There have been a lot of posts since that may have answered your question, but it's not just cookies, it's registry keys (which are a lot harder to find manually) as well as programs pretending to be normal services, etc. that can be installed not just from web sites, but from software you may download and execute.
Even if your running a firewall that is blocking these hidden programs from being installed, you can still get quite a bit.