So, you better keep yopur scripting and Java turned off while visiting sites you don't know.
Even better : Don't use the Internet Explorer while visiting sites you don't know.
But even worse, there is a kind of bug which can let hijakers use the Internet Explorer's scripting - Activex, to be exact - even when it's turned off ! <img src="/ubbthreads/images/graemlins/exclamation.gif" alt="" />
Don't trust what you don't know, that's the best defense, imho.
The virginity of the Internet is over. We must protect ourselves now.