A firewall is better than an av scan to protect your wallet.dat Probably there will be more and more exe's that look for wallet.dat and upload to a server somewhere. A lot of time it will come in the guise of a special video player or something along those lines. Even with a firewall, people are inclined to grant internet access to it because otherwise, the video won't play.

In this case sounds like it was likely the copy on dropbox.com.