With Noscript, external firewall, Firefox, no non- web except up to date Flash in Browser (no PDF, Media player, VLC, no added toolbars, no Java) all non-essential services off (upnp, telnet, server, no sharing, remote desktop, remote registry, HTTPS & HTTP server, FTP, SSDP etc, no autorun on any media inc net drives) etc XP used by a knowledgeable user is safer than Win 7, Win 8.x or Win 10 used by average user with a false sense of security in AV products and the default configuration.
Thunderbird or other client with no remote content enabled for email.
Using Libre office (or Office 2003 with no macros or activeX).
The default Windows settings for services are madness and always have been.
An alternate view
I use silentrunners,org and gmer, often booting in safe mode to check out people's PCs / laptops