Anti-virus programs work alright, but they cannot catch everything. They operate by finding signatures of known virii, but it is very easy for a programmer to change the structure of a virii very slightly, thus having it still preform the same effect but not setting off any "red flags". The way anti-viruses work is also very ineffective by creating a wide range of finding different signatures that it sets off "false positives" on completely innocent programs. I am not saying you shouldnt have one, by all means, get one. I recommend that you do have one, just be smart about using it, dont let it lead you.
As for a firewall, you should defiantly have one of those, one that blocks both incoming and outgoing traffic is optimal. I prefer
COMODO (free). I tried
ZomeAlarm's free version, but it is a bit resource-intensive for me (and COMODO did better in leak tests than ZoneAlarm). A firewall will prevent unauthorized people/programs from attacking your computer (like, if you get a keylogger on your computer, it will prevent it from sending the logged keystrokes back to the server where someone is waiting to steal your information).
Theres no problem with downloading free software, you just have to be careful where you download it from. Do not just google free software and download the programs that are listed, instead go to reputable sources, like
FileHippo,
Download.com,
PortableApps.com, or places that are really big-name free programs, like
GIMP,
Paint.net,
Code::Blocks,
Pidgin, etc. Just be careful where you get programs from (also dont trust program "awards"...see ). Also If you do want to download programs, use a virtualization-type program to test programs out (see next paragraph).
You should definitely have a program that allows you to run programs in a safe environment. If you have the Windows installation CD's (or you get a ISO from a torrent), you could install Windows into a virtual machine to test things out, thus completely protecting your OS. For a virtual machine i recommend
VirtualBox. But, if you do not have the CD's and dont want to download the ISO's (or dont have the hard drive space to have an extra OS installed (should have at least 10 GB free...not that all 10 would be used by it)) there is another alternative:
Sandboxie. Sandboxie is great, it allows you to run programs, and will not let them write anything to where they want to write, in the hard drive. It allows you to safely install and run programs without risking infection on your computer. Sandboxie is also free (well...sort of, it has a paid version that has a few extra features, but you can still use it for free).
One last thing. DO NOT use Internet Explorer. I would say that 90% of viruses/torjans/spyware/adware/etc. come from drive-by downloads, from Internet Explorer. A drive-by download is a download that happens when you visit a website, without any information to the user than the download has even happened. It allows websites to install that bad stuff on your computer. Instead, use a more secure web browser like
Firefox or
Opera.