As for the free:
It was AVG a few years back
Then it became Avira
And past 2 years it seems to be Avast Free, with some users even ending up upgrading to the "Internet Security suit" even users that never bought an antivirus.
Also the free edition (no active protection, just on-demand) of the anti-spyware: Malwarebytes is usually added to the mix, as a "once in a while scan for anything missed by the antivirus"
that + an adblock plus extension (with "optional ads" opt out off + localized language filter for non native English speakers\surfers) and possibly ghostery extension added too.
In regards to the paid:
Every single one of the non Avast paid users that I see is running Kaspersky.
Lastly for some users there seems to be an added anti-phishing layer called "Trusteer Rapport" I believe that some banks even went as far as to make it a mandatory software that is required in order to log-in to their accounts, from what I can tell its compatible "officially" with everything, yet meanwhile Kaspersky's stance is that it isn't, when in reality the two have many different features ... an a single overlapping feature that needs to be disabled in one of them to avoid issues.... - haven't personally looked into it as I am from the Avast user base =p
Hope that helps.
oh, and for the truly fanatics on top of all of the above... there's also the "NoScript" extension and PeerBlock software and possibly a VPN service as well (such as hidemyass)
[next step would be a PC running router flavor of Linux and firewall, between your actual PC and your house's cable\ADSL modem....
and an even further step would be an eBay old laptop with an eBay hard-drive bought elsewhere running the Linux OS Tails, not using any social network or known/common email provider and only using free WIFI in different locations
next step (towards madness?) would be same as the above with equipment bought for Bitcoins in different country\state than your own...
and then
then there's the forest\outdoors =p as only truly secure system is an offline one (buried under six feet of reinforced concrete, after being burned)
