Boot in safemode.
Run spybot.
Check startup entries in registry (hkeylocal and current user)
_________________________
Donate to UGN Security here.
UGN Security, Back of the Web, Elite Web Gamers & VNC Web Design Owner