WinDetect
We keep Windows PCs clean

The result of free antivirus

Created by anti-spyware software WinDetect:

  • Version: 2.10.0

Possible suspicious files:


%user_profile%\application data\16.exe

  • The file has digital signature but it is not valid: safebrowsing.mozilla.org.
  • The file does not contain company name.
  • File checksum is 7AC167CACF38EAFFF8CB36C112AC604E.
  • Windows Explorer starts it automatically.
  • Registered as MSSMARTMON1.
  • May download files from the Internet.
    • more info ...

%user_profile%\application data\59.exe

  • The file has digital signature but it is not valid: safebrowsing.mozilla.org.
  • The file does not contain company name.
  • The file was created short time ago. Spywares very often re-creates new files after system login.
  • File checksum is 7AC167CACF38EAFFF8CB36C112AC604E.
  • May download files from the Internet.
    • more info ...

%user_profile%\application data\71.exe

  • The file does not contain company name.
  • The file was created short time ago. Spywares very often re-creates new files after system login.
  • File checksum is 80BBDE226479626D1F456253D52852F2.
  • May download files from the Internet.
  • May connect to site http://ppppnipponp.r1m.us.
  • May connect to site http://pppppppppppppppppppp.r1m.us.
  • May connect to site http://obsoletegpppp.r1m.us.
  • May connect to site http://1p.r1m.us.
  • May connect to site http://pppppppppppp.p.r1m.us.
  • May connect to site http://mobip.r1m.us.
  • May connect to site http://ppp16ptok2pcomphomepaqupp.r1m.us.
  • May connect to site http://pppppppppppp.r1m.us.
    • more info ...

%win_dir%\yodrive32.exe

  • The file does not contain company name.
  • File checksum is 80BBDE226479626D1F456253D52852F2.
  • Established the Internet connection with 10.168.5.28 on port Microsoft-DS(445).
  • Established the Internet connection with 58.221.60.46 on port 6939.
  • Established the Internet connection with 10.168.5.30 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.22 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.26 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.24 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.21 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.25 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.29 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.23 on port Microsoft-DS(445).
  • Established the Internet connection with 10.168.5.27 on port Microsoft-DS(445).
  • Windows Explorer starts it automatically.
  • Registered as Microsoft Driver Setup.
  • The file may be invisible in Windows Explorer.
  • May download files from the Internet.
  • May connect to site http://ppppnipponp.r1m.us.
  • May connect to site http://pppppppppppppppppppp.r1m.us.
  • May connect to site http://obsoletegpppp.r1m.us.
  • May connect to site http://1p.r1m.us.
  • May connect to site http://pppppppppppp.p.r1m.us.
  • May connect to site http://mobip.r1m.us.
  • May connect to site http://ppp16ptok2pcomphomepaqupp.r1m.us.
  • May connect to site http://pppppppppppp.r1m.us.
    • more info ...

%user_profile%\application data\9.exe

  • The file does not contain company name.
  • File checksum is 02CFCABABDD958F538463895BBB4D104.
  • May bypass Windows Firewall.
    • more info ...

%win_dir%\system32\acs.exe

  • The file does not contain company name.
  • The file was created short time ago. Spywares very often re-creates new files after system login.
  • File checksum is 67A50E32687D4D5235E2DF07E680BC1C.
  • Registered as ACS, Atheros Configuration Service.
    • more info ...

%win_dir%\system32\drivers\aegisp.sys

  • Company is Meetinghouse Data Communications(3.2.0.3).
  • The file was created short time ago. Spywares very often re-creates new files after system login.
  • File checksum is 2C5C22990156A1063E19AD162191DC1D.
  • Runs at start up.
  • Registered as AegisP, AEGIS Protocol (IEEE 802.1x) v3.2.0.3.
    • more info ...

%user_profile%\application data\76.exe

  • The file does not contain company name.
  • The file was created short time ago. Spywares very often re-creates new files after system login.
  • File checksum is D668191DAA59B0E98AA68F313A0C7575.
  • May download files from the Internet.
  • May compromise other applications.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-14699\brenasa.exe

  • The file does not contain company name.
  • File checksum is D668191DAA59B0E98AA68F313A0C7575.
  • Spoofs the system process.
  • Windows Explorer starts it automatically.
  • Registered as tbrena.
  • The file may be invisible in Windows Explorer.
  • May download files from the Internet.
  • May compromise other applications.
  • Was not detected by anti-viruses.
    • more info ...

%allusers_profile%\application data\datacardservice\dcservice.exe

  • The file does not contain company name.
  • File checksum is CC8B5C964B777F4EC3E89F13B4B5FF0F.
  • Registered as DCService.exe.
    • more info ...

%user_profile%\application data\dssssv.scr

  • The file does not contain company name.
  • File checksum is 90508EE8FB9638D820624059567FD0D7.
  • Windows Explorer starts it automatically.
  • Registered as Dssssv.
  • The file may be invisible in Windows Explorer.
  • May download files from the Internet.
  • May connect to site http://api.wipmania.com.
  • May compromise other applications.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12340\newcont1rnd.exe

  • The file does not contain company name.
  • File checksum is 73E62FE1AD1E3741D32284C2AFE80E5F.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr1nd.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as BackDoor.Ddoser.236 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12310\newcont2rnd1.exe

  • The file does not contain company name.
  • File checksum is 57EC6CC9BCB5B4A6F7DD820B6CD685B8.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr2nd1.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as BackDoor.Ddoser.235 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12330\newcont3rnd2.exe

  • The file does not contain company name.
  • File checksum is 345D9AFEAED6302756DC7714CFA0D25E.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr3nd2.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as BackDoor.Ddoser.235 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12341\newcont4rnd3.exe

  • The file does not contain company name.
  • File checksum is 5C439FF34C8C8FF006F083A4E427FA0E.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr4nd3.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as BackDoor.Ddoser.236 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12352\newcont5rnd4.exe

  • The file does not contain company name.
  • File checksum is 0D0FD9BCFF17D202ECBF8F8E9DEB5909.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr5nd4.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as Win32.HLLW.Autoruner.56303 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12356\newcont6rnd5.exe

  • The file does not contain company name.
  • File checksum is 854416D294888D2B9FEE333F86D9D971.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr6nd5.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as BackDoor.Ddoser.241 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12367\newcont7rnd6.exe

  • The file does not contain company name.
  • File checksum is 94C6D925C452F67C838CD755395DA2D1.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr7nd6.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as BackDoor.Ddoser.241 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12387\newcont8rnd7.exe

  • The file does not contain company name.
  • File checksum is 6C24D2F400A1F154E92CB4B57DAB3779.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr8nd7.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as Win32.HLLW.Autoruner.56303 by DrWeb AntiVirus.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-12389\newcont9rnd8.exe

  • The file does not contain company name.
  • File checksum is 6EA36B9835B8DBE9E24FB9B756F47C5F.
  • The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
  • Windows Explorer starts it automatically.
  • Registered as newcontr9nd8.
  • The file may be invisible in Windows Explorer.
  • May compromise other applications.
  • Detected as W32/Zbot.CGZF!tr by Fortinet AntiVirus.
  • Detected as Win32.HLLW.Autoruner.56303 by DrWeb AntiVirus.
    • more info ...

%user_profile%\application data\5b.exe

  • The file does not contain company name.
  • The file was created short time ago. Spywares very often re-creates new files after system login.
  • File checksum is C14C75705B2E61E4E329014FD86E3629.
  • May download files from the Internet.
  • May compromise other applications.
    • more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe

  • The file does not contain company name.
  • File checksum is C14C75705B2E61E4E329014FD86E3629.
  • Windows Explorer starts it automatically.
  • Registered as zaber0.
  • The file may be invisible in Windows Explorer.
  • May download files from the Internet.
  • May compromise other applications.
    • more info ...