if you haven't installed winexit.scr it is possibly an infection.
From another PC download and install these two programs and copy the the installed folders to a USB Stick.
Restart the PC in Safe Mode and turn off System Restore and run Sophos when you have completed the 4 steps run Spybot.
Download Sophos and the latest IDE Files. Install it and extract the IDE files to the SAV32CLI folder. I normally create batch Files for the 4 runs. EG: Sav1.bat cd\SAV32CLI SAV32CLI -P=C:\SCANLOG.TXT
http://www.sophos.com/support/knowledgebase/article/13251.html
Running an information scan To run a scan for information only, so as to create a log, type the following at the command prompt: SAV32CLI -P=C:\SCANLOG.TXT This will create a log of infected files, but will not disinfect or delete any infected files. You can then copy the log to a floppy disk for printing or emailing. If you run SAV32CLI without the -P command line parameter, the information on viruses will be written only to the screen. Disinfecting infected files To disinfect infected items with SAV32CLI, use the '-di' command line parameter. If a file is infected more than once (either with different viruses, or several cases of the same virus), you might need to run multiple scans to disinfect all virus infections. Do not use the command line parameter '-remove' in the same scan as '-di', as you could delete a file which could have been cleaned. If the infection on the computer seems to be progressing rapidly, back up your data to CD or DVD before attempting disinfection. The '-di' command line parameter will disinfect infected boot sectors, some infected program (.exe) files, and infected documents (e.g. .doc, .xls). So, if your computer has been infected by a number of viruses, macro viruses, and worms, shut down the infected processes (either manually, or by using safe mode with command prompt), then run a series of scans to disinfect and remove these malicious programs. Make a log of all scans. First run SAV32CLI -DI -P=C:\SCANLOG1.TXT Make a note of the number of files disinfected. Run the scan again, with a different log name SAV32CLI -DI -P=C:\SCANLOG2.TXT If the number of files disinfected has decreased, run a third scan. If it has not, or the number is '0', remove all other virus files: SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT The above scans will disinfect all files that can be disinfected, and remove the rest. During this process any infected documents will have been disinfected. Check the relevant virus analysis to find out if the virus involved could have corrupted data in the document. If you check the logs, you may well find that some worm or Trojan files were infected with a virus, so they were first disinfected, then removed.
Download Spybot - Search & Destroy 1.5.2 and install it. Update it. http://www.safer-networking.org/en/download/index.html
Take note of anything that can't be removed and check this link.
http://forum.worldstart.com/showthread.php?t=43513
If everything is OK and you think that you are clean re-enable Systen Restore.
RootKit
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
