Originally Posted by Yngwie

run filemon and regmon and see what services.exe is doing. Also use process explorer to be sure that this is really services.exe that is responsible. Also use sigcheck to verify that services.exe is not a compromised version.