Threat Summary. atomicalarmclock.exe, contextmenu.dll, fonts.dll, l}710093.dll, notepad.exe

The result of free antivirus

Created by anti-spyware software WinDetect:

Version: 2.10.0

Possible suspicious files:

%program_files%\atomicalarmclock\atomicalarmclock.exe
%win_dir%\system32\akelfiles\plugs\contextmenu.dll
%win_dir%\system32\akelfiles\plugs\fonts.dll
%win_dir%\system32\g173228.dll
%win_dir%\system32\notepad.exe
%win_dir%\notepad.exe
%win_dir%\system32\scrnsave.scr
%win_dir%\system32\drivers\sptd.sys
%win_dir%\system32\drivers\tcpip.sys
%win_dir%\system32\akelfiles\plugs\toolbar.dll

%program_files%\atomicalarmclock\atomicalarmclock.exe

The file does not contain company name.
File checksum is 2F144D1D899AF111F586F9117393475B.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
Windows Explorer starts it automatically.
Registered as SkinClock.
May connect to site http://mcop.netfirms.com.

%win_dir%\system32\akelfiles\plugs\contextmenu.dll

The file does not contain company name.
File checksum is 94274E7C69EE787A1DB8F377CC82B707.
Loaded to %win_dir%\system32\notepad.exe.

%win_dir%\system32\akelfiles\plugs\fonts.dll

The file does not contain company name.
File checksum is 1053E75ADA23AF827FDFDCA27124D01F.
Loaded to %win_dir%\system32\notepad.exe.

%win_dir%\system32\g173228.dll

The file does not contain company name.
File checksum is 77A5B66A5A033D2DC85A2D6EA2DFBA0E.
Detected as W32/KillAV.NE!tr by Fortinet AntiVirus.
Detected as W32.Sality-73 by Clam AntiVirus.
Detected as Win32.Sector.4 by DrWeb AntiVirus.

%win_dir%\system32\notepad.exe

The file does not contain company name.
File checksum is D2BD0F5F4C0927E66E5EBA9077CF5F87.

%win_dir%\notepad.exe

The file does not contain company name.
File checksum is 65B2B27B061B13AD5BD7158E3B7119C5.

%win_dir%\system32\scrnsave.scr

The file has digital signature but it is not valid: Invalid signature.
The file does not contain company name.
File checksum is 4C83509108CFCF2A23063E6333E1B423.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
Screen saver.

%win_dir%\system32\drivers\sptd.sys

The file does not contain company name.
The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
Starts at system boot.
Registered as sptd.

%win_dir%\system32\drivers\tcpip.sys

Company is Microsoft Corporation(5.1.2600.5649 (xpsp_sp3_qfe.080728-1259)).
File checksum is D97149782966084468C79077279809F1.
Runs at start up.
Registered as Tcpip, Драйвер протокола TCP/IP.

%win_dir%\system32\akelfiles\plugs\toolbar.dll

The file does not contain company name.
File checksum is E9363F06612DFDECC7C0E4405525FC0F.
Loaded to %win_dir%\system32\notepad.exe.