Malcolm,
>I would ask your customer to export all 3 of their NT event logs and send them to you. I've had similar (but not identical) "strangeness" happen and the NT event logs were the key to tracking down the problem.
I don't see anything in either application, security or system logs that corresponds to this phenomena.
I take back one thing I said before... at least today I can see the task come up as an imagename on the processes tab in task manager... these things ought to be coming up as applications though.