I actually was working with Girasole and they had this happen. was going to ghost, He had a tech guy who worked on his personal computers and knew how to fix this virus issue. Below is teh e-mail on how to fix.
There are several variants of spyware/adware etc that add entries to the image file execution registry key. The key is located at:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options
Whatever programs are added to this registry key will not run. Usually they will add every program related to common antivirus software like Symantec, McAfee, AVG, etc so that you cannot update or install any AV software. They will also add common programs like regedit, msconfig, taskmgr, etc so that it is difficult to remove the virus/spyware program.
The way that I fix this is to delete the registry key and then import the key from a known good computer running XP. If you do a Google search on this registry key you’ll find a bunch of spyware/adware that uses this hack to screw up computers. The thing that gets me is that these programs are able to infect computers that are running just about any antivirus software.