I tried every search in the registry for C:\documents and found nothing. Then msconfig to check startup programs and processes, nothing. Autoruns gave more detail but still nothing that remotely looked like the culprit until I knew what to look for..
BTW, Symantec Endpoint found the trojan which apparently put a file called "lsass.exe" in the dir " C:\documents and settuings\administrator\application data\**
" and an associated registry entry to run the executable.
I deleted the file/registry entry via Autoruns and that solved the problem. Apparantly Endpoint had deleted everything else that the trojan did but this leftover dialog box at every boot was getting annoying.
You can download Autoruns here : http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
It's a free program that when you run, you'll see the registry entry for lsass.exe pretty close to the top.
Good luck and I hope it works for you as well ! Let me know, Frank
P.S. the "application" dir is hidden so you have to set your file options to show hidden files and directories. I also noticed that the date of lsass.exe was the same date that I got the trojan !