Help, my computer was hijacked!

Found a rogue user acct on my winXP -- ran all the tools according to Read & Run Me First instructions (except that I couldn't run Microsoft Malicious Software Removal in safe mode, so I ran in normal). Some of the reports seem to indicate that my anti-virus and firewall were disabled. I am still unable to update windows.



hjt attached

 

Forgot to add, last bdfscan found no viruses. Attached is last activescan

 

Thanks. I've been continuing to scan, going through your steps and then some and I think I have a better idea of what happened.
According to the TrendMicro scan, I have an ASP.NET Path Validation Vulnerability. Coincidentally, the rogue account was called "ASP.NET ACCCOUNT"

According to Spybot, it looks like the invader disabled Antivirus & Firewall and disable notification. HKEY_LOCAL...Windows Security Center AntiVirusDisableNotify and FirewallDisableNotify

I think I've kicked him out and set up more secure firewall and antivirus, but it's still very scary. How can I be sure he didn't leave anything nasty behind?

I'm attaching my most recent logs, if you wouldn't mind taking a quick look just to make sure.... (I have financial information on this computer, which I have to assume may have been compromised.) I appreciate your help

 

here is the hjt scan