Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe' /bc
- '<SYSTEM32>\grpconv.exe' -o
- '%APPDATA%\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Kur.cmd" "
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '%TEMP%\is-NBDQG.tmp\setup.tmp' /SL5="$10136,6115574,235520,%APPDATA%\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-MV3JT.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5EI20.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VATV2.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-HL4TN.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-4GNRI.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-13N24.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-4C303.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-I9IU2.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RFJBI.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0CNPH.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-365JO.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-27FTA.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6DDAQ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-JRIUC.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
- %WINDIR%\inf\oem3.inf
- <LS_APPDATA>\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat
- <DRIVERS>\SET3.tmp
- %WINDIR%\inf\oem3.PNF
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-CPO0H.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-AMDTI.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-NRI71.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
- %TEMP%\is-09G4F.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-NBDQG.tmp\setup.tmp
- %APPDATA%\x.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-IHGRJ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-NHNDR.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5ISIP.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CF1CD.tmp
- %APPDATA%\english.ini
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %APPDATA%\Kur.cmd
- %TEMP%\$inst\0001.tmp
- %APPDATA%\setup.exe
- %APPDATA%\RevoUninPro.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-56K76.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-SSVNU.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FP0RI.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VD4PM.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-IPUBC.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-N06S6.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-ABILD.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GGIM2.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S09KF.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-P93TD.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-O6659.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-1AM94.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S94SG.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5MELK.tmp
Удаляет следующие файлы:
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\temp_0.tmp
Перемещает следующие файлы:
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-27FTA.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6DDAQ.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5EI20.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VATV2.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-JRIUC.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RFJBI.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0CNPH.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-365JO.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-I9IU2.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-AMDTI.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-NRI71.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
- <DRIVERS>\SET3.tmp в <DRIVERS>\revoflt.sys
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-CPO0H.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-4GNRI.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-HL4TN.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-MV3JT.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-13N24.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-4C303.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GGIM2.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S09KF.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5MELK.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-O6659.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-P93TD.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CF1CD.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-IHGRJ.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-NHNDR.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5ISIP.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-ABILD.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VD4PM.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-IPUBC.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-N06S6.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-56K76.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-1AM94.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S94SG.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-SSVNU.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FP0RI.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
