Trojan.Win32.SwrortProxy_11d34aff10

Artemis!11D34AFF10B7 (McAfee), TrojanSwrortProxy.YR (Lavasoft MAS) Behaviour: Trojan The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete...
Blog rating:1.8 out of5 with4 ratings

Trojan.Win32.SwrortProxy_11d34aff10

by malwarelabrobot on June 24th, 2018 in Malware Descriptions.

Artemis!11D34AFF10B7 (McAfee), TrojanSwrortProxy.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 11d34aff10b788290a5677287c0f1e01
SHA1: 0f7b265e31af1308a4109ba77611690816e5fc15
SHA256: fa7acf34854d572ff850497f49d10c87b132cebe92aa28bce052c1471154983d
SSDeep: 49152:ze1ROQEVi2a4UCpvQ/pFeC7ooYXcRBZEda7Umd 2cv1677XKU5:ze1Ld2a4rOzooYMRBKooc tsXXKU5
Size: 2499304 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:46
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2932
spcplink.exe:3088
netsh.exe:3700
netsh.exe:3108
netsh.exe:2848
netsh.exe:2576
netsh.exe:3224
netsh.exe:2436
netsh.exe:1988
netsh.exe:2236
netsh.exe:3096
netsh.exe:4036
netsh.exe:3656
netsh.exe:1016
tvnserver.exe:2880

The Trojan injects its code into the following process(es):

SMPCSetup.exe:2268

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll (15168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCHelper.exe (23296 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\XDMessaging.dll (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\mm2.res (5520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\loading.html (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll.manifest (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdC92.tmp (142026 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\DiffieHellman.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smvnview.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\spcplink.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.manifest (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\screenhooks.dll (2392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Interop.WODVPNCOMLib.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\sas.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwg.exe (13584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Org.Mentalis.Security.dll (6584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe (23971 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\ICSharpCode.SharpZipLib.dll (7192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwinvnc.exe (19152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\tvnserver.exe (27504 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.config (234 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\settings.ini (12844 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smpcvc.exe (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Tamir.SharpSSH.dll (7192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\md5dll.dll (14 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\System.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\md5dll.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnC81.tmp (0 bytes)

The process SMPCSetup.exe:2268 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadpiece.bmp (676 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 (320 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab5FA0.tmp (53 bytes)
%Program Files%\ShowMyPCService\screenhooks.dll (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\rightpiece.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.command (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\stlport_vc645.dll (39900 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404 (316 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.param (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Recorder.exe (17548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab8A6B.tmp (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe (20740 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (716 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar8A6C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404 (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadnode.bmp (306 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Camdata.ini (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\vscap.exe.manifest (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\hook.dll (3172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller_backup.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\leftpiece.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe.manifest (691 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamShapes.ini (408 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 (76 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smhtc (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar5FA1.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smht.exe (292406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamLayout.ini (408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar748A.tmp (2712 bytes)
%Program Files%\ShowMyPCService\sas.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton.bmp (1 bytes)
%Program Files%\ShowMyPCService\tvnserver.exe (6692 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7489.tmp (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton2.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\pack3500.zip (63171 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7489.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar748A.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab5FA0.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab8A6B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar8A6C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar5FA1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:2932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process SMPCSetup.exe:2268 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\TightVNC\Server]
"BlockRemoteInput" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\TightVNC\Server]
"Password" = "15 7B 81 B1 93 93 20 60"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\ORL\WinVNC3]
"FileTransferEnabled" = "1"

[HKLM\SOFTWARE\TightVNC\Server]
"PollingInterval" = "300"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\TightVNC\Server]
"SmpcTest" = "11261"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\TightVNC\Server]
"BlockRemoteInput" = "0"

[HKLM\SOFTWARE\TightVNC\Server]
"EnableFileTransfers" = "1"
"FileTransferEnabled" = "1"

[HKCU\Software\TightVNC\Server]
"FileTransferEnabled" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\TightVNC\Server]
"AllowLoopback" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\TightVNC\Server]
"AlwaysShared" = "1"

[HKCU\Software\TightVNC\Server]
"EnableFileTransfers" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\TightVNC\Server]
"RfbPort" = "6900"

[HKCU\Software\ORL\WinVNC3]
"InputsEnabled" = "1"
"EnableFileTransfers" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\TightVNC\Server]
"RunControlInterface" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process spcplink.exe:3088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\SimonTatham\PuTTY\SshHostKeys]
"rsa2@443:svr7.showmypc.com" = "0x10001,0xefe637decef48136f95c36613366c777d805191e1bb4060939bce3cf70eef5527545b395f472ba68666d0d987277f564968c29ab494cf7f987f463731069971e14bbbfeee19cadb960fa46f07c23f2eac745cd7367156c176070e299f9539ad8875c2c8bcbe9a11725a32a53a84d8db92c4a9796984e7fc5a1905689e126e0be4e58e4a7fd4e75c182aafa2be3e6704477f310a1421aa20e8e1daeff6f5b5d2b96f3afeaec90f94f1b807a45cf77aa9bf9153f6db8ef6f6edfd28695b80b92b9d6b0b8f5a8e87c48078686f73cba3ff5811279075ff26bc85bfa2f942fd37b8bedc2086663aaa90b52ea7afae91de30865ce66d19a77fe9ccd5d6304ede40445"

The process netsh.exe:3700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:3108 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:2848 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:2576 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:3224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:2436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:1988 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:2236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:3096 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:4036 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:3656 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E\@%SystemRoot%\system32]
"eapqec.dll,-103" = "Microsoft Corporation"
"napipsec.dll,-1" = "IPsec Relying Party"
"napipsec.dll,-2" = "Provides IPsec based enforcement for Network Access Protection"
"napipsec.dll,-3" = "Microsoft Corporation"
"dhcpqec.dll,-101" = "Provides DHCP based enforcement for NAP"
"dhcpqec.dll,-100" = "DHCP Quarantine Enforcement Client"
"dhcpqec.dll,-103" = "1.0"
"dhcpqec.dll,-102" = "Microsoft Corporation"
"eapqec.dll,-101" = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."
"eapqec.dll,-102" = "1.0"
"tsgqec.dll,-100" = "RD Gateway Quarantine Enforcement Client"
"eapqec.dll,-100" = "EAP Quarantine Enforcement Client"
"tsgqec.dll,-102" = "1.0"
"tsgqec.dll,-103" = "Microsoft Corporation"
"napipsec.dll,-4" = "1.0"
"tsgqec.dll,-101" = "Provides RD Gateway enforcement for NAP"

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process netsh.exe:1016 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

The process tvnserver.exe:2880 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tvncontrol" = "%Program Files%\ShowMyPCService\tvnserver.exe -controlservice -slave"

Dropped PE files

MD5 File path
60c3820c4f56c77e3e8bece9d7a51842 c:\Program Files\ShowMyPCService\sas.dll
362ba3b724eb94eef488f6865d1b54e6 c:\Program Files\ShowMyPCService\screenhooks.dll
711561440fdc396cb6e4c69c13375a38 c:\Program Files\ShowMyPCService\tvnserver.exe
234b9052ad2010604bcae98c39672888 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\DiffieHellman.dll
c8164876b6f66616d68387443621510c c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\ICSharpCode.SharpZipLib.dll
29586496202e8896784072bffb9be667 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Interop.WODVPNCOMLib.dll
9353734293fb3f871f50a97a76fa9f9f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Org.Mentalis.Security.dll
d62408c656f54abb00b65498b6fbd1be c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCHelper.exe
b75b62ab07cdbe683574efa3d8ed1c2b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe
af76c9491a29477fe8a4bb57e3e40b4e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Tamir.SharpSSH.dll
e468eb5116950f766dc30198d10737f2 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\XDMessaging.dll
5986e6f66b3347b2e916714d80dcce7a c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe
3e7eca671e4ede8d7988031bc9f10276 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Recorder.exe
dbff0ae3444ceabcb11e5563b0a13211 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\hook.dll
8ad8871f21cfe557ae9efbbae5d999d8 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\stlport_vc645.dll
60c3820c4f56c77e3e8bece9d7a51842 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\sas.dll
362ba3b724eb94eef488f6865d1b54e6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\screenhooks.dll
49f5ad4781a082789e2aa531e38193b2 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smht.exe
0ceb92bc938674df03d1ad51f8ece6e1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smpcvc.exe
34167743b4047b5ff4bd41a165ce0aa2 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smvnview.exe
491e99207bba55d1bbb03346b0ae3a4e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwg.exe
87e700bd9fc23ed4286ac473e3979785 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwinvnc.exe
393bbaefd6c3cd31bdd329262dfbe660 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\spcplink.exe
711561440fdc396cb6e4c69c13375a38 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\tvnserver.exe
496123666f3871ab793fc03c3f838649 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 23130 23552 4.44841 0bc2ffd32265a08d72b795b18265828d
.rdata 28672 4496 4608 3.59163 f179218a059068529bdb4637ef5fa28e
.data 36864 110488 1024 3.26405 975304d6dd6c4a4f076b15511e2bbbc0
.ndata 147456 36864 0 0 d41d8cd98f00b204e9800998ecf8427e
.rsrc 184320 172488 172544 3.57863 d801dc8786a25e3f7b650b14c09126a5

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 103
a2cceb6f292cd23a8a76c7885b188016
486498e95eef4372309d9b0284467407
edcfba93bb8f7dcd15f960c156a0e4c3
bf6a9efbb17f27f1f25d4f6111697962
800ab49b44fe81d1fc2cb33d5c4670b9
38fffd2ce7c32ef0d4445e24f8d8f3dd
a4ca6649b4e628cd3056020fa7450daa
6b8ad0ba736cda80b9e5c4445d651977
09536a4a47d37c79f68796180700d46d
43dca8a483dd54808181e0e85ac1b160
c2468fb6431f470c4afb04876263d065
01fd1b7c4c20d597098e70898e328c4c
8034a0634411f43bc5568dd8def0406f
e296e887b82669cda327f1bcdb4b8ca4
1e716f783996fb1ad3e3bde173167605
f1d04f50a8828a09e79b45222ca06550
a97a91a3c351a54f6e6e9a9a71bf6bc0
89e89991483dc932c8455998adde0ca5
1649970c726f25e3b5cfca44639fcf01
64086f706cdd7c4cd86abc8ec3cc1600
94d19ab77ef5c742834466ec096685e5
76d6bcee41b833fa1ecce8b637dfbd4f
d492f4eefea839f43ad39186be493008
8d949a795a7bc179e8cc7d795a89ee2a
02765e84bce375cc65740af45fe2d098

URLs

URL IP
hxxp://a207.dscb.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s=
hxxp://a207.dscb.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs=
hxxp://showmypc.com/users/practice-web/logo.jpg?seq=6/23/2018 7:19:51 AM 173.255.253.123
hxxp://crl.usertrust.com.cdn.cloudflare.net/UTN-USERFirst-Object.crl 104.17.104.175
hxxp://showmypc.com/app/pack3500.zip?ci=practice-web&vr=3517 173.255.253.123
hxxp://a652.dscb.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEAiMquqMtE3p4sNkGxtE8Oo=
hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODOCodeSigningCA2.crl 104.16.90.188
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=-1&seq=636653352066332881 146.148.52.8
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=del&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&lmid=-1&lmh=5eda04ad4989f0494af9c944cd7601aa&seq=636653352069140886 146.148.52.8
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352086612917 146.148.52.8
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=del&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&lmid=&lmh=5eda04ad4989f0494af9c944cd7601aa&seq=636653352088016919 146.148.52.8
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352106892952 146.148.52.8
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=del&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&lmid=&lmh=fa4752cb89916421415fcd5aa99ce367&seq=636653352108296955 146.148.52.8
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352127172988 146.148.52.8
hxxp://servicert.showmypc.com/htv1/rtsrv.jsp?t=get&k=a86f5a320fb9f3729c8746f52ee5f821&ci=practice-web&tms=10&lmid=&seq=636653352208293130 146.148.52.8
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= 2.21.89.58
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= 2.21.89.58
hxxp://crl.comodoca.com/COMODOCodeSigningCA2.crl 104.16.90.188
hxxp://crl.usertrust.com/UTN-USERFirst-Object.crl 104.17.104.175
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEAiMquqMtE3p4sNkGxtE8Oo= 2.21.89.33
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 91.223.19.233
svr7.showmypc.com 50.18.219.142
assured.showmypc.com 173.255.253.123


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY SSLv3 outbound connection from client vulnerable to POODLE attack
ET POLICY SSH banner detected on TCP 443 likely proxy evasion

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps were not found.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:2932
    spcplink.exe:3088
    netsh.exe:3700
    netsh.exe:3108
    netsh.exe:2848
    netsh.exe:2576
    netsh.exe:3224
    netsh.exe:2436
    netsh.exe:1988
    netsh.exe:2236
    netsh.exe:3096
    netsh.exe:4036
    netsh.exe:3656
    netsh.exe:1016
    tvnserver.exe:2880

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll (15168 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCHelper.exe (23296 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\XDMessaging.dll (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\mm2.res (5520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\loading.html (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\wodVPN.dll.manifest (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdC92.tmp (142026 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\DiffieHellman.dll (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smvnview.exe (16944 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\spcplink.exe (16944 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.manifest (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\screenhooks.dll (2392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Interop.WODVPNCOMLib.dll (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\sas.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwg.exe (13584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Org.Mentalis.Security.dll (6584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\ICSharpCode.SharpZipLib.dll (7192 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smwinvnc.exe (19152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\tvnserver.exe (27504 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\SMPCSetup.exe.config (234 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\settings.ini (12844 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smpcvc.exe (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\Tamir.SharpSSH.dll (7192 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnD6D.tmp\md5dll.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadpiece.bmp (676 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 (320 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab5FA0.tmp (53 bytes)
    %Program Files%\ShowMyPCService\screenhooks.dll (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (471 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\rightpiece.bmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller.ini (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.command (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\stlport_vc645.dll (39900 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404 (316 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.param (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Recorder.exe (17548 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab8A6B.tmp (53 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe (20740 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (716 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.ini (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar8A6C.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (471 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404 (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\loadnode.bmp (306 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Camdata.ini (134 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamStudio.Producer.ini (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\vscap.exe.manifest (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_40C9AB7ADB4045727B7EDF9E3BB238B0 (688 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\hook.dll (3172 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\controller_backup.ini (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\leftpiece.bmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\Producer.exe.manifest (691 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (684 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamShapes.ini (408 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 (76 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smhtc (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar5FA1.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton2.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\pausebutton2.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0 (1480 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\smht.exe (292406 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\CamLayout.ini (408 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar748A.tmp (2712 bytes)
    %Program Files%\ShowMyPCService\sas.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (471 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\playbutton.bmp (1 bytes)
    %Program Files%\ShowMyPCService\tvnserver.exe (6692 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7489.tmp (53 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\record\controller\stopbutton2.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ShowMyPC\-11d34aff10b788290a5677287c0f1e01\pack3500.zip (63171 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "tvncontrol" = "%Program Files%\ShowMyPCService\tvnserver.exe -controlservice -slave"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Average: 1.8 (4 votes)

x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now