Use NAT (either from the routing network hw, or from linux/bsd). This is the single most effective way to block tons of malware coming thru OS service vulnerabilities. No-one from outside world can access your box directly. This also allows you to safely (re)install Windows without fear of instant infection.
But most people who have single pc in their home has no router and just instead hook up the cable/adsl modem directly into the lan port. The fact still is that this OS is way to unsecure for the average person to use.
Sadly 90% of the the computer users is far from as experienced as most of us, and thus will not be able to follow all these tasks just to get a reasonable secure OS.
I dont think Windows will get any better before they completly rewrite the OS from scratch and then write it with some focus on basic security.
I personally wish Windows adopted the unix way of multiuser capability. I have a WinXP pc setup for my parents and i gave them a user account with only a very limited set of priviligies, which means they wont be able to change settings, install software and so on. But the sad part is that this also gives alot more hassle, since alot of software wont even run properly without admin priviligies. I also wonder why i should have to login as a admin when using the control panel?? Why dosent it just ask me for the login info for admin priviligies, like most window managers on linux does? If i want to change some setting using kde, it will come up with a popup asking me for my root password, which makes my life a hell of alot easier.