You can catch a Trojan even if you visit only legitimate websites. This post explains how it happens and what you should do to protect yourself.