Well, that's pretty much the name of the game when it comes to "free" games - and mosta the rest out there on the web that urges you to
"Click here now for
FREE!!!!!! <whatever> -
HURRY!!!!!!, Offer Expires
SOON!!!!!!"
But if ya gotta play, there are some things you can do to greatly reduce, though not really totally eliminate, the risks to which you expose yourself.
JavaCool Softaware's free
SpywareBlaster, free/donationware (pay something if ya wanna), isn't a scan-and-remove app, all it does is block lotsa nasties, prevent 'em from "getting in", and since it blocks specific apps and websites it uses next to no resources - install it, "Enable All Protection" when prompted during install and/or update, update it at least a couple times a month, and it just prevents a huge list of known nasties from getting in. Its as good as its most recent update, so the better you are about updating it, the better it will be at what it does.
Nick Skrepitos'
SuperAntiSpyware is a very good free, multifeatured scan-and-remove app with an available for-fee version that offers a robust real-time detect-and-prevent feature among other enhancements over the free version. The downloaded free program amounts to a full-featured trial period for the for-fee "Pro" version, so you can try it out and see if you think its worth paying for. If you decide to not pay for the "Pro" upgrade before the end of the trial period, the free version just switches off the advanced features while remaining a very good scan-and-remove app with lotsa handy features, though without real-time active protection and some advanced/enhanced features. The free version can be upgraded to the "Pro" version at any time before or after expiration of the trial period.
Crawler Software's
Spyware Terminator (also free/donationware), another very good scan-and-remove app, does offer real-time detection/protection against a broad spectrum of known nasties, and can be configured to include an optiona;l, free, fairly decent, though pretty basic antivirus as well - I dunno as I'd wanna rely on the antivirus as a real-time active primary frontline defense, but it does enhance the detect-and-remove capabilities of Spyware Terminator, and it can be a handy "second opinion" if you have reason to think mebbe something mightta gotten past your primary resident antivirus.
And finally, there's Ronen Tzur's
Sandboxie - not an anti-anything, really, but more of an app which when "turned on" sorta makes your browser (either IE or Firefox) into a "virtual machine"; you have full browser functionality when using Sandboxie, but whatever goes on while using it is "sandboxed" - isolated from your system - and when you close your Sandboxie session, pretty much whatever might have been piggybacked or otherwise "slipped in" while properly-configured Sandboxie had control of you browser goes away as though it never had been there.