VirusTotal ha analizzato i file che mi hai indicato.
Il primo risultato è:

File vsnpstd.exe ricevuto il 2008.05.09 18:29:56 (CET)
Stato corrente: finito
Risultato: 2/31 (6.46%)

Antivirus Versione Ultimo aggiornamento Risultato
AhnLab-V3 2008.5.9.1 2008.05.09 -
AntiVir 7.8.0.14 2008.05.09 -
Authentium 4.93.8 2008.05.08 -
Avast 4.8.1169.0 2008.05.07 -
AVG 7.5.0.516 2008.05.08 -
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.08 -
ClamAV 0.92.1 2008.05.09 -
DrWeb 4.44.0.09170 2008.05.09 -
eSafe 7.0.15.0 2008.05.07 suspicious Trojan/Worm
eTrust-Vet 31.4.5771 2008.05.08 -
Ewido 4.0 2008.05.09 -
F-Prot 4.4.2.54 2008.05.08 -
F-Secure 6.70.13260.0 2008.05.09 -
Fortinet 3.14.0.0 2008.05.08 -
Ikarus T3.1.1.26.0 2008.05.09 -
Kaspersky 7.0.0.125 2008.05.09 -
McAfee 5291 2008.05.08 -
Microsoft 1.3408 2008.05.09 -
NOD32v2 3088 2008.05.09 -
Norman 5.80.02 2008.05.08 -
Panda 9.0.0.4 2008.05.09 -
Prevx1 V2 2008.05.09 Cloaked Malware
Rising 20.43.42.00 2008.05.09 -
Sophos 4.29.0 2008.05.09 -
Sunbelt 3.0.1097.0 2008.05.07 -
Symantec 10 2008.05.09 -
TheHacker 6.2.92.305 2008.05.08 -
VBA32 3.12.6.5 2008.05.08 -
VirusBuster 4.3.26:9 2008.05.08 -
Webwasher-Gateway 6.6.2 2008.05.09 -

Informazioni addizionali
File size: 14348 bytes
MD5...: 84a266c2c01e09912144c3744d0970f2
SHA1..: d15a08c71d0f7a050d2909d6bbc2b92a54590422
SHA256: 6136b70a2bcb91a879aee543d61ebb47b7438ba39fd027fccd 3d4d349deb20c0
SHA512: d5e3654c1e7abb05396c34f7c755ce7d1e5a3808886e061235 e6874509663983
1d7fb78b8cb2edf72cc06844fb78ffa7dbcaf413440b6a0d17 db596987385be8
PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x409f40
timedatestamp.....: 0x481f3998 (Mon May 05 16:45:12 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x6000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x7000 0x4000 0x3200 7.84 08817b1fc062ee730249136d476d8433
UPX2 0xb000 0x1000 0x200 2.50 bac0808cde7de0b0ed672e7b9ab07036

( 3 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> SHLWAPI.dll: StrStrA
> USER32.dll: wvsprintfA

( 0 exports )

Prevx info: http://info.prevx.com/aboutprogramte...F71E00EA59426F
packers (F-Prot): UPX
packers (Authentium): UPX
packers (Kaspersky): PE_Patch.UPX, UPX

Per quanto riguarda il secondo file, VirusTotal riporta:

Il file è già stato analizzato:
MD5: 84a266c2c01e09912144c3744d0970f2
First received: 2008.05.09 18:30:45 (CET)
Data 2008.05.09 18:30:48 (CET) [<1D]
Risultati 2/31
Permalink: analisis/b2d2c0488f110391bd84bb18d63d6a43

In ogni caso l'ho rianalizzato, e il risultato è questo:

File winsyser.exe ricevuto il 2008.05.09 18:47:11 (CET)
Stato corrente: finito
Risultato: 2/31 (6.46%)

Antivirus Versione Ultimo aggiornamento Risultato
AhnLab-V3 2008.5.9.1 2008.05.09 -
AntiVir 7.8.0.14 2008.05.09 -
Authentium 4.93.8 2008.05.08 -
Avast 4.8.1169.0 2008.05.07 -
AVG 7.5.0.516 2008.05.08 -
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.08 -
ClamAV 0.92.1 2008.05.09 -
DrWeb 4.44.0.09170 2008.05.09 -
eSafe 7.0.15.0 2008.05.09 suspicious Trojan/Worm
eTrust-Vet 31.4.5772 2008.05.09 -
Ewido 4.0 2008.05.09 -
F-Prot 4.4.2.54 2008.05.08 -
F-Secure 6.70.13260.0 2008.05.09 -
Fortinet 3.14.0.0 2008.05.08 -
Ikarus T3.1.1.26.0 2008.05.09 -
Kaspersky 7.0.0.125 2008.05.09 -
McAfee 5291 2008.05.08 -
Microsoft 1.3408 2008.05.09 -
NOD32v2 3088 2008.05.09 -
Norman 5.80.02 2008.05.08 -
Panda 9.0.0.4 2008.05.09 -
Prevx1 V2 2008.05.09 Cloaked Malware
Rising 20.43.42.00 2008.05.09 -
Sophos 4.29.0 2008.05.09 -
Sunbelt 3.0.1097.0 2008.05.07 -
Symantec 10 2008.05.09 -
TheHacker 6.2.92.305 2008.05.08 -
VBA32 3.12.6.5 2008.05.08 -
VirusBuster 4.3.26:9 2008.05.08 -
Webwasher-Gateway 6.6.2 2008.05.09 -

Informazioni addizionali
File size: 14348 bytes
MD5...: 84a266c2c01e09912144c3744d0970f2
SHA1..: d15a08c71d0f7a050d2909d6bbc2b92a54590422
SHA256: 6136b70a2bcb91a879aee543d61ebb47b7438ba39fd027fccd 3d4d349deb20c0
SHA512: d5e3654c1e7abb05396c34f7c755ce7d1e5a3808886e061235 e6874509663983
1d7fb78b8cb2edf72cc06844fb78ffa7dbcaf413440b6a0d17 db596987385be8
PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x409f40
timedatestamp.....: 0x481f3998 (Mon May 05 16:45:12 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x6000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x7000 0x4000 0x3200 7.84 08817b1fc062ee730249136d476d8433
UPX2 0xb000 0x1000 0x200 2.50 bac0808cde7de0b0ed672e7b9ab07036

( 3 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> SHLWAPI.dll: StrStrA
> USER32.dll: wvsprintfA

( 0 exports )

Prevx info: http://info.prevx.com/aboutprogramte...F71E00EA59426F
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX
packers (Authentium): UPX

Devo quindi eliminare entrambi i file, giusto?
Ora provvedo a fare lo scanning del sistema...