First, run the computer as a limited user account. This will prevent the installation of software. Never run as an administrator. PadreSJ says that the #1 cause for all the bad stuff is the user, so if he could take himself out of the equation, then he doesn't need to spend money securing the system. He also should make sure his modem isn't plugged straight into his computer. Use a router in between.
Sean should make sure to install updates and patches. Every Tuesday is Patch Tuesday for Microsoft and he should always have automatic updates turned on.
His behavior is a very important aspect of this as well. Sean will be the last line of defense in keeping his system safe, so avoid things like clicking on unknown links, opening attachments, and going to untrusted sites.