Threat Summary. agent.exe, dbsrv7.exe, dpmtrcdd.sys, inputdirector.exe, msivge32.dll

The result of free antivirus

Created by anti-spyware software WinDetect:

Version: 2.10.0

Possible suspicious files:

%program_files%\common files\installshield\updateservice\agent.exe
%program_files%\common files\siemens\sqlany\dbsrv7.exe
%win_dir%\system32\drivers\dpmtrcdd.sys
%program_files%\input director\inputdirector.exe
%win_dir%\system32\msivge32.dll
%program_files%\yandex\punto switcher\punto.exe
%win_dir%\system32\pdfmonnt.dll
%win_dir%\system32\drivers\s7opcsrtx.sys
%win_dir%\system32\drivers\s7snsrtx.sys
%win_dir%\system32\drivers\sntie.sys
%win_dir%\system32\drivers\sptd.sys
%win_dir%\system32\drivers\unimull.sys
%program_files%\windjview\windjview.exe

%program_files%\common files\installshield\updateservice\agent.exe

Company is Macrovision Corporation(4, 60, 100, 37068).
File checksum is A325C1DDE8913D168905408E89C0BE08.
May download files from the Internet.
May connect to site http://www.installshield.com.

%program_files%\common files\siemens\sqlany\dbsrv7.exe

Company is Sybase, Inc.(7.0.3.2092).
File checksum is 672F1FE65F29E80BC607877649978292.
May get commands from the Internet on port 2638.
May bypass Windows Firewall.
Started by %program_files%\Common Files\Siemens\S7ubtoox\S7ubtoox.exe.

%win_dir%\system32\drivers\dpmtrcdd.sys

Company is SIEMENS AG(V 6.2.630.3259 ).
File checksum is CFFF8DC72C98559A747A648D70A3269C.
Runs at start up.
Registered as Dpmtrcdd.

%program_files%\input director\inputdirector.exe

The file does not contain company name.
File checksum is 2D3E6C01DC9F5A83C2894712D57F0F63.
May get commands from the Internet on port 31234.
May bypass Windows Firewall.
Windows Explorer starts it automatically.
Registered as InputDirector.
May connect to site http://www.inputdirector.com.

%win_dir%\system32\msivge32.dll

The file does not contain company name.
File checksum is 821F6F62ED704A326A67510C7792AE61.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
Loaded to %win_dir%\system32\rundll32.exe.

%program_files%\yandex\punto switcher\punto.exe

Company is ООО Яндекс(3, 1, 1, 72).
File checksum is CF0CAAD499DF0C39CC8CD763BBD67E6F.
May download files from the Internet.
May connect to site http://download.yandex.ru.
May connect to site http://soft.export.yandex.ru.

%win_dir%\system32\pdfmonnt.dll

The file does not contain company name.
File checksum is 1574DD9D409F2DC45CF82C22B99164A4.
Print monitor.
Registered as PDFConverter.
Loaded to %win_dir%\system32\spoolsv.exe.

%win_dir%\system32\drivers\s7opcsrtx.sys

Company is SIEMENS AG(K08.00.01.00_01.01.00.01 release).
File checksum is 4E7EC9ADD8DBA12BA4BDD32BB1939132.
Runs at start up.
Registered as S7opcsrtx, PROFINET IO RT-Protocol (LLDP).

%win_dir%\system32\drivers\s7snsrtx.sys

Company is SIEMENS AG(V 07.00.39.3402-REL).
File checksum is A92467842EAFCBC37E7B1C63CC069C29.
Runs at start up.
Registered as s7snsrtx, PROFINET IO RT-Protocol.

%win_dir%\system32\drivers\sntie.sys

Company is SIEMENS AG(V 07.00.7005.3506-REL).
File checksum is 4ECE81451E2A264E7F92CECFD2E04B90.
Runs at start up.
Registered as SNTIE, SIMATIC Industrial Ethernet (ISO).

%win_dir%\system32\drivers\sptd.sys

The file does not contain company name.
The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
Starts at system boot.
Registered as sptd.

%win_dir%\system32\drivers\unimull.sys

Company is Tyrus [mail2tyrus@yahoo.com](999.0.2.9).
File checksum is 497D2B75058936C9D0D8B97A3A8B16EC.
Runs at start up.
Registered as unimull.

%program_files%\windjview\windjview.exe

Company is Andrew Zhezherun(1.0.3).
File checksum is 579877B02B7682FAA11E0FE811316A45.
May download files from the Internet.