Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [<HKLM>\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Создает следующие сервисы
- 'Revoflt' system32\DRIVERS\revoflt.sys
Вредоносные функции
Регистрирует фильтр файловой системы
- [<HKLM>\System\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\autd807.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-u6iin.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-93hei.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-k3lec.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-i510c.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oghuk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ec9ru.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1ul02.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kl8q4.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-91c4c.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s6io3.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0b84m.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9f218.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-80637.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ito98.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jt2tg.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-gj9np.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-uut2d.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-7e3dm.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-l27lc.tmp
- %TEMP%\is-i03v6.tmp\_isetup\_setup64.tmp
- %TEMP%\is-deulv.tmp\dta32.tmp
- %LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
- %WINDIR%\temp\udd2f8e.tmp
- <DRIVERS>\set2b67.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
- C:\users\public\desktop\revo uninstaller pro.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\revo uninstaller pro.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-ftffc.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-nidr3.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4ht2s.tmp
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\is-h6r83.tmp
- %TEMP%\is-i03v6.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-he8m0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7ptec.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c3upm.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vgsn2.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1b326.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c742r.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jlki1.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-u2s2a.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tedek.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jfot4.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-atkpg.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-719d7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-5v8hd.tmp
- %TEMP%\is-qh5om.tmp\_isetup\_setup64.tmp
- %TEMP%\is-u3oui.tmp\revouninprosetup.tmp
- %TEMP%\dta32.exe
- %TEMP%\aute45d.tmp
- %TEMP%\revouninprosetup.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o7uop.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bupvi.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-q8uoq.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4ieb7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cnlsm.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-662d3.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qcknk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hn1kp.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tq1tf.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-e0hql.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vo4lb.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8864l.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8bdpn.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o8f69.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-n0792.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2f5vs.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-rrv2g.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2juj8.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-klld2.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lfqcf.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uoavq.tmp
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\is-q2s6e.tmp
Удаляет следующие файлы
- %TEMP%\autd807.tmp
- %TEMP%\aute45d.tmp
- %WINDIR%\temp\udd2f8e.tmp
- %TEMP%\is-qh5om.tmp\_isetup\_setup64.tmp
- %TEMP%\is-u3oui.tmp\revouninprosetup.tmp
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
- %TEMP%\is-i03v6.tmp\_isetup\_setup64.tmp
- %TEMP%\is-i03v6.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-deulv.tmp\dta32.tmp
- %TEMP%\revouninprosetup.exe
- %TEMP%\dta32.exe
Перемещает следующие файлы
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-5v8hd.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7ptec.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-he8m0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jt2tg.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ito98.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-80637.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9f218.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0b84m.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s6io3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-91c4c.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kl8q4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1ul02.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lfqcf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ec9ru.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-i510c.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-k3lec.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-93hei.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-u6iin.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-gj9np.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-uut2d.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-7e3dm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-l27lc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\is-h6r83.tmp в %PROGRAMDATA%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4ht2s.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-nidr3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uoavq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c3upm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cnlsm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-662d3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qcknk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-atkpg.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jfot4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tedek.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-u2s2a.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jlki1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c742r.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1b326.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vgsn2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o7uop.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bupvi.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-q8uoq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-ftffc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oghuk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4ieb7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2juj8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-rrv2g.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2f5vs.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-n0792.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o8f69.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8864l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8bdpn.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vo4lb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-e0hql.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tq1tf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hn1kp.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-719d7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-klld2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
- <DRIVERS>\set2b67.tmp в <DRIVERS>\revoflt.sys
Подменяет следующие файлы
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
Другое
Создает и запускает на исполнение
- '%TEMP%\revouninprosetup.exe' /VERYSILENT /NORESTART
- '%TEMP%\is-u3oui.tmp\revouninprosetup.tmp' /SL5="$A022A,16266533,188928,%TEMP%\RevoUninProSetup.exe" /VERYSILENT /NORESTART
- '%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
- '%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
- '%TEMP%\dta32.exe' /VERYSILENT /NORESTART
- '%TEMP%\is-deulv.tmp\dta32.tmp' /SL5="$B022A,122640,56832,%TEMP%\DTA32.exe" /VERYSILENT /NORESTART
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
