Outpost is the best Windows firewall around. You don't need to worry about people getting into your box remotely, because nobody does that anymore. The way it works now is they have the worm/trojna/payload connect to them.
This means you need to watch what outgoing connections a program is making. Most modern firewalls do that, but to get around that, what we did was we began injecting the payload into existing and trusted apps like browsers. So what my worms used to do was force your default web browser to load a DLL file that did all the dirty work. Since most people allow their browser full access to the net (inbound and out), my worm bypassed the firewall. Nobody is going to let Notepad.exe access the Internet, after all.
And to 1up us, what The Man did was to issue warnings when DLLs were dynamically loaded, especially if the DLLs did not reside in the web browser's program folder. I don't code for Windows anymore, and in all honesty, if somebody has a problem with you, there's almost no way to secure yourself. Best tips I can give is to turn off auto-run (I used to pwn my enemies by sending them a CD that had the worm hidden on it and executed via auto-run), get something that will keep tabs on items that are being added to startup, and make sure they keep watch on ActiveX objects, because for as long as I can remember, that method has NEVER been detectable except maybe by HijackThis if you paid close attention (no one did).
