Created by anti-spyware software WinDetect:

• Version: 2.10.0

Possible suspicious files:

• %win_dir%\system32\ati2evxx.dll
• %program_files%\faststone image viewer\fsviewer.exe
• %win_dir%\system32\kmqdpye.dll
• %user_profile%\application data\netprotocol.exe
• %program_files%\yandex\punto switcher\punto.exe
• %win_dir%\system32\drivers\sptd.sys
• %win_dir%\system32\drivers\tcpip.sys
• %allusers_profile%\application data\vksaver\vksaver.exe
• %win_dir%\system32\windebug32.exe

%win_dir%\system32\ati2evxx.dll

• Company is ATI Technologies Inc.(6.14.10.4179).
• File checksum is BFBD65BD40A7A2A4F14A9DD5AEDE004B.
• Loaded to Windows Security Process.
• Registered as AtiExtEvent.
more info ...

%program_files%\faststone image viewer\fsviewer.exe

• The file does not contain company name.
• File checksum is C3CCFEFB76785A46F97743B2FB547DF9.
• The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
more info ...

%win_dir%\system32\kmqdpye.dll

• The file does not contain company name.
• File checksum is 571585996DD2D9256E0D5A25F9E5EACB.
• Loads to all processes.
more info ...

%user_profile%\application data\netprotocol.exe

• The file does not contain company name.
• File checksum is B31458A9EADB64249975F09B52C84368.
• The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
• Established the Internet connection with 96-9-160-96.static.hostnoc.net on port World Wide Web HTTP(80).
• Established the Internet connection with 190.9.35.198 on port World Wide Web HTTP(80).
• Windows Explorer starts it automatically.
• Registered as Netprotocol.
• May download files from the Internet.
more info ...

%program_files%\yandex\punto switcher\punto.exe

• Company is ООО Яндекс(3, 1, 1, 72).
• File checksum is CF0CAAD499DF0C39CC8CD763BBD67E6F.
• May download files from the Internet.
• May connect to site http://download.yandex.ru.
• May connect to site http://soft.export.yandex.ru.
more info ...

%win_dir%\system32\drivers\sptd.sys

• The file does not contain company name.
• The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
• Starts at system boot.
• Registered as sptd.
more info ...

%win_dir%\system32\drivers\tcpip.sys

• Company is Microsoft Corporation(5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)).
• File checksum is 6A104BA98D99D53AB0C91825CE659FC6.
• Runs at start up.
• Registered as Tcpip, Драйвер протокола TCP/IP.
more info ...

%allusers_profile%\application data\vksaver\vksaver.exe

• Company is AudioVkontakte.ru(3.1.110425.1262).
• File checksum is 5544D3A4B0498ABADE8719F621C8BF2D.
• Established the Internet connection with domain4.ru on port World Wide Web HTTP(80).
• Windows Explorer starts it automatically.
• Registered as VKSaver.
more info ...

%win_dir%\system32\windebug32.exe

• The file does not contain company name.
• The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
• Windows Explorer starts it automatically.
• Registered as Windows Debugger 32.
more info ...