>But what about something like malware attacking you from an adserver that didn't happen to get blocked by AdBlock or Ghostery and you're not running NoScript o

>But what about something like malware attacking you from an adserver that didn't happen to get blocked by AdBlock or Ghostery and you're not running NoScript or you whitelisted the domain (perhaps supporting a company you were happy to help support from ads). Assuming you are talking about a fully silent "driveby" on a modern browser like Chrome: There's a very good chance such a dedicated and advanced attack will also bypass all AV products at the time you are infected. To this day it's still quite easy to bypass any AV if you know what you're doing. If the malware author himself (I'd say "him/herself" but I have encountered very few female authors of advanced malware, Joanna Rutkowska being the only exception I can think of) is the one launching the browser exploit campaign, he likely also knows full well how to get it past any AV. Personally, I run AV just as a simple "stupidity guard" for myself. I would pretty much never get infected with malware through regular browsing; I work in information security and fight malware daily. But there's that chance I get really drunk one day and do something stupid, so it's nice to have.