Windows XP includes a Firewall to protect your system against unwanted "visitors" from the
Internet , but it does not control connections from your system to the Internet ( to control
the "calling back home of XP" or a virus/worm trying to spread itself ).
To control outgoing connections, you need to install a non-Microsoft firewall, there are several
packages available on the web
more details
http://www.windowsnetworking.com/articles_tutorials/wxpzonea.html