Trojan.DownLoader11.36114

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
[<HKLM>\SOFTWARE\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe' /regserver /NOREDIRECT
'%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe' /bc
'%TEMP%\Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-LP5S2.tmp\Setup.tmp' /SL5="$100E2,10111664,198656,%TEMP%\Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-39H90.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-89H0C.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-F6FNI.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-K2I7O.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-7QN35.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-TMII7.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-7KEBI.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-T02IP.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-01FKV.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-SH36M.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-K3DDI.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VMAAH.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-UJ0TB.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-ARMLA.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JSLPN.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-EB299.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MERI2.tmp
%WINDIR%\inf\oem3.inf
%WINDIR%\inf\oem3.PNF
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
%TEMP%\aut5.tmp
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
<DRIVERS>\SET4.tmp
<LS_APPDATA>\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-595JV.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-P9459.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-FOCFR.tmp
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-8C8V5.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FJA0Q.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9RO02.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5C4N2.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DVF4F.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TNTDH.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-IEAQR.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MA6NV.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FIJDA.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-C4GCM.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9D16N.tmp
%TEMP%\is-LP5S2.tmp\Setup.tmp
%TEMP%\is-T7N4S.tmp\_isetup\_shfoldr.dll
%TEMP%\aut1.tmp
%TEMP%\Setup.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PQK3G.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-6N9V0.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-V3K93.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QC49F.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KIL36.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A155T.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-R7JAG.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FK0CT.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-SE4VK.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0OPR4.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KF8JN.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RQ0Q0.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1TIE8.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1I9M3.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RM3B3.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-H9GON.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0138N.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BMFCG.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TCOM8.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A8BFE.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-633DD.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%TEMP%\Setup.exe

Удаляет следующие файлы:

%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
%TEMP%\aut5.tmp
%TEMP%\Setup.exe
%TEMP%\aut1.tmp
%TEMP%\is-T7N4S.tmp\_isetup\_shfoldr.dll
%TEMP%\is-LP5S2.tmp\Setup.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MERI2.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-EB299.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-K3DDI.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-01FKV.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JSLPN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-ARMLA.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-SH36M.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0OPR4.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-SE4VK.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RQ0Q0.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-UJ0TB.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VMAAH.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FJA0Q.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-8C8V5.tmp в %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-FOCFR.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\License.txt
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-TMII7.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
<DRIVERS>\SET4.tmp в <DRIVERS>\revoflt.sys
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-P9459.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-595JV.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-7QN35.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-39H90.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-K2I7O.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-F6FNI.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-T02IP.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-7KEBI.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-89H0C.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KF8JN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FIJDA.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5C4N2.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9RO02.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MA6NV.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-IEAQR.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-C4GCM.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TNTDH.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PQK3G.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QC49F.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-V3K93.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DVF4F.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9D16N.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-6N9V0.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-R7JAG.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1TIE8.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TCOM8.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A155T.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-KIL36.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-FK0CT.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BMFCG.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1I9M3.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0138N.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-H9GON.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-633DD.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A8BFE.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RM3B3.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini

Сетевая активность:

Подключается к:

'www.re#####nstallerpro.com':80
'localhost':1039

TCP:

Запросы HTTP GET:

www.re#####nstallerpro.com/proinstall_thankyou.html

UDP:

DNS ASK www.re#####nstallerpro.com

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней