ok, what scans showed up negative?

At the risk of being redundant....did you make sure all definitions for your spy killers were updated?

Did you try with another AV scanner? It sounds like your Norton may be sick... there was a rumored exploit some time back that was rumored to erase some of Norton's files. I don't know if it is true or not. If you have worms and virii, which, going by the ports you listed above, your spy killers won't get them anyway.

Also, once you think you have your firewall working, go to the following link:
https://grc.com

Run the shield's up probe for common ports. Tweak your firewall, then run again.