Hi,

maybe in the company there’s some sort of group policy in effect ?
or some logon-script or something in HKU/default ?

can you post the HJT-Log or is it confidential ?? edit out the private/company stuff.maybe