I use a multilayered defense:
1: I use SpywareBlaster (it only runs when updating and adding blacklists, otherwise isn't doing anything.) This blocks cookies and executables from dodgy sites.
2: I use an adblocker extension to the web browser. Because ads are such a security risk (a lot of infections can be traced through ad servers), I block them, and try to pay for a subscription, or for rv.net, buy CW products.
3: I use the "click to play" option, so some site throwing Flash dialogs are not shown unless actively activated.
4: I use separate Web browsers for sites. Facebook gets its own browser, banking another, everything else, a third. This way, tracking cookies from one site can't leak to others.
5: As the last resort, I use virtual machines and/or a sandbox tool (sandboxIE). If a Web browser gets compromised, at least the infection is contained to the sandbox and won't spread outside of it.
This may be a lot, but for most people, I recommend at least doing measures 1-3.
