I don't run an antivirus. Any good virus is written with a polymorphic (impossible to detect using modern antivirus) crypter stub. Every other poor quality one uses a static crypter stub and chances are your antivirus won't detect it anyway. Furthermore, web-based attacks can really only use Java, which I'm asked if I actually want to load the app or not before it loads anyway. Any web-based attack that exploits a zero-day error in a browser will not be detected by AV. In my completely honest opinion, antiviruses are a waste of time unless you download files from shady sites on the regular.