Software

[1]
win.ini
[windows]
run=
load=
system.ini
[boot]shell=

[2]
root directory:Autoexec.bat

[3]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce ,runonceex,runservices,runservices-,runservicesonce,...and the like
[3.2]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run,run-,runonce,...and the like.

[4]windows startup

[5]
in msconfig start up ,there is sometimes filenames similar(like) to the normal filename .
for example
normal:c:windows\scanreg.exe
bad:c:windows\system\scanregw.exe
......

You can also download a free software called 'ad-aware' from download.com and install it on the
problem PC. This program cleans the computer of
any hidden spy softwares like the one you mentioned.
While running it you might come across other hidden programs nobody's aware of. I suggest running it periodically for maintenance and security reasons.

I don't know if this will help but I encountered a similar problem with a popup called Britney's dorm cam....It turns out they had written it as a windows recovery file named winrec.exe it was stored in the winnt system 32 file in windows xp. I deleted the file (after making a copy on a floppy to be sure I didn't need it) and the popup finally stopped. Good luck.

Try 'answer 2' (AD-AWARE) first i'd suggest: by far the easiest and safest. And a good program as well :)