Where is it being called from?

[fatboyjim]

I had a lame virus a while back, running itself on boot from c:\windows\system32\drivers\media\cat32\services.exe

So I deleted the file, and the registry call for it in HKLM/Software/M$/Windows/CurrentVer/Run called "Services"

Now when I boot I get two dialog boxes. (As attached)

Where is the file being called from? There is nothing in MSCONFIG, HKLM/HKCU or anywhere in the registry (after a CTRL+F for "services.exe" and even "cat32")

There's nothing in the 'Startup' folder either. I'm running Windows XP, where else could it possibly be calling the file services.exe?

Thanks a lot, it's getting annoying now...

[reboot]

Search the registry.
Look in system.ini as well.
It's there somewhere.
XP actually has "services.exe" being located in both c:\windows\system32 and c:\windows\system32\dllcache

[fatboyjim]

It was in HKCurrentUser/Software/Microsoft/Windows NT/CurrentVersion/Windows

in a key called "Run" listed the file c:\windows\system32\drivers\media\cat32\services.exe

Thanks for the help

Jim