[wizbones]

If this user opens the one Spreadsheet, then saves it as something else does the same thing happen?

I would also suggest ensuring they are using the latest and greatest virus definition and check for a worm or the like.

Does sound very strange. Look at the properties of the shortcut, what's in the program line? There may be some extra code in the line creating the shortcuts?

Curious to hear more on this.