Trojan.Win32.SwrortProxy_11d34aff10
Artemis!11D34AFF10B7 (McAfee), TrojanSwrortProxy.YR (Lavasoft MAS)
Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 11d34aff10b788290a5677287c0f1e01
SHA1: 0f7b265e31af1308a4109ba77611690816e5fc15
SHA256: fa7acf34854d572ff850497f49d10c87b132cebe92aa28bce052c1471154983d
SSDeep: 49152:ze1ROQEVi2a4UCpvQ/pFeC7ooYXcRBZEda7Umd 2cv1677XKU5:ze1Ld2a4rOzooYMRBKooc tsXXKU5
Size: 2499304 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:46
Analyzed on: Windows7 SP1 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:2932
spcplink.exe:3088
netsh.exe:3700
netsh.exe:3108
netsh.exe:2848
netsh.exe:2576
netsh.exe:3224
netsh.exe:2436
netsh.exe:1988
netsh.exe:2236
netsh.exe:3096
netsh.exe:4036
netsh.exe:3656
netsh.exe:1016
tvnserver.exe:2880
The Trojan injects its code into the following process(es):
SMPCSetup.exe:2268
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:2932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll (15168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCHelper.exe (23296 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\XDMessaging.dll (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\mm2.res (5520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\loading.html (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll.manifest (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdC92.tmp (142026 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\DiffieHellman.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smvnview.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\spcplink.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.manifest (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\screenhooks.dll (2392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Interop.WODVPNCOMLib.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\sas.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwg.exe (13584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Org.Mentalis.Security.dll (6584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe (23971 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\ICSharpCode.SharpZipLib.dll (7192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwinvnc.exe (19152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\tvnserver.exe (27504 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.config (234 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\settings.ini (12844 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smpcvc.exe (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Tamir.SharpSSH.dll (7192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\md5dll.dll (14 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\System.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\md5dll.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnC81.tmp (0 bytes)
The process SMPCSetup.exe:2268 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadpiece.bmp (676 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 (320 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab5FA0.tmp (53 bytes)
%Program Files%\ShowMyPCService\screenhooks.dll (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\rightpiece.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.command (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\stlport_vc645.dll (39900 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404 (316 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.param (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Recorder.exe (17548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab8A6B.tmp (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe (20740 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (716 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar8A6C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404 (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadnode.bmp (306 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Camdata.ini (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\vscap.exe.manifest (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\hook.dll (3172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller_backup.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\leftpiece.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe.manifest (691 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamShapes.ini (408 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 (76 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smhtc (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar5FA1.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smht.exe (292406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamLayout.ini (408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar748A.tmp (2712 bytes)
%Program Files%\ShowMyPCService\sas.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton.bmp (1 bytes)
%Program Files%\ShowMyPCService\tvnserver.exe (6692 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7489.tmp (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\pack3500.zip (63171 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7489.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar748A.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab5FA0.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab8A6B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar8A6C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar5FA1.tmp (0 bytes)
Registry activity
The process %original file name%.exe:2932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process SMPCSetup.exe:2268 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\TightVNC\Server]
"BlockRemoteInput" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\TightVNC\Server]
"Password" = "15 7B 81 B1 93 93 20 60"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"EnableFileTracing" = "0"
[HKCU\Software\ORL\WinVNC3]
"FileTransferEnabled" = "1"
[HKLM\SOFTWARE\TightVNC\Server]
"PollingInterval" = "300"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\TightVNC\Server]
"SmpcTest" = "11261"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"EnableConsoleTracing" = "0"
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"FileTracingMask" = "4294901760"
[HKCU\Software\TightVNC\Server]
"BlockRemoteInput" = "0"
[HKLM\SOFTWARE\TightVNC\Server]
"EnableFileTransfers" = "1"
"FileTransferEnabled" = "1"
[HKCU\Software\TightVNC\Server]
"FileTransferEnabled" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\TightVNC\Server]
"AllowLoopback" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\TightVNC\Server]
"AlwaysShared" = "1"
[HKCU\Software\TightVNC\Server]
"EnableFileTransfers" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\TightVNC\Server]
"RfbPort" = "6900"
[HKCU\Software\ORL\WinVNC3]
"InputsEnabled" = "1"
"EnableFileTransfers" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\TightVNC\Server]
"RunControlInterface" = "1"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process spcplink.exe:3088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\SimonTatham\PuTTY\SshHostKeys]
"rsa2@443:svr7.showmypc.com" = "0x10001,0xefe637decef48136f95c36613366c777d805191e1bb4060939bce3cf70eef5527545b395f472ba68666d0d987277f564968c29ab494cf7f987f463731069971e14bbbfeee19cadb960fa46f07c23f2eac745cd7367156c176070e299f9539ad8875c2c8bcbe9a11725a32a53a84d8db92c4a9796984e7fc5a1905689e126e0be4e58e4a7fd4e75c182aafa2be3e6704477f310a1421aa20e8e1daeff6f5b5d2b96f3afeaec90f94f1b807a45cf77aa9bf9153f6db8ef6f6edfd28695b80b92b9d6b0b8f5a8e87c48078686f73cba3ff5811279075ff26bc85bfa2f942fd37b8bedc2086663aaa90b52ea7afae91de30865ce66d19a77fe9ccd5d6304ede40445"
The process netsh.exe:3700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:3108 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:2848 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:2576 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:3224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:2436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:1988 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:2236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:3096 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:4036 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:3656 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E\@%SystemRoot%\system32]
"eapqec.dll,-103" = "Microsoft Corporation"
"napipsec.dll,-1" = "IPsec Relying Party"
"napipsec.dll,-2" = "Provides IPsec based enforcement for Network Access Protection"
"napipsec.dll,-3" = "Microsoft Corporation"
"dhcpqec.dll,-101" = "Provides DHCP based enforcement for NAP"
"dhcpqec.dll,-100" = "DHCP Quarantine Enforcement Client"
"dhcpqec.dll,-103" = "1.0"
"dhcpqec.dll,-102" = "Microsoft Corporation"
"eapqec.dll,-101" = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."
"eapqec.dll,-102" = "1.0"
"tsgqec.dll,-100" = "RD Gateway Quarantine Enforcement Client"
"eapqec.dll,-100" = "EAP Quarantine Enforcement Client"
"tsgqec.dll,-102" = "1.0"
"tsgqec.dll,-103" = "Microsoft Corporation"
"napipsec.dll,-4" = "1.0"
"tsgqec.dll,-101" = "Provides RD Gateway enforcement for NAP"
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process netsh.exe:1016 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
The process tvnserver.exe:2880 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tvncontrol" = "%Program Files%\ShowMyPCService\tvnserver.exe -controlservice -slave"
Dropped PE files
| MD5 | File path |
|---|---|
| 60c3820c4f56c77e3e8bece9d7a51842 | c:\Program Files\ShowMyPCService\sas.dll |
| 362ba3b724eb94eef488f6865d1b54e6 | c:\Program Files\ShowMyPCService\screenhooks.dll |
| 711561440fdc396cb6e4c69c13375a38 | c:\Program Files\ShowMyPCService\tvnserver.exe |
| 234b9052ad2010604bcae98c39672888 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\DiffieHellman.dll |
| c8164876b6f66616d68387443621510c | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\ICSharpCode.SharpZipLib.dll |
| 29586496202e8896784072bffb9be667 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Interop.WODVPNCOMLib.dll |
| 9353734293fb3f871f50a97a76fa9f9f | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Org.Mentalis.Security.dll |
| d62408c656f54abb00b65498b6fbd1be | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCHelper.exe |
| b75b62ab07cdbe683574efa3d8ed1c2b | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe |
| af76c9491a29477fe8a4bb57e3e40b4e | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Tamir.SharpSSH.dll |
| e468eb5116950f766dc30198d10737f2 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\XDMessaging.dll |
| 5986e6f66b3347b2e916714d80dcce7a | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe |
| 3e7eca671e4ede8d7988031bc9f10276 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Recorder.exe |
| dbff0ae3444ceabcb11e5563b0a13211 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\hook.dll |
| 8ad8871f21cfe557ae9efbbae5d999d8 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\stlport_vc645.dll |
| 60c3820c4f56c77e3e8bece9d7a51842 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\sas.dll |
| 362ba3b724eb94eef488f6865d1b54e6 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\screenhooks.dll |
| 49f5ad4781a082789e2aa531e38193b2 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smht.exe |
| 0ceb92bc938674df03d1ad51f8ece6e1 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smpcvc.exe |
| 34167743b4047b5ff4bd41a165ce0aa2 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smvnview.exe |
| 491e99207bba55d1bbb03346b0ae3a4e | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwg.exe |
| 87e700bd9fc23ed4286ac473e3979785 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwinvnc.exe |
| 393bbaefd6c3cd31bdd329262dfbe660 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\spcplink.exe |
| 711561440fdc396cb6e4c69c13375a38 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\tvnserver.exe |
| 496123666f3871ab793fc03c3f838649 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 23130 | 23552 | 4.44841 | 0bc2ffd32265a08d72b795b18265828d |
| .rdata | 28672 | 4496 | 4608 | 3.59163 | f179218a059068529bdb4637ef5fa28e |
| .data | 36864 | 110488 | 1024 | 3.26405 | 975304d6dd6c4a4f076b15511e2bbbc0 |
| .ndata | 147456 | 36864 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 184320 | 172488 | 172544 | 3.57863 | d801dc8786a25e3f7b650b14c09126a5 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 103
a2cceb6f292cd23a8a76c7885b188016
486498e95eef4372309d9b0284467407
edcfba93bb8f7dcd15f960c156a0e4c3
bf6a9efbb17f27f1f25d4f6111697962
800ab49b44fe81d1fc2cb33d5c4670b9
38fffd2ce7c32ef0d4445e24f8d8f3dd
a4ca6649b4e628cd3056020fa7450daa
6b8ad0ba736cda80b9e5c4445d651977
09536a4a47d37c79f68796180700d46d
43dca8a483dd54808181e0e85ac1b160
c2468fb6431f470c4afb04876263d065
01fd1b7c4c20d597098e70898e328c4c
8034a0634411f43bc5568dd8def0406f
e296e887b82669cda327f1bcdb4b8ca4
1e716f783996fb1ad3e3bde173167605
f1d04f50a8828a09e79b45222ca06550
a97a91a3c351a54f6e6e9a9a71bf6bc0
89e89991483dc932c8455998adde0ca5
1649970c726f25e3b5cfca44639fcf01
64086f706cdd7c4cd86abc8ec3cc1600
94d19ab77ef5c742834466ec096685e5
76d6bcee41b833fa1ecce8b637dfbd4f
d492f4eefea839f43ad39186be493008
8d949a795a7bc179e8cc7d795a89ee2a
02765e84bce375cc65740af45fe2d098
URLs
| URL | IP |
|---|---|
| hxxp://a207.dscb.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= |  |
| hxxp://a207.dscb.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= | |
| hxxp://showmypc.com/users/practice-web/logo.jpg?seq=6/23/2018 7:19:51 AM |  173.255.253.123 |
| hxxp://crl.usertrust.com.cdn.cloudflare.net/UTN-USERFirst-Object.crl | 104.17.104.175 |
| hxxp://showmypc.com/app/pack3500.zip?ci=practice-web&vr=3517 | 173.255.253.123 |
| hxxp://a652.dscb.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEAiMquqMtE3p4sNkGxtE8Oo= | |
| hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODOCodeSigningCA2.crl | 104.16.90.188 |
| hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab |  |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=-1&seq=636653352066332881 | 146.148.52.8 |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=del&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&lmid=-1&lmh=5eda04ad4989f0494af9c944cd7601aa&seq=636653352069140886 | 146.148.52.8 |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352086612917 | 146.148.52.8 |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=del&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&lmid=&lmh=5eda04ad4989f0494af9c944cd7601aa&seq=636653352088016919 | 146.148.52.8 |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352106892952 | 146.148.52.8 |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=del&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&lmid=&lmh=fa4752cb89916421415fcd5aa99ce367&seq=636653352108296955 | 146.148.52.8 |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352127172988 | 146.148.52.8 |
| hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352208293130 | 146.148.52.8 |
| hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= | 2.21.89.58 |
| hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= | 2.21.89.58 |
| hxxp://crl.comodoca.com/COMODOCodeSigningCA2.crl | 104.16.90.188 |
| hxxp://crl.usertrust.com/UTN-USERFirst-Object.crl | 104.17.104.175 |
| hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEAiMquqMtE3p4sNkGxtE8Oo= | 2.21.89.33 |
| hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | 91.223.19.233 |
| svr7.showmypc.com | 50.18.219.142 |
| assured.showmypc.com | 173.255.253.123 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
ET POLICY SSLv3 outbound connection from client vulnerable to POODLE attack
ET POLICY SSH banner detected on TCP 443 likely proxy evasion
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2932
spcplink.exe:3088
netsh.exe:3700
netsh.exe:3108
netsh.exe:2848
netsh.exe:2576
netsh.exe:3224
netsh.exe:2436
netsh.exe:1988
netsh.exe:2236
netsh.exe:3096
netsh.exe:4036
netsh.exe:3656
netsh.exe:1016
tvnserver.exe:2880 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll (15168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCHelper.exe (23296 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\XDMessaging.dll (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\mm2.res (5520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\loading.html (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll.manifest (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdC92.tmp (142026 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\DiffieHellman.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smvnview.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\spcplink.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.manifest (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\screenhooks.dll (2392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Interop.WODVPNCOMLib.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\sas.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwg.exe (13584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Org.Mentalis.Security.dll (6584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\ICSharpCode.SharpZipLib.dll (7192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwinvnc.exe (19152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\tvnserver.exe (27504 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.config (234 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\settings.ini (12844 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smpcvc.exe (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Tamir.SharpSSH.dll (7192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadpiece.bmp (676 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 (320 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab5FA0.tmp (53 bytes)
%Program Files%\ShowMyPCService\screenhooks.dll (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\rightpiece.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.command (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\stlport_vc645.dll (39900 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404 (316 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.param (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Recorder.exe (17548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab8A6B.tmp (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe (20740 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (716 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar8A6C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404 (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadnode.bmp (306 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Camdata.ini (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\vscap.exe.manifest (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\hook.dll (3172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller_backup.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\leftpiece.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe.manifest (691 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamShapes.ini (408 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 (76 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smhtc (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar5FA1.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smht.exe (292406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamLayout.ini (408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar748A.tmp (2712 bytes)
%Program Files%\ShowMyPCService\sas.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton.bmp (1 bytes)
%Program Files%\ShowMyPCService\tvnserver.exe (6692 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7489.tmp (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\pack3500.zip (63171 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tvncontrol" = "%Program Files%\ShowMyPCService\tvnserver.exe -controlservice -slave" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
