Vista - Questionable File: HPCEE.exe

I have found what I term a questionable file:
C:\\ProgramFiles\hewlett-packard\sdp\ceement\HPCEE.exe, related to
C:\\Windows\tasks\HPCeeScheduleforkaryn.job. On 9-15-09 Windows Defender
flagged this for potentially unwanted behavior. On 10-01, this program,
HPCEE.exe was "preparing to access the internet" according to Norton
history.

On 10-13, I happened to be looking at Task Scheduler Library. I found a
scheduled task triggered by time: 6:02 PM 10-15-09; last run: never; author
of task: me; purpose: open a program:
C:\\ProgramFiles\hewlett-packard\sdp\ceement\HPCee.exe. This task was
scheduled to run every 6 days for the next 30 days. I suspected a virus or
intrusion of some sort. I never created that task. I called HP technical
support and the agent said it was not a legit HP program. He suggested
uninstalling my whole os. Seemed overkill. I just disabled the task.

After some Google searching and reading at forums, it appears that it is a
legit HP program file, but I suspect it was hijacked. I would appreciate
any input on the purpose of this program: HPCEE.exe, and if this was a virus
attack. Also I wonder if there is anything else I should do. Where was my
Norton?

I have Vista 32 bit, sp2, running Norton 360 antivirus and firewall and WD
malware as well. Thank-you. KC

HPCEE.EXE is not digitally signed. That's one bad for HP.
It sounds like Norton could use better tech support. Score is tied.

It's a toss up. Call Norton and INSIST you upload the file for them to determine if it actually is a virus or not. I'm betting it's a legit file by HP, but no use taking chances.

"Karyn C" <Karyn C@newsgroup> wrote in message
news:A77F9DCB-4E26-4937-ACBE-63453D355799@newsgroup
Send your suspect file online to'
http://www.virustotal.com/

They will test the file and you should see a result
in a few seconds (more or less)...let us know!

hth

'Seek and ye shall find'
NT Canuck

Thanks for the link. Virustotal says it's clean. Interesting, it is a legit
HP file: HPCEE stands for Customer Experience Enhancement. I still think it
was hijacked with the scheduled job, but that file doesn't exist since I
disabled the job. Guess I should just stop worrying. KC

"NT Canuck" wrote: