Quote
i did find some registries with lots of numbers in there names but they were .pf files that were routed from windows/prefetch
could those be them
Its possible. It should be safe to delete any suspect files from the windows prefetch directory, according to this.
As for making changes to the registry, hard to say at this stage, so I'd leave that side of things alone rather than risk cocking it up. Although if any instances of iexplore appear here HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or here
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
they should be deleted.