Malware (not a virus) can't be running at login, because there is no access to system resources until somebody logs in.
Hi Kurt, I can't say why this is happening, though I agree it's extremely unlikely to be malware. But I disagree; the system is up and running well before login. A rootkit, or backdoor from a Trojan, for example, (not that I'm saying this is what is happening) would have access to system resources before login.
Seems related to the wife's user account. Only happens after his wife has logged in. I think it is very unlikely to be a Permissons issue. And, if it is related to his or his wife's user, Permissions repair wouldn't even touch that.
Just a guess, but perhaps this is coming from a corrupted cache. Might try running Applejack.
Download:
http://sourceforge.net/projects/applejack/
Article on using:
http://reviews.cnet.com/8301-13727_7-10334620-263.html?tag=mfiredir
It runs in single user mode. After installing (you won't see it in the Applications Folder) hold CMD-S at startup. You will get a black screen with MS-DOS like text. Just follow the prompts: type in "applejack AUTO" and it will run through the following:
Correct any Disk problems.
Repair Permissions.
Clear out Cache Files.
Repair/check several plist files.
Dump the VM files for a fresh start.
Trash old Log files.
You can also run tasks selectively and for specific users by typing in "applejack." After running in "AUTO," you can go back and run it again as "applejack," steps 3 & 4 only, for your user.
The first reboot will take much longer than usual, as it rebuilds caches. It may take several restarts to see the benefits. Because of the deep cache cleaning in AUTO mode some applications may tell you they are being opened for the first time.
NOT YET UPDATED FOR LION
(Adapted from post by BDAqua)