I have run RR again to check this out and it does produce exactly the symtoms I am describing - a dead randomly named service with the EXE file missing, and registry entries to support the service entry. I think I can breathe easily again.
I watched the TEMP folder and TaskManager while RR was running and the file is created and loaded as a servive. According to the file properties it is another instance of RootkitRevealer.
Useful utility ....
~~~~~~~~~~
If it is of use to other people there is a utility in the MS Windows 2003 Resource Kit (free download, definitely worth having, from
MS website) which is useful for getting rid of unwanted service entries, and removes the need to edit the registry. This resource kit is compatible with WinXP and Win2003 32-bit versions only. Win2k has a Resource Kit but it isn't free.
The command is SC.EXE (not a helpful name) and the syntax is:
SC.EXE DELETE <service_name>
SC.EXE does a lot more too, open a DOS window and try SC.EXE /? for a full list, or look at the help file.
If you have Windows 2000 you need to delete this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service_name>