Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [HKLM\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Создает следующие сервисы
- 'Revoflt' system32\DRIVERS\revoflt.sys
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im ruplp.exe
Регистрирует фильтр файловой системы
- [HKLM\System\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'
Изменения в файловой системе
Создает следующие файлы
- C:\kinghaze\kur.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-gr0uo.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-9j3vc.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-t3kjb.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-vaf9c.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4v721.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-3mo4k.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4l43c.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hcsu0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-k2km0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-efa6l.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j19sd.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o6ie0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ujt7c.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-m5lbm.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eksvj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oabhk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j9b55.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9glrs.tmp
- %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-8iabt.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
- %WINDIR%\temp\udd9189.tmp
- %LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
- %LOCALAPPDATA%\vs revo group\revo uninstaller pro\logfile.vslog
- %WINDIR%\temp\udd896d.tmp
- %WINDIR%\temp\udd8180.tmp
- %WINDIR%\temp\udd78e7.tmp
- %WINDIR%\temp\udd70ac.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-kk8kk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-ddrv0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.msg
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
- C:\users\public\desktop\revo uninstaller pro.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-i1ng1.tmp
- <DRIVERS>\set6c59.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eqm28.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-dqg55.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-e5ga0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hcie2.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p8c5p.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-okami.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2c66i.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9utnq.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t8u1u.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2cgod.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9sg40.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-shu3g.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-umq1l.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ffneu.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-cekvr.tmp
- %TEMP%\is-7djp9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ef2v1.tmp\setup.tmp
- C:\kinghaze\setup.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9se1s.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b9c5u.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-i5k4o.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qgr1u.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8kubq.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-idj70.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1opdk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vkvgr.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-iu4cu.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ge37d.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9b0uu.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qra0t.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a30ju.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1a67f.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-maa74.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jdj5j.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j5429.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a364s.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9gcce.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5ujj6.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-seof6.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1flv8.tmp
- %TEMP%\aut98b6.tmp
- %WINDIR%\temp\udd9976.tmp
Удаляет следующие файлы
- %WINDIR%\temp\udd70ac.tmp
- %WINDIR%\temp\udd78e7.tmp
- %WINDIR%\temp\udd8180.tmp
- %WINDIR%\temp\udd896d.tmp
- %TEMP%\is-7djp9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ef2v1.tmp\setup.tmp
- %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
- %TEMP%\aut98b6.tmp
- %WINDIR%\temp\udd9189.tmp
- %WINDIR%\temp\udd9976.tmp
- C:\kinghaze\kur.exe
- C:\kinghaze\setup.exe
Перемещает следующие файлы
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-cekvr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8kubq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-e5ga0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-dqg55.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eqm28.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hcsu0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9glrs.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oabhk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eksvj.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-m5lbm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ujt7c.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\thai.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o6ie0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vkvgr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1opdk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j19sd.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-k2km0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4l43c.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-3mo4k.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-4v721.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-vaf9c.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-t3kjb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-9j3vc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-gr0uo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
- %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-8iabt.tmp в %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-ddrv0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-kk8kk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-efa6l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j9b55.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-iu4cu.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ge37d.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9b0uu.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-umq1l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-shu3g.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9se1s.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9sg40.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t8u1u.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9utnq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2c66i.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-okami.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p8c5p.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hcie2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-i5k4o.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2cgod.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ffneu.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b9c5u.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-maa74.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1flv8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-seof6.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5ujj6.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9gcce.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a364s.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j5429.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jdj5j.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1a67f.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-idj70.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a30ju.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qra0t.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qgr1u.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\gujarati.ini
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-i1ng1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
- <DRIVERS>\set6c59.tmp в <DRIVERS>\revoflt.sys
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Подменяет следующие файлы
- %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- 'C:\kinghaze\kur.exe'
- 'C:\kinghaze\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-ef2v1.tmp\setup.tmp' /SL5="$B00A6,17135947,196608,C:\Kinghaze\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
- '%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
- '%WINDIR%\syswow64\taskkill.exe' /f /im ruplp.exe' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
