6 for winXP SP3, less the Malicious Software Removal Tool, which I always decline.
I found the hard way that, when doing the monthly MS Updates, once it's finished checking that your update software is up to date and you're presented with the choice of update modes (I forget the exact wording, but it's something like "critical" vs. "all"), you don't get the opt-out ability for
anything if you've chosen critical-only, at least on my XP SP3. I agree that MRT shouldn't be necessary if you're reasonably well protected, especially since it's typically the largest and slowest upgrade other than any cumulative security updates.