without knowing what he means by a "text box" you could run all the anti-hijacking software around and it might just be windows messanger service left running. i also think its adware but wouldn't a picture be so much easier?