How should IE security settings be set? Bad experience tonight

(I posted earlier tonight about a trojan(/malware?) that installed automatically from a site I visited. No one replied as of yet; I added the single response that's there.) (TDS-3 was calling it a downloader trojan, BTW.)
TDS-3 identified it as - trojan.win32.revop.c
Spybot did not detect it.

Can I prevent sites from installing programs and especially trojans!?
It's random and scary! When visiting sites, I Alt+F4 to close popup windows. This site had quite a lot of windows. I didn't touch them though. Still, it installed. Does it make a difference, malware versus trojan?

So, what to do with my IE settings to prevent this?
I can't find a guide, or a list, that says plainly how to set my IE security settings. I do see lots of articles that talk about individual settings, but no list. They usually leave it up to the reader to decide what to do - well, I will be wrong, wrong, wrong! I have to be told how it should be. Mainly I want to prevent disasters like this from happening again. I hope I can do that.

(It installed three .exe programs.)

 

Read here:http://forums.techguy.org/t208517.html

If you have XP you will need to see this one as well:
http://www.microsoft.com/technet/security/bulletin/MS03-011.mspx

 

My History is wiped so I don't know what the site was. It was towards the top of the second page of google listings for "song lyrics", but I know that's pretty vague. Wish I'd thought of getting the site name yesterday, but it had me in a tizzy.

I have XP, and I do already have the Virtual Machine patch installed.

I changed a those Active X things in the security settings. Do I have to go onto every other user's screen and make the same changes on their IEs too?

Thank you so much for your help (and in my other thread as well!!)

 

Just a quick question about your recommendation for this setting:
"Download signed and unsigned ActiveX controls to 'prompt'"
(If the settings are done on each user's screen, that is.)

My other users click on anything, allow everything, download anything, etc., and make fun of me for worrying. They need keepers, really. Will setting the "Download Unsigned ActiveX" to "PROMPT" therefore allow them to run amok? They are impatient and clueless. Can/should I put that setting to Disable for them? Do I do it on each of their screens one by one? (XP Home.)