Thanks for your replies before I head in to tackle this foe.

Nihil: I will try pest patrol, thanks for recomending it. I have run aaw and sb:sod (yep, updated and all that jazz) but there was no change (no ad/spy ware on the machine, user was good about using aaw)

Jinxy: Yeah, I'm the same way. The last time a machine of mine was compromised (3 years ago when i was using kazaa) I formatted my machines, changed passwords, all that good stuff. I would like to just format, but that's not what he wants.