Wouldn't hurt to post a Hijack This! log to us, If you can't get it from merjin or any other site because they are blocked, PM me and I'll ship one over.
Check this out
Also, there is no restriction on what a BHO can do your system; it can do anything any other program can do: read or write (or delete) anything on your system. Usually, software is installed on your system explicitly by you; when you do so, you are, in effect, saying that you trust the vendor. BHOs, however, have a history of being installed without the users knowledge (fine print notwithstanding)
from http://www.definitivesolutions.com/bhodemon.htm

(not recommending the software at the page, just referring the BHO info)

Maybe a BHO in the HJT log will find us a culprit. It would run whenever IE is run.