There may also be a hidden folder in c:\windows\system32 called lowsec, associated with the sdra64.exe infection