>>Besides keeping patched and being vigilant, you can be proactive by disabling active content such as scripting and Adobe/Java as listed above, by using FireFox with the NoScript extension. It's always good to be retroactive too, by having good backups.
>
>IMO a Linux VM running on Win Host is better - having a dedicated Boot USB-stick for separate machine is best.
>Currently my old 17' laptop has those tasks: running ubuntu with browser and nothing else
>a single core 2Gig machine is good enough although adblocker on some sites is more helpful than on current CPUs.
>I once tried to have separate installs with adobe or scripting allowed, but nowadays think a fully enabled install which
>can be scrapped and replaced by a fresh copy is best. Clearly YMMV depending on personal habits,
>but for me it is better to highten the fence as Murphy corollary says it will hit you exactly when safety is out of date.

Agreed. I went to a security seminar some years back when virtualization was still uncommon, but the presenter was a proponent of this - what he called "toilet paper" computing. Run your browser in a VM, if it gets "dirty", blow (flush) it away, and restart it (get a fresh sheet).

Not everyone has the hardware or knowledge to do this but it's getting easier and cheaper all the time.

Another interesting side effect of using a VM is that some of the nastiest and most sophisticated malware won't infect a VM, because security researchers often use them to dissect malware behaviour: http://www.infoworld.com/d/security/crisis-malware-infects-vmware-virtual-machines-researchers-say-200645