Simple Software Restriction Policy is an open-source tool which makes it much more difficult for malware to launch on your PC.

This works by only allowing executables to be run from standard and approved locations: \Program Files, \Program Files x86, your Windows folders and more. Programs which try to launch from more unusual places - your Documents folder, internet cache, temp folders and more - are blocked by default, instantly protecting you from many exploits and vulnerabilities.

(If you're thinking this sounds like Windows Group Policies, you're right, it's essentially a simpler alternative front-end for the same Windows Registry settings and security layers.)

The program also has a "LimitedApps" feature which allows specific applications to be run under a restricted user account, even if you're running as an administrator. Apply this to your browsers and they'll only be able to save and modify files in your user profile folders. Even if you do open some malicious document which tries to force a download to a system or program folder, it just won't work.

These are very powerful techniques, but they can also cause conflicts. Legitimate programs sometimes install themselves or try to run code from odd places, and if these get blocked there can be all kinds of odd results.

If you do have problems, Simple Software Restriction Policy can be disabled with a click. Do whatever you were trying to do, restore the protection afterwards and carry on as before.

Alternatively, Simple Software Restriction Policy may be fine-tuned by editing an INI file, for example to add custom folders where software will be allowed to run. This works well enough, but you need to be careful as there's real power here. Accidentally disable a setting like "AlwaysAllowSystemFolders" and you could cause yourself major problems.