I have run RR again to check this out and it does produce exactly the symtoms I am describing - a dead randomly named service with the EXE file missing, and registry entries to support the service entry. I think I can breathe easily again.
I watched the TEMP folder and TaskManager while RR was running and the file is created and loaded as a servive. According to the file properties it is another instance of RootkitRevealer.
Useful utility ....
If it is of use to other people there is a utility in the MS Windows 2003 Resource Kit (free download, definitely worth having, from MS website
) which is useful for getting rid of unwanted service entries, and removes the need to edit the registry. This resource kit is compatible with WinXP and Win2003 32-bit versions only. Win2k has a Resource Kit but it isn't free.
The command is SC.EXE (not a helpful name) and the syntax is:
SC.EXE DELETE <service_name>
SC.EXE does a lot more too, open a DOS window and try SC.EXE /? for a full list, or look at the help file.
If you have Windows 2000 you need to delete this key: