How are you supposed to avoid sites with malware unless you know about it beforehand? How are you supposed to do that without some sort of list? You don't appear to have thought through your own suggestion.