Kind of a general question, what stops things like malicious code coming in from browsing without downloading a file and opening it? I'm thinking in terms of 'You're our 1 millionth visitor' type crap. Doesn't stuff like MSE or ESET or what have you prevent that kind of thing from opening? I obviously never click the links, but I had always assumed the real time protection aspects of most antivirus would (attempt to) stop that kind of thing. Am I pretty much only getting by on the fact that I don't click the links and kill the browser manually if something really weird pops up?
Wiley.
Disabling flash, java and javascript stops most browser based attacks to their tracks. Using Firefox with noscript and not installing java and/or adobe reader at all goes a long way and this is all that's needed to stop the 'you've won blablabla' crap and popup windows. Windows XP is also vulnerable to a JPG exploit where code is executed simply by viewing a tailored jpg image, but this has been fixed in all OSes after it.
Foxit PDF reader does everything that adobe reader does, free, faster and safer. Noscript blocks also flash scripts from running so if you're into browser based games you're going to have to risk and enable flash case by case if you want the flash game to run. I run noscript even on linux and OSX while browsing and I've decided that if a website doesn't display properly without enabling scripts on it, I don't need to use it.