Hi Jaydigs12,
Some routers, such as the Linksys WRT54G for example, have separate MAC addresses for the WAN (what your ISP sees) the LAN (what your wired ethernet network sees) and the WLAN (what your wireless network sees). Each of these will be identical except for the last digit in the MAC address.
Moreover, spoofing a MAC address means that one is making a separate device appear to be the device that actually belongs to the legitimate MAC address in question. The MAC address would look the same, not different. What you describe is not MAC address spoofing, and would not permit an outside device to join your network by pretending to be an allowed device.
Further still, the Cloud 7. L and WS Trojan H submissions, unless they are being detected and removed by Norton during a virus scan, are simply files of interest that are submitted to Symantec for analysis. If you are finding them listed in Norton Community Watch, but not in Quarantine or Resolved Security Risks, then they are not malicious and would not be related to anything you are reporting as an issue.
Networking can be difficult to troubleshoot sometimes, so it is hard to know what might be causing web page loading to be slower with one network connection than another - expecially if you are alternating routers (although if you are using both routers at the same time you could be having a problem with double NATing). But from what you describe, it sounds like things are behaving normally (Norton firewall logs report new connections and closed connections all the time). I wouldn't be too concerned about anything malicious going on, and the best thing to do if connection speed seems to be an issue would be to try to review all of your Windows and router wireless settings to make sure everything is setup correctly.
