Trojan.Siggen20.31060

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
[HKLM\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'

Создает следующие сервисы

'Revoflt' system32\DRIVERS\revoflt.sys

Вредоносные функции

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe
iexplore.exe

Регистрирует фильтр файловой системы

[HKLM\System\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\aut8f34.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-nae9o.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-u52od.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v7e4j.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nr3f9.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uldpf.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-l457b.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3agdp.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ctt1q.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-4h67n.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ma0ng.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mhgdk.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kvars.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tlgl6.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5ule3.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4hvob.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-canre.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nrjkt.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uun3b.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-u0ipe.tmp
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
%LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
%WINDIR%\temp\uddfc19.tmp
<DRIVERS>\setf797.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
%APPDATA%\microsoft\internet explorer\quick launch\revo uninstaller pro.lnk
C:\users\public\desktop\revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
%ProgramFiles%\vs revo group\revo uninstaller pro\is-tma2c.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-tlt9r.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-khlnc.tmp
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-cpud4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-9ijp4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-rg8f0.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tinpm.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6i0v6.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ov74d.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0hn66.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-17tuq.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1pi1a.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-78che.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-73c4m.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cai96.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-8dhs5.tmp
%TEMP%\is-shoqj.tmp\_isetup\_setup64.tmp
%TEMP%\is-6niqd.tmp\setup.tmp
%TEMP%\auta103.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-aenrj.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo86.exe
%TEMP%\auta0a5.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\crack.exe
%TEMP%\auta056.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe
%TEMP%\aut9740.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\test.gif
%TEMP%\aut515a.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-3qppq.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4nqar.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9cr4n.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v071v.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c9lev.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pk77l.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c4oje.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vpf58.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-inur8.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3kup4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-skh0b.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v2621.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cqh8q.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-i7oe1.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mvqh4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1hvsc.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vg45s.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2fafk.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-33ue1.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-q7mfi.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kl0r7.tmp
%WINDIR%\performance\winsat\datastore\installfiles\install\denspike.gif

Удаляет следующие файлы

%TEMP%\aut8f34.tmp
%TEMP%\aut9740.tmp
%TEMP%\auta056.tmp
%TEMP%\auta0a5.tmp
%TEMP%\auta103.tmp
%WINDIR%\temp\uddfc19.tmp
%TEMP%\is-shoqj.tmp\_isetup\_setup64.tmp
%TEMP%\is-6niqd.tmp\setup.tmp
%TEMP%\aut515a.tmp
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\crack.exe
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo86.exe
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe
C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\test.gif

Перемещает следующие файлы

%ProgramFiles%\vs revo group\revo uninstaller pro\is-8dhs5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4hvob.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5ule3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tlgl6.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kvars.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mhgdk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ma0ng.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6i0v6.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nrjkt.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3agdp.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-l457b.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uldpf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vg45s.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nr3f9.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\is-u52od.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-nae9o.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-4h67n.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ctt1q.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-u0ipe.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
%ProgramFiles%\vs revo group\revo uninstaller pro\is-3qppq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
%ProgramFiles%\vs revo group\revo uninstaller pro\is-rg8f0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-9ijp4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-cpud4.tmp в %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
%ProgramFiles%\vs revo group\revo uninstaller pro\is-khlnc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-tlt9r.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tinpm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-canre.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ov74d.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0hn66.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-17tuq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-73c4m.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-78che.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1pi1a.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v071v.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-aenrj.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4nqar.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uun3b.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kl0r7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9cr4n.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-q7mfi.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-33ue1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\is-tma2c.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v7e4j.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2fafk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mvqh4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-i7oe1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cqh8q.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v2621.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-skh0b.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-3kup4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-inur8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vpf58.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c4oje.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pk77l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c9lev.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cai96.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1hvsc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
<DRIVERS>\setf797.tmp в <DRIVERS>\revoflt.sys

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Другое

Ищет следующие окна

ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'BUTTON' WindowName: ''

Создает и запускает на исполнение

'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-6niqd.tmp\setup.tmp' /SL5="$140152,16038129,188928,C:\Users\Default\AppData\Local\Microsoft\Windows\History\installfiles\install\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
'%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\crack.exe'
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe'
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' (со скрытым окном)
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\crack.exe' ' (со скрытым окном)
'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe' ' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней