Malcolm,

>I would ask your customer to export all 3 of their NT event logs and send them to you. I've had similar (but not identical) "strangeness" happen and the NT event logs were the key to tracking down the problem.

I don't see anything in either application, security or system logs that corresponds to this phenomena.

I take back one thing I said before... at least today I can see the task come up as an imagename on the processes tab in task manager... these things ought to be coming up as applications though.