to make sure he doesn't get any viruses or malware. He'll also be using this machine for school so of course I don't want him spreading anything across the school's network.
My knowledge of protecting Windows machines is limited. At work we use McAfee enterprise, which of course would be overkill for a personal laptop. I have a Windows XP VM on my Mac that has a very outdated copy of Avast on it.
So, in short, I would like:
Free or inexpensive software (<$50) that will:
Protect from viruses or malware
Get regular updates automatically, or via prompting.
Ideally send ME an alert (via email) if anything gets infected
Not bloat the machine too badly
Be mostly invisible and not interfere too badly with the use of the machine.
I'm not interested in blocking his activity, though it would be nice if there was a log I could refer to if I had to.
He's been well schooled in on-line safety and we're generally aware of what he's doing so I don't need advice in that area.
I'm also interested in general best practices for setting up a laptop for a 12 year old. He's pretty computer savvy, though mostly on Macs, but I don't think he's fully aware of how vulnerable Windows machines can be.
I will have an admin account on the laptop. Do I give him admin rights? I don't want him to need me to install things for him.
What about Windows updates? Best to just set it for automatic? How does that work on a laptop, will it start updating every time he opens it up?
tl;dr: How do I keep a 12 year-old's new Windows laptop from getting bogged down with viruses and malware while still allowing him to freely use it and download and install things without my intervention?
Response by poster: Not to threadsit, but he prefers Chrome over Firefox, so I'd prefer Chrome-related extensions. I doubt he'd ever use IE for anything as I've raised him properly.
posted by bondcliff at 6:53 AM on December 15, 2014 [6 favorites]
posted by bondcliff at 6:53 AM on December 15, 2014 [6 favorites]
These days, installing things is where you get the crap installed. Installer will offer an easy install option (which installs crapware, toolbars, and potentially malware) or a custom install (which gives you an opportunity to avoid these things. It used to be that custom install would just let you change the install folder, but now that's where all the bad stuff gets in.
I keep and run SuperAntiSpyware, Malwarebytes Anti-Malware, Spybot Search & Destroy 2.
And if anything gets infected and hard to remove, there's deezil's profile, which gives a ton of great advice.
posted by Sunburnt at 7:03 AM on December 15, 2014 [1 favorite]
I keep and run SuperAntiSpyware, Malwarebytes Anti-Malware, Spybot Search & Destroy 2.
And if anything gets infected and hard to remove, there's deezil's profile, which gives a ton of great advice.
posted by Sunburnt at 7:03 AM on December 15, 2014 [1 favorite]
I think Windows updates are set to automatic by default. Whenever updates are ready to install, they'll do so when he next shuts down his laptop (although he might get a prompt asking him to install the updates). But if it's not set to automatic by default, set it to automatic.
You say you don't want him to have you install things for him, but how much/often are you expecting him to want to install things? There might be some things in the beginning, but after that he's probably set. And you don't need admin rights to install browser extensions. As Sunburn points out, installing things is where you get the bad software (not necessarily viruses, but malware nonetheless). It might be good to have some adult supervision there.
And an adblocking extension to Chrome would be good. Many places where you download anything have ads which look like download buttons, and you can end up downloading the wrong thing if you're not careful.
posted by bjrn at 7:07 AM on December 15, 2014
You say you don't want him to have you install things for him, but how much/often are you expecting him to want to install things? There might be some things in the beginning, but after that he's probably set. And you don't need admin rights to install browser extensions. As Sunburn points out, installing things is where you get the bad software (not necessarily viruses, but malware nonetheless). It might be good to have some adult supervision there.
And an adblocking extension to Chrome would be good. Many places where you download anything have ads which look like download buttons, and you can end up downloading the wrong thing if you're not careful.
posted by bjrn at 7:07 AM on December 15, 2014
I would recommend purchasing and installing ESET NOD32 antivirus. We use the business version of it at work. It has a very useful feature that's particularly relevant to your situation: When you install it, make sure you select the option to block "potentially unwanted programs". This feature has the effect of preventing the installation of free programs that come bundled with crapware, like browser toolbars, search redirectors, etc. The ESET program costs about $40 per year, but it's worth it.
posted by alex1965 at 7:12 AM on December 15, 2014 [3 favorites]
posted by alex1965 at 7:12 AM on December 15, 2014 [3 favorites]
Microsoft Security Essentials has fallen in their risk detection lately, unfortunately. I'd go with Avast.
I install Malwarebytes Premium on every computer I manage. You can find a 2013 (unlimited time limit) key on Amazon for $16 or so. I just did this last week.
I'm not sure if MWB will alert you via email if there's a problem. Check out Soluto to make sure that he's getting the updates for Flash and Java (and Windows).
posted by getawaysticks at 7:13 AM on December 15, 2014 [3 favorites]
I install Malwarebytes Premium on every computer I manage. You can find a 2013 (unlimited time limit) key on Amazon for $16 or so. I just did this last week.
I'm not sure if MWB will alert you via email if there's a problem. Check out Soluto to make sure that he's getting the updates for Flash and Java (and Windows).
posted by getawaysticks at 7:13 AM on December 15, 2014 [3 favorites]
You mentioned Avast, and the current version probably meets most if not all of your criteria. I'm not sure about the e-mail ability, but it's free, pretty customizable when you install it, has a "Silent/Gaming" mode, can update in the background or with notification, and seems (to me) to have less CPU/disc utilization than AVG. For general use, I'd suggest setting up Windows Update to download automatically but only install with permission. In the unlikely event that an update borks something, that gives him at least a couple hours or days of lead time. I second starbreaker's suggestion of MSE, Incognito mode, and granting him some sort of admin rights to install software. Extensions like AdBlock Plus, Collusion, and Hola! should be enough to disable a lot of ads/tracking and unblock content limited by geography. You also know at least a bit about VMs, so I would suggest teaching him about using them as sandboxes. I don't know what you prefer (VirtualBox, Hyper-V, etc), but it's a good place for him to do stuff like experiment with other OSes without worrying about messing up the computer.
posted by zombieflanders at 7:14 AM on December 15, 2014
posted by zombieflanders at 7:14 AM on December 15, 2014
The one most important thing you can do is to ensure that he keeps his general user account at most basic level and is very careful in granting permission for new installs.
Most malware/crapware/viruses enter the system because the user mindlessly clicked okay on something requesting some install access. And when that happens, most protective software you installed would be useless.
or, if he is a bit tech savvy, you could get ask him to do his download/internet browsing through a linux virtual program. this link is a good place to start. You might even google for "running linux under windows".
play games on windows, browse internet on linux is my fav way to avoid unwanted crap.
posted by TheLittlePrince at 7:18 AM on December 15, 2014 [1 favorite]
Most malware/crapware/viruses enter the system because the user mindlessly clicked okay on something requesting some install access. And when that happens, most protective software you installed would be useless.
or, if he is a bit tech savvy, you could get ask him to do his download/internet browsing through a linux virtual program. this link is a good place to start. You might even google for "running linux under windows".
play games on windows, browse internet on linux is my fav way to avoid unwanted crap.
posted by TheLittlePrince at 7:18 AM on December 15, 2014 [1 favorite]
Give him a regular account that he always logs into, and make an admin account that he can use to install programs (eg: use "Run as Administrator" from right-click when installing).
I'd also look into the free OpenDns.org service. You can use it to block a lot of the malware sites and questionable content (if you choose to do that).
For his games, encourage him to use something like Steam, which will allow him to have his games and saves "in the cloud", in case you need to nuke his laptop and reinstall windows.
You might also want to look into something like Prey. It's "Find My iPhone" for laptops with remote wiping,etc. Open source and free(ish).
posted by blue_beetle at 7:56 AM on December 15, 2014
I'd also look into the free OpenDns.org service. You can use it to block a lot of the malware sites and questionable content (if you choose to do that).
For his games, encourage him to use something like Steam, which will allow him to have his games and saves "in the cloud", in case you need to nuke his laptop and reinstall windows.
You might also want to look into something like Prey. It's "Find My iPhone" for laptops with remote wiping,etc. Open source and free(ish).
posted by blue_beetle at 7:56 AM on December 15, 2014
There really is no effective anti-virus software at this point, and Symantec et al have admitted as much. They keep selling it only because people keep buying it. Personally, I think this would be a good opportunity to get him started on using an open source OS like Ubuntu - if that's not an option, I'd add the following to the suggestions that folks made above:
1. Useful plug-ins for Chrome: Adblock Plus, Flash Control, HTTPS Everywhere, Disconnect, Privacy Badger. If he's tech savvy or interested in playing with the guts of this a bit, ScriptBlock.
2. Harden Chrome's out-of-box security settings.
3. Likely the single biggest source of malware for the average user is malicious links included in spam emails. Have him read this short overview and take this quiz to make him less likely to click on them. Phishing gets more sophisticated every year, and we're now past the era of obvious Nigerian scammer-style malicious emails.
4. He's a gamer and he's always going to sketchy download sites to get mods for Minecraft: AskMe: How to safely mod Minecraft. Personally, I'd also consider allowing Firefox to retain history for a week or so, then use Chrome's parental controls to blacklist sketchy sites.
The OS edge in security is now basically over, so revisiting settings, plug-ins, etc. for your Apple machines is also a good idea.
Lastly, run (then uninstall) PC Decrappifier to get rid of any bloatware the Lenovo machine comes packaged with.
posted by ryanshepard at 9:06 AM on December 15, 2014 [5 favorites]
1. Useful plug-ins for Chrome: Adblock Plus, Flash Control, HTTPS Everywhere, Disconnect, Privacy Badger. If he's tech savvy or interested in playing with the guts of this a bit, ScriptBlock.
2. Harden Chrome's out-of-box security settings.
3. Likely the single biggest source of malware for the average user is malicious links included in spam emails. Have him read this short overview and take this quiz to make him less likely to click on them. Phishing gets more sophisticated every year, and we're now past the era of obvious Nigerian scammer-style malicious emails.
4. He's a gamer and he's always going to sketchy download sites to get mods for Minecraft: AskMe: How to safely mod Minecraft. Personally, I'd also consider allowing Firefox to retain history for a week or so, then use Chrome's parental controls to blacklist sketchy sites.
The OS edge in security is now basically over, so revisiting settings, plug-ins, etc. for your Apple machines is also a good idea.
Lastly, run (then uninstall) PC Decrappifier to get rid of any bloatware the Lenovo machine comes packaged with.
posted by ryanshepard at 9:06 AM on December 15, 2014 [5 favorites]
nthing the advice above that his daily driver account should not be an admin. The vast majority of Windows malware is defeated by simply not running as an administrator.
posted by Aizkolari at 9:32 AM on December 15, 2014
posted by Aizkolari at 9:32 AM on December 15, 2014
Definitely you should set up 2 administrator accounts and 1 limited-user account. One admin is for you, the other one is for him to use only for installing software. Make sure he knows that he should be browsing the web, etc. on the limited account.
posted by serelliya at 11:50 AM on December 15, 2014
posted by serelliya at 11:50 AM on December 15, 2014
Just did this on a computer a friend is giving as a gift -- when you first set up Windows, it creates one account with whatever username you picked; that user is automatically an Administrator.
Create a new local account called "admin", give it a fancy password, and then go change the original account to made to a regular user. Now the regular user will get prompted for the "admin" account password whenever they do something that could mess up the system (in theory).
If I could remember all the steps, I'd tell you, and if you're a Mac user you're handicapped regarding how Windows users work, but it's not too hard to figure out. Windows 8 annoyingly handles users through a couple different interfaces, but google around and you should find enough to get you through it.
posted by AzraelBrown at 11:51 AM on December 15, 2014
Create a new local account called "admin", give it a fancy password, and then go change the original account to made to a regular user. Now the regular user will get prompted for the "admin" account password whenever they do something that could mess up the system (in theory).
If I could remember all the steps, I'd tell you, and if you're a Mac user you're handicapped regarding how Windows users work, but it's not too hard to figure out. Windows 8 annoyingly handles users through a couple different interfaces, but google around and you should find enough to get you through it.
posted by AzraelBrown at 11:51 AM on December 15, 2014
Seconding eset nod32. A system with nod32 and malwarebytes pro installed is essentially impossible to infect unintentionally, especially if you're running a user and not administrator account.
The way to set up an admin account just for software installs is to create it, and give him the password, but set it to deactivated so that you can't actually log in to it and can only use it for admin escalation for things. This is as simple as creating the account then hitting an option in the users/accounts control panel.
I disagree that nothing is effective anymore. Nothing is 100% effective, but neither are condoms. People bring me systems all the time with McAfee or something on them that are totally infected with crap, and then don't ever get re infected after i turn them on to those two pieces of software.
What about Windows updates? Best to just set it for automatic? How does that work on a laptop, will it start updating every time he opens it up?
Windows 8 is gracious about this. It'll go "hey there's updates, updates will automatically install in two days or you can just click here to get it over with." and then basically shuts up until you log in again.
Honestly, i'd get those two AV/AM programs and just give him an admin account and let him do whatever he wants. That's what i did at that age, and i figured it out and dealt with it totally fine. I think it's valuable knowledge to get some dumb malware infection from a game mod(or pirated game, heh) a couple times and have to figure out how to get rid of it yourself via google so that you know better.
posted by emptythought at 3:43 PM on December 15, 2014 [1 favorite]
The way to set up an admin account just for software installs is to create it, and give him the password, but set it to deactivated so that you can't actually log in to it and can only use it for admin escalation for things. This is as simple as creating the account then hitting an option in the users/accounts control panel.
I disagree that nothing is effective anymore. Nothing is 100% effective, but neither are condoms. People bring me systems all the time with McAfee or something on them that are totally infected with crap, and then don't ever get re infected after i turn them on to those two pieces of software.
What about Windows updates? Best to just set it for automatic? How does that work on a laptop, will it start updating every time he opens it up?
Windows 8 is gracious about this. It'll go "hey there's updates, updates will automatically install in two days or you can just click here to get it over with." and then basically shuts up until you log in again.
Honestly, i'd get those two AV/AM programs and just give him an admin account and let him do whatever he wants. That's what i did at that age, and i figured it out and dealt with it totally fine. I think it's valuable knowledge to get some dumb malware infection from a game mod(or pirated game, heh) a couple times and have to figure out how to get rid of it yourself via google so that you know better.
posted by emptythought at 3:43 PM on December 15, 2014 [1 favorite]
I think it's a good idea as others have mentioned to have a separate admin and general user accounts to be safe. Although I do have a variety of anti-malware and related programs but most of it is avoiding shady sites and finding a reliable community for say minecraft mods vs any any site listed from search engines.
posted by chrono_rabbit at 10:47 PM on December 15, 2014
posted by chrono_rabbit at 10:47 PM on December 15, 2014
Unchecky helps stop the crapware during software downloads.
posted by peacay at 8:20 PM on December 27, 2014
posted by peacay at 8:20 PM on December 27, 2014
« Older How does this co-working thing go again? | Books appropriate for a middle school boy Newer »
This thread is closed to new comments.
posted by starbreaker at 6:48 AM on December 15, 2014 [1 favorite]