Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\smartpppoe.lnk
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SmartPPPoE.exe
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- C:\smartpppoe\tcl\tk8.5\demos\menu.tcl
- C:\smartpppoe\tcl\tk8.5\demos\license.terms
- C:\smartpppoe\tcl\tk8.5\demos\labelframe.tcl
- C:\smartpppoe\tcl\tk8.5\demos\label.tcl
- C:\smartpppoe\tcl\tk8.5\demos\knightstour.tcl
- C:\smartpppoe\tcl\tk8.5\demos\ixset
- C:\smartpppoe\tcl\tk8.5\demos\items.tcl
- C:\smartpppoe\tcl\tk8.5\demos\images\teapot.ppm
- C:\smartpppoe\tcl\tk8.5\demos\images\tcllogo.gif
- C:\smartpppoe\tcl\tk8.5\demos\images\pattern.xbm
- C:\smartpppoe\tcl\tk8.5\bgerror.tcl
- C:\smartpppoe\tcl\tk8.5\demos\images\noletter.xbm
- C:\smartpppoe\tcl\tk8.5\demos\images\letters.xbm
- C:\smartpppoe\tcl\tk8.5\demos\images\flagup.xbm
- C:\smartpppoe\tcl\tk8.5\demos\images\flagdown.xbm
- C:\smartpppoe\tcl\tk8.5\demos\images\face.xbm
- C:\smartpppoe\tcl\tk8.5\demos\images\earthris.gif
- C:\smartpppoe\tcl\tk8.5\demos\images\earth.gif
- C:\smartpppoe\tcl\tk8.5\demos\image2.tcl
- C:\smartpppoe\tcl\tk8.5\demos\image1.tcl
- C:\smartpppoe\tcl\tk8.5\demos\icon.tcl
- C:\smartpppoe\tcl\tk8.5\demos\hscale.tcl
- C:\smartpppoe\tcl\tk8.5\demos\mclist.tcl
- C:\smartpppoe\tcl\tk8.5\demos\menubu.tcl
- C:\smartpppoe\tcl\tk8.5\demos\toolbar.tcl
- C:\smartpppoe\tcl\tk8.5\demos\goldberg.tcl
- C:\smartpppoe\tcl\tk8.5\demos\msgbox.tcl
- C:\smartpppoe\tcl\tk8.5\demos\timer
- C:\smartpppoe\tcl\tk8.5\demos\textpeer.tcl
- C:\smartpppoe\tcl\tk8.5\demos\text.tcl
- C:\smartpppoe\tcl\tk8.5\demos\tcolor
- C:\smartpppoe\tcl\tk8.5\demos\tclindex
- C:\smartpppoe\tcl\tk8.5\demos\style.tcl
- C:\smartpppoe\tcl\tk8.5\demos\states.tcl
- C:\smartpppoe\tcl\tk8.5\demos\square
- C:\smartpppoe\tcl\tk8.5\demos\spin.tcl
- C:\smartpppoe\tcl\tk8.5\demos\search.tcl
- C:\smartpppoe\tcl\tk8.5\demos\sayings.tcl
- C:\smartpppoe\tcl\tk8.5\demos\ruler.tcl
- C:\smartpppoe\tcl\tk8.5\demos\rolodex
- C:\smartpppoe\tcl\tk8.5\demos\rmt
- C:\smartpppoe\tcl\tk8.5\demos\readme
- C:\smartpppoe\tcl\tk8.5\demos\radio.tcl
- C:\smartpppoe\tcl\tk8.5\demos\puzzle.tcl
- C:\smartpppoe\tcl\tk8.5\demos\plot.tcl
- C:\smartpppoe\tcl\tk8.5\demos\pendulum.tcl
- C:\smartpppoe\tcl\tk8.5\demos\paned2.tcl
- C:\smartpppoe\tcl\tk8.5\demos\paned1.tcl
- C:\smartpppoe\tcl\tk8.5\demos\nl.msg
- C:\smartpppoe\tcl\tk8.5\demos\hello
- C:\smartpppoe\tcl\tk8.5\demos\images\gray25.xbm
- C:\smartpppoe\tcl\tk8.5\demos\form.tcl
- C:\smartpppoe\tcl\tk8.5\demos\floor.tcl
- C:\smartpppoe\tcl\tk8.5\demos\tree.tcl
- C:\smartpppoe\tcl\tcl8.5\msgs\vi.msg
- C:\smartpppoe\tcl\tcl8.5\safe.tcl
- C:\smartpppoe\tcl\tcl8.5\parray.tcl
- C:\smartpppoe\tcl\tcl8.5\package.tcl
- C:\smartpppoe\tcl\tcl8.5\opt0.4\pkgindex.tcl
- C:\smartpppoe\tcl\tcl8.5\opt0.4\optparse.tcl
- C:\smartpppoe\tcl\tcl8.5\msgs\zh_tw.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\zh_sg.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\zh_hk.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\zh_cn.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\zh.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\uk.msg
- C:\smartpppoe\tcl\tcl8.5\tm.tcl
- C:\smartpppoe\tcl\tcl8.5\msgs\tr.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\th.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\te_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\te.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ta_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ta.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\sw.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\sv.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\sr.msg
- C:\smartpppoe\tcl\tcl8.5\word.tcl
- C:\smartpppoe\tcl\tcl8.5\msgs\sl.msg
- C:\smartpppoe\tcl\tk8.5\button.tcl
- C:\smartpppoe\tcl\tk8.5\clrpick.tcl
- C:\smartpppoe\tcl\tk8.5\demos\filebox.tcl
- C:\smartpppoe\tcl\tcl8.5\tclindex
- C:\smartpppoe\tcl\tk8.5\demos\entry3.tcl
- C:\smartpppoe\tcl\tk8.5\demos\entry2.tcl
- C:\smartpppoe\tcl\tk8.5\demos\entry1.tcl
- C:\smartpppoe\tcl\tk8.5\demos\en.msg
- C:\smartpppoe\tcl\tk8.5\demos\dialog2.tcl
- C:\smartpppoe\tcl\tk8.5\demos\dialog1.tcl
- C:\smartpppoe\tcl\tk8.5\demos\ctext.tcl
- C:\smartpppoe\tcl\tk8.5\demos\cscroll.tcl
- C:\smartpppoe\tcl\tk8.5\demos\combo.tcl
- C:\smartpppoe\tcl\tk8.5\demos\colors.tcl
- C:\smartpppoe\tcl\tk8.5\demos\clrpick.tcl
- C:\smartpppoe\tcl\tk8.5\demos\check.tcl
- C:\smartpppoe\tcl\tk8.5\demos\button.tcl
- C:\smartpppoe\tcl\tk8.5\demos\browse
- C:\smartpppoe\tcl\tk8.5\demos\bitmap.tcl
- C:\smartpppoe\tcl\tk8.5\demos\bind.tcl
- C:\smartpppoe\tcl\tk8.5\demos\arrow.tcl
- C:\smartpppoe\tcl\tk8.5\demos\aniwave.tcl
- C:\smartpppoe\tcl\tk8.5\demos\anilabel.tcl
- C:\smartpppoe\tcl\tk8.5\console.tcl
- C:\smartpppoe\tcl\tk8.5\comdlg.tcl
- C:\smartpppoe\tcl\tk8.5\choosedir.tcl
- C:\smartpppoe\tcl\tcl8.5\msgs\sq.msg
- C:\smartpppoe\tcl\tk8.5\demos\ttkbut.tcl
- C:\smartpppoe\tcl\tk8.5\license.terms
- C:\smartpppoe\tcl\tk8.5\ttk\spinbox.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\sizegrip.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\scrollbar.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\scale.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\progress.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\panedwindow.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\notebook.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\menubutton.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\fonts.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\entry.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\ttk.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\treeview.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\combobox.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\classictheme.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\clamtheme.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\button.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\aquatheme.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\alttheme.tcl
- C:\smartpppoe\tcl\tk8.5\tkfbox.tcl
- C:\smartpppoe\tcl\tk8.5\tk.tcl
- C:\smartpppoe\tcl\tk8.5\text.tcl
- C:\smartpppoe\tcl\tk8.5\tearoff.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\defaults.tcl
- C:\smartpppoe\tcl\tk8.5\scrlbar.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\utils.tcl
- C:\smartpppoe\uninstall.ini
- %HOMEPATH%\desktop\smartpppoe.lnk
- C:\smartpppoe\uninstall.exe
- C:\smartpppoe\_win32sysloader.pyd
- C:\smartpppoe\_tkinter.pyd
- C:\smartpppoe\_ssl.pyd
- C:\smartpppoe\_sqlite3.pyd
- C:\smartpppoe\_socket.pyd
- C:\smartpppoe\_hashlib.pyd
- C:\smartpppoe\_ctypes.pyd
- C:\smartpppoe\winxpgui.pyd
- C:\smartpppoe\win32ras.pyd
- C:\smartpppoe\win32process.pyd
- C:\smartpppoe\win32pipe.pyd
- C:\smartpppoe\win32gui.pyd
- C:\smartpppoe\win32api.pyd
- C:\smartpppoe\unicodedata.pyd
- C:\smartpppoe\tk85.dll
- C:\smartpppoe\tcl85.dll
- C:\smartpppoe\tcl\tk8.5\xmfbox.tcl
- C:\smartpppoe\tcl\tk8.5\unsupported.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\xptheme.tcl
- C:\smartpppoe\tcl\tk8.5\ttk\wintheme.tcl
- C:\smartpppoe\tcl\tk8.5\tclindex
- C:\smartpppoe\tcl\tk8.5\ttk\cursors.tcl
- C:\smartpppoe\tcl\tk8.5\spinbox.tcl
- C:\smartpppoe\tcl\tk8.5\scale.tcl
- C:\smartpppoe\tcl\tcl8.5\msgs\en_ph.msg
- C:\smartpppoe\tcl\tk8.5\demos\ttkmenu.tcl
- C:\smartpppoe\tcl\tk8.5\images\readme
- C:\smartpppoe\tcl\tk8.5\images\pwrdlogo75.gif
- C:\smartpppoe\tcl\tk8.5\images\pwrdlogo200.gif
- C:\smartpppoe\tcl\tk8.5\images\pwrdlogo175.gif
- C:\smartpppoe\tcl\tk8.5\images\pwrdlogo150.gif
- C:\smartpppoe\tcl\tk8.5\images\pwrdlogo100.gif
- C:\smartpppoe\tcl\tk8.5\images\pwrdlogo.eps
- C:\smartpppoe\tcl\tk8.5\images\logomed.gif
- C:\smartpppoe\tcl\tk8.5\images\logolarge.gif
- C:\smartpppoe\tcl\tk8.5\images\logo64.gif
- C:\smartpppoe\tcl\tk8.5\images\logo100.gif
- C:\smartpppoe\tcl\tk8.5\images\logo.eps
- C:\smartpppoe\tcl\tk8.5\focus.tcl
- C:\smartpppoe\tcl\tk8.5\entry.tcl
- C:\smartpppoe\tcl\tk8.5\dialog.tcl
- C:\smartpppoe\tcl\tk8.5\demos\widget
- C:\smartpppoe\tcl\tk8.5\demos\vscale.tcl
- C:\smartpppoe\tcl\tk8.5\demos\unicodeout.tcl
- C:\smartpppoe\tcl\tk8.5\demos\twind.tcl
- C:\smartpppoe\tcl\tk8.5\demos\ttkscale.tcl
- C:\smartpppoe\tcl\tk8.5\demos\ttkprogress.tcl
- C:\smartpppoe\tcl\tk8.5\demos\ttkpane.tcl
- C:\smartpppoe\tcl\tk8.5\images\tai-ku.gif
- C:\smartpppoe\tcl\tk8.5\demos\ttknote.tcl
- C:\smartpppoe\tcl\tk8.5\listbox.tcl
- C:\smartpppoe\tcl\tk8.5\menu.tcl
- C:\smartpppoe\tcl\tk8.5\mkpsenc.tcl
- C:\smartpppoe\tcl\tk8.5\pkgindex.tcl
- C:\smartpppoe\tcl\tk8.5\panedwindow.tcl
- C:\smartpppoe\tcl\tk8.5\palette.tcl
- C:\smartpppoe\tcl\tk8.5\optmenu.tcl
- C:\smartpppoe\tcl\tk8.5\obsolete.tcl
- C:\smartpppoe\tcl\tk8.5\msgs\sv.msg
- C:\smartpppoe\tcl\tk8.5\msgs\ru.msg
- C:\smartpppoe\tcl\tk8.5\msgs\pt.msg
- C:\smartpppoe\tcl\tk8.5\msgs\pl.msg
- C:\smartpppoe\tcl\tk8.5\msgs\nl.msg
- C:\smartpppoe\tcl\tk8.5\msgs\it.msg
- C:\smartpppoe\tcl\tk8.5\msgs\hu.msg
- C:\smartpppoe\tcl\tk8.5\msgs\fr.msg
- C:\smartpppoe\tcl\tk8.5\msgs\es.msg
- C:\smartpppoe\tcl\tk8.5\msgs\eo.msg
- C:\smartpppoe\tcl\tk8.5\msgs\en_gb.msg
- C:\smartpppoe\tcl\tk8.5\msgs\en.msg
- C:\smartpppoe\tcl\tk8.5\msgs\el.msg
- C:\smartpppoe\tcl\tk8.5\msgs\de.msg
- C:\smartpppoe\tcl\tk8.5\msgs\da.msg
- C:\smartpppoe\tcl\tk8.5\msgs\cs.msg
- C:\smartpppoe\tcl\tk8.5\msgbox.tcl
- C:\smartpppoe\tcl\tk8.5\safetk.tcl
- C:\smartpppoe\tcl\tcl8.5\msgs\sk.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\sh.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ru_ua.msg
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-4.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-3.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-2.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-16.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-15.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-14.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-13.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-10.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-1.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-6.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-8.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso2022.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\gb2312.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\gb2312-raw.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\gb1988.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\gb12345.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\euc-kr.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\euc-jp.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\euc-cn.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\ebcdic.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\dingbats.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso2022-kr.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso2022-jp.enc
- C:\smartpppoe\tcl\tcl8.5\init.tcl
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-9.enc
- C:\smartpppoe\tcl\tcl8.5\history.tcl
- C:\smartpppoe\tcl\tcl8.5\encoding\tis-620.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\symbol.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\shiftjis.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macukraine.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macturkish.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macthai.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macromania.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macroman.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macjapan.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\maciceland.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macgreek.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\macdingbats.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\maccyrillic.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\maccroatian.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\maccenteuro.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\ksc5601.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\koi8-u.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\koi8-r.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\jis0212.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\jis0208.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\jis0201.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp950.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp949.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-7.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp936.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp932.enc
- C:\smartpppoe\tcl\tcl8.5\clock.tcl
- C:\smartpppoe\microsoft.vc90.crt\msvcp90.dll
- C:\smartpppoe\sqlite3.dll
- C:\smartpppoe\smartpppoe.exe
- C:\smartpppoe\shared.lib
- C:\smartpppoe\select.pyd
- C:\smartpppoe\pywintypes27.dll
- C:\smartpppoe\python27.dll
- C:\smartpppoe\pyexpat.pyd
- C:\smartpppoe\pil._imagingtk.pyd
- C:\smartpppoe\pil._imaging.pyd
- C:\smartpppoe\microsoft.vc90.crt\msvcr90.dll
- C:\smartpppoe\microsoft.vc90.crt\msvcm90.dll
- C:\smartpppoe\tcl\tcl8.5\http1.0\pkgindex.tcl
- C:\smartpppoe\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- C:\smartpppoe\icon.ico
- C:\smartpppoe\devcon.exe
- C:\smartpppoe\connect.lib
- C:\smartpppoe\connect.dll
- C:\smartpppoe\bz2.pyd
- C:\smartpppoe\3.ico
- C:\smartpppoe\2.ico
- %TEMP%\$inst\temp_0.tmp
- C:\smartpppoe\tcl\tcl8.5\encoding\ascii.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\big5.enc
- C:\smartpppoe\tcl\tcl8.5\http1.0\http.tcl
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1251.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1250.enc
- C:\smartpppoe\tcl\tcl8.5\auto.tcl
- C:\smartpppoe\tcl\tcl8.5\encoding\cp869.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp866.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp865.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp864.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp863.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp862.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp861.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp860.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp857.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp855.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp852.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp850.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp775.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp737.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp437.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1258.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1257.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1256.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1255.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1254.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1253.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp1252.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\cp874.enc
- C:\smartpppoe\tcl\tcl8.5\encoding\iso8859-5.enc
- C:\smartpppoe\tcl\tcl8.5\msgs\af.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\it.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fa_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\is.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\id_id.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\id.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\hu.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\hr.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\hi_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\hi.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\he.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\gv_gb.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\gv.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\gl_es.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\gl.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ga_ie.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ga.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fr_ch.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fr_ca.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fr_be.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fr.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fo_fo.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fo.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fi.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fa_ir.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\af_za.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\it_ch.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ja.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\kl.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\kl_gl.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ro.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\pt_br.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\pt.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\pl.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\nn.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\nl_be.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\nl.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\nb.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\mt.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ms_my.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ms.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\mr_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\mr.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\mk.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\lv.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\lt.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\kw_gb.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\kw.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ko_kr.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\kok_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\kok.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ko.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ru.msg
- C:\smartpppoe\tcl\tk8.5\ttk\vistatheme.tcl
- %TEMP%\da7gzc
- C:\smartpppoe\tcl\tcl8.5\msgs\eu.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\da.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_hk.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_gb.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_ca.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_bw.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_be.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_au.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\el.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\de_be.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\de_at.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\de.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\cs.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ca.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\bn_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\bn.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\bg.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\be.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ar_sy.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ar_lb.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ar_jo.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ar_in.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\ar.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\eu_es.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\fa.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_nz.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_za.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_ie.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\et.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_ve.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_uy.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_sv.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_py.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_pr.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_pe.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_pa.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_ni.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_mx.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_hn.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_gt.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_ec.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_do.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_cr.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_co.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_cl.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_bo.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es_ar.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\es.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\eo.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_zw.msg
- C:\smartpppoe\tcl\tcl8.5\msgs\en_sg.msg
- C:\smartpppoe\connect.dll-journal
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\da7gzc
- C:\smartpppoe\connect.dll-journal
Substitutes the following files
- C:\smartpppoe\connect.dll-journal
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\smartpppoe\smartpppoe.exe'
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SmartPPPoE.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic nic get index"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=0 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=1 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=2 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=3 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=4 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=5 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=6 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=7 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=8 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=9 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=10 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=11 call enable"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=12 call enable"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "wmic nic get index"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=11 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=11 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=10 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=10 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=9 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=9 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=8 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=8 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=7 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=7 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=6 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=6 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=5 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=5 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=4 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=4 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=3 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=3 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=2 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=2 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=1 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=1 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=0 call enable
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=0 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' nic get index
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path win32_networkadapter where index=12 call enable"
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_networkadapter where index=12 call enable
