Winrar
Wrong! This is not 1997, it's freaking 2011 you old gizzard!!!
If you have v3 or higher, then it'll use AES 128bit, which given a long and strong password, should provide enough security.
How long is overkill and how short is too short? I am using a paragraph of about 4 rather long sentences out of a book.