85% of malware is some kind of trojan (trojan downloader).
Recently an owner of an enormous botnet was arrested for using a 400.000 machine RX botnet with malicious intent.
Main line of your defense: “Do not take any candy from strangers” . Bots can both be fought in the same way: do not download software from an unknown source, always check downloaded code with a virus scanner and do not install anything unless you are sure it is the official version of a legitimate program. Use in browser protectiuon not to land on insecure sites or hyperlinks: siteadvisor & Dr.Web’s pre-hyperlink scanner plug-in, or search through scandoo.com. Do not have script installed on questionable sites or unknown sites (NoScript on), surf without full admin rights on your OS.
Use a secure mail policy ((remote) scanning, e.g. Mailwasher with several blacklist active, do not open mail you do not expect).
Don’t use programs that connect to the Internet whilst logged on to an account with administrator privileges (OSes that this applies, XP, etc.), unless absolutely necessary.
Whilst browsing or collecting email, etc. if you get infected then the malware by default inherits the same permissions that you have for your user account. So if the user account has administrator rights, the malware has administrator rights and can reap havoc. With limited rights the malware can’t put files in the system folders, create registry entries, etc. This greatly reduces the potential harm that can be done by an undetected or first day virus, etc.
Check out the link to DropMyRights (in my signature below) - Browsing the Web and Reading E-mail Safely as an Administrator. This obviously applies to those NT based OSes that have administrator settings, winNT, win2k, winXP.
As Polonus says use an anti-spam program that can identify spam (plus suspect) email and delete it from the email server. I too use MailWasher pro, great for adding Origins of Spam blacklists and it also uses Bayesian logic to help identify spam. There is a free version of MailWasher but that only covers one email account.