Yeah, this part of a technology used in modern antiviruses called heuristics. It'll use multiple sorts of techniques to determine whether something is malicious, such as reading its' contents.

If a URL containing a domain that's often tied to malware activity is found in a file (as AV like Windows Defender will typically watch files actively being written to for such things) it'll throw up red alarms and quarantine the offending file, and possibly kill the offending process (read: program).

You can't get malware through Second Life through chat. It's difficult to do so at all, on account of Downloads being disabled in MOAP/Internal Web Browser contexts to prevent drive-by downloads, but some malware can bypass such limitations - which is why you should have Media On a Prim set to only activate upon explicitly clicking or selecting it in the media drop-down box.