ZoneAlarm is a nice Firewall
ZoneAlarm Free is a crappy firewall, worse than Windows Firewall in my book
Comodo is the best free firewall. Beyond that either MSE or Avast! for your AV (depending on your preference. Avast! has a bigger footprint, but more proactive protection, MSE has the edge on having a small footprint and better after-infection removal) and Spyware Doctor for antispyware. Spybot is good for the hosts file modifications it makes, and if you want to put MBAM on there too, nothing wrong with that.
If at all possible, DON'T install Java on the computer. Block Java.com to keep your family members from installing it. If they need Java, however (for either a program or a website), see below:
After that, For simplicity I will explain with Firefox (mostly everything can be done with other browsers):
1. Install Firefox
2. Install Adblock Plus
3. Install NoScript -- Script blocking will probably annoy the heck out of your mom and brother, but our reason for getting it is to use it for plug-ins on demand:
Go NoScript -> Options and under general set scripts to "Scripts Globally Allowed". Next go to the Embeddings tab. Make sure Java is forbidden, and maybe Flash too. Check "Apply these restrictions to whitelisted sites too". Now both Flash and Java (two of the three most dangerous browser plugins) are on-demand rather than instantly loading.
The third most dangerous plug-in (actually THE most dangerous plug-in, but it sounds weird to say that when I already mentioned the other two most dangerous browser plugins) is Adobe Reader. Think about installing an alternative PDF reader.