ok i run adawre and spybot daily, I do have the following extentiens installed
1 ) tab mix Plus 0.3.0.5
2) colorful tabs 1.4
3) fireFTP 0.94.3 ( i know i don't nead it but i keep forgetting how to do the ftp log in and this just make my life easier)
4) torbutton 1.0.4
5) talkback 1.5.0.7
and as of about an hour ago IE tab 1.1.06
All are the lattest versions.
As for my home page, it is the defult Mozilla/Google page
I don't know if it was realy paypal the ip address by the looks of my logs was 216.168.252.103 .
a back trace came up with nothing but ***.
I did end up reinstalling firefox im not seeing pay pall but their are a lot of odd ip's in my logs but seeing as thay are blocked I think I'm ok , For the moment at leat.