Roxiocreator Business Edition 10.1.177 Pxbdq.dll ?

[JackSprat]

Windows XP Prof SP3, RoxioCreator Business Edition 10.1.177, roxmediadb10

 

I hope this type of question is allowed .

Alternatively, a list of all processes/dlls that the software should be running is something nice to have.

 

I have the Roxio software preinstalled on my Lenovo (circa 2010) T400 profess. laptop.

 

I noticed a supicious new file that was running (via XP startup) while trying to remove a stubborn trojan.

The file is "pxbdq.dll".

The file was located in \documents and settings\(user)\local settings\application data\roxio\microsoft help.

The normal method of a google search to indentify a DLL turns up absolutely nothing.

 

I say its suspicious because I never noticed it before ( I check my XP startup config often to weed out unneeded stuff) and also the file didn't seem to be present in disk backups before I had the trojan problem (and I haven't updated roxio).

 

Is this dll/process a part of roxmediadb10 or not?

[cdanteek]

What happens when you right click, properties on the pxbdq.dll, and look at the details?

 

Most here run retail Roxio software and I don't see it on any of my boxes.

 

I like your user name!

 

[sknis]

Did you ask Levono if it is something they can identify?

 

When you got rid of the trojan, did you clear the restore files? Sometimes they hide in there so when you use restore, it shows up again.

[Brendon]

I say its suspicious because I never noticed it before ( I check my XP startup config often to weed out unneeded stuff) and also the file didn't seem to be present in disk backups before I had the trojan problem (and I haven't updated roxio).

 

Is this dll/process a part of roxmediadb10 or not?

 

Checking your startup is a very good practice. A DLL which is loaded directly in startup is very suspicious. I'd remove it.

It's not a Roxio file. Like Cdanteek, I can't find it in any of my boxes.

 

You can send suspect files to jotti.org or virscan.org for an automated malware scan which might identify it, but I'd still remove it even if those sites can't identify it for you.

 

Brendon