Worm.Win32.Vobfus.11.FD, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 8dc79bc10cbb62c4860443a08d219452
SHA1: 84fa3a94c68450b8e92b920a824ab4e776b80226
SHA256: e0771e1a71533f4e8f4045ce0a3e17e2cf5f1bffd5103ae19c20dd76fdfe9517
SSDeep: 49152:KZLn3WAmzGk8bQfBBfOvMWc02BPzbSH8Uyo1D6mpmAA21SH6kc2h5qqRl/gxEzjE:KZz3WHBNLm8021Vc1DVpC2P26qzusdWb
Size: 3052544 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Heaventools Software
Created at: 2004-08-04 09:01:37
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan-Dropper creates the following process(es):
%original file name%.exe:3400
SMPCSetup.exe:260
The Trojan-Dropper injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:3400 makes changes in the file system.
The Trojan-Dropper creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\MSWINSCK.OCX (3183 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smhtc (840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\sas.dll (903 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smht.exe (44593 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\i_obtnstr_JPN (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\i_vbtnstr_JPN (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smpcvndat (1911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smvnview.exe (11009 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\VNCHooks.dll (1414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\spcplink.exe (7706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCSetupSrv.exe (52216 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCHelper.exe (16026 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smpcvc.exe (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\TIPOFDAY.TXT (797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\ijl11.dll (2882 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\mm2.res (3261 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\screenhooks.dll (1498 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smwg.exe (7163 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\i_sbtnstr_JPN (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\tvnserver.exe (13977 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\settings.ini (3031 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe (71643 bytes)
The process SMPCSetup.exe:260 makes changes in the file system.
The Trojan-Dropper creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\info_48[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\dnserrordiagoff_webOC[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\httpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\dnserrordiagoff_webOC[2] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\down[1] (748 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ErrorPageTemplate[1] (2 bytes)
The Trojan-Dropper deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\dnserrordiagoff_webOC[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\errorPageStrings[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\ErrorPageTemplate[1] (0 bytes)
Registry activity
The process %original file name%.exe:3400 makes changes in the system registry.
The Trojan-Dropper creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan-Dropper adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"
The process SMPCSetup.exe:260 makes changes in the system registry.
The Trojan-Dropper creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"
[HKCU\Software\VB and VBA Program Settings\SmpcApp\Common]
"astart" = ""
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"EnableFileTracing" = "0"
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\SMPCSetup_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan-Dropper deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
Dropped PE files
MD5 | File path |
---|---|
9484c04258830aa3c2f2a70eb041414c | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\MSWINSCK.OCX |
d62408c656f54abb00b65498b6fbd1be | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCHelper.exe |
fbd475c35b6185001a00f9e044034cff | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe |
fbd475c35b6185001a00f9e044034cff | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCSetupSrv.exe |
2e5356f7c8938730dd5a639893d325f1 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\VNCHooks.dll |
a0ce0247d48fecaac607edb1e2d87fd8 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\ijl11.dll |
60c3820c4f56c77e3e8bece9d7a51842 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\sas.dll |
362ba3b724eb94eef488f6865d1b54e6 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\screenhooks.dll |
49f5ad4781a082789e2aa531e38193b2 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smht.exe |
0ceb92bc938674df03d1ad51f8ece6e1 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smpcvc.exe |
52541baa5793f240603b6afa1b908ae5 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smvnview.exe |
491e99207bba55d1bbb03346b0ae3a4e | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smwg.exe |
63c46d69f98b1bbf21a782e75308d9a6 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\spcplink.exe |
ba1a4c2adecb2228a9728b99a957c088 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\tvnserver.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:3400
SMPCSetup.exe:260 - Delete the original Trojan-Dropper file.
- Delete or disinfect the following files created/modified by the Trojan-Dropper:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\MSWINSCK.OCX (3183 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smhtc (840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\sas.dll (903 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smht.exe (44593 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\i_obtnstr_JPN (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\i_vbtnstr_JPN (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smpcvndat (1911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smvnview.exe (11009 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\VNCHooks.dll (1414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\spcplink.exe (7706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCSetupSrv.exe (52216 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCHelper.exe (16026 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smpcvc.exe (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\TIPOFDAY.TXT (797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\ijl11.dll (2882 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\mm2.res (3261 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\screenhooks.dll (1498 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\smwg.exe (7163 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\i_sbtnstr_JPN (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\tvnserver.exe (13977 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\settings.ini (3031 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe (71643 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\info_48[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\dnserrordiagoff_webOC[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\httpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\dnserrordiagoff_webOC[2] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\down[1] (748 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ErrorPageTemplate[1] (2 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"
Static Analysis
VersionInfo
Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 6.00.2900.2180
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE
Internal Name: Wextract
File Version: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: Language Neutral
Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 6.00.2900.2180Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE Internal Name: Wextract File Version: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)File Description: Win32 Cabinet Self-Extractor Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 39212 | 39424 | 4.55052 | 17a6fbe18a834b6f3462304415675d36 |
.data | 45056 | 7140 | 1024 | 2.94449 | 99858e86526942a66950c7139f78a725 |
.rsrc | 53248 | 3010656 | 3011072 | 5.53866 | e6264e2ef45e5f43d568cf796348de39 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan-Dropper connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_3400:
.text
.text
`.data
`.data
.rsrc
.rsrc
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
COMCTL32.dll
COMCTL32.dll
VERSION.dll
VERSION.dll
advapi32.dll
advapi32.dll
advpack.dll
advpack.dll
wininit.ini
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
Software\Microsoft\Windows\CurrentVersion\App Paths
setupapi.dll
setupapi.dll
setupx.dll
setupx.dll
IXPd.TMP
IXPd.TMP
TMP4351$.TMP
TMP4351$.TMP
FINISHMSG
FINISHMSG
USRQCMD
USRQCMD
ADMQCMD
ADMQCMD
msdownld.tmp
msdownld.tmp
wextract.pdb
wextract.pdb
PSSSSSSh
PSSSSSSh
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyA
GetWindowsDirectoryA
GetWindowsDirectoryA
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
rundll32.exe %s,InstallHinfSection %s 128 %s
rundll32.exe %s,InstallHinfSection %s 128 %s
SHELL32.DLL
SHELL32.DLL
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnce
PendingFileRenameOperations
PendingFileRenameOperations
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
wextract_cleanup%d
wextract_cleanup%d
%s /D:%s
%s /D:%s
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
Command.com /c %s
Command.com /c %s
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\
~~}}}|||3
~~}}}|||3
smpcvc.exe
smpcvc.exe
settings.ini
settings.ini
SMPCSetup.exe
SMPCSetup.exe
spcplink.exe
spcplink.exe
TIPOFDAY.TXT
TIPOFDAY.TXT
VNCHooks.dll
VNCHooks.dll
smvnview.exe
smvnview.exe
tvnserver.exe
tvnserver.exe
mm2.res
mm2.res
MSWINSCK.OCX
MSWINSCK.OCX
smht.exe
smht.exe
ijl11.dll
ijl11.dll
SMPCHelper.exe
SMPCHelper.exe
smwg.exe
smwg.exe
sas.dll
sas.dll
screenhooks.dll
screenhooks.dll
SMPCSetupSrv.exe
SMPCSetupSrv.exe
.nF&&
.nF&&
Fq=%f`{c
Fq=%f`{c
.XW%V
.XW%V
q(\.gah
q(\.gah
.rL#5
.rL#5
>.rpby
>.rpby
GWs.PS
GWs.PS
}(? 7.VNs
}(? 7.VNs
ur.CS
ur.CS
gg.uG
gg.uG
)Vt%FG
)Vt%FG
D%6s2
D%6s2
9.nHX3
9.nHX3
S;.MTY
S;.MTY
fB.lj
fB.lj
.uN.f1
.uN.f1
TO9h%U
TO9h%U
@.kzn
@.kzn
R!.Prc:2
R!.Prc:2
Tcp)q
Tcp)q
N-o%S
N-o%S
.oUZK
.oUZK
w@U4FTPT3
w@U4FTPT3
/83d%x
/83d%x
19~7|.st
19~7|.st
r1.DDR
r1.DDR
Rr%CV
Rr%CV
2!.VieQ/
2!.VieQ/
U#.GU
U#.GU
F%X&eb%
F%X&eb%
.BqGV
.BqGV
Z.Wc]}
Z.Wc]}
mb.cye
mb.cye
4.oGs: B=
4.oGs: B=
I:\IJ
I:\IJ
cW.jNe
cW.jNe
Bt[%X
Bt[%X
Lurl~!D
Lurl~!D
CmDW
CmDW
|.pRH
|.pRH
xv7Ã
xv7Ã
.hRtB
.hRtB
%4o7
%4o7
%f*(A\a
%f*(A\a
GFkQI%u
GFkQI%u
44h%F
44h%F
.po-*
.po-*
Rz%UF
Rz%UF
{=2/_..ZU__..O
{=2/_..ZU__..O
.xsO
.xsO
>
>
.UBiV
.UBiV
N/%Xw
N/%Xw
r*W;%X
r*W;%X
SUrLO
SUrLO
K.Yd)
K.Yd)
.VQ?]#
.VQ?]#
]MW_NT
]MW_NT
LTV%D
LTV%D
e&Si
e&Si
d.ZX$
d.ZX$
{1.dq
{1.dq
4.CzL
4.CzL
$9Â
$9Â
% .zgeI
% .zgeI
jVR.bI
jVR.bI
n[6.NP
n[6.NP
.Ls6bHQj
.Ls6bHQj
%U2OJ{
%U2OJ{
F0.Vw2,
F0.Vw2,
P&.ADB
P&.ADB
.EgX_
.EgX_
"YH%S(
"YH%S(
%f%8n
%f%8n
qA{j.gV&q
qA{j.gV&q
.oHo\
.oHo\
'g.qR
'g.qR
_.WKs4
_.WKs4
<.ek>
<.ek>
^4m%s[9I
^4m%s[9I
\F.de
\F.de
AiB.bM1
AiB.bM1
T.MAb;(f
T.MAb;(f
..yk^
..yk^
#%7Xh
#%7Xh
?.MXU
?.MXU
R7@%UO
R7@%UO
|ZEs%UdR
|ZEs%UdR
WKE.lD
WKE.lD
&v2{yO%D
&v2{yO%D
.zkU~
.zkU~
4we%f#
4we%f#
W^üG
W^üG
;z>~%C
;z>~%C
zf%SU
zf%SU
Tcp #
Tcp #
.nj>6
.nj>6
a%US%mQ%
a%US%mQ%
I%sNPnD
I%sNPnD
A= %C
A= %C
%Xy,Rf
%Xy,Rf
%Xf~3
%Xf~3
.AWmb
.AWmb
%Si=.
%Si=.
yUK>.Ix
yUK>.Ix
i%s"r
i%s"r
.iHu.%
.iHu.%
".fh1
".fh1
]%XW$
]%XW$
nG%d/
nG%d/
A^r:.YR
A^r:.YR
%%s)`>Ah
%%s)`>Ah
%DntA
%DntA
EwEB
EwEB
ZTI.FID@
ZTI.FID@
b%d 2
b%d 2
(.Zy(9
(.Zy(9
.pn?pB
.pn?pB
[UmSgz
[UmSgz
CR%SJ
CR%SJ
.Lhopf
.Lhopf
J.maY
J.maY
?M]%S
?M]%S
5%F$N
5%F$N
huco.dvK
huco.dvK
.oCXLK#
.oCXLK#
sshy]
sshy]
".jQY
".jQY
}?H%u
}?H%u
.jdl-
.jdl-
JIMSG
JIMSG
:dH.pS.
:dH.pS.
.DE_}QO
.DE_}QO
!wEbl
!wEbl
jh.bQ4`
jh.bQ4`
=ÿO
=ÿO
`h.xA
`h.xA
`E-W}
`E-W}
J4{.zGO
J4{.zGO
.lWG="
.lWG="
>%Usw
>%Usw
"o'%X
"o'%X
F2Hg%s
F2Hg%s
%fO>b
%fO>b
]$%D,
]$%D,
%C) F *
%C) F *
|-Q}k
|-Q}k
d8S.jX
d8S.jX
g"%SH Bv
g"%SH Bv
;.QPrh
;.QPrh
*Pe%f
*Pe%f
&iM%x
&iM%x
lm.uO
lm.uO
.oT>q
.oT>q
.xu3#UE
.xu3#UE
g%\.WX
g%\.WX
fi~ie%f
fi~ie%f
C@{%ds'
C@{%ds'
-GD}f
-GD}f
#.lZN
#.lZN
%s/>BA#
%s/>BA#
AM.DV
AM.DV
^?qY.eR
^?qY.eR
.fT2aYX
.fT2aYX
Us.Dyh:
Us.Dyh:
0Bg.hv
0Bg.hv
Q.CW`
Q.CW`
.VtP|
.VtP|
W>=.loa
W>=.loa
-h}uI
-h}uI
.Nv)2l)
.Nv)2l)
#.hyR5
#.hyR5
.uaeO
.uaeO
;%DS,
;%DS,
g%d!'
g%d!'
%X2Tj
%X2Tj
s.Sj}
s.Sj}
}B/
}B/
.xk4U
.xk4U
g.Zo4
g.Zo4
'B.tC7]
'B.tC7]
r.QWX
r.QWX
%fjU*
%fjU*
#v.Ik
#v.Ik
M9
M9
[T.eJ
[T.eJ
4%x*K
4%x*K
55M,T.WvB,
55M,T.WvB,
$.klH
$.klH
O,>%U
O,>%U
Z%2U:
Z%2U:
.EvMs
.EvMs
%XgB=s
%XgB=s
/-=;%
/-=;%
z=5.Jx
z=5.Jx
U.aI"}!
U.aI"}!
_}.yG
_}.yG
7}-.hq
7}-.hq
qc.Tqr
qc.Tqr
s%x#k
s%x#k
r.gyY
r.gyY
.hDm]p9%
.hDm]p9%
s&Iu-P}
s&Iu-P}
.Myzi
.Myzi
KCfdW%fG
KCfdW%fG
"w.nK
"w.nK
$e{%Us
$e{%Us
IJ.GE
IJ.GE
OPR%c
OPR%c
#%Sn.
#%Sn.
p~.ageN!
p~.ageN!
%Sjzm
%Sjzm
he.ypO
he.ypO
e.Zc81
e.Zc81
-.lE0N
-.lE0N
z]*.SDC
z]*.SDC
%U%o%
%U%o%
J=[.TW
J=[.TW
/ÞP
/ÞP
7S& @.Sn
7S& @.Sn
D)Z?'%F
D)Z?'%F
%xVF~
%xVF~
\-.ys%(
\-.ys%(
.YL.,X8mv
.YL.,X8mv
%x bq
%x bq
.Rh %
.Rh %
o"OM
o"OM
xb.xx
xb.xx
keyu
keyu
u~'.FN
u~'.FN
D%ds
D%ds
J\.KC
J\.KC
j$k=
j$k=
.sx!*
.sx!*
>%4Uu
>%4Uu
*b.uQx
*b.uQx
"SMPCSetup.exe"
"SMPCSetup.exe"
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
CFailed to get disk space information from: %s.
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
8Unable to retrieve operating system version information.!Memory allocation request failed.
Filetable full.Ên not change to destination folder.
Filetable full.Ên not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Error retrieving Windows folder
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
/C: -- Override Install Command defined by author.
/C: -- Override Install Command defined by author.
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
Could not find the file: %s.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
WEXTRACT.EXE
WEXTRACT.EXE
Windows
Windows
Operating System
Operating System
6.00.2900.2180
6.00.2900.2180
SMPCSetup.exe_260:
.text
.text
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
shdocvw.dll
shdocvw.dll
SHDocVwCtl.WebBrowser
SHDocVwCtl.WebBrowser
WebBrowser
WebBrowser
MSWINSCK.OCX
MSWINSCK.OCX
MSWinsockLib.Winsock
MSWinsockLib.Winsock
CmdOutput
CmdOutput
ModuleWindows
ModuleWindows
frmLogin
frmLogin
frmLoginService
frmLoginService
FormSSHSettings
FormSSHSettings
ModMsgDisp
ModMsgDisp
cMsgDisp
cMsgDisp
frmLogin1
frmLogin1
ws2_32.dll
ws2_32.dll
iphlpapi.dll
iphlpapi.dll
urlmon
urlmon
URLDownloadToFileA
URLDownloadToFileA
SHFileOperationA
SHFileOperationA
wininet.dll
wininet.dll
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
comdlg32.dll
comdlg32.dll
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
advapi32.dll
advapi32.dll
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
PrepareDotSSHFolder
PrepareDotSSHFolder
.httpConCheck
.httpConCheck
.%System%\winhttp.dll
.%System%\winhttp.dll
WinHttp
WinHttp
httpConCheck1
httpConCheck1
winHttpReqObj
winHttpReqObj
DebugReport
DebugReport
SupportRemoteUsers
SupportRemoteUsers
TextRemotePassword
TextRemotePassword
LabelRemotePassword
LabelRemotePassword
WebBrowserFooter2
WebBrowserFooter2
%WinDir%\System32\shdocvw.oca
%WinDir%\System32\shdocvw.oca
WebBrowser1
WebBrowser1
ShowKeyboardInfo
ShowKeyboardInfo
ShowParallelPortInfo
ShowParallelPortInfo
ShowSerialPortInfo
ShowSerialPortInfo
ShowPortConnectorInfo
ShowPortConnectorInfo
ShowSerialPortConfigurations
ShowSerialPortConfigurations
ReportProblem
ReportProblem
psapi.dll
psapi.dll
IsLegacyPassword
IsLegacyPassword
WriteExeProperty
WriteExeProperty
ReadExeProperty
ReadExeProperty
StartMeetingAfterGettingPorts
StartMeetingAfterGettingPorts
ReadSSHSettings
ReadSSHSettings
ForceSSHLogin
ForceSSHLogin
SendTerminateMsg
SendTerminateMsg
InviteUsersViaWeb
InviteUsersViaWeb
StartServerWithCurrentSSHPort
StartServerWithCurrentSSHPort
SwitchToBackUpSSH
SwitchToBackUpSSH
SSHHostConnection
SSHHostConnection
SetupHTTPtunnel
SetupHTTPtunnel
StartClientProcessAfterGettingPorts
StartClientProcessAfterGettingPorts
VerifyViewerSSH
VerifyViewerSSH
SSHViewerConnection
SSHViewerConnection
GenerateHostKey
GenerateHostKey
GetServerFromHostKey
GetServerFromHostKey
VBA6.DLL
VBA6.DLL
CreateAdditionalEXEAssociations
CreateAdditionalEXEAssociations
ValueKey
ValueKey
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegCreateKeyA
RegCreateKeyA
SectionKey
SectionKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyA
RegOpenKeyA
ClassKey
ClassKey
%System%\msvbvm60.dll\3
%System%\msvbvm60.dll\3
RegCreateKeyExA
RegCreateKeyExA
RegEnumKeyExA
RegEnumKeyExA
CreateEXEAssociation
CreateEXEAssociation
RegEnumKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegQueryInfoKeyA
KeyExists
KeyExists
CreateKey
CreateKey
DeleteKey
DeleteKey
__vbaStopExe
__vbaStopExe
CreatePipe
CreatePipe
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
TextSSHServer
TextSSHServer
kernel32.dll
kernel32.dll
WebBrowserMyList
WebBrowserMyList
TextLoginStatus
TextLoginStatus
cmdOK
cmdOK
cmdCancel
cmdCancel
cmdOK_Click
cmdOK_Click
ETextURL
ETextURL
LabelURL
LabelURL
txtPassword
txtPassword
user32.dll
user32.dll
StartMeetingWithNicePass
StartMeetingWithNicePass
SetSchPasswordOnServer
SetSchPasswordOnServer
SetCustomPass
SetCustomPass
cmdKick
cmdKick
%System%\MSWINSCK.oca
%System%\MSWINSCK.oca
cmdHost
cmdHost
cmdConnect
cmdConnect
menuPrivateMsg
menuPrivateMsg
cmdDisconnect
cmdDisconnect
LabelNickName
LabelNickName
cmdSend
cmdSend
cmdDeselect
cmdDeselect
SendMsgOnUserClick
SendMsgOnUserClick
TextProxyPass
TextProxyPass
TextPort
TextPort
FrameSSH
FrameSSH
LabelSSHPassword
LabelSSHPassword
LabelSSHPort
LabelSSHPort
LabelSSHServer
LabelSSHServer
ButtonSSHTest
ButtonSSHTest
CheckUseHttp
CheckUseHttp
TextSSHPort
TextSSHPort
TextSSHPassword
TextSSHPassword
TextSSHUserName
TextSSHUserName
RememberSSHSettings
RememberSSHSettings
ClearSSHSettings
ClearSSHSettings
winmm.dll
winmm.dll
CryptDeriveKey
CryptDeriveKey
CryptDestroyKey
CryptDestroyKey
GetNamedPipeInfo
GetNamedPipeInfo
olepro32.dll
olepro32.dll
msvbvm60.dll
msvbvm60.dll
%WinDir%\System32\stdole2.tlb
%WinDir%\System32\stdole2.tlb
msvfw32.dll
msvfw32.dll
ijl11.dll
ijl11.dll
Password
Password
Login
Login
~~}}}|||3
~~}}}|||3
&Password:
&Password:
ShowMyPC Web
ShowMyPC Web
Debug Report
Debug Report
Send Report
Send Report
Meeting Password:
Meeting Password:
Get password from presenter
Get password from presenter
Password:
Password:
Use Windows Remote Desktop
Use Windows Remote Desktop
00:00:00
00:00:00
Use HTTP Proxy Server
Use HTTP Proxy Server
HTTP Proxy Server
HTTP Proxy Server
Use SOCKS username/password
Use SOCKS username/password
Port:
Port:
Private SSH Server
Private SSH Server
HTTP / Proxy
HTTP / Proxy
Use HTTP to Connect (For Restrictive Firewalls)
Use HTTP to Connect (For Restrictive Firewalls)
Test Private SSH Server
Test Private SSH Server
SSH Server:
SSH Server:
TextURL
TextURL
Share URL
Share URL
Update Nick Name
Update Nick Name
Join
Join
Nick Name
Nick Name
SSH Encrypted
SSH Encrypted
div.tableContainer {
div.tableContainer {
html>body div.tableContainer {
html>body div.tableContainer {
div.tableContainer table {
div.tableContainer table {
html>body div.tableContainer table {
html>body div.tableContainer table {
thead.fixedHeader tr {
thead.fixedHeader tr {
/* this enables overflow to work on TBODY element. All other non-IE, non-Mozilla browsers */
/* this enables overflow to work on TBODY element. All other non-IE, non-Mozilla browsers */
html>body thead.fixedHeader tr {
html>body thead.fixedHeader tr {
thead.fixedHeader th {
thead.fixedHeader th {
thead.fixedHeader a, thead.fixedHeader a:link, thead.fixedHeader a:visited {
thead.fixedHeader a, thead.fixedHeader a:link, thead.fixedHeader a:visited {
thead.fixedHeader a:hover {
thead.fixedHeader a:hover {
html>body tbody.scrollContent {
html>body tbody.scrollContent {
/* hXXp://VVV.alistapart.com/articles/zebratables/ */
/* hXXp://VVV.alistapart.com/articles/zebratables/ */
tbody.scrollContent td, tbody.scrollContent tr.normalRow td {
tbody.scrollContent td, tbody.scrollContent tr.normalRow td {
tbody.scrollContent tr.alternateRow td {
tbody.scrollContent tr.alternateRow td {
/* hXXp://VVV.w3.org/TR/REC-CSS2/selector.html#adjacent-selectors */
/* hXXp://VVV.w3.org/TR/REC-CSS2/selector.html#adjacent-selectors */
html>body thead.fixedHeader th {
html>body thead.fixedHeader th {
html>body thead.fixedHeader th th {
html>body thead.fixedHeader th th {
html>body thead.fixedHeader th th th {
html>body thead.fixedHeader th th th {
html>body tbody.scrollContent td {
html>body tbody.scrollContent td {
html>body tbody.scrollContent td td {
html>body tbody.scrollContent td td {
html>body tbody.scrollContent td td td {
html>body tbody.scrollContent td td td {
Password for remote users
Password for remote users
Schedule using Web
Schedule using Web
Support Remote Users
Support Remote Users
File Transfer (Web based)...
File Transfer (Web based)...
Keyboard Info
Keyboard Info
Parallel Port Info
Parallel Port Info
Port Connector
Port Connector
Serial Port Configurations
Serial Port Configurations
Serial Port
Serial Port
Report a Problem...
Report a Problem...
HOME_URL
HOME_URL
callbackAfterGettingPorts
callbackAfterGettingPorts
attemptNumToGetPort
attemptNumToGetPort
httpConCheck
httpConCheck
supportID
supportID
hostkey
hostkey
sKeyNames
sKeyNames
iKeyCount
iKeyCount
sExePath
sExePath
bSupportPrint
bSupportPrint
bSupportNew
bSupportNew
bSupportInstall
bSupportInstall
eKey
eKey
sSectionKey
sSectionKey
sValueKey
sValueKey
viewerServiceURL
viewerServiceURL
LoginSucceeded
LoginSucceeded
AutoLogin
AutoLogin
meetingTypeSupport
meetingTypeSupport
remoteKey
remoteKey
sendPrivateMsg
sendPrivateMsg
uiMsg
uiMsg
o*\A\\smpcgate\H\vagish\ShowMyPC\current\FinalSMPCssh.vbp
o*\A\\smpcgate\H\vagish\ShowMyPC\current\FinalSMPCssh.vbp
2c49f800-c2dd-11cf-9ad6-0080c7e7b78d
2c49f800-c2dd-11cf-9ad6-0080c7e7b78d
WindowState
WindowState
tvnserver.exe
tvnserver.exe
smwinvnc.exe
smwinvnc.exe
smvnview.exe
smvnview.exe
winvncultra.exe
winvncultra.exe
hXXp://service1.showmypc.com/connectnow.php
hXXp://service1.showmypc.com/connectnow.php
f#p.x.gi52
f#p.x.gi52
hXXp://showmypc.com/ShowMyPCHelp.php?version=
hXXp://showmypc.com/ShowMyPCHelp.php?version=
hXXp://download3.showmypc.com/app/appheader.html?version=
hXXp://download3.showmypc.com/app/appheader.html?version=
hXXps://assured.showmypc.com/app/appheaderpr.html
hXXps://assured.showmypc.com/app/appheaderpr.html
hXXps://assured.showmypc.com/live/invite-users/index.php
hXXps://assured.showmypc.com/live/invite-users/index.php
hXXps://assured.showmypc.com/live/invite-users/screenshot-mail.php
hXXps://assured.showmypc.com/live/invite-users/screenshot-mail.php
hXXps://assured.showmypc.com/mac/meetnow.html
hXXps://assured.showmypc.com/mac/meetnow.html
hXXps://assured.showmyp.com/users/fixk.php?version=
hXXps://assured.showmyp.com/users/fixk.php?version=
hXXps://assured.showmypc.com/users/rsettings.php?vr=
hXXps://assured.showmypc.com/users/rsettings.php?vr=
hXXp://showmypc.com/users/rsettings.php?vr=
hXXp://showmypc.com/users/rsettings.php?vr=
up-msg
up-msg
pop-msg
pop-msg
no-pop-msg
no-pop-msg
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
smpcchat.ini
smpcchat.ini
[Joined]
[Joined]
Srv.exe
Srv.exe
Error occured during operation.
Error occured during operation.
Unsupported value type
Unsupported value type
Failed to delete requested subkey!
Failed to delete requested subkey!
Registry Key Delete
Registry Key Delete
Failed to delete requested main key!
Failed to delete requested main key!
\temp.html
\temp.html
Keyboard - Win32_Keyboard
Keyboard - Win32_Keyboard
ProtocolSupported
ProtocolSupported
Select * from Win32_Keyboard
Select * from Win32_Keyboard
Number of Function Keys
Number of Function Keys
NumberOfFunctionKeys
NumberOfFunctionKeys
Parallel ports - Win32_ParallelPort
Parallel ports - Win32_ParallelPort
Select * from Win32_ParallelPort
Select * from Win32_ParallelPort
Protocol Supported
Protocol Supported
Port connector - Win32_PortConnector
Port connector - Win32_PortConnector
Select * from Win32_PortConnector
Select * from Win32_PortConnector
Port Type
Port Type
PortType
PortType
Serial port configuration - Win32_SerialPortConfiguration
Serial port configuration - Win32_SerialPortConfiguration
Select * from Win32_SerialPortConfiguration
Select * from Win32_SerialPortConfiguration
Serial ports - Win32_SerialPort
Serial ports - Win32_SerialPort
Select * from Win32_SerialPort
Select * from Win32_SerialPort
Supports DTRDSR
Supports DTRDSR
Supports16BitMode
Supports16BitMode
Supports 16-Bit Mode
Supports 16-Bit Mode
SupportsDTRDSR
SupportsDTRDSR
Supports Elapsed Timeouts
Supports Elapsed Timeouts
SupportsElapsedTimeouts
SupportsElapsedTimeouts
Supports Int Timeouts
Supports Int Timeouts
SupportsIntTimeouts
SupportsIntTimeouts
Supports Parity Check
Supports Parity Check
SupportsParityCheck
SupportsParityCheck
Supports RLSD
Supports RLSD
SupportsRLSD
SupportsRLSD
Supports RTSCTS
Supports RTSCTS
SupportsRTSCTS
SupportsRTSCTS
Supports Special Characters
Supports Special Characters
SupportsSpecialCharacters
SupportsSpecialCharacters
Supports XOn XOff
Supports XOn XOff
SupportsXOnXOff
SupportsXOnXOff
Supports XOn XOff Setting
Supports XOn XOff Setting
SupportsXOnXOffSet
SupportsXOnXOffSet
Supports Hot Plug
Supports Hot Plug
SupportsHotPlug
SupportsHotPlug
VccMixedVoltageSupport
VccMixedVoltageSupport
VCC Mixed Voltage Support
VCC Mixed Voltage Support
VppMixedVoltageSupport
VppMixedVoltageSupport
VPP Mixed Voltage Support
VPP Mixed Voltage Support
Maximum Memory Supported
Maximum Memory Supported
MaxMemorySupported
MaxMemorySupported
Monochrome
Monochrome
Power Management Supported
Power Management Supported
PowerManagementSupported
PowerManagementSupported
SupportedSRAM
SupportedSRAM
Supported SRAM
Supported SRAM
Maximum Baud Rate To SerialPort
Maximum Baud Rate To SerialPort
MaxBaudRateToSerialPort
MaxBaudRateToSerialPort
Port SubClass
Port SubClass
PortSubClass
PortSubClass
Responses Key Name
Responses Key Name
ResponsesKeyName
ResponsesKeyName
Select * from Win32_OperatingSystem
Select * from Win32_OperatingSystem
Operating systems
Operating systems
Windows Directory
Windows Directory
WindowsDirectory
WindowsDirectory
Operating systems
Operating systems
Windows Directory
Windows Directory
hXXps://assured.showmypc.com/remotedb.php
hXXps://assured.showmypc.com/remotedb.php
hXXp://showmypc.com/remotedb.php
hXXp://showmypc.com/remotedb.php
hXXp://download3.showmypc.com/app/about-us.html
hXXp://download3.showmypc.com/app/about-us.html
hXXps://assured.showmypc.com/portxxxxxmlxxx-351.php
hXXps://assured.showmypc.com/portxxxxxmlxxx-351.php
download3.showmypc.com
download3.showmypc.com
ns2.showmypc.com
ns2.showmypc.com
\SMPCHelper.exe
\SMPCHelper.exe
\mmi.res
\mmi.res
winvnc.exe
winvnc.exe
winvnc4.exe
winvnc4.exe
hXXps://assured.showmypc.com/live/appsettings.php?ci=
hXXps://assured.showmypc.com/live/appsettings.php?ci=
connectnowurl
connectnowurl
hXXp://showmypc.appspot.com/connectnow.php
hXXp://showmypc.appspot.com/connectnow.php
Software\Microsoft\Windows\CurrentVersion\Policies\System
Software\Microsoft\Windows\CurrentVersion\Policies\System
RegKey
RegKey
&mtpass=
&mtpass=
Please visit hXXp://showmypc.com for help or update information.
Please visit hXXp://showmypc.com for help or update information.
/chat/index.php?myroom=
/chat/index.php?myroom=
showmypc.com
showmypc.com
hXXp://showmypc.com/users/
hXXp://showmypc.com/users/
\settings.ini
\settings.ini
Getting Port 1
Getting Port 1
hXXps://assured.showmypc.com
hXXps://assured.showmypc.com
hXXp://ns2.showmypc.com
hXXp://ns2.showmypc.com
Getting Port 2
Getting Port 2
hXXp://ns1.showmypc.com
hXXp://ns1.showmypc.com
Getting Port 3
Getting Port 3
UEMURL
UEMURL
InternetExplorer.Application
InternetExplorer.Application
hXXp://showmypc.com/emailHandler.php?seq=
hXXp://showmypc.com/emailHandler.php?seq=
AutoPortSelect
AutoPortSelect
PortNumber
PortNumber
RfbPort
RfbPort
AlwaysShared
AlwaysShared
?task=get&actionToPut=connect&keyToPut=
?task=get&actionToPut=connect&keyToPut=
hXXps://assured.showmypc.com/users/rsettings.php?vr=3096
hXXps://assured.showmypc.com/users/rsettings.php?vr=3096
hXXp://showmypc.com/users/rsettings.php?vr=3096
hXXp://showmypc.com/users/rsettings.php?vr=3096
hXXps://assured.
hXXps://assured.
hXXp://
hXXp://
hXXp://localhost:
hXXp://localhost:
/ok.html
/ok.html
/ok.html?seq=
/ok.html?seq=
Windows 2000
Windows 2000
hXXp://localhost:5800/?s=
hXXp://localhost:5800/?s=
?task=put&actionToPut=connect&keyToPut=
?task=put&actionToPut=connect&keyToPut=
?task=del&actionToPut=connect&keyToPut=
?task=del&actionToPut=connect&keyToPut=
hXXps://assured.showmypc.com/getClientStatus.php?ci=
hXXps://assured.showmypc.com/getClientStatus.php?ci=
\smpcvc.exe
\smpcvc.exe
\mm2.res
\mm2.res
Error closing key.
Error closing key.
WScript.Shell
WScript.Shell
Windows_NT
Windows_NT
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Cannot enable Remote Desktop on Windows 2000, use VNC
Cannot enable Remote Desktop on Windows 2000, use VNC
smwg.exe --no-check-certificate -O
smwg.exe --no-check-certificate -O
01/01/2009
01/01/2009
HTTP/1.0
HTTP/1.0
VVV.example
VVV.example
/index.asp
/index.asp
mypassword
mypassword
HTTP/1.1
HTTP/1.1
Windows 95
Windows 95
Windows 98
Windows 98
Windows Millennium
Windows Millennium
Windows NT 3.51
Windows NT 3.51
Windows NT 4.0
Windows NT 4.0
Windows XP
Windows XP
Windows 7
Windows 7
Msxml2.XMLHTTP
Msxml2.XMLHTTP
Microsoft.XMLHTTP
Microsoft.XMLHTTP
application/x-www-form-urlencoded
application/x-www-form-urlencoded
Msxml2.XMLHTTP.6.0
Msxml2.XMLHTTP.6.0
Msxml2.XMLHTTP.3.0
Msxml2.XMLHTTP.3.0
N:\home\vagish\ShowMyPC\showmypc-windows-bin-src\combo.exe
N:\home\vagish\ShowMyPC\showmypc-windows-bin-src\combo.exe
N:\home\vagish\ShowMyPC\showmypc-windows-bin-src\ShowMyPCPremium.exe
N:\home\vagish\ShowMyPC\showmypc-windows-bin-src\ShowMyPCPremium.exe
N:\home\vagish\ShowMyPC\showmypc-windows-bin-src\setall.bmp
N:\home\vagish\ShowMyPC\showmypc-windows-bin-src\setall.bmp
\combo.exe
\combo.exe
Getting Port
Getting Port
_MSG_ST_SVR
_MSG_ST_SVR
ENG_MSG_GN_ERR
ENG_MSG_GN_ERR
hXXp://VVV.vb2themax.com/vbmaximizer/files/vbm_demo.zip
hXXp://VVV.vb2themax.com/vbmaximizer/files/vbm_demo.zip
c:\vbm_demo.zip
c:\vbm_demo.zip
hXXp://showmypc.com/ShowMyPCHelp.php?version=3096
hXXp://showmypc.com/ShowMyPCHelp.php?version=3096
supportView
supportView
Share Password
Share Password
Do you wish to update exe with new ID.
Do you wish to update exe with new ID.
explorer.exe
explorer.exe
Cannot connect, Check SSH settings file.
Cannot connect, Check SSH settings file.
spcplink.exe
spcplink.exe
Testing SSH Connection...
Testing SSH Connection...
\res.txt
\res.txt
SSH Test Failed
SSH Test Failed
_MSG_DISCON
_MSG_DISCON
_MSG_WARNING
_MSG_WARNING
_MSG_GN_ERR
_MSG_GN_ERR
Check UI or settings.ini file, SSHServer is missing
Check UI or settings.ini file, SSHServer is missing
Check UI or settings.ini file, SSHUserName is missing
Check UI or settings.ini file, SSHUserName is missing
Check UI or settings.ini file, SSHPassword is missing
Check UI or settings.ini file, SSHPassword is missing
Check UI or settings.ini file, SSHPort is missing, using default 22
Check UI or settings.ini file, SSHPort is missing, using default 22
smpc.com443
smpc.com443
hXXps://secure.showmypc.com/transfer/index.php?cl=app&ver=
hXXps://secure.showmypc.com/transfer/index.php?cl=app&ver=
hXXp://download3.showmypc.com/app/appheader.html?version=3096
hXXp://download3.showmypc.com/app/appheader.html?version=3096
\explorer.exe
\explorer.exe
hXXps://showmypc.appspot.com/connectnow.php
hXXps://showmypc.appspot.com/connectnow.php
generatepasscode
generatepasscode
msgdesp
msgdesp
_MSG_LOGIN_FRM
_MSG_LOGIN_FRM
_MSG_LBL_HOST
_MSG_LBL_HOST
_MSG_LBL_PASS
_MSG_LBL_PASS
_MSG_LBL_EMAIL
_MSG_LBL_EMAIL
_MSG_LBL_TOP
_MSG_LBL_TOP
_MSG_LBL_CK_SRV
_MSG_LBL_CK_SRV
_MSG_LBL_OK
_MSG_LBL_OK
_MSG_LBL_CANCEL
_MSG_LBL_CANCEL
_MSG_FRM_SCH_MT
_MSG_FRM_SCH_MT
_MSG_LBL_HOST_EMAIL
_MSG_LBL_HOST_EMAIL
_MSG_LBL_MT_PASS
_MSG_LBL_MT_PASS
_MSG_LBL_MT_INFO
_MSG_LBL_MT_INFO
_MSG_SHARE_APP
_MSG_SHARE_APP
_MSG_REFRESH
_MSG_REFRESH
_MSG_CLOSE
_MSG_CLOSE
smvi.exe
smvi.exe
LoginFrmCaption
LoginFrmCaption
LoginPasLabel
LoginPasLabel
LoginTopCaption
LoginTopCaption
HomeURL
HomeURL
smht.exe
smht.exe
SSH Protocol Version 2, AES 256
SSH Protocol Version 2, AES 256
rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,3
rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,3
hXXp://showmypc.com/ShowMyPCFeedBack.html?cl=app&ver=
hXXp://showmypc.com/ShowMyPCFeedBack.html?cl=app&ver=
outlook.exe
outlook.exe
Outlook.Application
Outlook.Application
Password:
Password:
Or visit hXXp://
Or visit hXXp://
.showmypc.com
.showmypc.com
Password:
Password:
Reconnecting SSH...
Reconnecting SSH...
Restarting SSH
Restarting SSH
Using HTTP...
Using HTTP...
\spcplink.exe
\spcplink.exe
-N -C -v -ssh -2 -P
-N -C -v -ssh -2 -P
Starting SSH Connection...
Starting SSH Connection...
\smsh.exe -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p 443 -N
\smsh.exe -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p 443 -N
\smsh.exe
\smsh.exe
passcodegenerated
passcodegenerated
_MSG_UN_ERR
_MSG_UN_ERR
HTTP Connect...
HTTP Connect...
Starting with current port
Starting with current port
_MSG_GENER
_MSG_GENER
_MSG_SHR_ST
_MSG_SHR_ST
hXXps://assured.showmypc.com/live/mailer.php?sa=1&et=
hXXps://assured.showmypc.com/live/mailer.php?sa=1&et=
\smht.exe
\smht.exe
-C -ssh -2 -P
-C -ssh -2 -P
Connecting via HTTP...
Connecting via HTTP...
hostKey=
hostKey=
_MSG_ST_SSH
_MSG_ST_SSH
_MSG_SSHRST
_MSG_SSHRST
PROXY_AUTH_PASSTHROUGH
PROXY_AUTH_PASSTHROUGH
PROXY_AUTH_PASS
PROXY_AUTH_PASS
PROXY_PORT
PROXY_PORT
PORTMAP
PORTMAP
443 ssh
443 ssh
80 ssh
80 ssh
hXXp://localhost:4080/ok.html?
hXXp://localhost:4080/ok.html?
_MSG_CONN
_MSG_CONN
_MSG_WR_PASS
_MSG_WR_PASS
Check Version or Incorrect Password.
Check Version or Incorrect Password.
_MSG_ST_VIEW
_MSG_ST_VIEW
_MSG_SSH_ERR
_MSG_SSH_ERR
-C -v -ssh -2 -P
-C -v -ssh -2 -P
mstsc.exe /v:127.0.0.1:
mstsc.exe /v:127.0.0.1:
host=127.0.0.1
host=127.0.0.1
Port =
Port =
password =
password =
_MSG_VIEW_ST
_MSG_VIEW_ST
hXXps://assured.showmypc.com/room.html?vr=
hXXps://assured.showmypc.com/room.html?vr=
Warning, check password or get latest version from hXXp://showmypc.com
Warning, check password or get latest version from hXXp://showmypc.com
Would you like to send full report, it can take upto 30 secs
Would you like to send full report, it can take upto 30 secs
Generating report please wait...
Generating report please wait...
hXXps://assured.showmypc.com/live/mailer.php
hXXps://assured.showmypc.com/live/mailer.php
&de=1&sb=Debug Report (
&de=1&sb=Debug Report (
Could not send report, please copy text and email it to support@showmypc.com
Could not send report, please copy text and email it to support@showmypc.com
Report Sent
Report Sent
Password cannot be blank.
Password cannot be blank.
Meeting Password cannot less than 6 characters.
Meeting Password cannot less than 6 characters.
Check Password, Check Network or Meeting may not have started.
Check Password, Check Network or Meeting may not have started.
Use standard password.
Use standard password.
_MSG_YOUR_EMAIL
_MSG_YOUR_EMAIL
WMEncEng.WMEncoder
WMEncEng.WMEncoder
Video files (*.wmv)|*.wmv|All files (*.*)|*.*
Video files (*.wmv)|*.wmv|All files (*.*)|*.*
Windows Media Encoder might not be installed.
Windows Media Encoder might not be installed.
WMENC_HELP_URL
WMENC_HELP_URL
hXXp://showmypc.com/service/wmencoder.html
hXXp://showmypc.com/service/wmencoder.html
Password must be atleast 2 characters. No Spaces.
Password must be atleast 2 characters. No Spaces.
Password must be atleast 8 characters. No Spaces.
Password must be atleast 8 characters. No Spaces.
\mmit.res
\mmit.res
New Password
New Password
smsh.exe
smsh.exe
SMPCSetupSrv.exe
SMPCSetupSrv.exe
@reconnect.session
@reconnect.session
\smpcvc.exe
\smpcvc.exe
\SMPCSetupSrv.exe
\SMPCSetupSrv.exe
\smwg.exe
\smwg.exe
\sas.dll
\sas.dll
\screenhooks.dll
\screenhooks.dll
c:\cygwin
c:\cygwin
d:\cygwin
d:\cygwin
e:\cygwin
e:\cygwin
\cygcrypto-0.9.8.dll
\cygcrypto-0.9.8.dll
\cygminires.dll
\cygminires.dll
\cygwin1.dll
\cygwin1.dll
\cygz.dll
\cygz.dll
HttpPort
HttpPort
Please Save Password.
Please Save Password.
\ultravnc.ini
\ultravnc.ini
c:\.ssh
c:\.ssh
c:\cygwin\.ssh
c:\cygwin\.ssh
d:\cygwin\.ssh
d:\cygwin\.ssh
d:\.ssh
d:\.ssh
Invalid Password, try again!
Invalid Password, try again!
sshremem
sshremem
sshusr
sshusr
sshaut
sshaut
Check your network. Server not available. Check version or Contact support@showmypc.com
Check your network. Server not available. Check version or Contact support@showmypc.com
joined.
joined.
One or more connections are currently open. Disconnect before attempting to change the port settings.
One or more connections are currently open. Disconnect before attempting to change the port settings.
.cRegistry
.cRegistry
Failed to create registry Key: '
Failed to create registry Key: '
Failed to delete registry Key: '
Failed to delete registry Key: '
Failed to open key '
Failed to open key '
',Key: '
',Key: '
Failed to set registry value Key: '
Failed to set registry value Key: '
Invalid parameter list passed to CreateAdditionalEXEAssociations - expected Name/Text/Command
Invalid parameter list passed to CreateAdditionalEXEAssociations - expected Name/Text/Command
Make sure you have Windows Remote Desktop Enabled on Remote Machine.
Make sure you have Windows Remote Desktop Enabled on Remote Machine.
surl
surl
spcplink.exe -v -ssh -2 -P
spcplink.exe -v -ssh -2 -P
hXXp://showmypc.com/service/how-to-install-service/index.html?cl=app&ver=
hXXp://showmypc.com/service/how-to-install-service/index.html?cl=app&ver=
hXXps://assured.showmypc.com/service/readpclist.php?task=pclstgoog&ci=
hXXps://assured.showmypc.com/service/readpclist.php?task=pclstgoog&ci=
hXXp://showmypc.com/service/readpclist.php?task=pclstgoog&ci=
hXXp://showmypc.com/service/readpclist.php?task=pclstgoog&ci=
Test Complete. If Command Window is open, the SSH test passed, failed if it is closed.
Test Complete. If Command Window is open, the SSH test passed, failed if it is closed.
smpctestkey
smpctestkey
\Test_Report_
\Test_Report_
.html
.html
hXXp://showmypc.com/ok.html
hXXp://showmypc.com/ok.html
assetauthkey
assetauthkey
Verify Remote Port Manager
Verify Remote Port Manager
test.ini
test.ini
smpcval1
smpcval1
\test.ini
\test.ini
Verify Get Parent Exe Name
Verify Get Parent Exe Name
Verify SSH to Host Connection
Verify SSH to Host Connection
Verify Web Browser Control
Verify Web Browser Control
hXXps://assured.showmypc.com/ok.html
hXXps://assured.showmypc.com/ok.html
Verify Get Windows Version Information
Verify Get Windows Version Information
\ShowMyPCSSH.exe
\ShowMyPCSSH.exe
hXXp://showmypc.com/ShowMyPCSSH.exe
hXXp://showmypc.com/ShowMyPCSSH.exe
Test Passed:
Test Passed:
temp.jpg
temp.jpg
Uploading Screen Shot to URL...
Uploading Screen Shot to URL...
hXXps://showmypcup.appspot.com/up?ac=sht&t=u&iid=
hXXps://showmypcup.appspot.com/up?ac=sht&t=u&iid=
hXXps://assured.showmypc.com/broadcast/screenshot.html?ac=sht&iid=
hXXps://assured.showmypc.com/broadcast/screenshot.html?ac=sht&iid=
.cDIBSection
.cDIBSection
.mIntelJPEGLibrary
.mIntelJPEGLibrary
ADODB.Stream
ADODB.Stream
MSXML2.XMLHTTP
MSXML2.XMLHTTP
hXXp://showmypc.appspot.com/up?iid=56406&t=u&img=
hXXp://showmypc.appspot.com/up?iid=56406&t=u&img=
hXXp://showmypc.appspot.com/up
hXXp://showmypc.appspot.com/up
ADODB.Recordset
ADODB.Recordset
wscript.shell
wscript.shell
Upload file using http And multipart/form-data
Upload file using http And multipart/form-data
[cscript|wscript] fupload.vbs file url [fieldname]
[cscript|wscript] fupload.vbs file url [fieldname]
url ... URL which can accept uploaded data
url ... URL which can accept uploaded data
curl -k -F img=@
curl -k -F img=@
Content-Disposition: form-data; name="key"
Content-Disposition: form-data; name="key"
users/vnarang/3.gif
users/vnarang/3.gif
hXXp://s3.showmypc.com/ok.html
hXXp://s3.showmypc.com/ok.html
Content-Disposition: form-data; name="AWSAccessKeyId"
Content-Disposition: form-data; name="AWSAccessKeyId"
Content-Disposition: form-data; name="file"; filename="3.gif"
Content-Disposition: form-data; name="file"; filename="3.gif"
hXXp:///
hXXp:///
A*\A\\smpcgate\H\vagish\ShowMyPC\current\FinalSMPCssh.vbp
A*\A\\smpcgate\H\vagish\ShowMyPC\current\FinalSMPCssh.vbp
ShowMyPC.com Comments
ShowMyPC.com Comments
ShowMyPC.com
ShowMyPC.com
6.01.0979
6.01.0979
SMPCSetup.exe
SMPCSetup.exe