Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [<HKLM>\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\aut7093.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-2odfj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-3nd96.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-9tv5u.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-oqg8o.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2k1iv.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gq3ll.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-htvl1.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-26e95.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-84mut.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5b3ar.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uglt9.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-merbd.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1mcpg.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qm54v.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-04mqt.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-020eo.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nlu55.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2kom9.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lvrfr.tmp
- %APPDATA%\microsoft\internet explorer\quick launch\revo uninstaller pro.lnk
- %TEMP%\aut6c29.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-qu12g.tmp
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
- %TEMP%\regpatch.reg
- %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
- %TEMP%\dup2patcher.dll
- <LS_APPDATA>\vs revo group\revo uninstaller pro\data\cachedata.dat
- %WINDIR%\temp\uddfe0e.tmp
- <DRIVERS>\setf062.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d3ie5.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
- C:\users\public\desktop\revo uninstaller pro.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
- %PROGRAMDATA%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-g1ohd.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-u1d8b.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-hg7m6.tmp
- %PROGRAMDATA%\vs revo group\revo uninstaller pro\is-hrskd.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-1tono.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-vp5h5.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1lv6d.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tfoci.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t07o8.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4r6ma.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cprfv.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c99u5.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-82id1.tmp
- %TEMP%\is-nd1m9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5k6vo.tmp\setup.tmp
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4r2d7.tmp
- %TEMP%\aut9dc2.tmp
- %TEMP%\aut9c0c.tmp
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\patch86.exe
- %TEMP%\aut9a65.tmp
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\patch64.exe
- %TEMP%\aut98be.tmp
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe
- %TEMP%\aut8d53.tmp
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\test.gif
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo86.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lfojq.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vlvp3.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-g2j2f.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-u9lrb.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gdbpk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1g40h.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jrvmi.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f7dak.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eh73m.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b9pgo.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ej3c0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jafo3.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9r68a.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kdsuv.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-n15al.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ekh4l.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5g8d9.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-13r5f.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uhpno.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hg3js.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pbp7b.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bsqe7.tmp
- %WINDIR%\performance\winsat\datastore\installfiles\install\denspike.gif
Deletes the following files
- %TEMP%\aut7093.tmp
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo86.exe
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\patch86.exe
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\patch64.exe
- %TEMP%\aut6c29.tmp
- %TEMP%\dup2patcher.dll
- %TEMP%\regpatch.reg
- %TEMP%\is-5k6vo.tmp\setup.tmp
- %TEMP%\is-nd1m9.tmp\_isetup\_setup64.tmp
- %WINDIR%\temp\uddfe0e.tmp
- %TEMP%\aut9dc2.tmp
- %TEMP%\aut9c0c.tmp
- %TEMP%\aut9a65.tmp
- %TEMP%\aut98be.tmp
- %TEMP%\aut8d53.tmp
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe
- C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\test.gif
Moves the following files
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-82id1.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nlu55.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-020eo.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-04mqt.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qm54v.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1mcpg.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-merbd.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uglt9.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lvrfr.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5b3ar.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-26e95.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-htvl1.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ekh4l.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gq3ll.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-oqg8o.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-9tv5u.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-3nd96.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-2odfj.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-84mut.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-1tono.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-vp5h5.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-qu12g.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
- from %PROGRAMDATA%\vs revo group\revo uninstaller pro\is-hrskd.tmp to %PROGRAMDATA%\vs revo group\revo uninstaller pro\revouninstallerpro4.lic
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-hg7m6.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-u1d8b.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-d3ie5.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2kom9.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1lv6d.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jafo3.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-vlvp3.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-cprfv.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4r6ma.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-t07o8.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4r2d7.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bsqe7.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tfoci.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-g2j2f.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pbp7b.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hg3js.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-uhpno.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-13r5f.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-g1ohd.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2k1iv.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5g8d9.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-kdsuv.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lfojq.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-9r68a.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ej3c0.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-b9pgo.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-eh73m.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f7dak.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-jrvmi.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1g40h.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gdbpk.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-u9lrb.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c99u5.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-n15al.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
- from <DRIVERS>\setf062.tmp to <DRIVERS>\revoflt.sys
Network activity
UDP
- DNS ASK re####installer.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
Creates and executes the following
- 'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-5k6vo.tmp\setup.tmp' /SL5="$A020C,16019453,188928,C:\Users\Default\AppData\Local\Microsoft\Windows\History\installfiles\install\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
- '%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
- 'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\patch64.exe' /silent /overwrite /startupworkdir %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro
- 'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe'
- 'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' (with hidden window)
- 'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\patch64.exe' /silent /overwrite /startupworkdir %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro' (with hidden window)
- '%WINDIR%\regedit.exe' /s "%TEMP%\\regpatch.reg"' (with hidden window)
- 'C:\users\default\appdata\local\microsoft\windows\history\installfiles\install\revo64.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\regedit.exe' /s "%TEMP%\\regpatch.reg"
