Personally I think you can do just about as good a job as Windows OneCare for the grand price of FREE. Check
this site's free programs and reviews. I would get Spybot, Ad-aware, and Spywareblaster. For a Firewall I just heard a strong recommendation for
PC Tools free firewall .
Comodo is another one that's supposed to be very good, but I've heard it can be somewhat cumbersome and the PC Tools one is not. IE7 provides a free anti-phishing filter and maybe Firefox has add-ons for that too. As for a free Anti-virus, the top 3 are AVG, Avast and Anti-Vir. Anti-Vir has the best detection rates but the freebie lacks an email scanner. I use Web-mail only so I get free email scans anyway. Anyways just a thought for the good free stuff!!
EDIT: The Spycatcher Express program mentioned under the freebies is apparently detecting false positives and sometimes causing other PC programs to not run right after removing spyware, so I'd definitely pass on that one!
Another real good security tip that's not discussed much is - Creating a 2nd (or more) usernames in Win XP, and surfing with those instead of the administrator account. By default, when a PC only has one username, this defaults to the ADMINISTRATOR account. By creating a 2nd, 3rd, etc. user accounts these are LIMITED accounts and don't allow "baddies" to install on your computer. Here's a quick article about it and more info in WinXP's help file - search "administrator".
BE VERY CAREFUL WITH USING PASSWORDS ON THE ADMINISTRATOR ACCOUNT. IF YOU FORGET IT, IT WILL LOCK YOU OUT OF YOUR PC. I DON'T USE ANY LOGON PASSWORDS TO AVOID THIS PROBLEM. IF YOU DO, JUST WRITE THE PW's DOWN, ESPECIALLY ADMIN AS ITS THE ENTRANCE TO THE PC.
The #1 reason for running as non-admin is to limit your exposure. When you are an admin, every program you run has unlimited access to your computer. If malicious or other “undesirable� code finds its way to one of those programs, it also gains unlimited access. A corporate firewall is only partial protection against the hostility of the Internet: you still browse web sites, receive email, or run one or more instant messaging clients or internet-connected games. Even if you keep up to date on patches and virus signatures, enable strong security settings, and are extremely careful with attachments, things happen. Let’s say you’re using your favorite search engine and click on a link that looks promising, but which turns out to be a malicious site hosting a zero-day exploit of a vulnerability in the browser you happen to be using, resulting in execution of arbitrary code. When an exploit runs with admin privileges, its ability to compromise your system is much greater, its ability to do so without detection is much greater, and its ability to attack others on your network is greater than it would be with only User privs. If the exploit happens to be written so that it requires admin privileges (as many do), just running as User stops it dead. But if you’re running as admin, an exploit can:
* install kernel-mode rootkits and/or keyloggers (which can be close to impossible to detect)
* install and start services
* install ActiveX controls, including IE and shell add-ins (common with spyware and adware)
* access data belonging to other users
* cause code to run whenever anybody else logs on (including capturing passwords entered into the Ctrl-Alt-Del logon dialog)
* replace OS and other program files with trojan horses
* access LSA Secrets, including other sensitive account information, possibly including account info for domain accounts
* disable/uninstall anti-virus
* cover its tracks in the event log
* render your machine unbootable
* if your account is an administrator on other computers on the network, the malware gains admin control over those computers as well
* and lots more