I just experienced my first virus under Linux. In a virtual machine running Windows XP. Of course, it was just for testing purpose... I installed a fresh Windows XP, tried to share files between the real machine and the virtual machine through Samba. To ease the configuration, I deactivated the firewall of Windows. I didn't use Internet Explorer at all.
And the result was there in less than five minutes. Multiple windows popped-up out of nowhere, proposing to install sex software, false anti-virus software... and I don't want to think of the things that happened without displaying a pop-up window.
There was a statistic a few months ago, saying that a non-secured Windows box alone in the wild was compromised in a few minutes. I can confirm.