I agree with what Tarq wrote.
One firewall (I reckon ZoneAlarm; certainly not the Windows one), one anti-virus (I use AVG on the laptop, Avast on the desktop, nothing on the Linux box, nothing on the fileserver which is inaccessible from the Internet, and doesn't do e-mail).
I have a VPN from the Norfolk cottage back to the house in Essex, and it "just works". That means the primary defence for the whole system is the NAT firewall in the home router. I checked that with the Gibson "Shields Up!" site using the laptop with all protection turned off (so it wasn't the laptop's protection I was testing). It got a "full stealth" rating, so I reckon that firewall is OK. I suspect the same VPN would work from anywhere I was using the laptop, but I'd worry about security on a hotel or similar ADSL connection, so I don't do that.
I have a "hosts" file, but haven't updated it for a while. Reminder to self...