I always hated ZoneAlarm. Earlier versions would cut off all internet access when it asked you whether you want to let a not-yet-authorized program connect to the internet. That meant that if a trojan tried to connect to the internet while doing its thing, it wouldn't succeed, but it would successfully interupt your access to the internet, anyway.

Also, many of our network problems (a home network) would frequently get traced back to ZoneAlarm being overprotective or just not working right (even blue screens on my dad's Win2K computer).

I prefer Tiny Personal Firewall.