Well KW,
Start in the normal places, hkey/local and current user run. Don’t forget winlogon/notify.
Check the IE addons.
Run hijack this to look for stray exe’s and dll’s that could be the culprit.
Sorry, I would have recommended the registry diving earlier, but only if you’re comfortable in there.
Rick
Universal