There is known malware (dont remember the name) that finds and replaces bitcoin address in your clipboard. Sounds like you are infected.
Symantec describes one called the Trojan.Coinbitclip virus, although there are probably many others. It recommends a complete system scan, but has a faster fix using a removal tool.
Personally I would remove it using a free linux live CD from another company, then get all my data off windows, then wipe the disk and reinstall windows.
https://www.symantec.com/security_response/writeup.jsp?docid=2016-020216-4204-99&tabid=2Discovered: February 2, 2016
Updated: February 2, 2016 6:51:26 PM
Type: Trojan
Infection Length: Varies
Systems Affected: Windows
Once executed, the Trojan creates the following files:
%AppData%\Blizzard\Hearthstone.exe
%UserProfile%\Application Data\hearthstone\updater.exe
The Trojan creates the following registry entry so that it runs every time Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Hearthstone.exe" = "%AppData%\Blizzard\Hearthstone.exe2
The Trojan then monitors the compromised computer for Bitcoin addresses copied to the clipboard.
The Trojan contains a hardcoded list of Bitcoin addresses.
Once the Trojan detects a Bitcoin address in the clipboard, it replaces it with one from the hardcoded list.
The Trojan selects an address from the list that most closely resembles the address it is replacing.
Both kaspersky and avira offer free CDs for scanning and removing viruses.
https://support.kaspersky.co.uk/viruses/rescuediskhttps://www.avira.com/en/download/product/avira-rescue-systemThe OP of this thread had a similar virus, and some posts in it recommend using those live CDs.
https://bitcointalk.org/index.php?topic=1780068.0