according to the sophos log file, it reports windows update files, possibly, which will be copied to a temporary folder while installing any update manually.
and, i think, the temporary files are ok.
can you do a scan using hijack this (get it
here) and post log here: use additional options and upload log file.