By not installing Ubuntu and not removing the hard drive, I suppose I am vulnerable when I open bitaddress.org offline and enter the 64 random hexadecimal characters I have generated without a computer to find corresponding public address.

Yes, I clear the browser before re-connecting to the net. I never use the mouse to copy the private address (or indeed keep any computer record of it) but, if malware can pick up the 64 random hexadecimal characters which I typed in or if it can take a screenshot of the private WIF address I am screwed.