Ran into the same problem on a client's machine.
Villain is "W32.Gauphin" trojan/worm. See Symantec, et al, for solution:
http://securityresponse.symantec.com/avcenter/venc/data/pf/w32.guapim.html...