Considering the majority of malware we have to deal with nowadays, your best defenses are:

• A firewall that blocks everything by default. I use SimpleFirewall and give trust on a per executable basis.
• uBlockOrigin, because dear lord navigating some sites is almost impossible without blocking all that shit
• Avoid anything that asks for admin access
• Keep an eye on resource usage and be on the lookout for any weird looking processes.

There was one time I downloaded a piece of shit that started to encrypt my drive. Since the CPU fan started spinning loud, I immediately checked task manager, figured what was going on and ended the malicious root process. Next, it was time to scour my folders, especially inside %appdata%, for any possible leftover executables. All clean, restart PC, everything was fine. I lost a couple of files, but nothing personal, just other downloads.