Web filters are the first defense, as the browser is the first point of infection for almost all malware. I use Malwarebytes because it can do IP address blocking, but it seems the best defense is an adblock extension to the Web browser, and not using Internet Explorer (since all the bad guys are gunning for IE as it is the default.)
BlueCoat is pretty good, so I'll pass along the K9 recommendation, same with OpenDNS. I tend to use Google's DNS (8.8.8.8 and 8.8.4.4), but ODNS looks like it can do some additional site blocking before the bad stuff even can come across the network.
