svchost.exe attack from phoenix toolkit

Folks,

 

Have run NAV and it can not find an error going on, yet my daughters computer gets the message that Norton blocked an attack from svchost.exe which is trying to download a phoenix toolkit.  This program is not on my daughters computer, and I have deleted EVERY other toolbar/toolkit from her computer, removed Yahoo IM, ran a registry cleaner, malware remover, and NAV, yet I still get these messages like every 2-3 minutes.  Can anyone help me?