Guide

Three basic types of firewalls are available for you to choose from: Software firewalls (built into your OS) Hardware routers Wireless routers To determine which type of firewall is best for you, answer these questions: How many computers will use the firewall? What operating system do you use? (Windows, macOS, or Linux.) That’s it. You are now ready to think about what type of firewall you want to use. There are several options, each with its own pros and cons. ...

Antivirus software (sometimes spelled anti-virus) tries to identify, neutralize, or eliminate malicious software. Early tools targeted computer viruses; by the late 2000s products already aimed at worms, phishing-related payloads, rootkits, Trojans, and other malware. This page is a primer from that era — useful background when reading the scareware dossiers on this blog (WiniGuard, SecurityTool, and related clones). Pair AV with careful browsing (site advisor, hosts file) rather than treating any one product as enough. ...

Three steps to keep Windows fast, stable, and secure. The original 2009 version of this guide recommended FileHippo Update Checker (later renamed AppManager) and the Secunia Online Scanner. Both are gone — FileHippo retired its updater, and Secunia’s consumer tools shut down years ago. Here is what still works. 1. Patch Windows and Microsoft products Turn on automatic updates and verify nothing is pending. Reboot when prompted — pending restarts leave patches half-applied. ...

The original 2009 version of this checklist recommended Symantec Brightmail and the Symantec State of Spam site. Brightmail is now part of Broadcom’s enterprise portfolio and is not a practical choice for home users. The do/don’t advice below is still sound. Do Unsubscribe from legitimate mailings that you no longer want to receive. When signing up to receive mail, verify what additional items you are opting into at the same time. De-select items you do not want to receive. Be selective about the Web sites where you register your email address. Avoid publishing your email address on the Internet. Consider alternate options — for example, use a separate address when signing up for mailing lists, get multiple addresses for multiple purposes, or look into disposable address services. Using directions provided by your mail administrators, report missed spam if you have an option to do so. Delete all spam. Avoid clicking on suspicious links in email or IM messages as these may be links to spoofed websites. We suggest typing web addresses directly in to the browser rather than relying upon links within your messages. Always be sure that your operating system is up-to-date with the latest updates, and employ a comprehensive security suite. For organizations, use a reputable e-mail security gateway (Microsoft Defender for Office 365, Google Workspace spam filtering, or a dedicated provider such as Proofpoint or Mimecast) to filter spam before it reaches inboxes. Keep up to date on recent spam trends — the Anti-Phishing Working Group publishes quarterly reports on phishing and spam activity. Do not Open unknown email attachments. These attachments could infect your computer. Reply to spam. Typically the sender’s email address is forged, and replying may only result in more spam. Fill out forms in messages that ask for personal or financial information or passwords. A reputable company is unlikely to ask for your personal details via email. When in doubt, contact the company in question via an independent, trusted mechanism, such as a verified telephone number, or a known Internet address that you type into a new browser window (do not click or cut and paste from a link in the message). Buy products or services from spam messages. Open spam messages. Forward any virus warnings that you receive through email. These are often hoaxes.

Freeing up disk space keeps Windows responsive and gives updates room to install. The original 2009 version of this guide recommended Auslogics BoostSpeed and CCleaner for the job. Today you rarely need either — Windows 10 and 11 ship with cleanup tools that are safer than third-party “boosters” and registry cleaners. Here is the modern workflow. Why cleanup Over time Windows accumulates files you can safely remove: Temporary files from apps and the system Browser caches and downloaded program files Windows Update leftovers, WinSxS component-store bloat, and orphaned installer patches The Recycle Bin Delivery Optimization cache and old restore points Apps and games you no longer use Tip: On modern browsers the cache is capped and self-managing, so the biggest wins are usually Windows Update leftovers (especially WinSxS and the Installer folder), the Downloads folder, and unused applications — not the browser cache. ...

A firewall is an application which controls network traffic to and from a computer, permitting or denying communications based on a security policy. A personal firewall differs from a conventional firewall in terms of scale. Personal firewalls are typically designed for use by end-users. As a result, a personal firewall will usually protect only the computer on which it is installed. Many personal firewalls are able to control network traffic by prompting the user each time a connection is attempted and adapting security policy accordingly. Personal firewalls may also provide some level of intrusion detection, allowing the software to terminate or block connectivity where it suspects an intrusion is being attempted. ...

You can block a lot of ads and tracking by editing the hosts file on Windows and other operating systems. It is a local override that runs before your ISP’s DNS — useful against known bad domains as well as noisy ad servers. Once you rely on a custom hosts file, also read Protect Hosts File so malware cannot quietly rewrite it. Pair with a real antivirus and, where helpful, a site advisor-style reputation tool. ...

There are good reasons to be suspicious of e-mail. Some e-mail messages might be phishing scams, some might carry viruses. Images in spam e-mail might turn out to be pornographic, or to include Web beacons, which can be adapted to secretly send a message back to the sender. Follow these guidelines to help protect yourself when suspicious mail shows up in your Inbox. 1. Do not respond — and don’t open junk mail If an e-mail looks suspicious, don’t risk your personal information by responding to it. Delete junk e-mail messages without opening them. Sometimes even opening spam can alert spammers or put an unprotected computer at risk. Don’t reply to e-mail unless you’re certain that the message comes from a legitimate source. This includes not responding to messages that offer an option to “Remove me from your list.” Do not “unsubscribe” unless the mail is from a known or trusted sender. Use the junk mail tools in your e-mail program. Gmail, Outlook, Yahoo, and most providers let you mark messages as spam or phishing, which trains their filters and blocks the sender. 2. Approach links with caution Links in phishing e-mail messages often take you to phony sites that encourage you to transmit personal or financial information to con artists. Avoid clicking a link in an e-mail message unless you are sure of the real target address, or URL. ...

A few clues can help you spot fraudulent e-mail messages or links within them. What does a phishing e-mail look like? Phishing e-mail messages are designed to steal your identity. They ask for personal data, or direct you to Web sites or phone numbers to call where they ask you to provide personal data. Phishing e-mail messages take a number of forms: They might appear to come from your bank or financial institution, a company you regularly do business with, such as Microsoft, or from your social networking site. They might appear to be from someone you know. Spear phishing is a targeted form of phishing in which an e-mail message might look like it comes from your employer, or from a colleague who might send an e-mail message to everyone in the company, such as the head of human resources or IT. They might ask you to make a phone call. Phone phishing (vishing) scams direct you to call a customer support phone number. A person or an audio response unit waits to take your account number, personal identification number, password, or other valuable personal data. They might include official-looking logos and other identifying information taken directly from legitimate Web sites, and they might include convincing details about your personal information that scammers found on your social networking pages. They might include links to spoofed Web sites where you are asked to enter personal information. To make these messages look even more legitimate, scam artists may place a link that appears to go to the legitimate Web site, but actually takes you to a phony scam site or a pop-up window that looks exactly like the official site. ...

Online fraud is annoying, costly, and risky for both your accounts and your computer. You can cut a lot of that risk by learning to recognize scams and keeping a few habits consistent. Identity theft predates the web, but going online made it cheaper for criminals to reach large numbers of people. Attackers who want your accounts use phishing, hoaxes, and related tricks to obtain personal information — name, government ID numbers, account names, passwords, and more. ...

Phishing (pronounced “fishing”) is a type of online identity theft. It uses e-mail, text messages, and fraudulent Web sites that are designed to steal your personal data or information such as credit card numbers, passwords, account data, or other information. Con artists might send millions of fraudulent messages with links to fraudulent Web sites that appear to come from Web sites you trust, like your bank or credit card company, and request that you provide personal information. Criminals can use this information for many different types of fraud, such as to steal money from your account, to open new accounts in your name, or to obtain official documents using your identity. ...

Malware sometimes rewrites the hosts file to redirect you to malicious sites or to cut you off from update and security vendors. Locking the hosts file makes unauthorized edits harder. This note was written when Avira Premium Security Suite could lock the hosts file from its firewall settings. Product UIs change; the idea remains: immunize known malware domains first, then prevent silent rewrites. Before you lock Review how the hosts file works. Immunize by blocking known malware domains (for example with a hosts manager such as HostsMan). Then lock the file. Unlock periodically if you want to refresh blocked domains (weekly or monthly). Locking with Avira (historical steps) Assuming you have Avira Premium Security Suite: ...

A website reputation tool (often called a site advisor) warns whether a site looks safe, questionable, or risky — commonly shown as green / yellow / red next to search results. These programs usually install as a browser add-on and surface ratings while you use engines such as Google or Yahoo. They typically flag sites associated with phishing or scams, viruses or spyware, spam, browser exploits, and similar abuse. How ratings work Reputation metrics are usually collected from other users who have interacted with the site. Each user indicates whether they were satisfied or not. In the simplest model, reputation is an aggregate of those past ratings. ...

Spam is any kind of unwanted online communication. Common types of spam The most common form is unwanted e-mail. You can also get: Text message spam — sometimes called smishing Instant message spam — sometimes known as spim Social networking spam Harmless vs. dangerous spam Some spam is annoying but harmless. However, some spam is part of an identity theft scam or another kind of fraud. Identity theft spam is often called a phishing scam. ...

If you suspect that you’ve responded to a phishing scam with personal or financial information, take these steps to minimize any damage. Step 1: Report the incident Contact the following authorities: Your credit card company, if you have given your credit card information. The sooner an organization knows your account may have been compromised, the easier it will be for them to help protect you. The company that you believe was forged. Remember to contact the organization directly, not through the e-mail message you received. In the United States, report identity theft at IdentityTheft.gov and file a fraud report at ReportFraud.ftc.gov. You can also report the phishing scam to the Anti-Phishing Working Group by forwarding the phishing e-mail message as an attachment to [email protected]. ...