I used to use Hotmail mainly for anything where I thought there would be spam coming (and it worked very well), but even their virus checking didn't always work. Not sure if they use someone different now, but they had McAfee at one time and I still got a series of worms through (luckily identified by by AV software).
With Outlook Express security can be tricky, although I think if you turn off the preview thingy that at least gives you a chance of spotting them before they infect everything.
Just having a look through the settings of OE 6 at least under Tools > Options:
- Read tab:
"Read all messages in plain text" should protect you from most worms although doesn't work so well if people insist on sending you HTML e-mails.
- Send tab:
"Mail sending format - Plain Text". Just a quick plea for all OE users to set this for the sanity of those of us who don't use OE.
- Security tab:
"Restricted zone sites" is definitely the option to have selected which at least protects you to a greater degree. Also there seem to be a couple of other options on there related to viruses....OE being virus aware, whatever next!?
(Pity it doesn't appear to be working too well judging by the number of My Doom viruses)
I'd also go into IE > Tools > Internet Options > Security > Restricted Sites > Custom Level button
...set everything to either "disabled" or "prompt" as I seem to remember the defaults there aren't all that secure and thats what Outlook Express will be using for its security checks.
Apart from that, just make sure you've got a good anti-virus product, eg: Norton which scans the mail as it arrives/leaves.
And so ends Dr. Trev's "How to bolt down OE" tutorial...
Trev
PS: Being edgy is the best form of defence.
PPS: Theres an even safer way to do things, don't use OE! 
Author