rae, get the NoScript addon for firefox.
Some of these trojans download themselves - no user clicking required - just by being unfortunate enough to visit a hacked site with a hidden script inserted.
This is a very common attack vector which Noscript will block unless you allow it.
Takes a little bit to get the hang of. It's default-safe. And fairly intuitive.