Ideally, you do this step when you install Windows. The first user account is an Admin account by necessity. Create a second one, a Standard User account, to use for normal daily use. This limits the damage that a malware attack can accomplish. If you've been using a Computer Administrator account as your normal daily account, then create a new Administrator-level account, and then switch your own account(s) to Standard User. Don't use the Admin-level account for anything but Admin work.

Firewalls prevent other computers from making unauthorized network contact with your computer. These unwanted probes could come from worm-infected computers that are trying to infect your computer, or from human or automated hacking attacks that attempt to access your computer.

Enable Automatic Updates (click Start > All Programs > Windows Update).

The bad guys can't exploit something that isn't there, so uninstall software you don't use, by going to Start > Control Panel > Programs. Sun Java is heavily exploited, so remove all instances of Java unless you absolutely have to have it for something. Media players such as QuickTime and RealPlayer, instant-messaging and VOIP programs, email programs, web browsers, and other widely-used software are often exploited by the bad guys as well. If you don't need it, uninstall it.

Some of the best security enhancements in Windows Vista and Windows 7 depend on the User Account Control (UAC) system. If you disable UAC, you lose more than just the Continue / Cancel prompts that some people find bothersome; you're also losing file-system & Registry virtualization and Protected Mode. Set it to the "Always Notify" setting, as shown above. This change will stop certain attacks that would succeed if you were using the default setting.

Your computer might be attacked automatically if someone connects an infected portable device to it. For example:

• USB thumb drives / flash drives
• memory cards
• CD or DVD discs
• external hard drives
• digital picture frames
• MP3 players
• other USB and Firewire devices that can store data
• ...or even a network share on another computer!

When you download and install software, you are lowering your own defenses and putting yourself at the mercy of the software's author. Don't do this lightly, because the bad guys will be happy to bypass all your security measures with a Trojan Horse attack, targeting you as the weak point in the computer's defenses. Do not expect your antivirus software to detect all Trojan Horse programs; that is not realistic thinking.

One common Trojan Horse attack is a web page that claims you need to download something before you can watch a video or view a picture (see the example picture below). They might claim you need a codec, a Flash Player update, an ActiveX update, etc. The bad guys keep using this simple tactic because people keep falling for it.

Absolutely do not mess around with warez (illegal software), key generators, cracks, or any executable files you got from a P2P / file-sharing network; these are extreme risks. Also avoid websites that feature warez, serials, cracks or pornography, because those categories of websites are most likely to have malicious exploits built into them.

User education is the best defense against phishing. One common phishing technique is to send you an email claiming to be from a website like PayPal or EBay, Facebook, MySpace, or perhaps the IRS, Steam, or World Of Warcraft. The email contains a link to a faked version of the real website, where they hope you'll enter your log-in credentials or other private information, before you discover it's not the real website.

• Be skeptical Don't take any email at face value, no matter how official it looks. You should fully expect the scammers to send you authentic-looking emails posing as the Better Business Bureau, World Of Warcraft, Steam, MySpace, Facebook, the FBI, the IRS, PayPal, EBay, your bank, your credit-card company, your Internet provider, your retirement fund, etc.

• Don't click links in emails If you get an email containing a clickable link, don't click the link. Open a new Web browser and manually type in the real address of any site you need to visit.

• Don't be flustered by an urgent "call to action" Phishing emails often contain some sort of urgent language, to get an immediate reaction. For example, they might claim that your account has been suspended. Again, be skeptical, and don't take them at face value. If there's any doubt, then open a separate web browser, go to the real website by manually typing the address, and verify any claims for yourself.

• Display email as plain text If you use an email program like Outlook Express, Outlook, Thunderbird or Windows Mail to view email, set it to display email as plain text (see the program's Help file if necessary). Email won't look as pretty, but it unmasks faked links and content.

Sooner or later, you'll encounter a scam website that makes hysterical claims that your computer is infected, and that you need to run their "scanner" to fix it. These scams are often accompanied by a slick-looking animated "scanner" that reports fictional "infections." Invariably, the victim is asked to pay money to register the bogus "scanner," so it can remove the fictional "infections."

The bad guys create new versions of these scams every day, and they're cleverly made. Don't freak out. Press CTRL ALT DEL, start Task Manager, go to the Processes tab, click on your web browser's process, and click END TASK to terminate the browser. The picture below shows why: it's a web page designed to look like your own My Computer window. Closing your browser ensures you're not being fooled by these types of tactics.

If your computer died RIGHT NOW, or malware deleted important files, do you have a backup copy of your important stuff?

Be wise. Establish a backup system, such as an external hard drive, and use it.

What's a suggested backup software? The simplest option is to copy your important files to a backup drive manually, using Windows Explorer. Go to C:\Users\ and copy the folder that belongs to your user account. These "profile" folders contain the Documents, Pictures, Videos, Favorites, Downloads and Desktop folders for each individual user account. If you have additional files in other locations, don't forget to back them up too.

Many versions of Windows have a built-in Backup utility you can enable. On Windows 8, you can connect an external drive and configure it for File History, which you'll find in Control Panel > System and Security > File History.