That could be the LOP spyware as it is very hard to remove, even Spybot cannot remove it.