Usually it's users downloading garbage, but if it's on startup, RTR in
and check the Run and RunOnce reg entries (youll have to getsid and "reg
query HKU\[SID]\path\to\Run). Key may be there and may give you an idea.
Could Investigate the machine for...
