Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [<HKLM>\SOFTWARE\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-6PSBC.tmp\setup.tmp' /SL5="$100EC,11466676,200704,%WINDIR%\Temp\Temp_1\restfiles\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%WINDIR%\Temp\Temp_1\restfiles\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
Modifies file system:
Creates the following files:
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-PBOUQ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-D40CE.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-IML8R.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-COTL4.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8482S.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-HJIU8.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-BR9MT.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-133E8.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RKSFC.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VRVFR.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0JPFR.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-LIKQ4.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0C71V.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VVUV7.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-PMN1R.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-NLGHB.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-MCB8S.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8OADM.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-PFS33.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-5V3PE.tmp
- %ALLUSERSPROFILE%\Desktop\Revo Uninstaller Pro.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
- %WINDIR%\inf\oem3.PNF
- <DRIVERS>\SET9.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.dat
- %WINDIR%\inf\oem3.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-SMFEM.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-GK17E.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-UJNAA.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-1EMK0.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-BKE3D.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-L14T1.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-0G6IC.tmp
- %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-VTQGF.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-8QSO1.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-3CNQO.tmp
- %WINDIR%\Temp\Temp_1\restfiles\crack.exe
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-EU7IP.tmp
- %WINDIR%\Temp\Temp_1\restfiles\reg.exe
- %TEMP%\aut6.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-C9P4J.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-NQ94A.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-G5SN7.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CCQ0S.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FLJUI.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut2.tmp
- %WINDIR%\Temp\Temp_1\restfiles\BlackbunnyInstall.gif
- %TEMP%\aut1.tmp
- %WINDIR%\Temp\Temp_1\restfiles\Blackbunny.gif
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %WINDIR%\Temp\Temp_1\restfiles\setup.exe
- %WINDIR%\Temp\Temp_1\restfiles\BlackbunnyEnd.gif
- %TEMP%\~DF3AF0.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S3N51.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L1ECJ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-BIA6E.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FN4FN.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-LSIKF.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8AIDT.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-AA8HO.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CCEHC.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S5LIF.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0TF5F.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-J78IJ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6P504.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8L48H.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-E2TMC.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-A5IA9.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-16HQQ.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-4AM83.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-25GRK.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-59JVF.tmp
- %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-45U51.tmp
Deletes the following files:
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
Moves the following files:
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-COTL4.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-IML8R.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VRVFR.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-PBOUQ.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-133E8.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8482S.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-D40CE.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-PMN1R.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-LIKQ4.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese_standard.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0JPFR.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8OADM.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-MCB8S.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-NLGHB.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-PFS33.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
- from %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\is-VTQGF.tmp to %ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-BKE3D.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\License.txt
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-GK17E.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-8QSO1.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
- from <DRIVERS>\SET9.tmp to <DRIVERS>\revoflt.sys
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-0G6IC.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\reg_lp.bat
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-L14T1.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-BR9MT.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-HJIU8.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-RKSFC.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-5V3PE.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-SMFEM.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-1EMK0.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-UJNAA.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-VVUV7.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-6P504.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-A5IA9.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-E2TMC.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8L48H.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-45U51.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-59JVF.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-16HQQ.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CCQ0S.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-C9P4J.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\is-EU7IP.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\unins000.exe
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FLJUI.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S3N51.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-G5SN7.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-NQ94A.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\azerbaijani.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0TF5F.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-S5LIF.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-8AIDT.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-AA8HO.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-0C71V.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-3CNQO.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-CCEHC.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-J78IJ.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hindi.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-25GRK.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-4AM83.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-FN4FN.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-BIA6E.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-L1ECJ.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
- from %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\is-LSIKF.tmp to %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini
