Obviously, there is always a risk. The question is "How great is that risk?" What is the probability of being hit? With an admin account and anti-v installed and running, can one say the risk is not there?...etc. The questions are endless.
From my experience, my brother-in-law, a complete noob...