Sounds a bit like a hijacker from your description so...
I would advise HijackThis (usually on the PCA cover disk) and you can get help automatically click here by pasting the logfile output or click here, its in English and German, or click here.
I have never used Ewido but seen it recommended on this forum click here.
Or you could download the Trend Micro cleanup engine click here and the latest pattern file click here and use this; I find it good if long winded.
I would also suggest you ensure your father has a firewall (MS SP2 or Kerio click here or Zone Alarm on the PCA disk) and either MS AntiSpyware or its replacement Defender.
You could also download A2 Free click here and run this.
Hope this helps, best of luck.