Through several simple registry changes, I make the Restricted sites zone the default zone, while allowing the user to add sites to the Internet zone and no longer allowing sites to be added to the Restricted sites zone (since it is now the default zone).

Unless a domain has already been added to either the Internet zone or the Trusted sites zone, one is very unlikely to experience a drive-by download from a malicious site, since the Restricted sites zone (by default) does not permit scripting or downloads. Occasionally, it can be a nuisance to get certain sites to work properly (many sites often require a multitude of enabled domains to work properly), but it is worth the effort in my opinion.

The practices noted in the squidoo.com link are also worthwhile. However, I would add that one should NOT rely on site ratings given by SiteAdvisor, which are often shockingly inaccurate. However, do go siteadvisor.com and see what the more reliable reviewers have to say about the domain in question. The reviews written by good reviewers (SiteAdvisor has a reputation rating) are generally more reliable than SiteAdvisor’s ratings.

Here’s how I protect (most of) my computers:

http://www.squidoo.com/security2

Philip