Java, javascript, flash, all file associations for anything from Adobe for that matter, and any HTML5 code/pages. For email, it is a little trickier. Your email client needs to get really stupid and only open email in ASCII mode. You need to disable all network LISTENERS, or put them behind a hardened firewall (I had to do this as my Wife's work demands she have things on her computer which are unsafe).
Now, for javascript, I do have a select few pages I allow it to run on that I know I can trust (like our bulletin board). I also use a junk email address anytime some site requires an email address, for anything. I periodically start a new junk address and leave the old one to languish.
My incoming data stream is checked for binary data, of any kind, and it is either allowed through, if it passes criteria (images can be verified clean pretty easily) or held up and a placeholder inserted into the stream to let me know. That is a Linux box doing that so it is pretty much immune to the nastiness intended for Windows.
I also have a hardened firewall at home, which most people do not have.