I think that something worth noting here is that many ISP's are offering Free
subscriptions to Paid-For products such as Norton and McAfee. So don't rule out paid-for options yet without checking what your provider offers.
Here are some examples:
Comcast Subscribers can now download Norton Security Suite
Earthlink Subscribers can download Norton 360
Time Warner, Optimum & Roadrunner Subscribers can download CA's Internet Security Suite Plus
The point is that you should see if your current ISP offers a viable A/V & Firewall from a reputable company as well as investigate other free and paid-for options.