I've got a client who called me about his PC running slow since it came back from a DVD replacement at a major retailer (who shall remain unnamed). As he described the problem, it's obvious that WinAntiVirus 2006 is the problem. He's thinks the retailer's repair guys screwed it up, though I'm not sure. But I'd like to be sure, thus my question:

Is there any way of telling when a rogue app (or any app for that matter) got installed on a PC? In my experience, time stamps aren't always indicative of when an app went into a PC. Would the application log indicate when something like WinAntiVirus got installed?

Thanks...