Usually it's users downloading garbage, but if it's on startup, RTR in
and check the Run and RunOnce reg entries (youll have to getsid and "reg
query HKU\[SID]\path\to\Run). Key may be there and may give you an idea.
Could Investigate the machine for...
You are leaving our website
You are leaving our site and we cannot be held responsible for the content of external websites