I'll bet he had a Spyware service installed. I'm seeing more and more of those these days. Windows Net Login for example. It sounds like a legitimate service. It's pure spyware.
My FR homepage has more detail.
You've been thru more stuff than I have, course my resume includes mostly big IBM Iron.
....excellent advice on your Home page, lots of work...I like my solution...keep Windows away from browsing the WWW.
Thanks for your homepage anti spyware advice. Great one stop guide.