Spyware question - prevention

My father's PC had 27 trojans on it. I got it all cleaned up, primarily with the sticky thread you have here and reading/researching.

Everything is back to normal on his PC excepting for his email (Outlook Express 6.0 & his email is a msn.com address). My nephew is going to look at that for me.

I have downloaded AVG and ZoneAlarm on his PC. I also have installed Adaware, Spybot and CCleaner. Essentially, I have done everything that your sticky on how to prevent malware.

He has a DSL that he connects to the internet with. Since the discovery of the trojans, he has been powering down his PC each time he is done using it instead of leaving it on constantly.

My question is in regards to the best protection I can set up for him. I am guessing, but I think because so much junk got loaded onto his PC and nothing was done to clean it up and prevent further garbage, this PC has become a target for more attacks. (Similar to the elderly person that gets hit via a telemarketer then becomes a target for more of them).

ZoneAlarm is blocking a lot on his PC, much more so than I've ever seen on my PC (I use ZA also).

With Christmas around the corner, I am considering buying him a hardware firewall. Is this a necessary piece of equipment for ultimate protection? I can keep up with updating and scanning up PC, but I am not convinced he needs a hardware firewall, perhaps the money would be better spent on a new PC (his is a 7 year old w/ Win98).