You would be amazed how easy the same is just with infecting your browser...
Next to impossible
if you've secured it (i.e. use Firefox or Opera instead of IE, use web filters or plugins to disable Java, Javascript and Flash by default, run with non-admin privileges, etc (for Firefox, the "holy trinity" of plugins NoScript, AdBlock and Ghostery should be included).
You can do nothing similar to mitigate or secure Steam's software.
