1. Run regedit.
2. Search for "runonce" from the root level (there are many instances of runonce, keep searching until you can't search no more. See what is loaded in "Run" & "Runonce"; typically, these hold the programs it runs at startup.
3. Delete any key that looks suspicious. Careful ...
Also, consider
www.lavasoftusa.com . Something called Ad Aware 6.0. Personal (Free). It'll probe yer system. But be warned. Ad Aware probes DEEPLY, very very DEEPLY ... *snicker*