Created by anti-spyware software WinDetect:

• Version: 2.10.0

Possible suspicious files:

• %win_dir%\aadrive32.exe
• c:\recycler\s-1-5-21-0243556031-888888379-781863308-9364\fdwde92.exe
• %win_dir%\system32\ftzeehg.dll
• %win_dir%\system32\drivers\haspnt.sys
• %win_dir%\system32\drivers\sptd.sys
• c:\recycler\s-1-5-21-0243556031-888888379-781863308-1413\syitm.exe
• %win_dir%\system32\drivers\tcpip.sys
• c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe

%win_dir%\aadrive32.exe

• The file does not contain company name.
• File checksum is D250DA77C8F19B3E8F33A597A61E4293.
• Windows Explorer starts it automatically.
• Registered as Microsoft Driver Setup.
• The file may be invisible in Windows Explorer.
• Detected as BackDoor.IRC.Bot.166 by DrWeb AntiVirus.
more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-9364\fdwde92.exe

• The file does not contain company name.
• File checksum is F549B9E90817F4CA0141F2AD835C761F.
• Spoofs the system process.
• Windows Explorer starts it automatically.
• Registered as dw92.
• The file may be invisible in Windows Explorer.
• Detected as W32/Injector.LSH!tr by Fortinet AntiVirus.
• Detected as Trojan.Inject.57955 by DrWeb AntiVirus.
more info ...

%win_dir%\system32\ftzeehg.dll

• The file does not contain company name.
• File checksum is EF4CF03144392257AA51A6B821E0ED9C.
• Loads to all processes.
more info ...

%win_dir%\system32\drivers\haspnt.sys

• Company is Aladdin Knowledge Systems(4.65).
• File checksum is 2DD25F060DC9F79B5CDF33D90ED93669.
• Runs at start up.
• Registered as Haspnt.
more info ...

%win_dir%\system32\drivers\sptd.sys

• The file does not contain company name.
• The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
• Starts at system boot.
• Registered as sptd.
more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-1413\syitm.exe

• The file does not contain company name.
• File checksum is C158A84EE7D46AB913307EA45DBC349B.
• Windows Explorer starts it automatically.
• Registered as Tnaww.
• The file may be invisible in Windows Explorer.
more info ...

%win_dir%\system32\drivers\tcpip.sys

• Company is Microsoft Corporation(5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)).
• File checksum is EC936BB945F789C0B4DAE06397334430.
• Runs at start up.
• Registered as Tcpip, Драйвер протокола TCP/IP.
more info ...

c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe

• The file does not contain company name.
• File checksum is D59FD9A82D72A7CF5FD97845F7DF3C71.
• Windows Explorer starts it automatically.
• Registered as zaber0.
• The file may be invisible in Windows Explorer.
more info ...