Malware use new method to active on next reboot in Windows XP

While doing removal with "antivirus 2010",I have found a new method to active malware on Windows startup.

C:\WINDOWS\winSxS\x86_Microsoft.Windows.Shell.HWEventDetector_6595b64144ccf1df_5.2.2.3_x-ww_5390e909\shsvcs.dll

NOD32 detect as Win32/Sirefef.CB

http://www.threatexpert.com/report.aspx?md5=53243938af9118b8d674a5f82ea43d19

We all know a malware must be active on the next boot and we know lots of Registry startup items which AutoRun scans.

the file shsvcs.dll will run on windows start and create vbma*.sys.

So that TDSSKiller could not delete vbma*.sys file after reboot

 

It looks like on a clean machine that this dll should only be in system32 and SysWOW64 if you have a 64 bit machine. I'm not finding much other info on it. It looks like you could block it with SRP by only allowing it to run from the locations I specified and nowhere else, if I am correct in assuming it shouldn't exist anywhere else.