Best answer by Rakanisheu
Confirmed its Webroot, thanks for the info. Webroot must have found something in its initial scan and radomised its install name and path.
Sorry to ask you to get the logs I just wanted to be sure.
WRSVC REG_SZ "C:Program FilesHWXOcFcMUBXkpwPZ.scr" -ul
Directory of C:Program FilesHWXOcFcM
12/27/2012 07:52 PM <DIR> .
12/27/2012 07:52 PM <DIR> ..
03/29/2013 02:09 PM 729,528 UBXkpwPZ.scr
File size, service name and time stamp are the correct.