Since it's not malware, I won't counsel you to check the normal places, such as the Fonts folder. Did you check this registry key?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
There's a chance it could be launched from autoexec.bat, I guess, although that's kind of old-hat for system software.