As it turns out the trojan in the last post was trojan.Brepibot.L
Symantec still has no defs for it so I did a pre-infection, post-infection comparison of a fresh xp install and found the offending registry keys and files and cleaned the machines that needed it.