Bullshit, you don't.
I'm a very wary computer user, with decent security (firewall with a whitelist, and behind a router).
I've had two times in the last half a year that this one crept up; The last one only a few days ago.
The first time it took me a few hours to get properly rid of it, but a few days ago I immedeately recognised the 'fake scan' window, and as a quick resort, resetted my computer.
I started up in safe mode, and used MalwareByte's AntiMalwareto get rid of it (one of the few antispy that actually removes this one correctly; very much recommended once you get infected).
But to stress: There's NO user interaction necessary for this one to work and install itself. I'm up to date on everything (Windows, firewall, anti-virus, browser, java), and this one still slipped through.
My only resort was to have a rough look through the last 10 sites I've visited, and whereas I haven't noticed anything dodgy in particular, I'll refrain from using these sites for some time.