Although I will admit I am biased against ZoneAlarm due to prior problems I've had with the product in the past, the July 2008 MS Security patch related to a DNS exploit does not 'play well' with the ZoneAlarm software. It is highly recommended that you
download the updated version of ZoneAlarm from here before installing the security patch from KB
951748.
The initial knee jerk reaction to this problem might be to uninstall KB
951748, but I would advise against that due to the fact that there is an updated version of ZoneAlarm available.
Personally I am more of a fan of
ESET's security suite and I have also had good experiences with
Comodo's personal firewall, which is free. Of course, despite having a bit of a bad reputation in the past, the built in Windows Firewall isn't half bad these days either. You can even do per-process outbound blocking with Windows Live OneCare and the updated firewall in Vista and Server 2008 is much more feature-ful than what was included in XP.
Currently I'm "dogfooding" builds of the Forefront Threat Management Gateway at home on my EVDO connection and all the devices in our home are the clients. It is what would normally be called ISA 2008 or ISA 2009, renamed. The differences between ISA 2004 and ISA 2006 were pretty minimal, overall, for a compelling reason to upgrade from 2004 to 2006, but this version has a lot going for it, including Snort-like blocking signatures and other additions.