How to Keep Your PC Safe from Malware and Viruses

How infections actually start now

Four routes account for the overwhelming majority of consumer infections. Recognising them is most of the work.

• A cracked or free version of paid software. This is the single biggest source. A crack has to disable a security check to work, which is indistinguishable from what malware does — so the two travel together, and the antivirus warning gets dismissed as a false alarm.
• A fake installer from a lookalike download site. The real project name, a very similar domain, and an installer forty megabytes heavier than it should be.
• A browser extension that changed hands. It was fine for two years, the developer sold it, and the new owner shipped an update that reads every page you visit.
• An email attachment that asks you to enable content. That prompt exists to run code, and there is no legitimate modern reason to accept it.

The ten-second check before you run anything

Do this every time. It is quick enough to become a habit and it catches the overwhelming majority of bad files.

• Check the file extension, with extensions visible. In Windows Explorer turn on View, then File name extensions. A file called invoice.pdf.exe looks like a PDF until you do this.
• Check the size against expectation. A three-megabyte Photoshop installer is not Photoshop. A 900-megabyte PDF reader is not a PDF reader.
• Upload it to VirusTotal. It is free, it takes about twenty seconds, and it runs the file past dozens of engines at once. One or two obscure engines flagging something is ordinary noise; ten engines agreeing is not.
• Compare the checksum when the project publishes one. Run certutil -hashfile yourfile.exe SHA256 on Windows, or shasum -a 256 yourfile on macOS and Linux, and check the result against the value on the official site.
• Ask where the link came from. A download link that arrived unsolicited deserves more suspicion than one you went looking for.

Settings worth changing once

These are set-and-forget. None of them will bother you again after the first minute.

• Leave Windows Defender on. It is genuinely competitive with paid products now, and the paid ones frequently bundle exactly the browser-toolbar behaviour they claim to protect you from.
• Turn on Controlled folder access in Windows Security. It stops any unrecognised program writing to Documents and Pictures, which is precisely what ransomware needs to do first.
• Enable automatic updates for the operating system and the browser. Nearly all exploited vulnerabilities are exploited after the patch exists, against people who have not applied it.
• Use a standard user account for daily work rather than an administrator account. Anything needing elevation then has to ask, and the asking is the warning.
• Point your DNS at a filtering resolver such as Quad9 on 9.9.9.9. It blocks known-malicious domains before your browser reaches them, costs nothing, and takes two minutes.

Backups are the actual answer to ransomware

No antivirus catches everything, and ransomware only has to succeed once. A backup turns a catastrophe into an afternoon.

The rule of thumb is three-two-one: three copies of anything you care about, on two different kinds of storage, with one of them somewhere else. In practice that is your computer, an external drive, and a cloud backup.

The critical detail is that the external drive must be unplugged when it is not being written to. A drive that is always connected is just another folder for ransomware to encrypt.

If you think something already got in

Work in this order. Doing it out of order tends to make things worse.

• Disconnect from the network first. Unplug the cable or turn off Wi-Fi. This stops data leaving and stops the infection spreading to other machines.
• Do not log in to anything from the affected machine, especially banking or email.
• Scan from a different device or a rescue USB. Malware that is running can hide from a scanner running alongside it.
• Change important passwords from a clean device. Email first, because email resets everything else.
• If the machine held anything financial, a full reinstall is the only genuinely reliable cleanup. It costs a few hours; the alternative is trusting a machine you have a specific reason not to trust.

The one habit that matters most

Download from the source. Not the first search result, not an aggregator, not a mirror recommended in a forum comment — the project's own website, or the platform's own store.

Search results for popular free software are routinely bought by lookalike sites. The advert sits above the real result and the page is a convincing copy. Type the address, or use a bookmark.