My wife clicked on a popup from the taskbar saying "Windows wants to display a message. Click to allow."

A little later it said "Thank you for installing Google Toolbar for Internet Explorer." but without the correct grammar. (She only runs Chrome, but already had Google toolbar on her IE)

The install route was displayed as C:\Windows\System32\<can't remember>

I am assuming this is bad

She had the sense to immediately lift a couple of not-yet-backed-up critical documents onto a USB stick and immediately shut down.

Next time I started up the laptop, it was more or less locked running processes I couldn't find (but I'm not an expert).

I rebooted into safe mode and ran McAfee (already installed) -> nothing found
I installed Malwarebytes and ran -> nothing found
I installed AVG and am running -> nothing yet, but it's showing a number of files in User\Appdata and C:\ProgramData as being locked and not tested...

Any other ideas?

EDIT: Dell Vostro 1500 running patched up-to-date Vista

Assuming you can get on the web you could try Sophos security scan - http://www.sophos.com/products/free-too ... scans.html

Thanks, I will do once AVG stops listing all the files it isn't testing.

I think that's sorted it, thanks!

If a virus scanner hadn't of done the trick, something like Spyware Search & Destroy may have