Don't use an Administrator user account when you don't need to

Firewalls prevent other computers from making unauthorized network contact with your computer. These unwanted probes could come from worm-infected computers that are trying to infect your computer, or from human or automated hacking attacks that attempt to access your computer.

Keep Windows up-to-date

Enable Automatic Updates (you can reach this setting by right-clicking My Computer and choosing Properties, and then click System Protection on Vista systems).

Eliminate unnecessary "attack surface" by uninstalling software you don't need

The bad guys cannot exploit something that isn't there, so uninstall software you don't use, by going to Start > Control Panel > Add/Remove Programs (or just "Programs" on Vista systems). Media players such as QuickTime and RealPlayer, instant-messaging and VOIP programs, email programs, web browsers, Sun Java and other widely-used software are often exploited by the bad guys. Your system will have more disk space and may run faster, too.

Keep your other software up-to-date

Fully enable your computer's Data Execution Prevention feature

Use antivirus software

Do install a current-generation antivirus program and keep it up-to-date. Run a full system scan every week or so.

Don't assume that your antivirus software makes you invincible! Use the other steps in this guide to protect your computer from attacks that your antivirus software doesn't recognize.

Disable or restrict AutoPlay

Your computer might be attacked automatically if someone connects an infected portable device to it. For example:

• USB thumb drives / flash drives
• memory cards
• CD or DVD discs
• external hard drives
• digital picture frames
• MP3 players
• other USB and Firewire devices that can store data

Don't be fooled into running a Trojan Horse program on your computer

When you download and install software, you lower your own defenses and put yourself at the mercy of the software's author. Don't do this lightly, because the bad guys will be happy to bypass all your security measures with a Trojan Horse attack, targeting the computer's user as the weak point in the defenses (this is also another reason to restrict access to the Administrator account). Do not expect your antivirus software to detect all Trojan Horse programs; that is not realistic thinking.

One common Trojan Horse attack is a web page that claims you need to download something before you can watch a video or view a picture (see the example picture below). They might claim you need a codec, a Flash Player update, an ActiveX update, etc. Are you going to take that bait?

Absolutely do not mess around with warez (illegal software), key generators, cracks, or any executable files you got from a P2P / file-sharing network; these are extreme risks. Also avoid websites that feature warez, serials, cracks or pornography, because those categories of websites are most likely to have malicious exploits built into them.

Phish: recognize fake emails and websites that try to steal your information

User education is the best defense against phishing. One common phishing technique is to send you an email claiming to be from a website like PayPal or EBay, Facebook, MySpace, or perhaps the IRS, Steam, or World Of Warcraft. The email contains a link to a faked version of the real website, where they hope you'll enter your log-in credentials or other private information, before you discover it's not the real website.

• Be skeptical Do not take any email at face value, no matter how official it looks. You should fully expect the scammers to send you authentic-looking emails posing as the Better Business Bureau, World Of Warcraft, Steam, MySpace, Facebook, the FBI, the IRS, PayPal, EBay, your bank, your credit-card company, your Internet provider, your retirement fund, etc.

• Don't click links in emails If you get an email containing a clickable link, don't click the link. Open a new Web browser and manually type in the real address of any site you need to visit.

• Don't be flustered by an urgent "call to action" Phishing emails often contain some sort of urgent language, to get an immediate reaction. For example, they might claim that your account has been suspended. Again, be skeptical, and don't take them at face value. If there's any doubt, then open a separate web browser, go to the real website by manually typing the address, and verify any claims for yourself.

• Display email as plain text If you use an email program like Outlook Express, Outlook, Thunderbird or Windows Mail to view email, set it to display email as plain text (see the program's Help file if necessary). Email won't look as pretty, but it unmasks faked links and content.

Scareware: recognize fraudulent "security" websites and fake "security scanner" rip-offs

Sooner or later, it's likely that you'll encounter a scam website that makes hysterical claims that your computer is infected, and that you need to run their "scanner" to fix it. These scams are often accompanied by a slick-looking animated "scanner" that reports fictional "infections." Invariably, the victim is asked to pay money to register the bogus "scanner," so it can remove the fictional "infections."

I'd like to emphasize that the bad guys create new versions of these scams every day, and they're cleverly made. Your first response should be to press CTRL ALT DEL, start Task Manager, go to the Processes tab, click on your web browser's process, and click END TASK to terminate the browser. The picture below shows why: it's a web page designed to look like your own My Computer window. Closing your browser ensures you're not being fooled by these types of tactics.

Back up your data!

If your computer died RIGHT NOW, or malware deleted important files, do you have a backup copy of your important stuff?

Be wise. Establish a backup system, such as an external hard drive, and use it.

What's a suggested backup software?

Windows Vista and Windows XP users: upgrade to Internet Explorer 8

Windows Vista users: don't disable UAC (User Account Control)

Some of the best security enhancements in Windows Vista depend on the User Account Control (UAC) system. If you disable UAC, you lose more than just the Continue / Cancel prompts that some people find bothersome; you're also losing file-system & Registry virtualization and Protected Mode.

Tip: if you have issues creating or modifying files and folders, causing repeated UAC prompts, ask at a Forum for help adjusting the file-system permissions to actually fix the underlying issue.

Windows Vista: enable a protective feature called SEHOP