* Don't use Internet Explorer for your web browser. Internet Explorer 6 is very bad (though many businesses haven't upgraded their own systems to work with anything more recent), but even IE8 allows ActiveX controls that give websites way too much control over your computer. Some websites won't work with anything else, and you have to consider how much you need to use those websites and how much you trust them. Remember that even good websites can get hacked. The websites of antivirus companies have even been hacked, and at least one was infecting visitors with trojans for a long period fo time. So it's not just a case of careless, uninformed webmasters getting burned. Firefox is a free and easy to use alternative to IE. It doesn't run ActiveX.

* Consider not using a Windows operating system. Microsoft has the largest market share, so most trojans are written to run on it. Other operating systems also aren't as promiscuous as Windows, which allows random software to alter system files. If your computer is running MacIntosh or Linux, you can download most trojans and still not be harmed, because the trojans can only run on Windows.

* Don't allow Javascript to run by default when you visit websites. The easiest way to do that if you use Firefox is to install the Noscript add-on. That allows you to evaluate the site and easily decide if you want to allow Javascript -- and whether you want it to be permanent or temporary. You can even allow it for the main site and not for the ads. (Remember that ads on websites are often supplied by third party companies and vary from day to day, without the site owner having the ability to screen them. Criminals have managed to get dangerous content in the ads on otherwise safe websites.)

* Be highly suspicious about anything that arrives in email and asks you to provide any kind of information. Paypal, your bank, your email provider, your credit card company, your cell phone company, your airline, etc., are not going to send an email asking you to give them your password. They aren't going to ask you to provide information they already know. And if they need you to log in, they will tell you to go to their main website, not give you a link to follow, except to confirm an action you already initiated.

* Be suspicious of email attachments. Unfortunately, an increasing number of business users will send emails where the entire message is in the attachment, apparently thinking it will be taken more seriously if it is formatted as a .doc or .pdf file. But criminals can disguise malware in attachments. Attachments that end in .zip, .exe, .cmd, .vbs, .pif, .scr, and .bat are particularly risky. But there have been exploits that took advantage of formats like .pdf that are generally safe.

* Consider using an email program other than Outlook, or using a text-only program to check emails before opening them in Outlook. Outlook limits your ability to see the source code in emails, making it harder to evaluate whether a particular email is safe. There are programs like MailwasherPro that allow you to toggle between the source code and the viewable email and make it obvious when dangerous links are being disguised.

* Keep your computer's software programs up to date. You need to update your antivirus and antimalware programs daily due to the constant stream of new malware being created. But vulnerabilities are often found in browsers and other applications that interact with websites. You need to get the patches before the bad guys develop malware to exploit those vulnerabilities.

* Don't give access to your address book to any website. I know that sites like Facebook, LInkedIn, Classmates.com, etc. will ask, so they can search for your friends. They shouldn't ask. It requires your password, which you should never give to anyone.

* Make sure your home wireless network has encryption and a strong password. And don't access any website or account that requires a password from a public computer or an unsecured wireless network. A computer in an internet cafe is likely to be full of trojans from other people's surfing. And criminals honest-to-god do sit in their cars in hotel parking lots or on residential streets running "sniffer" programs that collect other people's passwords. Accessing your email account from a shared workplace computer is risky if you don't know what everyone else's level of security awareness is.

* Choose very strong passwords. A criminal doesn't need to make repeated guesses to find your password. They can try the same password on many different people's accounts. There are lists of commonly used passwords out there. You should make sure your passwords aren't on any of those lists. In general, a password should be very long. It should have upper and lower case letters, numbers and special characters in it. It should not be a dictionary word or a word with a few numbers added at the end. Except for trivial websites, you should use different passwords for each site. But ... you have to be able to remember it without writing it down anywhere. Think "passphrase" rather than "password." Some people use passages of text that they have memorized and use the first letters or last letters of each word in the passage, inserting capital letters, numbers and special characters in the middle as well.