Created by anti-spyware software WinDetect:

• Version: 2.10.0

Possible suspicious files:

• %user_profile%\appdata\roaming\ebe3.exe
• c:\recycler\s-1-5-21-0243556031-888888379-781863308-14699\brenasa.exe
• %win_dir%\assembly\nativeimages_v2.0.50727_32\isdiinterop\76632f5376aa57887b9cd7a5662c6d4f\isdiinterop.ni.dll
• %user_profile%\appdata\roaming\tkcmcf.scr
• %user_profile%\appdata\roaming\a1f.exe
• c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe

%user_profile%\appdata\roaming\ebe3.exe

• The file has digital signature but it is not valid: safebrowsing.mozilla.org.
• The file does not contain company name.
• The file was created short time ago. Spywares very often re-creates new files after system login.
• File checksum is 91AF8081AC61C1A09678D4EA45E9BE89.
• Windows Explorer starts it automatically.
• Registered as MSSMARTMON.
more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-14699\brenasa.exe

• Company is McAfee, Inc.(3,0,207,0).
• File checksum is E71B799C73DE369DDFB48B175C0A0EBD.
• The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
• Windows Explorer starts it automatically.
• Registered as tbrena.
• The file may be invisible in Windows Explorer.
• Detected as W32/Agent.SJOL!tr by Fortinet AntiVirus.
• Detected as Trojan.Siggen.65039 by DrWeb AntiVirus.
more info ...

%win_dir%\assembly\nativeimages_v2.0.50727_32\isdiinterop\76632f5376aa57887b9cd7a5662c6d4f\isdiinterop.ni.dll

• The file does not contain company name.
• File checksum is DCF1A408E95E06D8AA08DB9129F5F568.
more info ...

%user_profile%\appdata\roaming\tkcmcf.scr

• The file does not contain company name.
• File checksum is D6445D7575B3B17BC9F1BA2E2DCA8B83.
• The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
• Windows Explorer starts it automatically.
• Registered as Tkcmcf.
more info ...

%user_profile%\appdata\roaming\a1f.exe

• The file does not contain company name.
• The file was created short time ago. Spywares very often re-creates new files after system login.
• File checksum is D11DE351D25A03A943CC49096BC5AACD.
• The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
• Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
• Detected as BackDoor.Ddoser.131 by DrWeb AntiVirus.
more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe

• The file does not contain company name.
• File checksum is D11DE351D25A03A943CC49096BC5AACD.
• The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
• Windows Explorer starts it automatically.
• Registered as zaber0.
• The file may be invisible in Windows Explorer.
• Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
• Detected as BackDoor.Ddoser.131 by DrWeb AntiVirus.
more info ...