Rather than using windows update, download the IT department version of SP2 from Microsoft Technet. Burn it to a CD and update to SP2 on a clean install of XP. Don't connect to a network or the internet until the SP2 update has been installed.
>>Good advice, but having tried unsuccessfully to clean a friend's computer of nasty spyware and trojans, the only real answer is to backup all the crucial data and reinstall XP.<<
Did you shut down java and active X while you were working on cleaning it up. If not, you can't succeed because the trojan will continue to script itself.