I hope this is all on topic

Firstly, it is well worth it to buy an external hard drive and then use Acronis, Norton Ghost (I believe it's called that), or windows 7 for the automatic backup that comes with it.

Personally, I recommend Acronis. It has an option that allows you to enter a recovery mode before windows loads for instances when it won't even boot in safe mode so you can then use the windows system restore (which is included in XP, Vista, and 7). I have mine scheduled to backup my system every night at 1AM.

External hard drives just plug into a USB port and you won't have to perform surgery on your computer to install an internal hard drive, which can be problematic for the casual user. The prices have come way down.

For antivirus I like avast though AVG also has a free version. I don't remember if AVG does this but avast has a feature where it both scans web sites you're visiting as well as email (if you use a client like Mozilla Thunderbird, Eudora, or Outlook). If you visit a site with malicious code, it will alert you. I don't think AVG monitors the web sites you're visiting but I easily could be wrong.

For antivirus programs that aren't free, I highly recommend nod (or it might be called nod32). I've used nod before and while comparing nod to norton, nod detected viruses that Norton AV didn't detect.

As for firewalls, I use Zone Labs Zonealarm firewall. I like the feature where it alerts you if a program is trying to access the internet and you can prevent it from doing so. Such activity is called leakage I think; zonealarm prevents leakage which I don't think the windows firewall protects against.

You can test your firewall here at a site called GRC shields up. Everyone should test their firewall, imo. There are two things to look for: file sharing and common ports. What you want is a "true stealth" result. Hackers constantly scan IP addresses for computers. If they ping your computer and your computer replies to the ping, they will know there is a computer present at your IP address; that will be noted and then they might later attempt to do something malicious to your machine. If you have a "true stealth" rating, your computer is invisible to hackers and they won't even know anything at your IP address exists.

grc

As for paid firewalls, BlackIce is flat out the best firewall you can get, imo. I'm not currently running it since I get a "true stealth" rating with zonealarm.

There are a couple of other defensive programs to note. Malwarebytes will scan for things that would adversely affect your machine but are not considered viruses. It does not actively scan so you have to scan manually every so often. Spybot search and destroy does something similar but it has an active scanner so it prevents damage rather than Malwarebytes' detection of threats after the fact. Also, adaware is good for checking for tracking cookies, spyware, and key loggers.