| > The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. In the early 2000s up thru about 2012 I'd agree with you. Post-Vista malware adapted to UAC and now all malware works well as a normal user. Any data your normal user can access (local or on a remote CIFS server) is fair game for ransomware. Limiting administrator rights doesn't do anything to prevent the malware from getting at your data. Persistence has moved to per-user, non-Administrator, too. Of course, all the various quasi-malicious customized versions of Chrome that end users inevitably install when they go searching for software to end-run their IT departments operates the same way. I do think your daily driver Windows users shouldn't have administrator rights. It just isn't going to help much with malware. I use physically separate boxes for my most sensitive activities (banking, mainly) but you could do nearly as well having separate non-admin Windows logons and compartmentalize your access to data you don't want ransomed. Isolation between different user accounts on Windows is actually fairly good. Just limit the common data the accounts can access. Personally I've always wanted to use Qubes (and stop using physically separate machines) but I haven't taken them time to learn their contrivances. Edit: I should have said "quasi-malicious customized versions of Chromium", not Chrome. |
You can also run something like applocker and whitelist all the apps you use.
Also instead of separate physical boxes why not just use a VM ?