Firewalls can't protect very well against things like viruses or malicious software (malware). There are too many ways of encoding binary files for transfer over networks, and too many different architectures and viruses to try to search for them all. In other words, a firewall cannot replace security-consciousness on the part of your users. In general, a firewall cannot protect against a data-driven attack--attacks in which something is mailed or copied to an internal host where it is then executed.

Alternate Answer:
Properly configured firewalls can limit the propagation of worms - a form of malware.  Typically, firewalls are edge or parameter devices (separates network zones) and most viruses and malware targets end points (user workstations and servers).