I know it is topical but I am just sorting out a PC that Mrs Bigsurfer uses for cutting out Vinyl which has to remain as an XP machine due to drivers and software not working with anything newer. I have been running AVG free but last week the computer crawled to an almost stop taking several minutes to respond to each mouse click, uninstalling AVG Free has sorted this. I am happy to pay for software and was looking at Bitdefender for XP. Any other recommendations

Does it have to be on the net at all?

As above we have to support some XP machines that run legacy software for CNC machines, laser cutters etc – the software companies want £5k to update the software or something…

They isolated from the net, in fact everything – no network or wifi connection. Data is introduced via USB flash drive, AV is set to scan everything before it’s introduced – it’s faffy but it’s works, they’ve even got brand new old stock PCs ready and waiting for when the inevitable happens.

It doesn’t have to be on the net but it is helpfull otherwise all files have to be transfered onto a memory stick back and forth for ebay adverts, fonts, images etc.

The only sensible option is to have the xp box offline, and manually transfer files, or, if you have a more modern pc, run xp as a vm?

Or just back it up into an image you can restore in its current state, then if it goes to pot, just reformat it and restore the backup image.

Keep the back up on a drive that’s not attached to the machine.

mattyfez has it – and use it just for that dedicated purpose it’s needed for rather than any general web browsing or other internet connected stuff. If you do that there’s no particular reason it should ever get infected if it’s on a normal home network which has a firewall in the router.

Most (initial) infections are caused by dodgy downloads and e-mail attachments, so if you have good security at the human level you get rid of most of the risk. If you can rely on that, then you should be fine – if not then another layer of protection can be added by setting up a private network with no direct internet connection – so you can transfer files without the need for memory sticks, but the XP machine can’t connect to the internet (you’d have to make sure there is no internet connection sharing, but it’s easy enough to turn that off). TBH AV is the very last level of protection – like PPE for H&S – best to stop things before they get that far (quick check of my AV log – still nothing on it after several years of using this computer).

It doesn’t have to be on the net but it is helpfull otherwise all files have to be transfered onto a memory stick back and forth for ebay adverts, fonts, images etc.

Why does it have to be on the net for such things? Surely it’s just better to have the machine isolated to avoid any invasive ‘ware wreaking havok, when all measures that can be taken to make sure everything that goes onto it is sterile before hand, then just shoving the clean files onto a stick and copying them onto the machine.
Place I worked at for a while in the studio, around twelve-thirteen years ago actually moved small files around on floppy discs!
And fonts, ads, images and such like, if they get re-used, why aren’t they just kept in folders on the machine in question, especially fonts, or do you actually delete all fonts after the job is finished, and go through all the phaff of having to rely on agencies etc supplying all the correct fonts next time they want the job redone?
Yes, I know this is supposed to be SOP, but experience has shown, over many years, that often fonts get left out, or subtly incorrect versions supplied, resulting in hours wasted having to get correct fonts supplied and a/w gone through to make sure word- and letter- spacing and line-breaks are as they should be.
I had a fonts folder on my Mac with dozens of folders labelled with the names of various agencies and clients, containing further folders with job names in which were all the fonts relevant to each job, in order that everything meshed together next time a job came back.
There were hundreds of fonts in that folder, many were just slight variations on common faces, but vital in making sure the job looked right.
Still got a ‘back-up’ copy on a DVD somewhere, and one on my PowerBook as well… 😉

I’d run it as a VM on a more modern machine, that way you can always restore the image* if it does get infected / corrupted.

Another advantage of this method is any files transferred to the VM will get scanned by the hosts AV, which should be up to date.

* assuming you take regular snap shots and archive them away somewhere

A VM would be my first suggestion, were it not for talk of drivers and suggestion of specialist hardware (unless I’m reading too much into that).

Would the image even need to be be updated though as long as it’s xp with the relevant apps installed.

Just run it and if it goes pear shaped, wipe and restore the backup image.

I’d try this one – http://forticlient.com/ – it’s free and also comes with a great web filter to help users stop browsing to dodgy sites in the first place. Very reputable company who also make excellent firewalls.

At some point XP is going to become safer than Win10, because once there are only a few computers running it the hackers won’t bother to target it (because the potential small pool of users makes it not worth their while!)

Read the various articles (google it) on making sure your Ports are locked down (firewalled or better still completely disabled if not required!)

In my experience virtual environments don’t play nice with unusual hardware / peripherals.
Using USB sticks is *not* a guarantee of “hygiene” although you could add some manual procedures that might help. Relying on the Virus Scanner detecting the USB and auto-scanning is going to be a recipe for failure as the AV software will become out of date very quickly.

Beware if working on the “keep nothing on it that you don’t mind losing” approach that Ransomware can be sneaky and either corrupt your backups, or be lurking in your backups waiting to trigger as soon as you try to restore.

And… “another layer of protection can be added by setting up a private network with no direct internet connection”… that might work, but keep in mind that most of the machines infected in the NHS were not directly infected – most likely one machine caught it and spread it on the internal network.

Avast, maybe? I’ve lost track of what still supports it, the best AV for XP is Windows 10. All other things aside I’d be treating it as sacrificial at this point. You’ve got the recent WannaCry patch on there at least, yes?

WRT virtualisation: How does the vinyl cutter physically connect to the machine, is a parallel port job?

Beware if working on the “keep nothing on it that you don’t mind losing” approach that Ransomware can be sneaky and either corrupt your backups, or be lurking in your backups waiting to trigger as soon as you try to restore.

Or use it as a point of entry to infect the rest of your network.

Sure – but the transmission vector there is an unusual case and there’s a fix for it. Of course there might be another similar but different vulnerability, but it’s relatively unlikely and MS will almost certainly release patches even for XP if they learn about another one.

If you were feeling particularly bothered then there are additional measures you can take with that approach to further reduce the risk.

MS will almost certainly release patches even for XP if they learn about another one

Don’t count on that. The fix they released this week was made months ago. They most certainly wouldn’t have released it had it not been for such a big attack. I’ll make the assumption that they came under unbearable pressure from the authorities, rather than release it for business or altruistic reasons.

As above, disconnect from the Internet use USB or even better burned cd’s to move stuff over.

@maxtorque I believe something like 75% of the world’s pc’s are running XP or older

Why not set it up as a dual boot machine?

Run Linux when you need to be online to download files etc then save them in a Windows folder than XP can access?

You turn off all connectivity in XP.

It may be more faff than a USB stick, though don’t know how many files you need to be transferring?

It sounds a lot more faff than a USB stick. Though it did inspire me to think of a possible solution – rather than running XP as a VM, have XP as the base OS on the machine and run a VM inside that (I’d use Virtualbox assuming that still runs on XP, but other options are available). Lock down the XP so that only the VM has access to the internet, have a shared folder. For cheapness and ease of licensing you could run Linux inside the VM, though W7 or W10 has the advantage of being able to run Windows AV to scan files before they reach XP.

jambalaya – Member

@maxtorque I believe something like 75% of the world’s pc’s are running XP or older

I doubt that, source? The current netmarketshare figures have XP at a smidge over 7%, and hasn’t been over 10% for about a year, and the entire ‘Not Windows 10 or 7’ figures barely exceed 25%

Admittedly that’s for internet connected desktop devices, and only polled using their methods, but it’s pretty indicative of reality and recognised as such by most places when doing this kind of research, there’s going to be a fair chunk of offline industrial machines, but even accounting for them and a wide margin of error, it’s not going to get anywhere near 75%

On the original topic, if a VM is out fo the question due to needing to play with custom hardware* then my advice would be keep it offline, and when it must go online, plug it in manually to your router/firewall and make sure it only has access to POP/IMAP ports to retrieve mail from a dedicated** account/mailbox (if that is your chosen transfer method), block everything else, don;t even let it have HTTP access.

* how does the hardware connect? if it’s external via Serial or USB then you can normally do port passthrough to the guest machine.

** unpublished so literally the only mails it can/should receive at the ones with the files from known sender.

I used to run the free Avast! suite. It worked very well. I have an XP machine running one Windows app (Anquet maps) other than that I’m on mac. I wouldn’t put XP on the internet now. I don’t think I’d bother networking it at all or VMs – just use a stick.

My CNC computer (which runs XP) has as little on it as possible. I do all my file transfers via usb. If I want to do a bit of browsing I’ve got a little Atom laptop with windows 10. No need to put the CNC machine online. Its been OK for 8 years or so with no anti virus. It would be handy to have it hooked up to dropbox for easy file transfer but the usb drive isn’t that big a deal and I’d rather it just worked when I need it. I do try to keep it backed up although a recent system change showed that my back up was a bit lacking and I lost a few settings.