[H] Odd thing with a rental computer

[Thane Sherrington]

I have a computer that was a rent to buy machine.  It's paid for, but 
is suddenly booting up (as soon as I press CTRL-ALT-DEL to login) 
with a Trilock Plus screen (red screen) telling me the computer has 
been locked because a virus has been detected.  I don't think that's 
the case, but I can't figure out what file is running to bring up the screen.

Winlogon looks normal, as does Explorer.exe.  What runs that early in 
the boot process?  The run entries in the registry appear clean as 
well.  I'm assuming it's a service, but so far I'm not sure which one.

T