Whoever told you you do not need antivirus is a complete idiot, and as for the firewall why would you want to switch it off.
Sorry but whoever told you this knows nothing about computers.
Strictly speaking you would have been better putting this in the VISTA Forum but I'll answer as best I can.
You need one and only one antivirus program either bought or a free one, thats up to you.
I would personally have 2 antispyware programs, theres tons of free ones just pick two.
And either use the Vista firewall or get one of the free ones.
Since its Vista you are talking about you need to make sure that whatever you pick is capable of running under Vista.
Run your PC on the internet with no antivirus is tantamount to computer suicide, it wouldn't last a week.