hwclock.exe, what is this

[james636]

Guys, I've noticed in my firewall that an .exe called "hwclock.exe" is running and bringing activity to my computer (green bars in activity) well actually, at startup, my Firewall asks me do I want to allow this program to access the web, so I clicked yes thinking it was just my pc clock.

I've ran a scan and everything showed up negative. Oh and I've just reformatted yesterday. How can I found, out without messing something up, whether or not I need this running?

[Baldrick]

goooooooooooooooglE!!
http://www.bleepingcomputer.com/startups/HWCLOCK.EXE-7823.html

[james636]

I couldn't google or yahoo or anything. Just take a look at what time I started this topic and this reply to your post; thats how long I've been trying to get back to this forum. I checked startup but I can't seem to locate it to delete it. My A/V doesn't pick it up.

[Xylob the Destroyer]

A WORM/IRC backdoor as a new service, it's servicename being Hwclock.

get you some antivirus (Norton seems to work good for me) and the full-on version of Ad-Aware

[james636]

Guys after a reformatt (just last night), I noticed today that it took a hell of a long time for me to load up web pages and download updates for my A/V and antispyware progs.

I ran a scan with trend housecall online scan in safe mode w/networking and found this
http://img69.exs.cx/img69/2227/worm2fe.jpg


I turned off system restore and deleted the bastard with move on boot.

After I rebooted, my A/V realtime protect picked this up

http://img41.exs.cx/img41/9910/worm22wo.jpg


Like I said, I just rebooted last night, my firewall is set at stealth mode, and I've only been to forums boards and imageshack. So how did I get infected?