turg's Journal: Dumb WinXP questions

So I've got my new (that is, new to me -- refurbished lease return) laptop.

Last time I was in this position, the first thing I did was go online to download all the Windows updates. Even with the Windows Firewall turned on, I had several worms, etc., by the time the updates were complete. This time I want to avoid this. Though that was with the original WinXP (home) and this is SP2 (pro).

So:

1) What's the simplest procedure for getting the updates safely?

2) It's possible that this machine already has the updates. How do I find out if it does?

Best way

[Apocalypse111]

The best way I can think of is to reinstall XP on the box, but use an image that has SP2 and all the security updates slipstreamed in. This way, when the machine connects to the web, it is ready to face the horrors it will see out there. More here. [winsupersite.com]

standalone service pack

[PastaLover]

1) http://www.microsoft.com/downloads/details.aspx?Fa milyID=049c9dbe-3b8e-4f30-8245-9e368d3cdb5a&Displa yLang=en [microsoft.com] would be the easiest I'd say. Another way to make it almost inpenetrable is just put it behind a NAT.
2) I dunno, does it have a really annoying "security center" feature?

Make sure...

[Iamthefallen]

You have a firewall/router between yourself and the internet. Never hook it up with a public IP.

Secondly, try Windows Defender [microsoft.com], I haven't used it myself, but have heard good things about it.

Re:

[spun]

Yah, I have never had any trouble with a windows install performed behind a decent hardware firewall. Unless there is a serious flaw in the firewall, or you have acompromised machine in your private network, nothing's getting through. $30 will get you a decent one.

Re:

[robi2106]

thirded on the hardware NAT firewall.

jason

Re:

[ncc74656]

Ditto. They even make portable routers [linksys.com] that you can bring on the road with you. I mostly run Linux on my notebook now, but the router was useful for wireless-to-wired bridging when I didn't have working wireless on the notebook. Now that I have working WiFi under Linux, it's useful for wired-to-wireless bridging.

Re:

[TechnoLust]

We tried it at work. No good. I mean, I could have told them that. Do you trust the company the left the security bugs in there in the first place to make a secure product to protect it? Hells no!

2 methods I use

[Marxist Hacker 42]

First, before ever putting the machine online, I install AVG, Zonealarm, and Adaware from a clean CD that I made myself. Second, I *ALWAYS* use a NAT router of some sort between any Windows Box and the Internet (you can even get dialup NAT routers now as a Linux-based appliance) at all times, because Microsoft can't be trusted to put out the latest exploit fixes on time.

Re:

[Talinom]

Best advice ever. I do the same thing myself. A few others that could be added would be Spybot Search & Destroy [safer-networking.org], Windows Sysinternals [microsoft.com], TweakUI [microsoft.com], and turning off a few useless services [techtree.com] if it is a simple home PC.

Re:

[jawtheshark]

These guys say what I would do.... But hey, you've got all the advice you need by now ;-)

Go Here...Get What You Need...Toss On Thumbdrive

[Real World Stuff]

Great Place [portablefreeware.com]

first

[robi2106]

download a two way software firewall.

install and completely lock down the system.

then install firefox so you can browse safer than IE

then run windows update

if you have a functional system that has net access, then just download the stand alone SP2 install file (for network distribution). might require some searching.

burn said SP2 to CD or transfer via USB drive.

once installed, then may be you can loosen the software firewall and go directly to windows update.

of course, also install an anti-virus solution a

Updates a la carte

[tomhudson]

autopatcher.com [autopatcher.com]

When you run it, you'll be able to pick and choose which updates, tweaks, etc., you want to install. Even those that supposedly required WGA. (You can even install WGA, if for some reason that's what floats your boat ...)

Re:

[turg]

Lack of WGA prevents Windows Update from downloading and installing post-WGA patches. However the patches themselves are simple .exe files (the patch itself does not require WGA) and are available for anyone to download manually.

Re:

[tomhudson]

That's the beauty of autopatcher - the "post-wga" updates can be installed immediately without having to go through the steps of finding them and manually downloading them.

Re:

[Talinom]

* me bows *

Thank you! I've wanted something like this for a while but haven't gotten around to actually needing it until this week. A friend's computer was rooted and it is going to be nuked on Saturday. I want to have the cleanest enviornment possible for when I reinstall and you just can't get much better than this.

Thanks for the responses

[turg]

Thanks for the answers everyone. Just to clarify: The machine already has SP2. I have determined now that it does not have the (dozens of) patches released since SP2.