Guys who use "common sense" probably are rootkitted, botnetted, and java-exploited like a mother fucker without realizing it.
If you're using Windows, use some protection. I use Avast as a real time/boot time if I really need to scan the fuck out of my computer, Malwarebytes as my main scanner (not in background), and SpyBot as a second opinion scanner. Avast is the only thing that runs in the background (with a 6600k and 32gb of RAM there's no reason not to have one running), SpyBot and MB are just there for scanning purposes.
You should only pay for anti-virus if you run a business and would be a potential target for a DDoS or make purchases, Avast supposedly has a sophisticated system for isolating purchases and monetary uses away from all other functions of the computer. However, I've never used it myself.