My defense package (open to suggestions):
Mine is
(1)
Refrain from downloading, installing and running viruses.
Er, that's about it, really.
OK, so doesn't stop things that hit new exploits straight across the network , but
(2) Stealth mode router at the network boundary
does. And to make sure that it's only new exploits that even have that much of a chance I also
(3) Keep the system patched up to date.
And that really is it for most of the machines on my network. One of the kids runs AVG because it came with the machine ... but I rather suspect he's going to switch it off any day now because it's a resource hog.
There's one machine which is an exception, because it's a laptop and might be plugged into the internet by some means other than via the stealth mode router. So that has:
(4) Windows firewall. (When I remember to turn it back on, that is - obviously it's turned off in normal everyday use because, like all firewalls, it's a bit of a pain.)
(And it's also got McAfee on it, as it came with it and I've never bothered to uninstall it, but it's never detected anything, because the above layers of protection mean that nothing has ever got near enough to be detected.)
Right, now, (1) is easy enough for grown-ups, but there is a bit of a learning exercise for kids, who seem to feel the need to visit dodgy web sites, download things (games, chat applications, porno videos etc) and indulge in other unsafe practices that grown-ups find it easier to avoid. This is what worked for me:
Whenever a child's computer gets a virus, disconnect it from the internet "until you've got time" to fix it. Then fix it and reconnect. The point is that "until you've got time" goes up by a factor of two for every occurrence. Last time one of my kids got a virus it was a fortnight - so they know it'll be a month next time. That was sufficient to get the message home - the last virus was many years ago now.