I have an extremely security paranoid client that insists on running everything available. He has a router, ZA, and has enabled the XP SP2 firewall. I tried to tell him AVG, XP SP2 firewall, and AdAware Personal were enough to stop stuff, but he insisted on running ZA.
Well he since had to rebuild his computer because he got a TON of spyware. I prefer a hardware router/firewall solution as well. Enabling the XP SP2 firewall has proven useful as well. Generally stops network borne viruses from spreading from machine to machine on an internal network.
-Chris