I run my ip adress completely demilitarized ports 0-60,000 are all directly forwarded to my comp, with no firewall, no antivirus, and no anti spyware, download torrents constantly, and browse the web, and i've never had a problem
the whole virus/spyware scare is blown way out of proportion, 99% of spyware that end up on your comp is installed intentionally (bundled with 'freebie' software) and they don't even know it, and virus aren't spread by cookies, they're sent in through e-mails, usually by doing stupid things like having outlook express automatically open e-mails when you single click on them, or by not disabling pictures/links on e-mails from unkown senders.
Use firefox for your web, use the plugin called 'split link' which decrypts javascript links of webpages, and restructures them to open the intended page directly, and use thunderbird for your e-mail, and disable automatic previews.
And lastly, i'd love to know what a hacker would want in YOUR computer for. They're not gonna bother trying every possible ip adress/gateway/port combination on your WAN ip adress for a 1/100 shot in finding YOUR credit card number. Hundreds, maybe they'd spend the time, but give me a break.
virus and spyware companies are capitalizing on the irrational fear that all the gremlins and bad guys on the web have some sort of vested interest in their computer.