My antivirus is my brain. I use disposable VMs in QubesOS (not connected to the Internet) when opening sketchy PDFs and other documents. I rarely open attachments from email these days, but when I have to, I do it with extreme caution.

Antivirus products these days are not very privacy-aware and most of them upload personal documents to the cloud for 'analysis'. Now and then I run ClamAV on my friend's computers to clean up spyware & trojans, but that's it. Rootkits are a bigger problem though and not so easily removed because of persistence, but they can be removed by doing a clean install or just using a brand new (known clean) VM disk image.