value:  SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7 by creating a shim database to patch services.exe. 
name: Event Triggered Execution: Application Shimming