You must have an (1) antivirus program, (2) firewall and (3) current Windows Updates.  Period.  Even if your computer has no internet connection, someday you will use a floppy or CD that will destroy your computer and years of work.  Someday you will get an internet connection and it takes under 10 minutes for a clean computer, with no updates or antivirus to become compromised.  The antivirus program must be kept up-to-date.  All of the current products I know of have some level of automatic updates.  This has to be double checked every few days, in my opinion - or it is rendered useless.  There is no such thing as a Install-and-forget security product.  At home we run Grisoft AVG 7.0 Network Edition and every few days, I manually verify that all computers are up to date.  In the past, Norton Antivirus 2003 had to have Live Update run every few days to catch certain updates that wouldn't install automatically.  In the fall of 2004, we moved away from Norton Antivirus and went to Grisof'ts product line - and been very happy with it.  Add/Spyware is becoming more of an issue now, Broderbund and Intuit have installed "phone home" software in the past, and this is becoming more prevalent in software.

In todays world, you need a firewall to stop Windows "chattieness".  With the advent of Windows XP Service Pack 1, Microsoft finally got it right.  Up to then, windows would leave it's underlying Services pretty much open to anyone who wanted to use them, and you can be assured, the bad guys want your computer.  They want to use your internet connection to send spam and sell you products.  There are too many free firewalls out there to not use one.