Trojan.MulDrop5.33967

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
[<HKLM>\SOFTWARE\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe' /regserver /NOREDIRECT
'%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe' /bc
'%TEMP%\VSUSetup.exe' /VERYSILENT /NOCANCEL /SUPPRESSMSGBOXES /CLOSEAPPLICATIONS /NORESTART
'%TEMP%\is-FL5NH.tmp\VSUSetup.tmp' /SL5="$100E2,11855281,56832,%TEMP%\VSUSetup.exe" /VERYSILENT /NOCANCEL /SUPPRESSMSGBOXES /CLOSEAPPLICATIONS /NORESTART

Запускает на исполнение:

'<SYSTEM32>\grpconv.exe' -o
'%WINDIR%\regedit.exe' /s %TEMP%\patch.reg
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-0D8FM.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-4TBQB.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-SOK8J.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FTE9D.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-EBNM1.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-1QQ13.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-L667V.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-DC359.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-I8D4M.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HKEBH.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-L36K9.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-4VNDI.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3NDV1.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HA6PN.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9IIMB.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0JNJB.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-S3AER.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-IPOCN.tmp
%WINDIR%\inf\oem3.inf
%WINDIR%\inf\oem3.PNF
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
%TEMP%\aut6.tmp
%TEMP%\patch.reg
<DRIVERS>\SET5.tmp
<LS_APPDATA>\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-8CMPM.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-U7TQK.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-0ILC3.tmp
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-0J835.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-Q76C3.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RR7LL.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BTLHN.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KV3M7.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-C46K5.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-AFDGT.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-STPIO.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BNK6E.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MHAI2.tmp
%TEMP%\aut2.tmp
%TEMP%\VSUSetup.exe
%TEMP%\aut1.tmp
%TEMP%\qtttrut
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-LUJV9.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DC2IC.tmp
%TEMP%\is-FL5NH.tmp\VSUSetup.tmp
%TEMP%\is-0UOC4.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-N5DQ0.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TV5CE.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1KHIU.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-V615O.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JQF20.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-82280.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HDUNN.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RF5EK.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-8631A.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HO3S5.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0EJ3I.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3FT66.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-AAC5L.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BRSN9.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KSQHB.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-NDAA3.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-IMQDL.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-7TAM7.tmp

Удаляет следующие файлы:

%TEMP%\aut6.tmp
%TEMP%\is-FL5NH.tmp\VSUSetup.tmp
%TEMP%\patch.reg
%TEMP%\VSUSetup.exe
%TEMP%\qtttrut
%TEMP%\aut1.tmp
%TEMP%\is-0UOC4.tmp\_isetup\_shfoldr.dll
%TEMP%\aut2.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HA6PN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-S3AER.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0JNJB.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-SOK8J.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-I8D4M.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9IIMB.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-L36K9.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HDUNN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-82280.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-8631A.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HKEBH.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3NDV1.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-4VNDI.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-0J835.tmp в %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-0ILC3.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\License.txt
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-IPOCN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
<DRIVERS>\SET5.tmp в <DRIVERS>\revoflt.sys
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-U7TQK.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-8CMPM.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-1QQ13.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-4TBQB.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-0D8FM.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FTE9D.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-EBNM1.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-DC359.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-L667V.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-C46K5.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BNK6E.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-STPIO.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-AAC5L.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-N5DQ0.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-AFDGT.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RR7LL.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MHAI2.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DC2IC.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-LUJV9.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-Q76C3.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KV3M7.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BTLHN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JQF20.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-V615O.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-HO3S5.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RF5EK.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1KHIU.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TV5CE.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-NDAA3.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3FT66.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0EJ3I.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BRSN9.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KSQHB.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-7TAM7.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-IMQDL.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini

Другое:

Ищет следующие окна:

ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней