Norton Symantec Security Response gives details on location and how to correct.
Also in addition to the typical locations of viruses that I provided you, you may also want to go into the folder C:/Documents and Settings/User/Start Menu/Programs
Look for any unusual programs and run the scan feature.
I've seen a new Aurora variant the past week or so that is terrible. Its pretty much a back up what you can and reload windoze. It gets past NAV and Macafee even with current defs.
All hail windoze! Hahah on a side note Microsoft is having all kinds of hell with its new validation tool. Good luck getting critical updates if you have to reload.
IP_SEC Aurora can get by Norton Anti Virus but it does not get past Norton Intenet Security. This is because "this risk can be detected only by Symantec products that support security risks".
It's a good guess and a good call on the type of infection IP_SEC.