Yes, because you don't even have to be using the computer to acquire new malware -- if Windows isn't patched and you don't have a properly configured firewall in front of the system. Simply browsing the web with fully patched Windows behind a firewall is a risk as well.

Among other things, I review orders for an advertising service, 20-30 a day. Some of these orders are purposely placed to advertise sites with malicious code that installs malware. My fully patched Windows 7 system behind a firewall, running antivirus and the latest Google Chrome, gets infected with something or other on a regular basis -- at least once a month -- without me ever downloading any files.

Last week it was one of those fake antivirus programs that terminates all your real antivirus programs and pops up a window saying you're infected and need to upgrade for $29.99 every 20 seconds.

That one was probably a Java plugin vulnerability.