Device-protection resources: scanning, conversion and isolation

For device protection, start with what the operating system already provides and add extra tools one at a time only if you need them. Running several scanners at once, an unknown hardening script and an experimental sandbox does not usually make the machine safer, and those extra programs can themselves widen the attack surface.

The baseline is different on each system. The guides to supported Windows releases, Android updates and locks and Linux updates and privileges cover that line. If you have already seen signs of malware or phishing, follow the guide to responding to malware and phishing rather than installing several new scanners at random.

Understand the operating system’s own protection first

Windows Security on Windows, Play Protect on Android and the Mac’s built-in protections are the starting point. They do not replace your own judgment, but turning them off in order to install three programs with similar names rarely helps.

1. On Windows open Settings > Privacy & security > Windows Security. Virus & threat protection should be on, with definitions updating. Also look at the firewall and at app and browser control in the same window.
2. On Android open the Play Store app, tap your account and open Play Protect. Leave app scanning on, and do not install apps from outside the official store without a clear reason.
3. On a Mac open System Settings > Privacy & Security. Do not loosen installation from unknown sources without a reason, and do not postpone operating-system updates.
4. If you install a third antivirus, one is enough. Two engines on the same device often interfere and produce confusing alerts.

What a home scan finds and what it does not

A scan with the operating system’s own tools is useful for common malware and unwanted software. If you are worried about targeted spyware, a home scan is not enough, and you should not fill the device with random tools. Filling a phone or computer with unknown scanners can itself make a sensitive file readable to a new program.

1. If a file looks suspicious, first keep it away from open accounts and sync folders and work through the malware-response guide.
2. Uploading that same file to a multi-engine scanning service can also reveal the content to others. Do not do that with a highly sensitive document.
3. If you do upload a file somewhere, at least use a service whose access to samples you understand, and only for a file whose disclosure you can tolerate.
4. A “clean” report from a home scanner does not mean a targeted attack is absent. Read that report next to other signs — an opened account, a suspicious message, a rooted device.

Do not run an unknown hardening script

Forums and social networks circulate files titled “one-click hardening” or registry optimizers. Many of them change security settings with no clear explanation, break updates or bring unwanted software of their own.

1. Do not change a setting you do not understand from a ready-made command.
2. If you want stricter settings, follow documentation from Microsoft, Apple or your Linux distribution, not a file in a messenger.
3. Do not confuse an unknown registry cleaner or accelerator with a security tool.
4. Do not leave administrator access on for every ordinary install. On Windows do everyday work from a standard account and give an administrator confirmation only when you need it.

Start isolation with a separate user or profile

Isolation means keeping sensitive work apart from everyday browsing. That work does not have to begin by replacing the whole system.

1. On Windows open Settings > Accounts > Other users and create a separate user. Sign in as that user for sensitive work and keep a separate browser and separate files there.
2. On a Mac open System Settings > Users & Groups and create a new standard user.
3. On Linux add a separate user with your distribution’s own tools and do sensitive work in that user’s session.
4. In the browser create a separate profile so cookies and extensions do not mix. If you sign into the same account in both profiles, the isolation disappears.
5. Do not hand others an unlocked device, and for shared work create a guest or limited user rather than unlocking the main account. Software isolation is almost useless on a desk where anyone can sit down at an unlocked machine. Keep the screen lock on, and do not leave that same device in a crowded gathering with no screen lock turned on.

Conversion means reinstalling the environment, not an unknown toolkit

The title of this guide speaks of scanning, conversion and isolation. Conversion here means changing the working environment when the device is in a bad or untrusted state: a factory reset, reinstalling the operating system from an official image, or moving sensitive work to another device whose baseline you understand. This page is not a method for breaking into a system or bypassing someone else’s lock.

1. Before any reinstall, if you still trust the files, take a tested backup. The method is in backups you can restore.
2. Get the operating-system image only from Microsoft, Apple, Google or your Linux distribution’s official site.
3. After a reinstall, reconnect accounts one at a time with a fresh password or a fresh session; do not immediately copy a backup onto the new device if contamination is possible, until you know what you are restoring.
4. Resetting a phone whose storage was already encrypted usually throws away that key; read the device guides so you can tell a logical wipe from physical destruction of the media.

Specialized isolation operating systems

Operating systems built from the ground up for isolation exist, and some teams use them. They are hard to maintain: the hardware has to be compatible, updates need discipline, and one wrong configuration undoes the isolation. That level is not for everyone, and it does not replace a screen lock, updates and a separate account on an ordinary system.

1. If you do not have such an environment, first set up that separate user and separate profile.
2. If you do have one, do not change it from an unknown video tutorial, and follow that project’s own documentation for updates.
3. Do not assume that sitting at that system by itself protects a file from a contact who makes a copy.

Common mistakes

• Turning off Windows Security or Play Protect so you can install several scanners at once.
• Uploading a highly sensitive document to a multi-engine scanning site.
• Running a hardening script from a group or from an unsourced video.
• Assuming a clean home-scan report means a targeted attack has not happened.
• Starting isolation by replacing the whole system before you have even created a separate user.
• Leaving an administrator account open for everyday work.

When you should step away from the current device

Sometimes the best next step is not adding a tool, but setting that device aside for a while: when unknown sign-ins keep happening, when an unknown program has taken administrator access, or when a lost device has come back. In that case secure the accounts from another device you trust more, and then decide whether to reset the old device or retire it.

1. Do not change passwords from the suspicious device itself if you can sign in from another one.
2. Do not mix a fresh backup from the suspicious device into a clean one unless you know what you are overwriting.
3. If the device belongs to an organization, coordinate with whoever runs that system rather than reaching for a personal tool.

Do not treat iPhone and iPad like an Android toolkit

On an Apple device the starting point is also the system’s own settings, not several outside scanners. Lock, update and app-separation details are in the guide to iPhone and iPad security.

1. Open Settings > General > Software Update and keep the version current.
2. Walk through Settings > Privacy & Security once and close location, microphone and photo access for apps that do not need them.
3. Get apps from the official App Store. Do not try to “make good” an installer file from a messenger with a home scanner; do not install that file.
4. Lockdown Mode is designed for very high risk and makes everyday work harder for many people. Do not treat it as a substitute for updates and a screen lock.

If the built-in protection raises an alert

Do not ignore an operating-system alert, and do not immediately replace it by installing a new dashboard. Read the message first and see which file or app it is about.

1. Write down the name of the app or file and separate it from the downloads folder or the app list.
2. On Windows run a quick scan from Virus & threat protection; if the file is known, run a custom scan of that path.
3. If Windows offers Microsoft’s official one-time extra scanner, get that only from Microsoft’s support site, not from a link inside a message.
4. After a removal or quarantine, change passwords for accounts that were open on that device — from another device — if you see signs of unusual access.

What to do today

1. Leave the built-in operating-system protection on, and check once that it is up to date.
2. Do not run an unknown hardening script, and remove extra scanners so only one clear layer remains.
3. If you need isolation, start with a separate user or browser profile rather than replacing the whole system.
4. Do not upload a highly sensitive document to an unknown scanning service.
5. If you no longer trust the device, prepare a backup and an official system image before you reinstall.