Threat Summary. dirsize.dll, dsschat.exe, fsviewer.exe, logonuifix.exe, notepad.exe

The result of free antivirus

Created by anti-spyware software WinDetect:

Version: 2.10.0

Possible suspicious files:

%win_dir%\system32\dirsize.dll
e:\dsschat\dsschat.exe
%program_files%\fsimgviewer\fsviewer.exe
%win_dir%\system32\logonuifix.exe
%win_dir%\system32\notepad.exe
%win_dir%\notepad.exe
%win_dir%\system32\drivers\sptd.sys
%win_dir%\system32\drivers\tcpip.sys
%win_dir%\system32\uphclean.exe
%win_dir%\system32\vcsdel.dll
%win_dir%\system32\3d windows xp.scr

%win_dir%\system32\dirsize.dll

The file does not contain company name.
File checksum is 823DEFEC596B8256739D9A328EA87486.
Loaded to %win_dir%\Explorer.EXE.

e:\dsschat\dsschat.exe

Company is bn2(0.9.6.4).
File checksum is 9E88AA07A1061E37430E7020130567BF.
May get commands from the Internet on port 8167.
May get commands from the Internet on port 1027.
Windows Explorer starts it automatically.
Registered as vcs_autorun.
May connect to site http://www.vypress.com.
May connect to site http://www.trichview.com.
May connect to site http://home11.inet.tele.dk.

%program_files%\fsimgviewer\fsviewer.exe

The file does not contain company name.
File checksum is B5D03EBFF05D9670EBF329A31A2F62ED.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.

%win_dir%\system32\logonuifix.exe

Company is Корпорация Майкрософт(6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)).
File checksum is D4173229D06FF9959C970661A9E776AC.
Spoofs the system process.
Was not detected by anti-viruses.

%win_dir%\system32\notepad.exe

The file does not contain company name.
File checksum is 8A7ED59B33AA178A4CAAB61C2AE579BF.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
Detected as BC.Heuristic.Trojan.SusPacked.BF-6.A by Clam AntiVirus.
Detected as not-a-virus:Monitor.Win32.KeyLogger.oo by Kaspersky AntiVirus.

%win_dir%\notepad.exe

The file does not contain company name.
File checksum is 8A7ED59B33AA178A4CAAB61C2AE579BF.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
Detected as BC.Heuristic.Trojan.SusPacked.BF-6.A by Clam AntiVirus.
Detected as not-a-virus:Monitor.Win32.KeyLogger.oo by Kaspersky AntiVirus.

%win_dir%\system32\drivers\sptd.sys

The file does not contain company name.
The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
Starts at system boot.
Registered as sptd.

%win_dir%\system32\drivers\tcpip.sys

Company is Microsoft Corporation(5.1.2600.3311 (xpsp.080211-1047)).
File checksum is ACFB10506A8331CF12D7D880DD6CA998.
Runs at start up.
Registered as Tcpip, Драйвер протокола TCP/IP.

%win_dir%\system32\uphclean.exe

Company is Microsoft Corporation(1.6.30.0).
File checksum is 3F9A3232E5F942874488981F3242C989.
Registered as UPHClean, User Profile Hive Cleanup.
May manipulate kernel objects.

%win_dir%\system32\vcsdel.dll

The file does not contain company name.
File checksum is 7D77FD45340F5F9B466A898BA43FE0AE.
Loaded to E:\DSSChat\DSSChat.exe.

%win_dir%\system32\3d windows xp.scr

The file does not contain company name.
File checksum is 6F05DED5D6A2333268BECF9D4C72874B.
Screen saver.