Please check out ESET's free online on-demand scanner.
TL;DR / rant section:
|2||added eset link|
So, in addition (with some overlap) to all the great responses to this question, i still like to say this...
Think of your computer/private network as a country... If you have a country with valuable resources (aka. your private information, etc.) would you leave your boarders open when you see an army surrounding them? would you let anyone walk into your home if you were told that there was an assassin looking to take you down?
TL;DR / rant section:
Antivirus is one of the multiple layers of security that one should establish to keep themselves secure. Like many others have stated, it protects you from implementations of vulnerabilities that have not been mitigated through the respective application's mechanisms. AV mitigates threats out-of-band. These non-patched vulnerabilities, aka. zero days (O-Days) can be used for leverage to gain access to your machine.
As, i alluded to before, there are many other layers of security that should be in place. These layers include OS Updating, firewalls, anti-spyware, and depending on your intended level of security there can be many more.
If your system is compromised (which from the sounds of how opposed to security you are, i wouldn't be surprised), not only could the attacker cause you annoyance while you are using your system, but they could then use that compromise to do much more behind the scenes. The idea of persistence comes to mind. By that I mean that the compromise may result in your other security layers being also compromised to better hid the attacker's activities. That attack may be used to gain financial information about you, steal your identity, gather your password information to all of your online services, pivot onto your private network, stage attacks against other machines, and anything else that the attacker can think of. Many times the owner of a compromised machine that is used in an attack against another system (lets say in an hactivist attack or an attack on a government system) may be held accountable.
So, not only could you risk your credit and reputation, but also you may risk prosecution.
Additionally, if you do your research you can easily get an anti-virus solution that does not hog your system. And I don't believe that I've seen a false-positive from my antivirus solutions in the last year (aside from intentionally downloading exploits or penetration modules). There are also many solutions out now for doing virus scans via a browser plugin. This method still gives you the benefit of scanning your computer against that company' virus database, but segregates it from your system more than the tick client (also, it helps if you want to run multiple anti-viruses).
This being said, I, for one, rarely use an Antivirus solution. But I am currently working in the security field and I do not store PII or connect to any authenticated services without an antivirus installed. Like someone else said, i am constantly looking at my running services, my iptables setups, my inbound/outbound traffic and ports, etc.... and that's on machines that I have no valuable information on.
As for your firewall comment, an anti-virus and a firewall are two separate entities. Both of which should be used. Please don't tell me that you're not using AV or firewalls. I can't remember what study it was precisely , but i believe the statistic was that your computer cannot sit on the internet for more that 10 minutes without being attacked. Granted simple security stems will mitigate most of these threads posed by simple web crawlers looking for vulnerable machines that are easy pickings.
If you want a more simple explanation, here it is... it's one more way to keep your what you have out of the hands of thieves. Why would you not use an anti-virus when you can easily get a free application which has little false-positives and little performance impact. Most people that i deal with are infected because of what we call "Internet Drive-Bys" (which is a whole separate topic to discuss). And none of the best practices that you say that you employ would sufficiently protect you from these attacks.
The name of the game for most of security (though fairly short sighted) is to make deter attackers enough that they target someone more easy to win against. from what I've read, you're making yourself this target, please do something about it.
that came out more as a rant than a well-structured response, i apologize