In this tutorial, you will learn how to protect your system from an untrusted software.

1. Use your Antivirus

This may sound pretty obvious, but it is surprising that many people are not fully utilizing it. Some malware are known to prevent antivirus from running properly, so before you install anything, it is best to scan the file before running it.

This check is not going to take more than 1 minute and it is definitely worth your effort. If you don’t have any antivirus suite yet, Microsoft Security Essential is a good choice.

2. Check Digital Signatures

Some files include a signature to provide information about the developers who created the file. Virus and malware programs don’t usually include this information. We can easily check a file for its signature and discard those suspicious software that don’t come with one.

Right click on any file. Select “Properties”:

If the program include signatures information, you will see a new tab:

In this case we see that is signed by “RealVnc Limited“.

Note: Not all valid programs are signed, but at least you can eliminate the probability of a virus if the program include digital signature information.

3. Create A Restore Point

Every time you are going to make something risky with your computer, make sure you create a restore point. This applies to installing of a new antivirus suite or a new driver as well. Having a restore point allows you to restore the system back to an earlier time before the changes are made. Here is the way to create a restore point:

Using the search function in windows 7 type “create restore point” and select the program:

Go to the “Create” button:

Now the system will ask for a name for that restore point and create it. Select a descriptive name so you can find it easily.

4. Create A Standard User

Windows 7 creates its first user with administration rights. This user has the permission to do almost everything in your computer. It is a really good practice to never use your admin account for normal use of the computer. The best way is to create a standard user for your everyday use.

Go the search function type “user accounts” and press Enter:

Select “Create a new account“:

Type a name for the user, remember to check “Standard user” and click over “Create account“:

5. Restrict Access To Internet

Many viruses use Internet to look for updates. Other kind of malware, such as keyloggers, send every key you type to Internet. So if you don’t trust a program, you should block its access to the web.

Search for “windows firewall advanced“.

Goto “Outbound Rules” and select “New Rule…“:

In this case we are going to block a normal program, so select this option and press next:

Select “Block the connection” and press next:

Now you are done.

Note: If you are testing out a software, you can also use Windows XP Mode for Windows 7 or a virtual machine using Virtual Box to prevent any changes to your system.

Do you use any other security tips in your computer?

Note: The following tricks will modify your registry. It is best to backup your registry before you proceed. This hack only works in Windows 7 or Vista. It will not work under Windows XP.

The Registry Hack

We are going to change some entries, so when you use the context menu, you will see this menu:

Download the Firewall registry file here

The text in this file is:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\Add To Firewall]

[HKEY_CLASSES_ROOT\exefile\shell\Add To Firewall\command]
@="netsh advfirewall firewall add rule name=\"%1\" dir=out action=block program=\"%1\""

[HKEY_CLASSES_ROOT\exefile\shell\Delete From Firewall]

[HKEY_CLASSES_ROOT\exefile\shell\Delete From Firewall\command]
@="netsh advfirewall firewall delete rule name=\"%1\""

Double click the file.

Click Yes to the User Account Control message:

Next, go to the search tool in the Start menu and type “uac” (without quotes)

Drag the slider now to “Never notify” and click Ok.

Restart your computer.

Note: You only need to set the UAC to “Never notify” when you want to add or delete a program from the firewall. Once you have blocked the programs, restore the UAC settings to the defaults.

An Example

To illustrate, we are going to add the Internet Explorer to the Firewall and prevent it from accessing the Internet.

1. Use the Find utility in the Start menu, type “Internet Explorer”.

2. Right click on the “Internet Explorer” entry and select “Add To Firewall“.

If you go to the Firewall settings, you will see that Internet Explorer has been added to the Outbound Rules.

Selecting the “Delete From Firewall” will remove the app from the list.

Uninstalling

In case you don’t want this feature, download the file UninstallFirewall.reg

The text of this file is:

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\exefile\shell\Add To Firewall]

[-HKEY_CLASSES_ROOT\exefile\shell\Delete From Firewall]

First, unblock all the applications that you have previously blocked.

Secondly, double click the uninstall file. When prompted, press OK. The Firewall options will disappear from the context menu.

Note: Always remember to restore the User Account Control to the default settings.

Of course, times have changed now. I use Linux almost exclusively and rarely see the Windows login prompt. Most Linux distributions are far more secure than Windows, out of the box, but the threat is still there and having a good firewall protecting your computer is still a good idea.

Almost all Linux distributions comes bundled with a firewall software known as iptables, which is a command line based software for configuring Firewall rules for all network traffic to and from the Linux kernel.

Being a command line tool, the syntax tends to be a bit cryptic and even, intimidating for the first time user. This is where Firestarter comes into the picture.

Firestarter is a graphical interface for the iptables firewall. To install Firestarter on Debian, which is the Linux distribution that I use, give the following command.

sudo apt-get install firestarter

And then launch firestarter using the Applications -> Internet menu entry.

Instead of an intimidating interface, Firestarter uses a simple wizard to take new users through the steps necessary for configuring the firewall.

The first step is to identify which network interface will the firewall listen to. This is usually the primary network interface of the machine which is connected to the Internet.

Next comes the part where the user is asked to chose wether the particular machine is used for sharing the Internet connection. Select the secondary network interface of the machine which is connected to the rest of the internel network, if this machine is also being used for sharing the internet connection.

That’s it. The firewall is ready to be deployed.

Click on the Save button and you will see the Firewall status window. This is where you can see current statistics about your newly created firewall and also tweak the rules even more if you so desire.

By default, this firewall is fairly restrictive but if, for example, you want to create a rule that only your friend should be able to remotely access this machine, then you can add a policy to whitelist your friend’s IP address.

Firestarter is, in my opinion, a very simple and easy to use utility to configure and manage the iptables firewall, both for the novice and the experienced user.

Do you use any other firewall software on Linux ? Let us know in the comments?