Threat Summary. dwmink32.exe, mod_logonui.exe, netprotocol.exe, nsscm.dll, tcpip.sys

The result of free antivirus

Created by anti-spyware software WinDetect:

Version: 2.10.0

Possible suspicious files:

%win_dir%\system32\dwmink32.exe
%win_dir%\system32\mod_logonui.exe
%user_profile%\application data\netprotocol.exe
%win_dir%\temp\nsr3b.tmp\nsscm.dll
%win_dir%\system32\drivers\tcpip.sys
%program_files%\uphclean\uphclean.exe
%program_files%\windjview\windjview.exe

%win_dir%\system32\dwmink32.exe

The file does not contain company name.
The file is hidden. Most probably a rootkit hides this file. The file could belong to that rootkit.
Windows Explorer starts it automatically.
Registered as Windows Debugger 32.

%win_dir%\system32\mod_logonui.exe

Company is Корпорация Майкрософт(6.00.2900.5512 (xpsp.080413-2105)).
File checksum is 85679CD8F5148A80E99507091764B7FE.
Spoofs the system process.
Was not detected by anti-viruses.

%user_profile%\application data\netprotocol.exe

The file does not contain company name.
File checksum is DEDAA2C5B22A30002D64F313C7EB73C3.
The file hides its content. Most often spywares pack the binaries to be not detected by some anti-spywares. Perhaps this is legitimate file that belongs to a security product.
Windows Explorer starts it automatically.
Registered as Netprotocol.
Detected as W32/Yakes.B!tr by Fortinet AntiVirus.

%win_dir%\temp\nsr3b.tmp\nsscm.dll

The file does not contain company name.
The file was created short time ago. Spywares very often re-creates new files after system login.
File checksum is 62EFA7B730EB0523A026EA4325403B77.
Loaded to %program_files%\HeavenWard\RemoveAny\updates\s1v8..tmp.

%win_dir%\system32\drivers\tcpip.sys

Company is Microsoft Corporation(5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)).
File checksum is 1F39C7BDBA4C5F3F01C4EABF7EDBF4B3.
Runs at start up.
Registered as Tcpip, Драйвер протокола TCP/IP.

%program_files%\uphclean\uphclean.exe

Company is Microsoft Corporation(1.6.30.0).
File checksum is 3F9A3232E5F942874488981F3242C989.
Registered as UPHClean, User Profile Hive Cleanup.
May manipulate kernel objects.

%program_files%\windjview\windjview.exe

Company is Andrew Zhezherun(1.0.3).
File checksum is 579877B02B7682FAA11E0FE811316A45.
May download files from the Internet.