I'll add to the general 'user fault' concerns as being one of the most dangerous in terms of getting your system compromised. However when using a Windows platform, i always have both an AV and firewall as history has proven that even if a 'safe' user such as myself (by 'safe' i mean i don't do the typical errors we have seen talked about so far), you sometimes can get got by a virus/malware. These days of embedded scripts in advert banners, you simply need to just visit a site to get unlucky and get something, any site.
So yeah on Windows it has nearly always been required to have some tools to help you combat virus/malware, it's just too popular an OS system which is what makes it such a large target.
Mostly i use Linux for the internet these days, and even when most experienced Linux users were saying 'You don't need an AV in this OS', i felt i needed one as i swap files from Linux to Windows PC's and i need to make sure i'm not importing malware onto those systems. And even Linux has plenty of security issues these days, we get new stories about exploits all the time, not as frequent as for Windows, but they do happen. We live in an internet connected world of data-gathering and personal information theft, virus and malware are just part of that.
