Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /t /im RevoUninPro.exe
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-33N3C.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RH9KJ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6NCC9.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-R1A7K.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-F52H5.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-IFEAO.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-QV104.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-P7G89.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-O5SI6.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-OAHJU.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FNHTB.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-DHPBL.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-27AVA.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RA73I.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-J7FM9.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
- <DRIVERS>\SET4.tmp
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-CJ3DP.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-7556H.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-OS77H.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-MJCFD.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-LUR9L.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-U5BO3.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0AKG5.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-J7A3G.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-4NPPD.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GACIL.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-IOKCT.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9N0GL.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-401FE.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9APOE.tmp
- <LS_APPDATA>\Revo.exe
- <LS_APPDATA>\Reload.exe
- %TEMP%\~1.bat
- <LS_APPDATA>\RevoUninProSetup.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-NGJLT.tmp
- %TEMP%\is-0EBQ1.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-0HRQ9.tmp\RevoUninProSetup.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L22LQ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-AG2TS.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5743O.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9J5NO.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-JUHT9.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-JGF5V.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-1EIKO.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-T2FOV.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-D1988.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6PN4C.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-H8R9E.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9CEDU.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-18252.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L4F3U.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9P55I.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\~1.bat
Перемещает следующие файлы:
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RA73I.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-J7FM9.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-27AVA.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6NCC9.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-P7G89.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-DHPBL.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-U5BO3.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-JUHT9.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FNHTB.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-O5SI6.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-OAHJU.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RH9KJ.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-CJ3DP.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-7556H.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-MJCFD.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
- <DRIVERS>\SET4.tmp в <DRIVERS>\revoflt.sys
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-LUR9L.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\License.txt
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-OS77H.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-R1A7K.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-33N3C.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-QV104.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-F52H5.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-IFEAO.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9N0GL.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-401FE.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-IOKCT.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6PN4C.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-H8R9E.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GACIL.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9APOE.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-NGJLT.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-4NPPD.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0AKG5.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-J7A3G.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-D1988.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L22LQ.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-AG2TS.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9J5NO.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-JGF5V.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-1EIKO.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-5743O.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9P55I.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9CEDU.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L4F3U.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-T2FOV.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-18252.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\is-0HRQ9.tmp\RevoUninProSetup.tmp' /SL5="$50036,7324957,234496,<LS_APPDATA>\RevoUninProSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP
- '<LS_APPDATA>\RevoUninProSetup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP
Запускает на исполнение:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '<SYSTEM32>\cmd.exe' /c %TEMP%\~1.bat <Полный путь к файлу>
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
