Setting up a secondary or sub-network, for doing computer repair work, to protect main LAN from viruses?`

[VirtualLarry]

I am just curious how PC techs segment their network, for working on PCs.

I had a friend's relative tell me about their friend that has an infected PC that needs a re-format.

But they also need things saved off of their PC.

I was going to boot a Linux LiveUSB, and then save their HDD contents to an external HDD.

Was thinking how much easier it might be to have it save off to a NAS, using something like a Macrium Reflect Free LiveUSB.

Either way, then I'll maybe have to pull out e-mails, which I'm not quite sure how to deal with, as I don't do that often. (Mostly SOHO customers, very few business-oriented customers.)

But my primary question, was one of network segementation.

My current network setup, is two incoming internet connections, a Comcast (15/2) and a FIOS gigabit connection. I have a secondary router connected to the Verizon router, an Asus AC68U-family router, that serves as my local LAN router and wifi. The Comcast connection, slow as it is, is connected to an AC1900 Gateway modem/router combo. Currently, I've got a wired connection from my Asus LAN router, to the Comcast Gateway, as a failover connection.

So I was thinking, what way would be safe to connect up potentially-infected PCs. I could string a LAN cable, from the Verizon router, or from the Comcast Gateway. Probably the Comcast gateway, as I wouldn't want a virus to have access to a wide-open Gigabit internet connection to spread it's mayhem.

The other possibility, that I haven't explored, is using an additional Asus router, one with the Trend Micro network A/V software running in the router, and use that as a sort of controlled "quarantine" segment of my LAN, connected to the Verizon router, in parallel with my LAN router, but not directly connected to it.

So, PC techs out there, how do you do it? Full-blown PFSense with L7 filtering, and a DMZ? Something with consumer routers? Or just nuke-and-pave, and never let an infected machine online in the first place?

 

[Ajay]

I don’t put infected PCs on the network at all. Boot up with your favorite A/V boot USB (make sure it’s up to date) and then I would boot into safe mode and edit the registry as needed. If the virus is in an email and isn’t caught by the av software - then that’s going to be a fun game. In corporate environments, we'd just re-image the drive and restore user files from backups (or just reconnect to the user's mapped drive).

 

[Red Squirrel]

I just setup a separate vlan for that, it gets internet access and access to a few local resources like a separate VM that acts as an image server but that's it. I want to eventually set it up as a PXE boot so that anything plugged into that vlan will automaticly boot through PXE and let me load ISOs but I have not figured out a way to do that or looked all that deeply into it. I don't really work much on people's computers anymore though.

 

[ch33zw1z]

I'd probably use a VLAN if I didn't have a work-provided hotspot or android phone to use. I seldom do this type of PC work anymore though.

If the machine won't boot, I have a spare computer or two I can simply plug in the hard drive to it and boot linux for file system recovery.

This have proven to be the best method. I've even encountered windows machines that had a missing file system in both cmd and gui. I mean, the machine booted and everything, but I couldn't recover any files. It was some kind of ransomware. But, linux could still see the file system so files recovered ok.

 

[mikeymikec]

I haven't had to deal with particularly nasty malware for a good five years at least now. These days I've only experienced user-level very light-end malware like stuff that hijacks browsers.

Back when more serious stuff was common in my experience, I wasn't particularly concerned for the safety of my network as I don't run anything on my internal network that's a particular concern from automated threats (I tend to look at my network's security as if there is no NAT or firewall, so if it's not secure enough to hold its own on the Internet, it's not secure enough for my network). I'd normally do my best to disinfect a particularly infected PC without connecting it to a network at all, then connect and test.

I am curious about whether anyone else has seen anything particularly infectious first-hand in recent years.