Windows Security 101

What to do right now to secure your Windows system from almost all attacks

Contents

Executive Summary
Introduction
I. Checkpoints (System Restore Points)
· Definition of a checkpoint
· Scheduling checkpoints
· Display current checkpoints
II. Regular, Scheduled Backups
· User file backups: File History
· Windows system (i.e., operating system and configuration) backups
· Windows system restore
· Scripted backups
III. Malware Protection
· Windows Defender - the native solution
· Multi-layered security
· Antimalware software properties
· Antimalware providers
Conclusions
Footnotes

Executive Summary

Previously, we presented a long article with sections on practices every Windows user should already have implemented, vital, either official or authoritative sources on the topic of Windows security, and included sources for USA, international and European repositories of deep security knowledge and practices.

These sources form the fundamental knowledge that Windows users need to know, now, to keep their systems secure, at least from currently known and documented sources of attack. Since these sources are most often continuously updated, they help fulfil one of the criteria for safe usage of Windows; namely, to keep informed.

The present article covers three extremely important and irreplaceable practices we feel are incumbent on all users of Windows, whether expert, casual or beginners, to implement immediately. Here, we explain what each practice means, why they should be implemented now, and what types of attacks each guards against.

In this article, we explain why checkpoints (Windows System Restore Points) are necessary and how to implement them. We describe, in detail, the two types of absolutely necessary backups every Windows user should use, now. Last, we cover the vast subject of antimalware software and why Windows users should add at least one new antimalware system to their existing, default Windows Defender protection.

Back to Contents

Introduction

While there are many aspects to personal computer security, this article covers only the must-haves that every user of Windows can and should implement immediately. Our previous article covered a number of items all Windows users should be using or doing already. In addition, the previous article linked to, and annotated, 45+ authoritative and valuable resources on the subject of Windows security.

The incident that inspired this article: An accidental, right-click on a link on New Year’s day introduced a nasty virus to our main workstation computer that took days to fix, and destroyed a mechanical keyboard that had previously worked perfectly.

We still don’t know how it was done, but now understand that such damage is possible. The procedures discussed here will allow rapid repair and more permanent protection for one’s computer; we recommend immediate implementation of all of these measures.

We noticed during the outage that Windows programs were going crazy, but that CMD (the command-line interface), Power Shell (a more advanced command-line program) and other, similar programs were untouched. These can be used to fix the computer when all else seems lost, and so are given below.

Windows 10 still gets coverage here: This treatment is specific to Windows 10, which we like and intend to use until it’s end of life on 14 October 2025. Windows 11 is very likely similar; one can easily reproduce the below method for that system. We strongly recommend saving the results in a text or Word file for possible later use.

The security mindset: The first principle in system security is to assume that bad things will happen unless specifically guarded against. This is a mindset that takes time to develop; the issue is complicated, and there are definitely priorities, the top few we cover below. Additional measures of a more specialized nature will be covered in future articles.

Several important issues will not be covered in the present article. We believe, for example, that our government administrations and law enforcement should be continually encouraged, even pressured, to make black-hat hacking ever more difficult. Moreover, there are several countries with a reputation for, and a long history of black-hat hacking. We’d like to see much stronger measures put into place to stop such attacks. We’ll take up this more political and foreign relations topic in a future article.

We’re also going to skip delving into networking configurations as a security measure for the time being. This is largely due to the large variety of different ISPs and their non-standardized software for configuring home and office routers. These issues will be deferred to a later article.

We used Google Gemini to flesh out the basics of each topic, always explicitly quoting the AI so that readers can see exactly what it was asked and how it replies. While Gemini is certainly not the sharpest tool in the shed (and appears to have become somewhat dumber than usual lately), it is at least continually updated.

What we cover here: We cover three critical aspects of Windows security we deem so important that, if the reader runs Windows and hasn’t done all three of the recommended actions below, all else should be dropped immediately in favor of implementing them now. Covered in some detail in this article:

I. checkpoints, a.k.a. system restore points
II. backups, both user files and operating system backups
III. enhanced antimalware guardians.

Back to Contents

I. Checkpoints (System Restore Points)

Given that no software on Earth can provide 100% protection against malware attacks, eventually, someone is going to figure out a new way to attack Windows no one ever thought of, nor devised defenses against. It did happen to us, did result in hardware damage and can happen to others.

The first, and most important, bulwark against destruction of your private digital assets on your own computer is regular and routine checkpointing. This covers the cases you cannot predict and cannot defend against. A checkpoint, in simple terms, is a copy of your computer’s configuration at a particular time.

Doing this regularly, in scheduled form as we suggest, gives you the option of reverting your computer to its last known good configuration, chosen to be before the attack happened. You have to do this!

Windows creates checkpoints automatically in response to certain events, such as OS updates and software installs. We think you should do it on a schedule, independent of these occasional events, to prevent loss of more than a few days’ work, at worst.

It’s up to each user to determine their own risk / benefit profile; checkpoints take up storage space and must be managed, so deciding on how to do this is an individually determined decision. Consider the potential loss against the storage costs and bandwidth to create the checkpoints.

The decision should not be too hard. Twice a week is good enough for most people; daily might be better for people with very high-value work, weekly or less for relatively low-value work. It’s up to each user to decide for themselves.

Back to Contents

Definition of a checkpoint

Overlogix: In the context of the Windows operating system, what is a checkpoint?

Gemini: In the context of the Windows operating system, a checkpoint is essentially a system restore point.

Here's a breakdown:

• Purpose: Checkpoints are created to capture the current state of your system at a specific point in time. This includes system files, registry settings, and installed applications.

• Usage: If you encounter problems with your computer (like software conflicts, driver issues, or unexpected crashes), you can use a checkpoint to revert your system to the stable state it was in when the checkpoint was created. This helps you avoid the hassle of manually troubleshooting and reinstalling software.

• Creation:

  • Automatic: Windows automatically creates checkpoints at certain intervals (e.g., before installing updates).

  • Manual: You can also manually create checkpoints before making significant system changes (like installing new software or drivers).

In the context of the Windows operating system, a checkpoint is essentially a system restore point.

Here's a breakdown:

• Purpose: Checkpoints are created to capture the current state of your system at a specific point in time. This includes system files, registry settings, and installed applications.

• Usage: If you encounter problems with your computer (like software conflicts, driver issues, or unexpected crashes), you can use a checkpoint to revert your system to the stable state it was in when the checkpoint was created. This helps you avoid the hassle of manually troubleshooting and reinstalling software.

• Creation:

  • Automatic: Windows automatically creates checkpoints at certain intervals (e.g., before installing updates).

  • Manual: You can also manually create checkpoints before making significant system changes (like installing new software or drivers). ¹

Key Points:

• Checkpoints are a crucial part of Windows' system recovery features.

• They provide a safety net for your system, allowing you to easily undo unwanted changes.

• Regular checkpoint creation is recommended for maintaining system stability and minimizing downtime in case of issues.

Note: While the term "checkpoint" might not be as commonly used as "system restore point," they essentially refer to the same concept within the Windows operating system.

Back to Contents

Scheduling checkpoints

Overlogix: In Windows 10, is it possible to schedule regular computer checkpoint creation as a guard against disasters?

Gemini: Yes, it's possible to schedule regular System Restore point creation in Windows 10. While Windows automatically creates restore points before significant events like software installations and updates, you can set up a custom schedule for more frequent backups. Here's how:

1. Enable System Protection:

• First, ensure System Protection is turned on for your system drive (usually C:).

  • Search for "Create a restore point" in the Windows search bar and open the "System Properties" window.

  • Under the "System Protection" tab, select your system drive and click "Configure."

  • Choose "Turn on system protection" and adjust the "Max Usage" slider to allocate disk space for restore points. Click "Apply" and "OK."

2. Use Task Scheduler:

• Windows 10's Task Scheduler allows you to automate tasks, including creating restore points.

  • Search for "Task Scheduler" in the Windows search bar and open it.

  • In the Task Scheduler Library, navigate to Microsoft -> Windows -> SystemRestore.

  • You'll see a task called "SR." Right-click it and select "Properties."

3. Modify the Existing "SR" Task (Recommended):

• Instead of creating a new task, it's generally better to modify the existing "SR" task:

  • In the "SR Properties" window, go to the "Triggers" tab.

  • Click "New" to create a new trigger.

  • Choose a schedule (Daily, Weekly, Monthly, etc.) and set the desired time and recurrence.

  • Click "OK" to save the trigger.

  • You can also adjust other settings in the "Conditions" and "Settings" tabs if needed.

4. Create a New Task (Alternative Method):

• If you prefer to create a new task:

  • In the Task Scheduler window, click "Create Task" in the right-hand pane.

  • In the "General" tab, give the task a name (e.g., "Daily Restore Point") and check "Run with highest privileges."

  • In the "Triggers" tab, create a new trigger with your desired schedule.

  • In the "Actions" tab, click "New" and set the "Action" to "Start a program."

  • In the "Program/script" field, enter powershell.exe.

  • In the "Add arguments (optional)" field, enter the following command:

    PowerShell

Checkpoint-Computer -Description "Scheduled Restore Point" -RestorePointType "SCHEDULED"

• Click "OK" to save the action and the task.

Important Considerations:

• Disk Space: Restore points consume disk space. Regularly delete old restore points to free up space. You can manage this in the "System Protection" settings.

• System Stability: While scheduled restore points are helpful, they are not a substitute for regular backups of your important data.

• Resource Usage: Creating restore points can temporarily use system resources. Schedule them for times when your computer is not heavily in use.

By following these steps, you can effectively schedule regular System Restore point creation in Windows 10, providing an extra layer of protection against system issues and data loss.

Back to Contents

Display current checkpoints

Overlogix: How can one list the current, scheduled checkpoints in Windows 10?

Gemini: You can view a list of current and scheduled checkpoints in Windows 10 using the following methods:

1. Using System Restore:

• Open System Restore:

  • Press the Windows key + R to open the Run dialog box.

  • Type rstrui and press Enter.

• View Restore Points:

  • Click Next in the System Restore window.

  • If you've previously used System Restore, select "Choose a different restore point" and click Next.

  • This will display a list of all available restore points, including their creation date and time.

2. Using Command Prompt:

• Open Command Prompt as Administrator:

  • Search for "cmd" in the Start Menu, right-click, and select "Run as administrator".

• Use the vssadmin command:

  • Type the following command and press Enter:

vssadmin list shadows

• • This will display a list of all available restore points on your system.

3. Using PowerShell:

• Open PowerShell as Administrator:

  • Search for "PowerShell" in the Start Menu, right-click, and select "Run as administrator".

• Use the Get-ComputerRestorePoint cmdlet:

  • Type the following command and press Enter:

Get-ComputerRestorePoint

• • This will display a list of all available restore points.

These methods will help you view the existing restore points on your Windows 10 system. Remember that the availability of restore points depends on your system's configuration and the amount of disk space allocated for System Restore.

Back to Contents

II. Regular, Scheduled Backups

There should be no controversy over backups. They should be done regularly; the exact schedule must be left to the individual to decide.

We advise different schedules depending on usage. Heavy users, who cannot afford even small losses of productivity, likely need to backup nightly, every day they use their computers.

Irregular or occasional uses can get away with far less in the way of backups. In any case, we recommend a strong look at what each user can afford to lose in case of disaster, and plan and implement accordingly.

Back to Contents

User file backups: File History

Overlogix: On the topic of Windows 10 security, we're interested in backups. Assume a user doesn't have OneDrive, and has a vanilla Windows 10 installation, but also has plenty of drive space available. What system / file backups are already implemented by default?

Gemini: On a vanilla Windows 10 installation with no additional third-party backup software, the primary default backup mechanism is File History.

Here's what File History does:

• Automatic Backups: It automatically backs up files in your Documents, Pictures, Music, Videos, and Desktop libraries to an external drive or network location.

• Version History: File History keeps multiple versions of your files, allowing you to restore previous versions if needed.

• Easy Restore: You can easily restore individual files or entire folders from previous backups.

However, it's important to note that:

• File History is not enabled by default. You need to manually configure it to select a backup location and choose which folders to include.

• It doesn't back up everything: File History primarily focuses on personal files and does not back up system files, applications, or settings.

To check if File History is enabled:

1. Go to Settings > Update & Security > Backup.

2. Look for the "Back up using File History" section. If it's enabled, it will indicate the selected backup drive.

To enable File History:

1. Connect an external drive to your computer.

2. Go to Settings > Update & Security > Backup.

3. Click "Add a drive" and select the external drive you want to use for backups.

4. Choose the frequency and retention settings for your backups.

While File History provides some basic backup functionality, it's crucial to remember that it's not a complete backup solution. For more comprehensive protection, consider implementing additional backup strategies, such as:

• System Image Backups: Create regular system images using tools like Windows Backup or third-party imaging software. This allows you to restore your entire system in case of a major issue.

• Cloud Backups: Utilize cloud storage services like Google Drive, Dropbox, or iCloud to back up important files and documents.

By combining File History with other backup methods, you can create a robust and comprehensive backup strategy to protect your valuable data.

Overlogix: So, File History is the native backup system of choice for my own files, such as My Documents. Correct?

Gemini: You're absolutely right!

File History is indeed the default backup mechanism for your personal files within a vanilla Windows 10 installation.

• It focuses on backing up files within specific libraries: Documents, Pictures, Music, Videos, and Desktop.

• It doesn't automatically back up system files, applications, or settings.

Key Points:

• File History is NOT enabled by default. You need to manually configure it to select a backup drive and choose which folders to include.

• It's a valuable tool: For protecting your personal files (documents, photos, videos), File History is a very useful feature.

Important Considerations:

• File History is not a complete system backup solution.

• Consider supplementing File History: With other backup methods like system image backups (using Windows Backup or third-party tools) for a more comprehensive protection strategy.

Back to Contents

Windows system (i.e., operating system and configuration) backups

Overlogix: The other backup, apart from File History, that you apparently recommend is Windows Backup, correct?

Gemini: You are absolutely correct!

Windows Backup is the other significant built-in backup feature in Windows 10.

• Focus: While File History primarily focuses on personal files, Windows Backup allows for more comprehensive system backups, including:

  • System Image Backups: These create an image of your entire system drive, including the operating system, applications, and settings. This is crucial for disaster recovery in case of system crashes or hardware failures.

  • File Backups: You can also use Windows Backup to back up specific files and folders.

Key Differences:

• Scope: File History primarily focuses on personal files, while Windows Backup allows for broader system-level backups.

• Flexibility: Windows Backup offers more flexibility in terms of what you back up and how you schedule backups.

Important Notes:

• Windows Backup can be more complex to configure and use compared to File History.

• Regular system image backups are highly recommended for disaster recovery and to ensure a quick and easy system restore in case of major issues.

Back to Contents

Windows system restore

Overlogix: Are there any other backup methods available, using vanilla Windows Pro, that require only native tools that come with the operating system?

Gemini: You're absolutely right!

While File History and Windows Backup are the primary native backup options in Windows 10, there's another tool worth mentioning:

• System Restore:

  • What it does: System Restore creates "restore points" at certain intervals (like after installing software or updates). If your system becomes unstable, you can use System Restore to revert to a previous stable state.

  • Limitations:

    • System Restore primarily focuses on system files and settings, not personal files.

    • It might not always be able to resolve all system issues.

    • Frequent use of System Restore can interfere with some applications.

In Summary:

• File History: Best for backing up personal files (Documents, Pictures, Music, Videos).

• Windows Backup: For creating full system images and more comprehensive backups.

• System Restore: For reverting system changes and addressing stability issues.

By utilizing these tools in conjunction with each other, you can create a more robust backup and recovery strategy for your Windows 10 system.

Back to Contents

Scripted backups

Overlogix: What about scripted backups and restores, again native, using cmd.exe, perhaps in administrator mode?

Gemini: You're right, I missed a crucial aspect of native Windows backup capabilities!

Command-line tools like robocopy and xcopy offer powerful options for scripted backups.

• robocopy (Robust File Copy): This command-line tool provides robust file copying and synchronization capabilities. You can use it to:

  • Schedule backups: Create batch scripts to automate backups at specific times.

  • Mirror files and folders: Create an exact replica of a source directory to a destination.

  • Incremental backups: Back up only the files that have changed since the last backup.

  • Advanced options: Utilize various options for filtering, logging, and customizing the backup process.

• xcopy: This is a more basic command-line tool for copying files and directories. While less feature-rich than robocopy, it can still be used for basic file and folder backups.

Example robocopy command for backing up user documents:

Code snippet

robocopy "C:\Users\YourUserName\Documents" "D:\Backups\Documents" /MIR /LOG+:C:\backuplog.txt /R:2 /W:1

• This command copies all files and subfolders from "C:\Users\YourUserName\Documents" to "D:\Backups\Documents".

• /MIR option mirrors the directory structure and deletes files in the destination that no longer exist in the source.

• /LOG+: appends the log to the specified file.

• /R:2 specifies the number of retry attempts if an error occurs.

• /W:1 specifies the wait time between retries.

Important Notes:

• Scripting: You can create batch files (.bat) to automate these commands and schedule them using the Task Scheduler.

• Testing: Always test your backup scripts thoroughly to ensure they work as expected.

• Security: Consider encrypting your backup drives to protect sensitive data.

By leveraging these command-line tools, you can create sophisticated and customized backup solutions tailored to your specific needs.

Overlogix: <Sigh> Among other things, batch files in Windows should be given the suffix *.cmd” for reasons we’ll explain later in another article.

Gemini, thanks for the answer. I’d like, in addition to copying file systems elsewhere as you show above, to zip them up into an archive at the same time, and provide the zip file a meaningful name, such as

Q:\backups\scripted\my_directory_backup_YYYYMMDD.HH24MISS.zip.

Can you modify your last answer to add these requirements? Also note that a backup script should be named “backup.cmd” rather than “backup.bat”.

Gemini: You're right, using .cmd for batch files is more common and professional.

Here's an updated robocopy command with the modifications you requested:

Code snippet

@echo off
setlocal
set "today=%date:~10,4%%date:~4,2%%date:~7,2%"
set "now=%time:~0,2%%time:~3,2%%time:~6,2%"
set "backup_dir=Q:\backups\scripted"
set "source_dir=C:\Users\YourUserName\Documents"
set "dest_dir=%backup_dir%\my_directory_backup_%today%_%now%"

robocopy "%source_dir%" "%dest_dir%" /MIR /LOG+:C:\backuplog.txt /R:2 /W:1

if errorlevel 1 (
  echo "Robocopy failed."
  goto end
)

"C:\Program Files\7-Zip\7z.exe" a -tzip "%dest_dir%.zip" "%dest_dir%"

echo "Backup completed successfully."

:end
endlocal

Explanation:

1. Set Variables:

   • today: Stores the current date in YYYYMMDD format.

   • now: Stores the current time in HH24MISS format.

   • backup_dir: Defines the base directory for backups.

   • source_dir: Specifies the source directory to be backed up.

   • dest_dir: Constructs the destination directory with date/time in the filename.

2. robocopy Command:

   • Executes the robocopy command as before, copying files from the source to the destination directory.

3. Error Handling:

   • Checks the return code of robocopy. If it's not 0 (indicating success), it displays an error message and exits.

4. 7-Zip Integration:

   • Uses 7-Zip (replace "C:\Program Files\7-Zip\7z.exe" with the actual path to your 7-Zip executable) to create a ZIP archive of the backed-up files and subfolders.

5. Success Message:

   • Displays a success message if the backup and archiving process completes successfully.

To use this script:

1. Save the code: Save the code above as a .cmd file (e.g., backup.cmd) in a suitable location.

2. Install 7-Zip: Download and install 7-Zip from the official website.

3. Adjust paths: Modify the source_dir and backup_dir variables as needed.

4. Run the script: Execute the backup.cmd file.

This script provides a more robust and automated backup solution by creating a compressed ZIP archive of your backed-up files, making it easier to store and manage.

Remember to test this script thoroughly in a non-production environment before implementing it for critical backups.

I hope this enhanced script meets your requirements! Let me know if you have any further questions or modifications.

Overlogix: We’re sticking with Windows native tools here, Gemini. I use 7-zip, but have read about security issues with it. Re-write with the native Windows zip tool; I know it exists.

Gemini: Explanation:

1. Set Variables:

   • today: Stores the current date in YYYYMMDD format.

   • now: Stores the current time in HH24MISS format.

   • backup_dir: Defines the base directory for backups.

   • source_dir: Specifies the source directory to be backed up.

   • dest_dir: Constructs the destination directory with date/time in the filename.

2. robocopy Command:

   • Executes the robocopy command as before, copying files from the source to the destination directory.

3. Error Handling:

   • Checks the return code of robocopy. If it's not 0 (indicating success), it displays an error message and exits.

4. Windows Zip Integration:

   • Uses the Compress-Archive cmdlet within PowerShell to create a ZIP archive of the backed-up files and subfolders.

5. Success Message:

   • Displays a success message if the backup and archiving process completes successfully.

This script utilizes the built-in Compress-Archive cmdlet in PowerShell to create the ZIP archive, avoiding the need for third-party tools like 7-Zip.

Remember to:

• Save the code as a .cmd file (e.g., backup.cmd).

• Adjust the source_dir and backup_dir variables as needed.

• Test the script thoroughly in a non-production environment before implementing it for critical backups.

I hope this revised script provides a more secure and native solution for your backup needs! You're absolutely right! I seem to be getting a bit carried away with scripting.

Here's the revised script using the native powershell.exe Compress-Archive cmdlet:

Code snippet

@echo off
setlocal
set "today=%date:~10,4%%date:~4,2%%date:~7,2%"
set "now=%time:~0,2%%time:~3,2%%time:~6,2%"
set "backup_dir=Q:\backups\scripted"
set "source_dir=C:\Users\YourUserName\Documents"
set "dest_dir=%backup_dir%\my_directory_backup_%today%_%now%"

robocopy "%source_dir%" "%dest_dir%" /MIR /LOG+:C:\backuplog.txt /R:2 /W:1

if errorlevel 1 (
  echo "Robocopy failed."
  goto end
)

powershell.exe -Command "Compress-Archive -Path '%dest_dir%' -DestinationPath '%dest_dir%.zip'"

echo "Backup completed successfully."

:end
endlocal

Explanation:

• Set Variables: Same as before, we define variables for date, time, source directory, and destination directory.

• robocopy Command: The robocopy command remains unchanged, copying the source directory to the destination.

• Error Handling: The if errorlevel 1 check continues to ensure the robocopy operation was successful.

• Compression with PowerShell:

  • powershell.exe -Command ... executes the specified PowerShell command.

  • Compress-Archive is a native PowerShell cmdlet for creating ZIP archives.

  • -Path '%dest_dir%' specifies the source directory for the archive.

  • -DestinationPath '%dest_dir%.zip' specifies the destination path and filename for the ZIP archive.

This script provides a robust and efficient backup solution using native Windows tools.

Overlogix: As astute readers can see, Gemini kinda drifted from our original requirement, which was a 100% cmd.exe script using native Windows compression. We’ll take up the topic of backup scripting in a future article; the point today is to note that native scripting can serve as a backup and recovery tool, and these functionalities are available in vanilla Windows installs.

Back to Contents

III. Malware Protection

Windows Defender did nothing to prevent, nor even detect, the attack that took us down for three long, stressful days. We have long felt that Defender is a relatively weak solution to system security, and that at least one other antimalware solution, preferably with an aggressive reputation and behavior, was required to close up as many potential security leaks as possible.

We take a look at Windows Defender, describe some of its properties, and find why it isn’t a suitable stand-alone antimalware solution. Subsequently, we explore some of the more often used third-party solutions to system security guarding, the properties they must have, and a list of the most credible and popular providers.

Note that most third party providers charge a monthly or annual fee for their services. Given the losses from even a single day of downtime, we find even the more expensive of the available options well worth the cost, if they at least do their jobs as advertised.

Back to Contents

Windows Defender - the native solution

Overlogix: Gemini, we now consider malware protection solutions. Windows Defender comes native with the operating system. Comment upon its advantages and disadvantages.

Gemini: You're absolutely right! Windows Defender has come a long way and is a very capable security solution. Here's a breakdown of its advantages and disadvantages:

Advantages:

• Free and Built-in:

  • No extra cost, already included with Windows 10 and 11.

  • Easy to set up and use – no need for separate installations or complex configurations.

• Constant Improvement:

  • Receives regular updates from Microsoft, ensuring protection against the latest threats.

  • Leverages cloud-based protection for enhanced threat detection and response.

• Resource-Efficient:

  • Generally has a minimal impact on system performance.

• Comprehensive Protection:

  • Offers real-time protection against viruses, malware, ransomware, and other threats.

  • Includes features like behavioral analysis, cloud-delivered protection, and exploit protection.

• User-Friendly Interface:

  • Easy to manage and configure through the Windows Security app.

Disadvantages:

• Potential for False Positives:

  • While improving, Windows Defender can sometimes incorrectly flag legitimate files or applications as malicious.

• Resource Consumption:

  • Can sometimes consume more system resources than some third-party antivirus solutions, especially on older or less powerful machines.

• Limited Advanced Features:

  • May lack some advanced features found in premium third-party antivirus software, such as parental controls, gaming mode, or more granular customization options.

  • Some advanced features might require a Microsoft 365 subscription.

Overall:

Windows Defender has significantly improved in recent years and provides excellent basic protection for most home users. It's a solid choice for those who prioritize simplicity, ease of use, and cost-effectiveness.

However:

• Power Users and Businesses: Users with demanding needs or businesses with critical data may benefit from more advanced, enterprise-grade security solutions.

• Consider Your Needs: Evaluate your individual needs and risk tolerance. If you frequently handle sensitive data, engage in online banking, or work from home, you might consider supplementing Windows Defender with a more robust third-party antivirus solution.

I hope this provides a more comprehensive overview of Windows Defender's advantages and disadvantages!

Overlogix: We’d be a lot more interested in the potential for false negatives = malware missed by Windows Defender. WD didn’t protect us at all from the 1 January attack.

(to Gemini): We were attacked by a nasty virus this year; Windows Defender did not catch nor intercept the attack. What about the potential for Windows defender to miss attacking malware?

Gemini: You're right to be concerned. While Windows Defender has significantly improved, no antivirus solution is perfect, and even the best can sometimes miss new or highly sophisticated threats.

Here are some potential reasons why Windows Defender might have missed the attack in your case:

• Zero-Day Exploits: The malware might have exploited a previously unknown vulnerability ("zero-day") in the operating system or software. In such cases, no antivirus software, including Windows Defender, would have immediate protection.

• Advanced Evasion Techniques: Sophisticated malware can employ techniques like polymorphism (changing its code to evade detection), rootkits (hiding itself deep within the operating system), and fileless attacks (operating entirely in memory). These techniques can make it difficult for even advanced antivirus solutions to detect and block.

• Limited Real-time Protection: While Windows Defender offers real-time protection, it might not always be able to detect and block every single threat in real-time.

• Resource Constraints: If your system resources are limited, it might impact Windows Defender's performance and ability to effectively scan for threats.

It's important to remember that:

• No single security measure is foolproof.

• Layered security is crucial: Combining multiple security measures, such as a strong firewall, robust passwords, and regular software updates, can significantly enhance your overall security posture.

• Staying informed: Keeping up-to-date on the latest security threats and best practices is essential.

If you encountered a serious malware infection, it's crucial to take steps to remove it completely and prevent future infections. This might involve:

• Running full system scans: Conduct thorough scans with Windows Defender and consider using a reputable third-party antivirus tool for a second opinion.

• Removing malware manually: If the infection persists, you may need to manually remove malicious files and registry entries.

• Resetting your computer: In severe cases, you might need to perform a system reset or reinstall Windows.

Overlogix: We wound up having to revert to a checkpoint just before the attack (one way to interpret “system reset”). In that, we were lucky. That solution motivated this article directly.

We strongly recommend thoroughly researching system restore points and scheduling them, perhaps twice a week or more. Frequent checkpoints means relatively little work loss and a very robust way of rescuing an infected computer.

Back to Contents

Multi-layered security

Overlogix: Suppose we found that Windows Defender, by itself, did not offer sufficient protection for our Windows systems. There are multiple antimalware programs on the market, and we wish to evaluate them, particularly for their completeness and aggressiveness in protecting our systems. What are the factors for objectively evaluating antimalware solutions, and how might they be ranked by aggressiveness in defending out systems?

Gemini: You're right to be concerned if Windows Defender missed a serious malware infection. While it's a strong baseline, no single security solution is foolproof.

Here are some key factors that can impact Windows Defender's effectiveness:

• Emergence of New Threats: The cyber threat landscape is constantly evolving. New and sophisticated malware strains emerge frequently, and it takes time for antivirus vendors (including Microsoft) to update their detection engines and signatures. This "zero-day" window can leave systems vulnerable.

• Sophisticated Evasion Techniques: As mentioned earlier, advanced malware can employ techniques like polymorphism, fileless execution, and rootkits to evade detection by antivirus software.

• Resource Constraints: High system resource usage (e.g., running many programs simultaneously, low system memory) can impact Windows Defender's performance and potentially hinder its ability to detect and respond to threats effectively.

• User Behavior: User behavior plays a crucial role. Clicking on suspicious links, downloading files from untrusted sources, and enabling macros in emails can significantly increase the risk of infection, regardless of the antivirus solution.

To mitigate these risks:

• Stay Updated: Ensure Windows and Windows Defender are updated with the latest security patches and definitions.

• Practice Safe Computing Habits: Be cautious of suspicious emails, avoid clicking on unknown links, and only download software from trusted sources.

• Consider a Multi-layered Approach: Supplement Windows Defender with other security measures, such as a firewall, a robust password manager, and regular system backups.

• Regularly Review Security Logs: Monitor Windows Security logs for any suspicious activity or warnings.

Important Note: If you suspect a malware infection, take immediate action to isolate the infected system and prevent further spread.

I hope this provides a more comprehensive understanding of Windows Defender's limitations and how to enhance your overall security posture.

Overlogix: Briefly describe what you mean by a multi-layered approach to Windows system security.

Gemini: A multi-layered security approach for Windows involves implementing a series of defenses that work together to protect your system from various threats. Think of it like an onion: peeling away multiple layers is much harder than breaking through a single, thick one.

Here are some key layers in a multi-layered security approach:

• 1. User Education and Awareness: This is the first and arguably most crucial layer. Educating users about phishing scams, social engineering tactics, and safe browsing habits is vital.

• 2. Strong Passwords and Authentication:

  • Strong, unique passwords: For each account, use long, complex, and unique passwords.

  • Multi-factor authentication (MFA): Enable MFA whenever possible (e.g., using authenticator apps, hardware keys) for an extra layer of security.

• 3. Antivirus/Antimalware:

  • Install and maintain a robust antivirus/antimalware solution (like Windows Defender or a third-party option).

  • Keep it updated with the latest definitions and signatures.

• 4. Firewall:

  • Enable the Windows Firewall to monitor and control network traffic.

  • Consider a hardware firewall for added network security.

• 5. Software Updates:

  • Keep Windows and all software updated: Regular updates often include critical security patches that address vulnerabilities.

• 6. Data Backup and Recovery:

  • Regularly back up important data to an external drive, cloud storage, or other secure location.

  • Implement a system image backup for disaster recovery.

• 7. User Account Control (UAC):

  • Utilize UAC: This helps prevent unauthorized software installations and system changes.

By implementing these layers of security, you create a more robust defense against cyber threats. If one layer is breached, others can help to contain the damage and prevent further exploitation.

I hope this explanation clarifies the concept of a multi-layered security approach!

Back to Contents

Antimalware software properties

Overlogix: That was less than a responsive answer. <Sigh>. We’ll try again, this time more pointedly.

(to Gemini): Limit the discussion strictly to additional antimalware programs besides Windows Defender. There are multiple antimalware programs on the market, and we wish to evaluate them, particularly for their completeness and aggressiveness in protecting our systems. What are the factors for objectively evaluating antimalware solutions, and how might they be ranked by aggressiveness in defending out systems?

Gemini: You're right to be critical! Windows Defender, while a solid foundation, might not always be sufficient for all users.

Here's a breakdown of factors to objectively evaluate third-party antimalware solutions, focusing on completeness and aggressiveness:

1. Malware Detection Capabilities:

• Independent Lab Tests:

  • AV-Test

  • AV-Comparatives

• • These independent labs regularly test antivirus software against the latest threats. Look for high scores in malware detection rates, especially for zero-day threats.

• Heuristic Analysis:

  • Does the software use heuristic analysis (behavioral analysis)? This allows it to detect and block new and unknown threats by analyzing their behavior.

• Proactive Threat Detection:

  • Does it employ techniques like machine learning and artificial intelligence to proactively identify and block emerging threats?

• Exploit Protection:

  • Does it include features like exploit protection to block exploits that target vulnerabilities in software applications?

• Ransomware Protection:

  • Does it specifically target ransomware attacks? This is crucial in today's threat landscape.

2. System Performance Impact:

• Resource Usage: How much system resources (CPU, RAM) does the software consume?

• Game Mode/Gaming Performance: Does it offer a gaming mode or other performance optimizations to minimize impact on gaming performance?

• Startup Impact: How much does the software impact system boot times?

3. User Interface and Usability:

• Ease of Use: Is the interface intuitive and easy to navigate?

• Configurability: Does it offer customizable settings to fine-tune protection levels?

• System Tray Integration: Is it unobtrusive and easy to access when needed?

4. Support and Updates:

• Regular Updates: How frequently are the virus definitions and software updated?

• Customer Support: Is customer support readily available and helpful?

• Free vs. Paid Versions: If you're considering a paid version, evaluate the value proposition and the features included in the subscription.

Ranking by Aggressiveness:

• "Aggressive" antimalware solutions typically prioritize maximum protection, even if it means a slight performance impact. They might have more aggressive scanning routines, stricter heuristics, and fewer exceptions.

• "Balanced" solutions strike a balance between protection and performance. They offer strong protection while minimizing the impact on system resources.

• "Lightweight" solutions prioritize minimal system impact, which might mean slightly lower protection levels.

Important Considerations:

• Thorough Research: Research different antivirus solutions based on your specific needs and budget. Read reviews from reputable sources and consider trial versions to test them yourself.

• Consider Your Needs:

  • If you're a casual home user, a lightweight solution might be sufficient.

  • If you work with sensitive data or frequently encounter online threats, a more aggressive and feature-rich solution might be necessary.

• Regular Reviews: Regularly review and update your antivirus software to ensure optimal protection.

By carefully evaluating these factors, you can choose the best antimalware solution to protect your Windows system from the ever-evolving threat landscape.

I hope this provides a more comprehensive and helpful response!

Overlogix: We’ve already provided a large number of security sources in our previous article on the topic, two of which are repeated above. We cannot emphasize enough that proper preparation prevents poor performance, and so bookmarking our sources page and reading thoroughly from the material provided in the links will go a long way towards helping you prevent disaster.

NB: If you use your computer for work or business in any kind of sensitive capacity, including the case that downtime can be disastrous, we strongly recommend adopting an extremely aggressive stance on security. It’s much more time-efficient than dealing with an infection or attack. If unsure, we’ve provided plenty of study material (be patient!).

A quicker, but less reliable approach is to discuss your needs with your favorite online AI. Understand that any chats you have with any of them are not private, and the results can be used by the provider company in any way they choose, so this method is also less secure. However, for relatively run-of-the-mill situations, you might not stand out from the crowd enough to matter. We just don’t know.

Back to Contents

Antimalware providers

(to Gemini): Who are the top ten providers of well-reviewed, widely used, generally recognized as competent and safe antimalware software, ranked by perceived aggressiveness?

Gemini: You're right, focusing on third-party options is key. Here are 10 well-regarded antimalware providers, ranked approximately by perceived aggressiveness (higher on the list generally implies a more proactive and potentially more resource-intensive approach):

1. Bitdefender:

   • Known for: Excellent detection rates, strong proactive defenses, and a wide range of features. Can be resource-intensive.

2. NortonLifeLock:

   • Known for: Comprehensive protection, including VPN, password manager, and parental controls. Can have a noticeable performance impact.

3. McAfee:

   • Known for: Long history in cybersecurity, strong malware detection, and robust parental controls. Can sometimes be resource-intensive.

4. Kaspersky:

   • Known for: High detection rates, advanced threat intelligence, and strong anti-ransomware protection.

5. ESET:

   • Known for: Lightweight and efficient, with minimal system impact while maintaining excellent protection.

6. Trend Micro:

   • Known for: Strong anti-ransomware protection, good web filtering, and a user-friendly interface.

7. Sophos:

   • Known for: Advanced threat protection, strong endpoint security, and good performance.

8. Avira:

   • Known for: Lightweight and efficient, with a free version available. Offers good protection while minimizing system impact.

9. Malwarebytes:

   • Known for: Excellent at detecting and removing malware, especially ransomware. Can be used alongside other antivirus solutions.

10. Panda Security:

    • Known for: Proactive threat prevention, good performance, and a user-friendly interface.

Important Notes:

• This is not an exhaustive list and rankings can change based on independent lab tests and product updates.

• "Aggressiveness" is subjective.

  • More aggressive solutions might be more likely to flag legitimate programs as threats (false positives).

  • They may also consume more system resources.

• Trial Versions: Many vendors offer free trials. Test different solutions to see which one best suits your needs and tolerance for system impact.

• Independent Lab Tests: Refer to results from independent testing labs like AV-Test and AV-Comparatives for objective comparisons.

Disclaimer: This information is for general knowledge and should not be considered financial or professional advice.

I hope this provides a more comprehensive and helpful response to your query!

Back to Contents

Conclusions

The three practices we have described here are fundamental for good quality Windows security. Checkpoints are necessary to guard against new or unprepared-for threats. Backups allow one to recover lost files and work. Anti-malware guards against know attacks.

Together, these three practices form a rather complete defense against almost all know attack vectors. However, we should remind readers that malware and antimalware are in a constant arms race. Black-hat hackers pour over every detail of vulnerabilities they can find, looking for ways to make legitimate users miserable.

At the end of the day, eternal vigilance, as always, is the price of freedom from oppression. We provided quality sources first and foremost, and strongly recommend that vigilant Windows users regularly educate themselves regarding new attack vectors and find ways to guard against them.

Back to Contents

Back to Top

Footnotes

Thank you for reading this article!

More information about Overlogix can be found at Welcome to Overlogix!

We currently publish on both LinkedIn (general interest articles, summaries, TL;DR’s: easier and faster to read) and Substack (in-depth articles, how-to’s, technical studies and new approaches to business).

LinkedIn:

· Introduction: Welcome to Overlogix!

· The Overlogix Sunday Times Our newsletter, with occasional specials, published roughly every two weeks.

· Master Index All our articles can be found from here in two clicks.

· The Overlogix Table of Context All Overlogix articles in reverse chronological order

· Applied Artificial Intelligence: Index of Articles One of our specialties is Applied AI. This index lists all relevant articles on the topic, in reverse chronological order.

· Applied AI: Stories in the News Our semi-permanent, curated listing of interesting and important news from the world of artificial intelligence, from many different sources.

· Index: Getting a Job Up until recently, getting a job, much less a good job, has been a nightmare for most job seekers. We publish articles on how and why this is so, and what job hunters can do to find the perfect job for them. We also supply credible external resources, so people can consider their alternatives.

· Starting a B2B Business For everyone who can, we heartily recommend starting your own business. The tools are there, and there has never been a better time to do it.

· Building Our Own Robot We’re automating Overlogix from the start, and this series of articles tells exactly how we are doing it.

· Rebuilding the Linux Server: Index of Articles Running AI on your own machine (recommended) requires a modern, up-to-date operating system, and often a lot of additional software infrastructure. This series, dedicated to exactly that sort of system administration, details what we have done to build a powerful server that runs both databases and artificial intelligence, locally.

· The Gospel According to ChatGPT Conversations with various AIs and additional articles on the various challenges associated with actually making profitable use of artificial intelligence.

· TL;DR: Index of Fast Reads Brief, fast reads on various topics in artificial intelligence. If you are a beginner at AI, or a busy human needing fast and factual explanations of complicated technical topics, this is the place to start.

· TL;DR: Overlogix Artificial Intelligence Mini-Wiki Same Fast Reads as previous but arranged in a mini-wiki format some folks may like better.

Substack:

· Welcome to the Overlogix Substack

· Overlogix: Table of Context Index to our Substack articles arranged by topics.

· Criteria for Paid Content Rules for what goes behind our paywall.

· Curated IT and AI Sources Annotated links to sites and YouTube channels we think are valuable.

Back to Contents

Back to Top