I can't say for sure that MS firewall is safe from NSA attack. After all it seems to me that MS looked the other way for a decade or two while NSA exploited a vulnerability in MS Samba file sharing version 1 (circa 1990). The nice thing about vulnerabilities like that is the NSA doesn't have to use a social engineering attack. They can simply pick their victim and send some data to port 139. The victim must have 139 exposed to the internet but sooner or later they will be on a subnet at an internet cafe or at work where some other computer is waiting for them.
Step 1: turn off automatic updates. This should be obvious to everyone.
Step 2: block incoming connections.
Assuming you trust Windows firewall, just turn it on. If you are still running XP: Click Start, click Run, type Firewall.cpl, and then click OK. On the General tab, click On (recommended). Click OK.
If you are running Vista type firewall in the Start Menu search box. Then click Change settings, turn on, and block all incoming connections.
For Windows 7, 8, and 10 go here: http://www.thewindowsclub.com/how-to-configure-windows-7-firewall
Step 3: practice safe browsing. It's hard to get infected if you don't don't go to bars and pick up strange women. If you think you just got infected, immediately the internet connection (e.g. the physical wire from your router to the world) then use task manager to kill every process starting with the most suspicious, then press the power button for 10 seconds. The goal here is to kill the software before it can install itself permanently.