I can't recommend a hardware firewall enough. Especially when it is rolled into a wireless access point.
I'm fortunate in having Sophos AV provided free via work, but I believe the corporate standard is to move to ... Symantec, unfortunately (by the sound of it)
