[link|http://info.astrian.net/jargon/Hacker_Folklore/The_Meaning_of_Hack.html|http://info.astrian....ning_of_Hack.html]
Look at the last story.
Sadly, this behavior seems to be catching in the Windows field - last Thursday, I had a person who reported massive popups on internal sites, extremely slow system performance, etc., etc., ad nauseum, ad infinitum. Suspecting spyware, I ran Spybot S&D+Adaware in an attempt to nip this turkey in the bud. Neither got it, due to the "dual process" nature of the beast - it had two processes open, and if one died, the other restarted it. Took a boot to "safe" mode + lotsa reg hacking to get it out. :P