if u configure windows properly then u dont have sacrifice all ur resources to ur firewall program
. I used windows inbuilt ipsec policies in windows 2000 to block vulnerable ports completely and i never use ie so no prob of spyware . i dont even do windows update and still i never got a virus inside my pc . Just block ports Tcp 135-139 , udp 135-139 , dcom 1025 tcp/udp and udp 1026(messenger) and u are all set . This way ur resources arent sucked and u are well protected because ipsec is a part of os ... external firewall programs may crash sometimes but this wont . U can also block icmp completely using ipsec so no one can ping you .. Also u can block any protocol u want from secpol.msc 