> And we had
> customers that had downloaded the same file earlier in the day, plus we
> downloaded it and installed it to be sure.

Was this downloaded all from the same internet connection with
different machines, or different locations/offices?

If the latter, then different internet routes to your server hosting
the installer could explain the problem. I'm beginning to wonder if
there is some sort of infrastructure insertion attack taking place.
Considering the number of young people in IT today, experience is
lacking.

--
-- Richard