Honestly, by far and away the biggest security risk on a computer is the person using it. A user with a bit of basic knowledge and common sense on an unprotected computer is actually far less likely to get compromised than someone who doesn't know what they're doing with expensive paid AV software and firewalls running.
It comes back to the basics: don't download/open stuff that hasn't come from a legitimate and trustworthy source. Don't go to websites that have a dubious reputation. Don't follow links or open attachments in emails unless you're extremely confident about the source, etc. etc.
If some of these things are new to you, then there are loads of helpful guides to staying safe online that a Internet Search will provide to you. Taking those simple steps is much better than ignoring them and paying for AV software.
If you're looking for a free solution, most AV providers have a free online scan that will run. Obviously it's not actively protecting you, it's only looking for the existence of dodgy files or security vulnerabilities, but running those periodically is not a bad option.