Created by anti-spyware software WinDetect:

• Version: 4.2.0

Possible suspicious files:

• %user_profile%\appdata\local\temp\nsfc310.tmp\inetc.dll
• %win_dir%\kmsem\kmservice.exe
• %win_dir%\system32\drivers\kqemu.sys
• %user_profile%\appdata\roaming\images\load.exe
• %user_profile%\appdata\roaming\images\nscpucnminer32.exe
• %user_profile%\appdata\roaming\zbshareware lab\locales\russian.dll
• %win_dir%\system32\drivers\saa713x.sys
• %win_dir%\kmsem\shadow.kms
• %win_dir%\system32\srvany.exe
• %user_profile%\appdata\local\temp\nsfc310.tmp\system.dll
• %win_dir%\system32\utscsi.exe
• %win_dir%\system32\drivers\vsb.sys
• %win_dir%\system32\drivers\vserial.sys
• %win_dir%\system32\drivers\wdmtuner.sys

%user_profile%\appdata\local\temp\nsfc310.tmp\inetc.dll

• The file does not contain company name.
• The file was created short time ago. Spywares very often re-creates new files after system login.
• File checksum is D7A3FA6A6C738B4A3C40D5602AF20B08.
• Loaded to C:\Users\JURAEV\AppData\Roaming\Images\image.exe.
more info ...

%win_dir%\kmsem\kmservice.exe

• The file does not contain company name.
• File checksum is 5ED4E83542DB0FA5D865A6F596CFBF4F.
• Waits connection from the Internet on port 1688.
• Started by %win_dir%\system32\srvany.exe.
more info ...

%win_dir%\system32\drivers\kqemu.sys

• The file does not contain company name.
• File checksum is 2B8C0A23BBDE2457A683848D22CC4BEB.
• Registered as kqemu, KQEMU virtualisation module for QEMU.
more info ...

%user_profile%\appdata\roaming\images\load.exe

• The file does not contain company name.
• File checksum is BC6DB57B6F9118ECB27625CB7646688A.
• May connect to site http://nsis.sf.net.
• Started by C:\Users\JURAEV\AppData\Roaming\Images\image.exe.
more info ...

%user_profile%\appdata\roaming\images\nscpucnminer32.exe

• The file does not contain company name.
• File checksum is 3AFEB8E9AF02A33FF71BF2F6751CAE3A.
• The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
• Started by C:\Users\JURAEV\AppData\Roaming\Images\image.exe.
more info ...

%user_profile%\appdata\roaming\zbshareware lab\locales\russian.dll

• The file does not contain company name.
• File checksum is 8068A3D79C1C30FB85406CEF07907578.
• Loaded to C:\Users\JURAEV\AppData\Roaming\Zbshareware Lab\USBGuard.exe.
more info ...

%win_dir%\system32\drivers\saa713x.sys

• Company is Philips Semiconductors(2, 3, 4, 9).
• File checksum is 898B53170EDFF24FB7828A585DF3C76B.
• Runs at start up.
• Registered as 713xTVCard, SAA7130 TV Card.
more info ...

%win_dir%\kmsem\shadow.kms

• The file does not contain company name.
• File checksum is 678C2CD653906AD65A886F4E1E97C560.
• Loaded to %win_dir%\kmsem\KMService.exe.
more info ...

%win_dir%\system32\srvany.exe

• The file does not contain company name.
• File checksum is 4635935FC972C582632BF45C26BFCB0E.
• Registered as KMService.
more info ...

%user_profile%\appdata\local\temp\nsfc310.tmp\system.dll

• The file does not contain company name.
• The file was created short time ago. Spywares very often re-creates new files after system login.
• File checksum is C17103AE9072A06DA581DEC998343FC1.
more info ...

%win_dir%\system32\utscsi.exe

• The file does not contain company name.
• File checksum is 8AFFFDA081CFF3057391FEDBBB483601.
• Registered as UTSCSI, CLCV0.
more info ...

%win_dir%\system32\drivers\vsb.sys

• The file does not contain company name.
• File checksum is 1C8A783E90C34D205596F1AB4A97E261.
• Registered as vsbus, Virtual Serial Bus Enumerator.
more info ...

%win_dir%\system32\drivers\vserial.sys

• The file does not contain company name.
• File checksum is 3377DAA1CB8CAC46A538C236F5F3D58F.
• Registered as vserial, ELTIMA Virtual Serial Ports Driver.
more info ...

%win_dir%\system32\drivers\wdmtuner.sys

• Company is Philips Semiconductors(2, 3, 4, 9).
• File checksum is 32C3D8ACBBF15A4AC7667878A4D56348.
• Runs at start up.
• Registered as WDMTVTuner, Universal WDM TV Tuner.
more info ...