Q: If I leave a computer running, but doing nothing but setting there, is there any danger of getting spam, virus or other infection? In other words, doesn’t the user have to be actively surfing on the web to get unwanted stuff?

A: Technically you are never “safe”, but in general there is less risk if you aren’t actively opening naked pictures of Britney Spears or surfing porn sites.

There are a number of ways a computer can be attacked and not all require “active” participation.  Of course, the most common these days is “social engineering” attacks where the evil-doers get you to open a file or enter personal information by offering you something really interesting (naked pictures) or pretending to be someone else (phishing).  

However, if you are bored sometime look at the logs from the firewall closest to the Internet (in my case my wireless router).  Every few seconds some bot is doing penetration tests on my system, looking for obvious holes.  It blew me away the first time I saw it because it is constant.  Assuming you have a good firewall you should be fairly safe.  

There are certain services that run constantly on your system.  If these interact with the internet (e.g., update service) and have vulnerabilities (e.g., buffer overflows) your system can be attacked without you actively participating.  

In reality, these attacks are rare and there is a cottage industry of security “experts” trying to build their reputations (and thereby their businesses) by finding them before the low-life punk in Moscow does.  

There is a lot of good information at http://www.microsoft.com/protect/default.mspx.  There are other sites devoted to computer security issues that go into the gory details.  I would recommend reading up on rootkits as they are currently the scariest thing out there (other than the NSA) that I’m aware of.