Trojan.DownLoader26.59620

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
[<HKLM>\SOFTWARE\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\aut1.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S62GL.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-3AJ9F.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-2GE6O.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-42VVC.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-TOOPS.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-A9SQI.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-DP0B9.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-7P713.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GBPPE.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CJMBA.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-BI6U1.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-DVAPQ.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-JDQS2.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-LM2RF.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-JQ8TN.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-0363A.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-6LQ2G.tmp
%WINDIR%\inf\oem3.inf
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-AU72V.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-M8MCT.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-JR41H.tmp
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-AO9RA.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-364T4.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-ESGEO.tmp
%WINDIR%\inf\oem3.PNF
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GM2UU.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-OHB5L.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-A53S8.tmp
%TEMP%\~owjfkln.tmp
%TEMP%\is-I4DUC.tmp\~owjfkln.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-UBBUU.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9KNOM.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-4H6PL.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FBTVN.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-SOM49.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-2ABQ9.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-R3H4K.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-19G5K.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-P59CR.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-HG5S7.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-DPK18.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-481JO.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-LDFEF.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S1EB7.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-M0HF9.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CLNE0.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-ROTH8.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6F7R5.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-EI7I6.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-T2GUR.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-AJ16R.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-29D7F.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-C79IF.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-OF17N.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-SHHNJ.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-2V6IE.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8K682.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-E5A2Q.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L0K8Q.tmp
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0Q450.tmp
<DRIVERS>\SET4.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%TEMP%\~owjfkln.tmp

Удаляет следующие файлы:

%TEMP%\aut1.tmp

Перемещает следующие файлы:

%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-UBBUU.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-A53S8.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese_standard.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-OHB5L.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GM2UU.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S62GL.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-3AJ9F.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-2GE6O.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-42VVC.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-TOOPS.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-A9SQI.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-DP0B9.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-7P713.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-GBPPE.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CJMBA.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-BI6U1.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-DVAPQ.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-JDQS2.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-LM2RF.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-JQ8TN.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-0363A.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-6LQ2G.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-ESGEO.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-364T4.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\License.txt
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-AO9RA.tmp в %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-JR41H.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-M8MCT.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0Q450.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-AU72V.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\reg_lp.bat
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CLNE0.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6F7R5.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-9KNOM.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-4H6PL.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FBTVN.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-SOM49.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\azerbaijani.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-2ABQ9.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-R3H4K.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-19G5K.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-P59CR.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-HG5S7.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-DPK18.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-481JO.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-LDFEF.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S1EB7.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-M0HF9.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L0K8Q.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-E5A2Q.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hindi.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8K682.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-2V6IE.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-SHHNJ.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-OF17N.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-29D7F.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-C79IF.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-AJ16R.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-T2GUR.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-EI7I6.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini
%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-ROTH8.tmp в %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
<DRIVERS>\SET4.tmp в <DRIVERS>\revoflt.sys

Другое:

Создает и запускает на исполнение:

'%TEMP%\~owjfkln.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-I4DUC.tmp\~owjfkln.tmp' /SL5="$100E2,11466676,200704,%TEMP%\~owjfkln.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe' /regserver /NOREDIRECT

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней