Threat Summary. ati2evxx.dll, ati2sgag.exe, consult.sys, dcservice.exe, divx plus player.exe

The result of free antivirus

Created by anti-spyware software WinDetect:

Version: 2.10.0

Possible suspicious files:

%win_dir%\system32\ati2evxx.dll
%win_dir%\system32\ati2sgag.exe
%win_dir%\system32\drivers\consult.sys
%allusers_profile%\application data\datacardservice\dcservice.exe
%program_files%\divx\divx plus player\divx plus player.exe
%win_dir%\system32\drivers\eio.sys
%win_dir%\system32\fsusbexdisk.sys
%win_dir%\system32\spool\drivers\w32x86\3\hpzpi4wm.dll
%program_files%\bonjour\mdnsresponder.exe
%win_dir%\system32\drivers\sptd.sys
%program_files%\unlocker\unlocker.exe
%win_dir%\system32\wgalogon.dll

%win_dir%\system32\ati2evxx.dll

Company is ATI Technologies Inc.(6.14.10.4178).
File checksum is 4EBC9AF70E5DDEDFDB8D9DDB530D7929.
Loaded to Windows Security Process.
Registered as AtiExtEvent.

%win_dir%\system32\ati2sgag.exe

The file does not contain company name.
File checksum is B979BA0120B6DB757196A8E2E873FE3C.
Registered as ATI Smart.

%win_dir%\system32\drivers\consult.sys

Company is ConsultantPlus(5.30).
File checksum is 6ABFEBE25E9D0608C75402271B177263.
Runs at start up.
Registered as Consult.

%allusers_profile%\application data\datacardservice\dcservice.exe

The file does not contain company name.
File checksum is CC8B5C964B777F4EC3E89F13B4B5FF0F.
Registered as DCService.exe.

%program_files%\divx\divx plus player\divx plus player.exe

The file does not contain company name.
File checksum is AF52BE6F85A1EC9B93ED09ED8D8379DD.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.

%win_dir%\system32\drivers\eio.sys

Company is ASUSTeK Computer Inc.(1.880).
File checksum is 10D0CA0AF295F49C365A2EE7BF820315.
Runs at start up.
Registered as EIO.

%win_dir%\system32\fsusbexdisk.sys

The file does not contain company name.
File checksum is 790A4CA68F44BE35967B3DF61F3E4675.
Registered as FsUsbExDisk.

%win_dir%\system32\spool\drivers\w32x86\3\hpzpi4wm.dll

The file does not contain company name.
File checksum is 09258F92EAF669BABD3E837750B2C6C8.

%program_files%\bonjour\mdnsresponder.exe

Company is Apple Inc.(1,0,4,12).
File checksum is CFD4C3352E29A8B729536648466E8DF5.
May get commands from the Internet on port 1027.
Registered as Bonjour Service.

%win_dir%\system32\drivers\sptd.sys

The file does not contain company name.
The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
Starts at system boot.
Registered as sptd.

%program_files%\unlocker\unlocker.exe

The file does not contain company name.
File checksum is 51DFAF518ABE1B24AA409CEF12D7D0AB.
May connect to site http://ccollomb.free.fr.
May compromise other applications.

%win_dir%\system32\wgalogon.dll

Company is Microsoft Corporation(1.9.0009.1).
File checksum is 8AF3AF9B462AC590BADE6971676879E9.
Loaded to Windows Security Process.
Registered as WgaLogon.
Loaded to %win_dir%\system32\winlogon.exe.