XP does have a firewall in place except that it only protects you from the inbound threats.** What you need is a firewall that protects you from both inbound and outbound threats.
Outbound as in a trojan, XXX dialer etc. The XP firewall does not have this so you will not be protected.
A third party firewall will give you the outbound protection (as well as the inbound).
**Whilst you'll probably never get hacked, the XP firewall is not good as it only has the inbound protection.
Windows XP Service Pack 2 is apparently going to have an updated firewall so that it has both in and outbound protection. So until then you need a third party firewall.