i don't use spyware any more, i think a firewall is enough. anyone else agree?
Absolutely not.
A firewall will prevent unrequested external connections from breaking through to your computer (or unauthorized programs on your system from talking to the internet), but it will do absolutely nothing to prevent IE from launching questionable ActiveX components while you're browsing. your firewall will just see that IE is downloading a file, but will do nothing to prevent that since IE is a 'allowed' to access the internet.
The spyware program can still install itself on your system, and gobble up resources. It may be crippled if it is not allowed to download additional components or send out information, but that doesn't keep it from running in the first place...
A firewall is better than not running one, but don't let it give you a false sense of security. You can still end up with a ton of programs running in the background that slow your computer's speed to a crawl, even if they may not be able to download the images to throw pop-up ads at you.