Good tips from both of you.  A savvy user will generally know when they get a bogus pop-up, or an unsolicited phone call from "Microsoft support" requesting access to your PC so they can protect you from the bad guys.  (Note to all:  Microsoft will never, ever, make a call like that, and neither will any other reputable software provider.  It would be logistically impossible and ruinously expensive to provide that level of support).

The social engineering aspect is at least as much of a threat as the malware.