Threat Summary. autoit3.exe, fscapture.exe, nsscm.dll, tcpip.sys, unlocker.exe

The result of free antivirus

Created by anti-spyware software WinDetect:

Version: 2.10.0

Possible suspicious files:

%win_dir%\system32\autoit3.exe
%program_files%\faststone capture\fscapture.exe
%win_dir%\temp\nsc18.tmp\nsscm.dll
%win_dir%\system32\drivers\tcpip.sys
%program_files%\unlocker\unlocker.exe
%user_profile%\application data\acd systems\uplus.exe
%program_files%\vistadrive\vsdrv.exe

%win_dir%\system32\autoit3.exe

The file does not contain company name.
File checksum is 408D8EE73411CCF6D739FC80B08EF211.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.

%program_files%\faststone capture\fscapture.exe

The file does not contain company name.
File checksum is 9A5267B90F8F34E78FF9FE981B930ECD.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.

%win_dir%\temp\nsc18.tmp\nsscm.dll

The file does not contain company name.
The file was created short time ago. Spywares very often re-creates new files after system login.
File checksum is 62EFA7B730EB0523A026EA4325403B77.
Loaded to %program_files%\HeavenWard\RemoveAny\updates\s3i8..tmp.

%win_dir%\system32\drivers\tcpip.sys

Company is Microsoft Corporation(5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)).
File checksum is DF70435F3D17C40D5CB15E6DC918342E.
Runs at start up.
Registered as Tcpip, Драйвер протокола TCP/IP.

%program_files%\unlocker\unlocker.exe

The file does not contain company name.
File checksum is C341C51D39B82C2D923D7345AE2C0DD8.
May connect to site http://unlocker.emptyloop.com.
May connect to site http://www.emptyloop.com.
May compromise other applications.

%user_profile%\application data\acd systems\uplus.exe

The file does not contain company name.
File checksum is 12D8229E91470340CA55C80BA197896C.
May get commands from the Internet on port 1025.

%program_files%\vistadrive\vsdrv.exe

The file does not contain company name.
File checksum is 52C3485C4B181163C13FCC4BD6A4505B.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
Windows Explorer starts it automatically.
Registered as Vistadrv.
May download files from the Internet.
Detected as W32/Dx.GMQ!tr by Fortinet AntiVirus.