I'm getting popups that start with ad. or ad1.XXXX and nothing seems to find them in a scan... It's on one of my users machines, I've built another machine for the user and will soon have the machine in question in the shop for furthere analysis....
I just downloaded ewido and it seems to pretty good, I'm gonna have to try it out on the users machine