Virus on installation

My parents just started using Windows XP so everytime I go up to visit I try to update and check their computer to make sure everything is running safe and secure. They are on a DSL modem, and have absolutely no firewall of any kind installed except the default OS one.

When I first upgraded their OS to Win XP they were imediately infected by sobig before I even had a chance to finish the install. When I upgraded to sp1a I was similarly immediately hit by another worm before I could disable services and properly tweak and administer patches.

My Question: What is a good way to handle upgrades for their pc? It seems like I almost have to take them offline and install the upgrades from disk so there's no risk of infection. I realize they should get a router or some sort of protection and this will likely eliminate this problem.
However, is this a issue with their network too? What I mean is, it seems like worms and such are running rampant on their network because I never have such problems with my pc. I assume it's because Im behind a router, but then again I'm a newb and completely clueless about these things.

Thanx for your help.

Actually, good firewall software will almost eliminate the worm risk. As long as you have the firewall configured properly. An example would be explicitly blocking port 135.

As far as updates go, I would just set windows to notify you when updates are ready, then go get them. I doubt the updates had anything to do with the worms. Windows was already vulnerable.

BTW: for best security I would go with a good Linksys router, they should all come with Norton Internet Security, as I understand. That way you're covered on all fronts.

ANother option, although I don't know if it is feasible for you, is to download the patches to a box you know is clean, burn them to cd, then install tehm on your computer. You can do the same as far as downloading a firewall or antivirus....

Frustrating, isn't it? I read an article today about a honeypot that was compromised within 15 minutes of being brought online.

My policy has been, from a fresh install, disable services...install regprot , firewall, antivirus, winpatrol....then go after my updates. But that's just me :)

How about u have an Antivirus up to date running while you're doing the upgrades? I think that would work as the AV would catch them and take care of the issue :).