Some additional findings I think are very interesting.
I did run the readiness tool and had the same SFC result in normal mode, it found things as before it could not repair but the list was clean.
I ran the SFC /verifyonly command on our lap-top (it has same AV and similar programs but is win 7 Home premium 64bit) and it was clean so that ruled out Kaspersky blocking activity.
Now for some reason I got the idea to run SFC at boot using the tutorial here SFC /SCANNOW : Run in Command Prompt at Boot
I used my repair CD so I started at step #3 and ran the tool at boot, much to my surprise it completed with a clean result listing "no integrity violations"
Now I find comfort in this but I am still a little confused, I wish I knew what caused this activity.
I wanted to post this as it may be of aid to someone finding similar issues
All the best -- Bill