Windows XP's built-in firewall is good enough to keep your computer protected from attacks
from the internet. The only problem is that it can't protect you from sending unwanted information out of your computer. So, you need a 3rd party firewall to monitor outgoing connections.
If you want to see what I'm talking about, go to
Steve Gibson's Shields Up! website, and scan your machine. Then download LeakTest and see that your connections can be sent out without your knowing.
I've had problems with the recent version of ZoneAlarm, so I've been using
Tiny Personal Firewall. It's smaller, just as good, but a little more cryptic.