Worm or not?

[Kenny]

Trying to figure out why PC was locking up when using CPU intensive tasks I
started trying to identify Processes in Task Manager.
Found an entry "PDSched.exe" which is identified here:
http://www.bleepingcomputer.com/startups/PDSched.exe-2844.html
and many other sites as a worm.
I do have Roxio Perfect Disk on PC which should have a "pdsched.exe", note
the case difference, process which doesn't show, see here:
http://www.liutilities.com/products/wintaskspro/processlibrary/pdsched/
I ran updated AVG free, Panda online and Trend scans and none of them
identified it as a virus/worm.
Also have Zone Alarm free and regularly use AdAware SpyBot etc.
Until my subs ran out recently I had been using Norton Utilities with NAV
2003 and never seemed to have any problems then.

XP Pro with SP2
Asus A7N8X m/b
Athlon 2500XP Barton
512MB PC2700
Internal 120 & 160 GB and external USB 160GB HDD's.
Matrox G450 eTV graphics (this was my first suspect!)

When PC did lock up CPU went to 100%, the 2 progs it happened in mostly were
World Snooker 2005 and Changes, a program my daughter uses to show herself
with different hairstyles etc. This particular program runs perfect on hers
which is only Athlon 600MHz with 256MB and 8MB ATI graphics, (my hand me
down).
Big question is do I have a worm or not? Should I invest in a paid for
anti-virus prog, if so which one if Panda and Trend don't see this as a
risk?

 

[MAP]

Trying to figure out why PC was locking up when using CPU intensive
tasks I started trying to identify Processes in Task Manager.
Found an entry "PDSched.exe" which is identified here:
http://www.bleepingcomputer.com/startups/PDSched.exe-2844.html
and many other sites as a worm.
I do have Roxio Perfect Disk on PC which should have a "pdsched.exe",
note the case difference, process which doesn't show, see here:
http://www.liutilities.com/products/wintaskspro/processlibrary/pdsched/
I ran updated AVG free, Panda online and Trend scans and none of them
identified it as a virus/worm.
Also have Zone Alarm free and regularly use AdAware SpyBot etc.
Until my subs ran out recently I had been using Norton Utilities with
NAV 2003 and never seemed to have any problems then.

XP Pro with SP2
Asus A7N8X m/b
Athlon 2500XP Barton
512MB PC2700
Internal 120 & 160 GB and external USB 160GB HDD's.
Matrox G450 eTV graphics (this was my first suspect!)

When PC did lock up CPU went to 100%, the 2 progs it happened in
mostly were World Snooker 2005 and Changes, a program my daughter
uses to show herself with different hairstyles etc. This particular
program runs perfect on hers which is only Athlon 600MHz with 256MB
and 8MB ATI graphics, (my hand me down).
Big question is do I have a worm or not? Should I invest in a paid
for anti-virus prog, if so which one if Panda and Trend don't see
this as a risk?

Since the link below is from Trend Micro showing registry entrys this worm
creates and you have run an online scan with trend and came up clean I would
say that you do not have it.
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDBOT.CN&VSect=T

 

[Rick \Nutcase\ Rogers]

Hi Kenny,

What folder is it in? PDsched.exe should be in the Raxco program folder. A
worm would not be there, but rather in the system32 folder.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Kenny]

Thanks for the reply. Tried running the
prog with "PDSched" ended and the problem's still there.

Did a Find for this file and the only place it appears is the Perfect Disk
program.

Also followed advice here and I have none of these registry entries:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDBOT.CN&VSect=T


Looks like I'm not infected but don't understand why so many places see this
as a worm.

 

[da_test]

Hi Kenny,

What folder is it in? PDsched.exe should be in the Raxco program folder. A
worm would not be there, but rather in the system32 folder.

Unless it's a hidden file ?
Try the command prompt.
Enter CD \
Enter Dir /s /ah pdsched.exe

That command will search the entire C: partition for any files
that have the hidden attribute called pdsched.exe.

Dave