http://www.spywareinfo.com/articles/hijacked/prevent.php
This site has a link to software which institutes a block list of malicious sites designed to try and add spyware to your PC. You are free to download it and check out the sites listed.
http://doxdesk.com/parasite/prevention.html
This is a fine site with a little script built in that detects the most common parasites, as well as lots of descriptions and links to spyware forums, genuine removal tools and technical forums. If you want more technical detail, go there.
Yes, the biggest way they get stuff on your PC is to trick you into downloading it, and they get better at it every day. Bundling with other software is common (and the reason I got rid of ICQ) and offering it with stuff like atomic clock programs, browser skin programs, etc is also another way. I've now seen them disguising their active-X downloads as Media Player-9 updates and other complete fictions which the unwary might download. I have seen professionals caught out by some of these, they are more and more invasive and inventive as each day goes by.
The other way they get on is from supposedly safe web browsers downloading and running things like active-x components and javascripts, and exploiting security vulnerabilities in these technologies. You can protect yourself by patching and by shutting down as much of this functionality as you can, but you cripple the browser too. Also you must remember that patches tend to be reactive, made once they actually find a hole that's been their all the time, and once it starts to be used.
I for one would not even begin to surf until I'd cranked up some security settings, got a router or firewall between me and the net, got a good anti-virus and spyware program running and had disabled MS Messenger. I almost never get anything either, but I have been infected and I am well aware the next innovation might be the one that gets me, so I take precautions.