Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Вредоносные функции
Регистрирует фильтр файловой системы
- [<HKLM>\System\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\$inst\2.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nqc90.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-aagog.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bh8s5.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4vhtn.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-osphq.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-egbjf.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hu9e2.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hqoe7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3ucn8.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-hb8dl.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-62abv.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-fthap.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4se92.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-2l9lp.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-k6fvl.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-6na45.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-bcpr1.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
- C:\users\public\desktop\revo uninstaller pro.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\revo uninstaller pro.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
- <DRIVERS>\sete7a3.tmp
- %WINDIR%\temp\uddf2ce.tmp
- %LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1n0si.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lmkgh.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f6hh3.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\revouninpro.exe
- %TEMP%\revouninprosetup.exe
- %TEMP%\$inst\0001.tmp
- %TEMP%\team-full.bat
- %TEMP%\turkish.ini
- %TEMP%\is-lup2i.tmp\revouninprosetup.tmp
- %TEMP%\is-imo3s.tmp\_isetup\_setup64.tmp
- %TEMP%\is-imo3s.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-md833.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8ji6e.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nffrd.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ol3pd.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pgdpl.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p77e7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-frll7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bmapj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-fb2ln.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ke91i.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eerov.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-68vr9.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hks92.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-u8qp7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-fqd2b.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pnh95.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s4q9d.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-inj1v.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-i2v1v.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
Удаляет следующие файлы
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
- %WINDIR%\temp\uddf2ce.tmp
- %TEMP%\is-imo3s.tmp\_isetup\_setup64.tmp
- %TEMP%\is-imo3s.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-lup2i.tmp\revouninprosetup.tmp
- %TEMP%\revouninpro.exe
- %TEMP%\revouninprosetup.exe
- %TEMP%\turkish.ini
- %TEMP%\$inst\2.tmp
Перемещает следующие файлы
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-md833.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-aagog.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bh8s5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4vhtn.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-osphq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-egbjf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hu9e2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1n0si.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nqc90.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hqoe7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-62abv.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-fthap.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4se92.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-2l9lp.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-k6fvl.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-6na45.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3ucn8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-hb8dl.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lmkgh.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-i2v1v.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f6hh3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nffrd.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ol3pd.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pgdpl.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p77e7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-frll7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bmapj.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-fb2ln.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8ji6e.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ke91i.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-68vr9.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hks92.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-u8qp7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-fqd2b.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pnh95.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s4q9d.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-inj1v.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eerov.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-bcpr1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
- <DRIVERS>\sete7a3.tmp в <DRIVERS>\revoflt.sys
Другое
Создает и запускает на исполнение
- '%TEMP%\revouninprosetup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-lup2i.tmp\revouninprosetup.tmp' /SL5="$10272,6466250,235520,%TEMP%\RevoUninProSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\TEAM-Full.bat" "' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\TEAM-Full.bat" "
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\VS Revo Group\Revo Uninstaller Pro\General" /f /v "Language file" /t REG_SZ /d "Turkish.ini"
