Here is a good article about connecting computers to the internet. It details how Unprotected PCs can be hijacked in minutes.

Basically, if you connect to the internet at all, using a cable modem, DSL, dial up modem, anything - you MUST be running updated anti virus, updated anti-spyware, and using a firewall of some sort.

If your firewall is not configured correctly, it is just as bad as not having one. For the record, the firewall included in XP is fine as long as you have upgraded to SP2 for Windows XP. I would still get a hardware firewall and just plug it in between the internet and your computer for safety, however. Read the article - it is important to know just how quickly your system can be infected or taken over by spammers, hackers, or other nasty types. As little as 15 minutes in some cases.