imo, you really dont need to pay for stuff.
If you have a decent firewall and you use your brains, that ought to avoid a lot of stuff like viruses, but it wont avoid spyware if you use IE as your browser.
I'd recommend the following:
Mozilla Firefox browser (but keep IE because not all sites are Mozilla-friendly yet)
Mozilla Thunderbird email client.
AVG7 or Avast! anti-virus (both free)
Spybot S&D
Ad-Aware
Javacool Spyware Blocker
and a decent firewall (one that manages outbound as well as inbound connections, which the XP firewall doesnt do) - something like ZoneAlarm (also free) or (before Oatman jumps in) Sygate.
I wouldnt use Norton myself because I feel its too resource-hungry - but someone will probably disagree with me on that (where are you, JonnyT
?)
All the links for the above can be found in the Techies Corner sticky thread.