Disinfectant is free and was king of the anti-virus apps when 8.6 and 9 were all the rage. I run it occasionally, just to give its electrons exercise. I can't imagine there's much out there trying to attack OS 9. Don't pay for an anti-virus app.
iCab or OS 9 is a pretty good browser. It's supposedly up to date with security issues. JavaScript is flakey, but that's not iCab's fault. The version of JavaScript for OS 9 is too old.
I generally run
WaMCom's version of the Mozilla browser. WaMCom is a third-party build of the open-source Mozilla, and it moved the version up to 1.3.1 from Mozilla's 1.2.1, after Mozilla stopped development for OS 9. Security is better than Mozilla's 1.2.1 version. (The WaMCom-page download link is to a newer version than the patches link beneath it. Ignore the patches link.)
JavaScript is as flakey as it is with iCab. But each browser's flakiness is different, so a site that causes trouble in one browser might not in the other.
I prefer Mozilla over iCab because it accepts a few add-ons meant for OS X's Firefox and SeaMonkey. I'm running Adblock, Mouse Gestures, the Preferences Toolbar and SmoothWheel.
If you go this route with WaMCom and want to try the extensions, you first have to install these two add-ons from the Firefox/Mozilla site:
Extension Uninstaller API 2.0, then
Extension Manager 2.0, and in that order — the Uninstaller first.
Without the Extension Manager, you won't see the other add-ons (they show up under Tools). But without the Uninstaller, you won't see the Extension Manager. But the Uninstaller must be installed
before the Extension Manager, or neither will work.
If you install any add-ons, do each one at a time, and after each one, quit and restart the browser. It can't handle a batch load.