Microsoft added a Windows firewall to Windows XP, Service Pack 2. But it protects against only incoming data. You also need to protect against outgoing data as well.
Everything you need to know about a firewall.
My personal choice is Kerio.
Here's the manual.
Like AVG, the Kerio Personal Firewall is free.
If you want to check how vulnerable your computer is, go here and run Steve Gibson's excellent Shields Up utility.
And as long as we're discussing computer security, what are you doing to protect your computer from Spyware?
I use spybot and adaware, but the only catch stuff after the fact. I update definitions fairly regularly.
I have a very limited net circle of sites I go to, but my kid is all over the place. Some scary stuff out there!