Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [<HKLM>\SOFTWARE\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe' /bc
- '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\x86.exe' /nobackup /silent /overwrite
- '%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe' /regserver /NOREDIRECT
- '<SYSTEM32>\1.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-QECLQ.tmp\1.tmp' /SL5="$200E4,10060206,194048,<SYSTEM32>\1.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\regedit.exe' /s "%TEMP%\\regpatch.reg"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-J6F0K.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-358LG.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-JAFJ5.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-PGB8M.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-OLJG6.tmp
- %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-11JUA.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-R3GN7.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-1H6GQ.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-CFTS6.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5TKVM.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A59TL.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-H9G39.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-D9H45.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-6N2OO.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-G54FM.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-DONHT.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3MNQD.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-IP55T.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-UIGR0.tmp
- %TEMP%\aut6.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\x86.exe
- <DRIVERS>\SET5.tmp
- <LS_APPDATA>\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat
- %TEMP%\dup2patcher.dll
- %TEMP%\aut7.tmp
- %HOMEPATH%\Desktop\Uploded.net Premium Al Beklemeden İndir.url
- %TEMP%\regpatch.reg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\proinstall_thankyou[1].html
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BLI2P.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3BQ3T.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-L08TE.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BQJBF.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3DK5R.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-F5GDC.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VQR0J.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-P4306.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DIHEC.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-GB89H.tmp
- %TEMP%\aut2.tmp
- <SYSTEM32>\1.exe
- %TEMP%\aut1.tmp
- %TEMP%\blrbakr
- %TEMP%\is-QECLQ.tmp\1.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-U612P.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-J310R.tmp
- %TEMP%\is-99VIN.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-21PR1.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DF6RB.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-Q8MCG.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-52HC7.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JF0D1.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-O857D.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-E5QA1.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-2C4IM.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TMG1A.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-G7OR9.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JDIUQ.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QHEFK.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-2ET7H.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DSDLE.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-V4PJ3.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-8AEDB.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OO71L.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9SUR1.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MJHHL.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RDBBE.tmp
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\1.exe
Deletes the following files:
- %TEMP%\regpatch.reg
- %TEMP%\aut6.tmp
- %TEMP%\dup2patcher.dll
- %TEMP%\aut7.tmp
- %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\x86.exe
- <SYSTEM32>\1.exe
- %TEMP%\blrbakr
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\is-QECLQ.tmp\1.tmp
- %TEMP%\is-99VIN.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-A59TL.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-5TKVM.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-D9H45.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-IP55T.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3MNQD.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-6N2OO.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-H9G39.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JDIUQ.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-G7OR9.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-E5QA1.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BLI2P.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-TMG1A.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-2C4IM.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
- from %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-11JUA.tmp to %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-CFTS6.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\License.txt
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-1H6GQ.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
- from <DRIVERS>\SET5.tmp to <DRIVERS>\revoflt.sys
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-UIGR0.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-R3GN7.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-OLJG6.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-JAFJ5.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-DONHT.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-G54FM.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-358LG.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-J6F0K.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-PGB8M.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-GB89H.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DIHEC.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-F5GDC.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DF6RB.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-P4306.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-VQR0J.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-L08TE.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-J310R.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-U612P.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\is-21PR1.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3BQ3T.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-3DK5R.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-BQJBF.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-JF0D1.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-9SUR1.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-OO71L.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-52HC7.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-Q8MCG.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-O857D.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-RDBBE.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-QHEFK.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-V4PJ3.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-DSDLE.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-MJHHL.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-8AEDB.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
- from %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\is-2ET7H.tmp to %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini
Network activity:
Connects to:
- 'www.re#####nstallerpro.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- www.re#####nstallerpro.com/proinstall_thankyou.html
UDP:
- DNS ASK www.re#####nstallerpro.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
