Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [<HKLM>\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Создает следующие сервисы
- 'Revoflt' system32\DRIVERS\revoflt.sys
Вредоносные функции
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
Регистрирует фильтр файловой системы
- [<HKLM>\System\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'
Изменения в файловой системе
Создает следующие файлы
- %CommonProgramFiles(x86)%\~wzsfhkj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-njkvt.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-etgme.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-e41h0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bibui.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d6hm4.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s3lps.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-5acmg.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jg14m.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-097ab.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d886h.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6sln1.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-91a45.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-rkimr.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hqc1k.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-sfocm.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
- %LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-00khf.tmp
- %WINDIR%\temp\uddd3f0.tmp
- <DRIVERS>\setcfba.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\revo uninstaller pro.lnk
- C:\users\public\desktop\revo uninstaller pro.lnk
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ok4s8.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-o0ufk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-091oh.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-hojq5.tmp
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\is-0328h.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-la359.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-ijmbn.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-s4eav.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-efjs7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qh4hl.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mnllc.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kifho.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-g67e8.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bbi6k.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mreqo.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s1ul0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ijg2r.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jr0un.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jooqb.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jgb0n.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d7ak2.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-m7bvc.tmp
- %TEMP%\is-agrig.tmp\_isetup\_setup64.tmp
- %TEMP%\is-f1bau.tmp\~wzsfhkj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3e0tn.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-l6sa5.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o094e.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kc7g1.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3arcj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gqt03.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qualk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qdks6.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7tf4b.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-edrf1.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-r92pr.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9jjgd.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-no13o.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-35dsa.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6hekf.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t1e3i.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5lvf1.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ptlf5.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ub7ee.tmp
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
Присваивает атрибут 'скрытый' для следующих файлов
- %CommonProgramFiles(x86)%\~wzsfhkj.tmp
Удаляет следующие файлы
- %WINDIR%\temp\uddd3f0.tmp
- %TEMP%\is-agrig.tmp\_isetup\_setup64.tmp
- %TEMP%\is-f1bau.tmp\~wzsfhkj.tmp
- %CommonProgramFiles(x86)%\~wzsfhkj.tmp
Перемещает следующие файлы
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-m7bvc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-efjs7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ok4s8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hqc1k.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-rkimr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-91a45.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6sln1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d886h.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-097ab.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-sfocm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jg14m.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s3lps.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qh4hl.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d6hm4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-e41h0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-etgme.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-njkvt.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-5acmg.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-ijmbn.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-s4eav.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-00khf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-la359.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\is-0328h.tmp в %PROGRAMDATA%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-hojq5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-091oh.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o094e.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-r92pr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3arcj.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gqt03.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qualk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jgb0n.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jooqb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3e0tn.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jr0un.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-s1ul0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mreqo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bbi6k.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-g67e8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kifho.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mnllc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ijg2r.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-o0ufk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bibui.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ub7ee.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ptlf5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5lvf1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t1e3i.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6hekf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-35dsa.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-no13o.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-l6sa5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9jjgd.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-edrf1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7tf4b.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qdks6.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d7ak2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kc7g1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
- <DRIVERS>\setcfba.tmp в <DRIVERS>\revoflt.sys
Другое
Создает и запускает на исполнение
- '%CommonProgramFiles(x86)%\~wzsfhkj.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-f1bau.tmp\~wzsfhkj.tmp' /SL5="$16020C,16350626,188928,%CommonProgramFiles(x86)%\~wzsfhkj.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
- '%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\regsvr32.exe' /s /u "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
