Something that occurs is that you could grab a copy of FileMon from http://www.sysinternals.com/ and see if you can get that to tell you which process is creating the EXE file.

Alternatively, reinstall Windows: "I say we take off and nuke the site from orbit. It's the only way to be sure."