Trojan.Siggen32.13079

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
[HKLM\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'

Создает следующие сервисы

'Revoflt' system32\DRIVERS\revoflt.sys

Вредоносные функции

Завершает или пытается завершить

следующие пользовательские процессы:

iexplore.exe
firefox.exe

Регистрирует фильтр файловой системы

[HKLM\SYSTEM\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\aut5b89.tmp
%CommonProgramFiles(x86)%\~ppxhhyf.ibo
%TEMP%\is-bepe7.tmp\~ppxhhyf.tmp
%TEMP%\is-538d8.tmp\_isetup\_setup64.tmp
%TEMP%\is-538d8.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\vs revo group\revo uninstaller pro\is-s0c0f.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-toi1p.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-rrsej.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jeldr.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6uj6e.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tckem.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-400q5.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1d4up.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7v1e2.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-e9ujq.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5p2ep.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-65ncp.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c9gn3.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8fafs.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tnr64.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vu5ok.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gjm58.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-g4pll.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1fau1.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kb7n1.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9i009.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ugbbt.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0s5o5.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4lpgo.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ehjjv.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lnida.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0d1qa.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v522i.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mbbg2.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-dub8n.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-fs5e8.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-utot7.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-svl89.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gii0q.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-99l1m.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-k6c5e.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ibfkc.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vkocb.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b716d.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-m06k0.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p68g4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-edrm3.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a3ki4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-75llk.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-5oqr9.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-p1qsp.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-sa1uk.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-vtfb2.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-jtcpi.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-gfcj6.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-bui9k.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-lio93.tmp
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-jodin.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ocl01.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-2eikt.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-229of.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
C:\users\public\desktop\revo uninstaller pro.lnk
%APPDATA%\microsoft\internet explorer\quick launch\revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
%ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
<DRIVERS>\set7366.tmp
%LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693bc1a7-a08.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693bc1aa-13c8.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%TEMP%\autaaa4.tmp
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro.lic
%TEMP%\autaab5.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b3fb0ca3fad7c868_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8efbddd8b4e33e2d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b312220c688dca5a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9d6e8435496d66cf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a3092ddd8a475e39_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2c34d010db26042b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ca62262cb8bf97c9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a33811e4578cab1c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e94633b143e38b57_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3e919434e09aeaa6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e2f4d9a3699d7697_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8c86d3110a801188_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_1
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a6ed70455b7dc16a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5d0801576d6c6f07_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5d00eab6d695654e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\afd424038ea7b801_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9fe0ad91946beb61_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\dce8b380df7f16ed_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%TEMP%\b884f0cb-7940-48b9-b4ec-fbb9a3bcc905.tmp
%TEMP%\819c9022-8723-4cfa-ae4f-05db889e25a2.tmp
%TEMP%\c276b36a-0092-431f-affa-826344e037cc.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%TEMP%\5064_2086081609\manifest.json
%TEMP%\5064_2086081609\license.txt
%TEMP%\5064_2086081609\filtering rules
%TEMP%\5064_2086081609\_metadata\verified_contents.json
%TEMP%\5064_2086081609\manifest.fingerprint
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\scoped_dir5064_1952311896\ruleset data

Присваивает атрибут 'скрытый' для следующих файлов

%CommonProgramFiles(x86)%\~ppxhhyf.ibo

Удаляет файлы, которые сам же создал

%TEMP%\aut5b89.tmp
%TEMP%\is-538d8.tmp\_isetup\_setup64.tmp
%TEMP%\is-538d8.tmp\_isetup\_shfoldr.dll
%TEMP%\is-bepe7.tmp\~ppxhhyf.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%TEMP%\autaaa4.tmp
%TEMP%\autaab5.tmp
C:\users\public\desktop\revo uninstaller pro.lnk
%CommonProgramFiles(x86)%\~ppxhhyf.ibo
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693bc1a7-a08.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693bc1aa-13c8.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%TEMP%\edge_bits_5064_1496088220\dde93974-5cbc-4ecc-898f-436e62207c34
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress

Перемещает следующие файлы

%ProgramFiles%\vs revo group\revo uninstaller pro\is-s0c0f.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-toi1p.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-rrsej.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jeldr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6uj6e.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tckem.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-400q5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1d4up.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7v1e2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-e9ujq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5p2ep.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-65ncp.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c9gn3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-8fafs.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tnr64.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vu5ok.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gjm58.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-g4pll.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1fau1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kb7n1.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9i009.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ugbbt.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0s5o5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4lpgo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ehjjv.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lnida.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0d1qa.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v522i.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mbbg2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-dub8n.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-fs5e8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-utot7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-svl89.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gii0q.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-99l1m.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-k6c5e.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ibfkc.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vkocb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b716d.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-m06k0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-p68g4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-edrm3.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-a3ki4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-75llk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\is-5oqr9.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-p1qsp.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-sa1uk.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-vtfb2.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-jtcpi.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
%ProgramFiles%\vs revo group\revo uninstaller pro\is-gfcj6.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
%ProgramFiles%\vs revo group\revo uninstaller pro\is-bui9k.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-lio93.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-jodin.tmp в %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro.lic
%ProgramFiles%\vs revo group\revo uninstaller pro\is-ocl01.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-2eikt.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
%ProgramFiles%\vs revo group\revo uninstaller pro\is-229of.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
<DRIVERS>\set7366.tmp в <DRIVERS>\revoflt.sys
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index в %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\the-real-index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\current
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons
%TEMP%\.ses

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
C:\users\public\desktop\revo uninstaller pro.lnk
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index

Сетевая активность

Подключается к

'mo#####.map.fastly.net':443
'co####.edge.skype.com':443
're####installer.com':80
're####installer.com':443
'fo###.gstatic.com':443
'st######h.bootstrapcdn.com':443
'st####.zdassets.com':443
'pk#.goog':80
'aj##.#oogleapis.com':443
'cd#.##delivr.net':443
'wi####.trustpilot.com':443
'fo###.#oogleapis.com':443
'st####.elfsight.com':443
'go#####agmanager.com':443
'ap#.#ailjet.com':443
'f0##################-b74530d2d26278124f446233f95622ef.ssl.cf1.rackcdn.com':443
'xw###.mjt.lu':443
'se#########iews-ultimate.elfsight.com':443
'st#####.elfsight.com':443
'x1.#.lencr.org':80
'cr#.####g2.amazontrust.com':80
'co#####.facebook.net':443
'un#######static.elfsightcdn.com':443
'google.com':443
'x.##2.us':80
'st###.#.doubleclick.net':443
'go##le.ru':443
'fa###ook.com':443
'wi######ediator.zopim.com':443

TCP

Запросы HTTP GET

http://www.re#####nstallerpro.com/proinstall_thankyou.html
http://pk#.goog/gsr1/gsr1.crt
http://cr#.####g2.amazontrust.com/rootg2.cer
http://x.##2.us/x.cer

Другие

'co####.edge.skype.com':443
're####installer.com':443
'fo###.gstatic.com':443
'st######h.bootstrapcdn.com':443
'ek#.##assets.com':443
'aj##.#oogleapis.com':443
'cd#.##delivr.net':443
'wi####.trustpilot.com':443
'ap#.#ailjet.com':443
'f0##################-b74530d2d26278124f446233f95622ef.ssl.cf1.rackcdn.com':443
'co##.###vice.elfsight.com':443
'xw###.mjt.lu':443
'go#####agmanager.com':443
'co#####.facebook.net':443
'fo###.#oogleapis.com':443
'un#######static.elfsightcdn.com':443
'google.com':443
'a###ytics.google.com':443
'st###.#.doubleclick.net':443
'go##le.ru':443
'fa###ook.com':443
'wi######ediator.zopim.com':443

UDP

DNS ASK mo#####.map.fastly.net
DNS ASK co####.edge.skype.com
DNS ASK re#####nstallerpro.com
DNS ASK re####installer.com
DNS ASK fo###.gstatic.com
DNS ASK st######h.bootstrapcdn.com
DNS ASK aj##.#oogleapis.com
DNS ASK cd#.##delivr.net
DNS ASK st####.zdassets.com
DNS ASK pk#.goog
DNS ASK wi####.trustpilot.com
DNS ASK f0##################-b74530d2d26278124f446233f95622ef.ssl.cf1.rackcdn.com
DNS ASK st####.elfsight.com
DNS ASK ap#.#ailjet.com
DNS ASK go#####agmanager.com
DNS ASK fo###.#oogleapis.com
DNS ASK xw###.mjt.lu
DNS ASK ek#.##assets.com
DNS ASK co##.###vice.elfsight.com
DNS ASK se#########iews-ultimate.elfsight.com
DNS ASK st#####.elfsight.com
DNS ASK x1.#.lencr.org
DNS ASK cr#.####g2.amazontrust.com
DNS ASK co#####.facebook.net
DNS ASK google.com
DNS ASK un#######static.elfsightcdn.com
DNS ASK x.##2.us
DNS ASK a###ytics.google.com
DNS ASK st###.#.doubleclick.net
DNS ASK go##le.ru
DNS ASK fa###ook.com
DNS ASK wi######ediator.zopim.com

Другое

Ищет следующие окна

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Создает и запускает на исполнение

'%CommonProgramFiles(x86)%\~ppxhhyf.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-bepe7.tmp\~ppxhhyf.tmp' /SL5="$50166,10618626,198656,%CommonProgramFiles(x86)%\~ppxhhyf.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
'%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.revouninstallerpro.com/proinstall_thankyou.html
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.revouninstallerpro.com/proinstall_thankyou.html (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,15042326931477796162,13929342306011516867,131072 --lang=en-US --service-sandbox-type=none --mojo...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней