Look into getting a hardware wallet and don't connect it to just any computer. Use only on a computer that you completely trust that has just had a virus scan performed on. Secure internet connection is also a must.
Hardware wallets are usually designed to resist virus attacks and it wouldn't have high risk of it being compromised. Secure internet connection isn't mandatory as your private key is never broadcast to the internet. The only thing that is downloaded to your hardware wallet is the UXTO info and a signed transaction would be sent. There is close to 0 risk of it getting compromised due to a insecure internet connection (at least in trezor). Even for updates, there is a signature that it must match for the device to accept the upgrade. (CMIIW)
Offline. Put the wallet .dat files on a usb stick and keep them safe.
Encrypt the wallet.dat, and then put it on a usb stick.
It helps if you also rename it. Possibly if the .dat doesnt destroy the filesystem, then even put a .txt extension, but not recommended.
An even safer way is to encode the content of the wallet.dat, into a BMP or JPEG file, and keep it in image format, nobody will look after that.
USB sticks are prone to failure. Btw, it is alright to rename it to any format.