Personally I hide my 98SE machines behind a hardware firewall.
I uninstall any software I don't use, including portions of Windows, and I'm ruthless about this.
I install only the security upgrades that actually affect me (why update ftp.exe when I've deleted it?)
I stay familiar with my system's normal operation, using Nir Sofer's tools and SysInternals' tools, among others.
I inspect installers and programs before installing them - not just for malware, but because the occasional installer will ignorantly cream a 98SE system file and try to replace it with an XP one. I recommend Universal Extractor, but there are other tools.
I update any software that interfaces with the outside world, such as browsers or downloaders, regularly.
I disallow my browser from doing ALL KINDS of things others consider normal (browsing with "no images"? Sure, if I distrust the site, or I just feel paranoid about website hijackings this week.)
I do my mail on the web, where it takes extra special work for me to download malware - even html or images.
With these precautions, I've had the luxury to just go and search for an AV program when I decide I want one. I've NEVER "needed" one for my own machines, except to find out exactly what was IN that package I wasn't supposed to be able to save instead of running.
And this process worked even back in 2001 when I went through that binge of downloading cracked software and keygens. I couldn't USE the stuff, sometimes didn't even know what it did, it was just like "that's THREE THOUSAND DOLLARS!!!". Saved "StarDialer" to the desktop a lot, never ran it once. Got about fifty pieces of malware for each working keygen. Ended up never using a single thing, losing it all in harddisk crashes EXCEPT the things that got saved to my malware collection.
Anybody NEED old versions of StarDialer that run on Win95?
The last year has seen software drop 98SE support left and right, so any recommendations go out of date quickly. Even software that wants to continue support finds that some crucial library or framework had a different attitude. The next time I need a malware scan, I'll probably look at one of those "last version to support 98SE" sites.
On the other hand, I just manually removed a malware package from a new used Win2K computer (containing a whole collection of malware), uploaded it to Jotti's, and had half of the scanners, including some well-rated ones, find nothing. And this is an installer that I could tell was a problem by just reading, in plaintext, the list of files that it was going to install - if it WASN'T a rootkit or zombie, it was an impressively powerful remote administration/monitoring package. What THAT says about modern malware scans, I don't know.
So judging my computer security by what software I use is rather like judging my diet by my fork collection.
I would be more interested in what JOBS people use what software for, and how they decide what jobs constitute a security sytem. Do you scan internet traffic? Do you firewall? How do you manage mail? Can you even be mailed files that you have to scan, or do you have to download them first? Do you whitelist? Do you blacklist? Do you use a router/firewall? Do you know what it blocks and allows?