Just out of interest, how does common sense prevent trojans, exploits and drive-bys served up by legitimate sites like the BBC through iframes (for example)?
I don't know what that means, but how often are reputable sites like the BBC infected?
I do also use avast, but I've never had a notification of a virus from a site that wasn't inherently dodgy anyway and I accepted those risks when visiting it. Of course, my computer may be riddled and avast may just not be picking them up but it runs fine and the only one that is emptying my bank account is me.


). To be fair though you're being too simplistic. As I've said a few times in this thread signature based AV is old hat now. Heuristics, HIPS and automatic sandboxes with default deny are where it's at and make signatures redundant.