The Security Mentor

Microsoft says, in their "Ten immutable laws of security", that once you let a bad guy run software on your computer you have given away your computer to the bad guy.

Problem is, there are lots of things floating around that are actually programs but aren't called that.

The example that's biting people now is spyware in plugins required to view online video. They may be called "codecs", or something else. They're supposed to understand compressed video and display it for you. But they are programs and there's nothing to stop them from doing other things, like recording all your keystrokes including your passwords. Antivirus software might help, but of course the bad guys know about antivirus software and may make their wares look innocent and then, once on your system, download the poison from the web and run it.

So the usual advice is only to download codecs from a trustworthy source. Nobody ever explains what a "trustworthy source" is. Geek community word of mouth points to the Combined Community Codec Pack as an example of something that lets you play a wide variety of videos and that's free of malicious software.