Threat Summary. _iu14d2n.tmp, _iu14d2o.tmp, cmdlineext03.dll, glb1a2b.exe, ikernel.exe

The result of free antivirus

Created by anti-spyware software WinDetect:

Version: 2.10.0

Possible suspicious files:

%user_profile%\local settings\temp\_iu14d2n.tmp
%user_profile%\local settings\temp\_iu14d2o.tmp
%win_dir%\system32\cmdlineext03.dll
%user_profile%\local settings\temp\glb1a2b.exe
%program_files%\common files\installshield\engine\6\intel 32\ikernel.exe
%user_profile%\local settings\temp\lak.exe
%program_files%\microsoft\search enhancement pack\seaport\seaport.exe

%user_profile%\local settings\temp\_iu14d2n.tmp

The file does not contain company name.
The file was created short time ago. Spywares very often re-creates new files after system login.
File checksum is E6DC14D6EAFF677493978149CCA21112.
May connect to site http://schemas.microsoft.com.
Started by %program_files%\AVS4YOU\AVSUpdateManager\unins000.exe.

%user_profile%\local settings\temp\_iu14d2o.tmp

The file does not contain company name.
The file was created short time ago. Spywares very often re-creates new files after system login.
File checksum is 3C0190BD7272B3A4E4A482C158D49478.
May connect to site http://www.innosetup.com.
May connect to site http://schemas.microsoft.com.
May connect to site http://www.remobjects.com.
Started by %program_files%\Common Files\AVSMedia\VideoUploader\unins000.exe.

%win_dir%\system32\cmdlineext03.dll

The file does not contain company name.
File checksum is 635FD9FBD20D51F5A4CD5E7764F67585.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.

%user_profile%\local settings\temp\glb1a2b.exe

The file does not contain company name.
The file was created short time ago. Spywares very often re-creates new files after system login.
File checksum is 973567B98CDFC147DF4E60471D9DF072.
Started by C:\PROGRA~1\Thoosje\UNWISE.EXE.

%program_files%\common files\installshield\engine\6\intel 32\ikernel.exe

Company is InstallShield Software Corporation(6, 31, 100, 1221).
File checksum is B3FD01873BD5FD163AB465779271C58F.
May download files from the Internet.
Started by %win_dir%\system32\rundll32.exe.

%user_profile%\local settings\temp\lak.exe

The file has digital signature but it is not valid: Microsoft Corporation.
Company is Sysinternals - www.sysinternals.com(1.70).
File checksum is 71B8DA260E391A04751221D6394993F1.
Registered as LAK.

%program_files%\microsoft\search enhancement pack\seaport\seaport.exe

Company is Microsoft Corp.(1.2.123.0).
File checksum is F6B65A374C7EE0DDC06959A2D3A3CC35.
Established the Internet connection with cds59.syd9.msecn.net on port World Wide Web HTTP(80).
Registered as SeaPort.