Antivirus:When connecting to the internet, your first and most important step for protecting your PC is to get a decent anti-virus solution installed and updated.
Microsoft Security Essentials paired with
Immunet is an excellent start.
Avira is also often referred to as having a very high detection rate, however Microsoft has stepped up the heuristics game in their latest revisions and it's far less nagging with popups than the free Avira.There's also
Avast, and
AVG which are well regarded free AV solutions.The free version of Avast in particular is fairly robust with the addition of p2p, email, and light weight network intrusion detection. And AVG is allowed for use in business settings much like MSE.However, I don't believe paying for any antivirus solution is worth it (the exception being enterprise solutions where centralized management is crucial), and here's my reason why:
You can't rely on AV solutions to be the magic bullet that prevents you from getting malware.On a good day, a very good AV solution, regardless of being free or purchased, will prevent around 30% of new (aka. zero day) threats based on heuristics alone.Without heuristics, it will block 0% of new threats designed to be undetected.That is coupled with an exponential increase in malware variants over the past few years.In 2010 alone, 1/3 of all malware variants THAT EVER EXISTED were created.So far in 2011, AV companies like Panda are seeing 73k+ new variants DAILY.The reason there has been such a tremendous increase is due to malware developers shifting from "causing havoc" to scamming or stealing you out of your hard earned cash.And like anything...where there's money to be made, the criminals come in droves from all over the world.
So that's where the rest of this guide will focus, malware prevention:
Limited Rights: The first and most important thing you'll want to do,is to remove your "main" account from the Administrators group.I know that sounds inconvenient, but trust me, it's not bad at all with Windows 7.(I recommend
upgrading away from XP as soon as you can, support for it officially ends in 2013) Here is one way to accomplish reduced rights, step by step:
1. Right-click My Computer and select Manage
2. Navigate to the Users and Groups section (under System Tools) and click on Users
3. Right-click on the right hand pane and select New User
4. Give this user a name and password. Set it so that"not expire" is the only check selected
(for example the username "Trusted" and password "trustno1" would work)
5. Click on the members tab and add the Administrators group
6. Log out and log in as your new "Trusted" account.Go back to Users and Groups
7. Click on Groups then double-click Administrators.Remove your "main" account
8. Double-click the Users group.Ensure your "Main" account is there, add it if not.
9. Log off "Trusted" and log back into your "Main" account.You're all set!
From here when you want to install a new device, administer your PC, or run a program that requires elevated rights, you'll get a prompt to enter the password for your "Trusted" account.You should rarely, if at all, need to log out and log in to the "Trusted" profile in order to install something...instead simply install it by typing in its credentials while under limited rights.
By doing this simple initial step...you gain a protection inherent to many operating systems other than Microsoft's, who with Windows adopt more of a "lazy admin by default" paradigm...you've protected yourself immensly against the bulk of rootkits out there...and some of the nastier system-wide trojans.You might still manage to accidently get a profile based trojan, but in most cases you can clear it up by logging in as "Trusted" to address it. (in "good news" terms...no need to wipe/reload..yay!)
(And yes, the UAC is built into Windows 7, but I wouldn't trust it at all...unfortunately it does not prompt for many windows processes...which to Microsoft's benifit avoids nagging. This can be abused by certain types of malware like TDSS/TDL4, etc.The Power Users group has similar vulnerbilities, allowing malicious code to self-escalate..always use the Users group for limited rights)
Patches: The 2nd most important thing to have besides limited rights is patched software!Most malware programs these days install via web based exploit packs (drive by infections) that take advantage of unpatched 3rd party programs.Running Windows updates only gets you so far, that older copy of Adobe Reader makes your PC as secure as a raw steak in a lions cage.In fact, back in 2009, Adobe Reader alone was seen by AV companies to be responsible for over 80% of all malware infections.The trend is constantly in flux as malware developers always go for the lowest hanging (and most profitable) fruits....often more than 1 at a time.
There's two places to go that make personal patch management a breeze:
-
Secunia PSI is an automatic patching service for home PCs.Think of it as "Windows Updates for everything else"
-
Ninite is a web based updater that is very easy to use to get the latest versions of software.It lacks active features that PSI has however, such as security assessments and automatic patching.But it's easier to use to get things started.
Site Advisors: So far, all these precautions are fine and dandy.But what's still missing is a way to know that the address your looking at is malicious before visiting it.That's where these very helpful tools come in:
-
Web of Trust I cannot recommend enough.Think of it as an "early warning" to malicious sites before actually clicking on them in search results.A simple search for "free screensavers" for example usually returns about 1-2 "safe" sites out of 10.Very very handy plugin. (works for IE, Chrome, Firefox, and Opera)
-
Peerblock is a very decent IP filter that will help you control "who" your PC is talking to.Lot's of prebuilt lists as well as ones you can download.This program is a little more on the paranoid end, but is also easy to learn and has an active community supporting it. (at the least, you get to watch tons of advertismentcompanies lose track of what your doing..)
-
OpenDNS is a very good alternative DNS provider that will help steer your browser away from unwanted sites.Since it is a DNS provider, it can also be configured on a home router level to be your default DNS provider for all PCs, helping to protect any new devices that are added to your network.
- Depending on the browser you use, you might want to look into
Adblockers to cut down ad exposure. Many advertising affiliates are lazy in checking their content for obfuscated code.Let alone adblockers help ward off cookies and help protect your privacy!
Some other random things to consider: - If you really want to go all out, disable java and activex entirely. (or set to always prompt..alternatively use a plugin like
noscript that controls what loads and what doesn't, and keep an eye on what toolbars, browser helper objects, or addins are installed)
Java, in particular was heavily targeted in FY 2010, so will definitely be one to keep updated and look after.Adobe Reader has traditionally taken the top spot (in FY 2009 it accounted for over 80% of all malware infections).With the newer Adobe X being sandboxed, infections initiating from Reader vulnerabilities have dramatically dropped.
- Make sure your Windows Firewall is running.It should be sufficient for the most part in Windows 7...simple to use, and will alert you to programs trying to send data out into the wild.
- Read Microsoft's recommendations on
preventing malware which offer additional settings you could incorporate such as Applocker, KPP, MOICE, SEHOP, and ODOCT (have I mentioned they love to use acronymns?)
- Be sure to create a manual Restore Point when you get to a configuration you really like.
- Factory installs are often outdated driver-wise and can sometimes present their own niche of vulnerabilities.Head to the manufacturer's website and grab the latest drivers from their support section.
- Click in the searchbox above the start button and type "msconfig" to assist in cleaning up the remaining startup items you don't want.It will save what you disable just in case you find you want to turn it back on later.
Further Reading: -
US Computer Emergency Readiness Team -
Microsoft's Security Intelligence Report v10 -
Microsoft's Malware Protection Center
