yep, a HijackThis log would help.
it is most likely a keylogger... usual places to look is the Runkeys and Winlogon keys..