A select handful will jump out of the browsing environment and hack themselves into the main system.
They would require MS scripting engine to be turned on and/or other service ports(135, 139(NETBIOS), 1024(DCOM), 5000(UPnP) and etc) to be opened to world. In Windows 2003 Server (NT 5.2), the MS script engines are turned off by default.
That is why it is a Windows/IE-only problem: no other combination I know of allows such easy hijacking and modification of the browser by outside parties, despite you trying your best to surf cleanly and patch your system as often as you can
Could you point me to a malicious web site that will compromise a properly configured Windows setup?
A reasonably properly configured Windows setup would include
1. DCOM crippled. This is for Distributed COM objects i.e. use for remotely executing COM objects.
2. Firewall applied for all ports including service ports(applied only for Internet Connections).
3. At least all of April 2004 patches. At worst, MS’s Feb 2004 Security Update CD.
4. Privacy set to at least "Medium High". Cookies blocked except for trusted sites.
5. "Security Setting" set to high. Special attention to ActiveX scripting by disabling them or setting to prompt at minimum.
6. Strict software installation regime i.e. only trusted software to be installed.
7. Web surfing via limited account not the usual admin level account.