"Installer Center" service on XP, malware?

Found a suspicious service running on some XP machines I maintain at one of our local primary schools, picked up by Kaspersky TDSSKILLER as hloeignzq and file C:\Windows\System32\xlevcb.dll, did a full Sophos scan but nothing reported, using Sophos Enpoint Security and Control 10.0.

Looking through the registry links it to "Installer Center" service with same description as Secondary Logon service, but there is no file called xlevcd.dll in System32 folder so unsure if this is a remnant of some uninstalled software but it just looks suspicious.

Anyone come across this service running on XP machines before or know what it is?

Thanks.