1) non-administrator account for daily-driver stuff like IM, browsing and email
2) no warez, pr0n, cracks, etc
3) keep Windows, Office, and other software updated
4) use a really good antivirus program such as Kaspersky Antivirus Personal, max out its detection options, and never turn it off.
5) use a router and/or firewall software, and never let your firewalls down. Bonus points for actually
configuring your router to only allow ports that you have specific uses for, and closing the other 65500+ ports.
router info
Browser choice won't make a difference if you adhere to the rules listed above, particularly rule #1. And you don't have to take my word for it, Spywareinfo.com finally ran a blurb about the use of Limited accounts and found that they were pretty much invincible:
http://www.spywareinfo.com/newsletter/archives/2005/nov11.php#limitedsurfing
This is one of those ideas that make you want to slap your forehead and wonder why it never occurred to you before. I don't remember what prompted it, but I decided to do a little experiment with my virtual test PC. I created a low-level user account and then went surfing some of the most spyware-infested web sites I could find.
Guess what? Nothing happened. Not only did I fail to pick up a single hijacker, I never once saw as much as a single ActiveX prompt. As far as I could determine, I was immune to spyware infection. Why? Because in limited mode, Windows doesn't allow you to do very much. You are not allowed to make the changes necessary for malware to install and hide itself.
That's the owner of SpywareInfo.com talking. Who's listening?