Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [<HKLM>\SOFTWARE\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe' /regserver /NOREDIRECT
- '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe' /bc
- '%TEMP%\Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-0BFQ4.tmp\Setup.tmp' /SL5="$100E2,10111664,198656,%TEMP%\Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-90FBF.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-P7PVQ.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-V7GKH.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-TPH3L.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-8SMHN.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-62KU2.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-NOO7O.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-2L4QN.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OTNNP.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0U5NP.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BL4Q5.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-E23J9.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-GMMO5.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3BMAU.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PPVCS.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TCCR6.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OJSAJ.tmp
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
- %TEMP%\aut5.tmp
- %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
- <DRIVERS>\SET4.tmp
- <LS_APPDATA>\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-OQ3VC.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-6VBH8.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-12HPV.tmp
- %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-SJ2SR.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QUCRI.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3CVKO.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-83VDE.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-4O8MV.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VQ4H2.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A2FU5.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5RP7G.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-00V82.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DBB9H.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-S4NUJ.tmp
- %TEMP%\is-0BFQ4.tmp\Setup.tmp
- %TEMP%\is-NBJRH.tmp\_isetup\_shfoldr.dll
- %TEMP%\aut1.tmp
- %TEMP%\Setup.exe
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-EMCMF.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-LT6GP.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-R9N9A.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PMKLF.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QSK6S.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-J1H38.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-84HFR.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-L6LAK.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1G7FG.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MCD5F.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-S4LTC.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VTRTC.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-CK6KB.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PA3NP.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5CR2K.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-60A1G.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-I8HRL.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OVP0B.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MPIOF.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-E7DG0.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1C676.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\Setup.exe
Удаляет следующие файлы:
- %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
- %TEMP%\aut5.tmp
- %TEMP%\Setup.exe
- %TEMP%\aut1.tmp
- %TEMP%\is-NBJRH.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-0BFQ4.tmp\Setup.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OJSAJ.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TCCR6.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BL4Q5.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OTNNP.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PPVCS.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3BMAU.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-0U5NP.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MCD5F.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1G7FG.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VTRTC.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-GMMO5.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-E23J9.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QUCRI.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
- %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-SJ2SR.tmp в %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-12HPV.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\License.txt
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-62KU2.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
- <DRIVERS>\SET4.tmp в <DRIVERS>\revoflt.sys
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-6VBH8.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-OQ3VC.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-8SMHN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-90FBF.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-TPH3L.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-V7GKH.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-2L4QN.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-NOO7O.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-P7PVQ.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-S4LTC.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-00V82.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-83VDE.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3CVKO.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5RP7G.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A2FU5.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DBB9H.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VQ4H2.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-EMCMF.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PMKLF.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-R9N9A.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-4O8MV.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-S4NUJ.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-LT6GP.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-84HFR.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-CK6KB.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MPIOF.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-J1H38.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QSK6S.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-L6LAK.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OVP0B.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-PA3NP.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-I8HRL.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-60A1G.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-1C676.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-E7DG0.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5CR2K.tmp в %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini
Сетевая активность:
Подключается к:
- 'www.re#####nstallerpro.com':80
- 'localhost':1039
TCP:
Запросы HTTP GET:
- www.re#####nstallerpro.com/proinstall_thankyou.html
UDP:
- DNS ASK www.re#####nstallerpro.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
