Use NoScript, one active scanner and one passive scanner (Microsoft Security Essentials and Malwarebytes in my case), never click on links in emails you weren't expecting to get, even if they're from people you know, and if you're not sure if a website is safe, don't go to it.
Porn sites and many free service sites are automatically suspect, so are popular ones like Cracked and SomethingAwful. It's not that the latter sites have malicious intent, it's the ads. If you're using vanilla Internet Explorer to browse Cracked, you WILL encounter an ad that redirects you to an attack site. Even Firefox or Chrome can get redirected this way, which is why I take whatever measures are necessary to prevent ads from running on my machine.
Site owners may not like that solution very much, but after three different infections through malicious ads on sites I used to trust, I've decided that we simply have different perspectives on the importance of site revenue vs. user security. Personally, I think that if your business model, or your contracts, demand that your users make themselves vulnerable to attacks, you've done something wrong somewhere.
Finally, limit your downloads as much as possible. If you can possibly get by without downloading a file from a site you are not sure is trustworthy, then don't download it. If you must download from a non .gov or .edu source, look for forum discussions about the file to see if it's associated with malware. Just make sure the forums are trustworthy too.
One more thing: they say proper computer security is indistinguishable from paranoia. My experience has shown that to be absolutely true if you really want to keep your machine clean. However, paranoia is no fun either. Worrying too much about this stuff can be far worse for you than getting a rootkit, so don't go overboard. Do what you need to to keep your machine clean; more if you need it for work, less if there's nothing important on it. No computer is worth your mental health though.