ICS should be creating a subnet behind NAT out of the box, so unless you bridged the networks somehow, something smells very rotten.

I personally would just set up the old machines on an isolated network without direct internet access, with your main machine connected to both networks. (main and dark, and set up the dark one was private and the main as public) Windows 9x and friends don't really want to see the modern internet, and you can store stuff on the main machine to share with the dark one. if you must have internet, set up forwarding and use your machine as a gateway.

All is good advice, and generally it is much easier to manage a proper router-based setup than an ICS-based one. However, I still believe that a correctly configured ICS can provide the desired security, and some tips to that end were given here.

I still don't recall seeing a definitive answer to the question:

When you say you've caught him inside your computer twice now, can elaborate more on what you observed to determine he was in fact "in your computer"? It would be fairly difficult to casually catch someone browsing a shared folder. If he's using RDP or VNC and you see him controlling your desktop, that would be dramatically more serious.

Before jumping through lots of hoops to solve a problem, it's best to determine if the problem in fact exists, and if so - what exactly its nature is. 😀

yes I did, my files where getting moved, and he changed my wallpaper on them to one that said Pwned by Adam. Adam is the roommate. But the norton rule blocked the connections 😁

Good to hear that Norton actually worked - wasn't sure honestly what to tell you regarding Norton + ICS here. Now be a good friend and print out "pwned by candle_86" and tape it to his door with an invitation to play StarCraft or something. 🤣

well I removed the gateway and dns configuration from the ME, 98 and 2000 setup's, no internet access now, just network, but I want XP to still be allowed to go online, because I still like him and he recives updates for XP embeded now so he is still secure