Removing malware after the fact always costs more time than preventing it, and the good news is that most infections rely on a small, predictable set of tricks — a rushed software install, an unpatched vulnerability, or a convincing email. This guide covers the specific, realistic habits and Windows settings that close off the routes malware actually uses, without requiring you to buy expensive extra software or live in constant suspicion of your own computer.

Keep Everything Updated — This Is the Single Biggest Factor

Most malware doesn't rely on clever trickery to get onto a PC — it exploits known vulnerabilities that have already been patched, on machines that simply haven't installed the update yet.

  1. Open Settings > Windows Update and confirm updates are set to install automatically, not just "notify."
  2. Don't indefinitely postpone restarts after updates — a pending security patch that never gets applied because the PC is never restarted provides no protection at all.
  3. Update your browser — Chrome, Edge, and Firefox all auto-update by default, but check under each browser's "About" page occasionally to confirm it isn't stuck on an old version.
  4. Update third-party software regularly, especially anything that handles files from the internet: PDF readers, media players, and compression tools (WinRAR, 7-Zip). These are common targets specifically because people forget they need updating at all.
  5. Update your router's firmware every few months via its admin page — a vulnerable router can be a route into your whole home network, not just one device.

Pro tip: Set a recurring monthly reminder to spend ten minutes checking for updates across your router, browser extensions, and any software that doesn't auto-update. This single habit closes more real-world attack routes than any single piece of security software.

Use Windows Defender Properly (You Don't Need to Buy Extra Antivirus)

Windows Defender, built into Windows 10 and 11, performs competitively with paid antivirus products in independent testing (AV-Test, AV-Comparatives) and is tightly integrated with the operating system.

  1. Confirm it's active at Settings > Privacy & security > Windows Security > Virus & threat protection — it should show "No actions needed."
  2. Ensure Real-time protection, Cloud-delivered protection, and Automatic sample submission are all switched on — cloud protection lets Defender react to brand-new threats far faster than signature updates alone.
  3. Enable Controlled folder access under Ransomware protection — this blocks unrecognised applications from modifying files in your Documents, Pictures, and Desktop folders, a meaningful defence specifically against ransomware.
  4. If you do want a second opinion scanner for peace of mind, use something like Malwarebytes' free on-demand scanner alongside Defender rather than replacing it — running two full-time, always-on antivirus products simultaneously causes conflicts and performance problems.

Think Before You Click: Email and Messaging

Phishing remains the most common way malware actually reaches a home PC.

  • Check the sender's actual email address, not just the display name — "Amazon Support" can be sent from any address at all; hover over or tap the name to reveal it.
  • Be suspicious of urgency — "your account will be suspended," "unpaid invoice attached," "delivery failed, click to reschedule" are classic pressure tactics designed to make you act before you think.
  • Don't open unexpected attachments, especially .zip, .exe, .js, or Office documents that prompt you to "Enable Content" or "Enable Macros" — this single prompt is one of the most common real-world infection triggers, since enabling macros lets an embedded script run.
  • Hover over links before clicking to preview the actual destination URL at the bottom of your email client or browser — a link reading "Your Bank" can point anywhere.
  • Verify unexpected requests (even from known contacts) through a separate channel — a text or phone call — since compromised accounts are frequently used to message their own contact list.

Safety warning: If you're ever asked to "enable macros" or "enable editing" on a document you weren't expecting, don't. This is one of the most common single steps that turns an email attachment into an active infection, and there is almost never a legitimate reason a normal document needs it enabled just to be read.

Download Software Safely

  • Download software only from the official developer website or a trusted platform like the Microsoft Store — not from third-party "download portal" sites, which frequently repackage legitimate installers with bundled adware or worse.
  • During any installation, choose Custom/Advanced setup rather than "Express" or "Recommended," so you can see and decline any bundled extras.
  • Be sceptical of free versions of paid software, "activators," or "cracks" — these are one of the most heavily targeted categories for malware distribution, since anyone downloading them already expects to run something slightly unusual and is primed to ignore warnings.
  • Check file extensions carefully — a file named invoice.pdf.exe is an executable disguised to look like a PDF; enable File Explorer > View > Show > File name extensions so Windows always shows the true extension rather than hiding it.

Browser Hygiene

  • Keep your browser's built-in protection enabled — Chrome and Edge both include Safe Browsing / Microsoft Defender SmartScreen, which blocks known malicious sites; confirm it's on in Settings > Privacy and Security.
  • Periodically review installed browser extensions and remove anything you no longer use or don't remember installing.
  • Avoid installing extensions from outside the official Chrome Web Store or Edge Add-ons store.
  • Don't save banking passwords in the browser's built-in password manager if you share the PC with others; use a dedicated password manager (Bitwarden, 1Password) with its own master password instead.

Back Up Regularly — Your Best Defence Against Ransomware Specifically

No amount of prevention is 100% guaranteed, so a good backup routine is what turns a ransomware infection from a disaster into an inconvenience.

  1. Follow the 3-2-1 rule: at least 3 copies of important data, on 2 different types of media, with 1 copy stored offsite or offline (e.g. an external drive that isn't permanently connected, or a cloud backup service).
  2. Use File History (Settings > Update & Security > Backup, or Control Panel > File History) or a dedicated backup tool to automate this rather than relying on remembering to do it manually.
  3. Keep at least one backup disconnected from the PC most of the time — ransomware that encrypts your main drive will also encrypt any permanently-connected backup drive it can reach.

Use Standard User Accounts for Daily Use

  1. Go to Settings > Accounts > Family & other users and check your account type.
  2. For everyday use, a Standard account (rather than Administrator) means malware that does get run has fewer default permissions to make system-wide changes — you'll be prompted for admin credentials (User Account Control) for anything that needs elevated access, which is a genuine extra checkpoint.
  3. Keep a separate Administrator account for installing software and making system changes deliberately.

Secure Your Home Network Too

Malware prevention isn't just about the PC itself — see our dedicated guide on securing your home Wi-Fi network for router-level steps, since a compromised router or an insecure IoT device on the same network can be a route to infecting every PC in the house.

Quick Prevention Checklist

  • [ ] Windows Update set to install automatically, restarts not postponed indefinitely
  • [ ] Windows Defender real-time and cloud protection enabled, Controlled folder access on
  • [ ] File extensions visible in File Explorer
  • [ ] Software only downloaded from official sources, Custom install used to decline bundled extras
  • [ ] Macros never enabled on unexpected documents
  • [ ] Regular backups following the 3-2-1 rule, with at least one copy offline
  • [ ] Daily-use account set to Standard, not Administrator
  • [ ] Router firmware and home Wi-Fi security reviewed periodically

None of these steps individually guarantees safety, but together they close off the routes that the overwhelming majority of real-world infections actually use — and cost nothing beyond a little routine attention.

Was this guide helpful? Explore more Malware Removal guides, or browse all Security & Performance articles.