I would
not rely on XPs firewall. The XP one
does not monitor outgoing traffic - incoming only. So, if you have an infection, it could be sending out your details without your knowledge. A router seems to be preferred by the hardware guys and it will give you an extra layer of protection. Other than that, try one of these free firewalls
Sygate Personal Firewall
ZoneAlarm
Tiny Personal Firewall