Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
- [HKLM\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'
Creates the following services
- 'Revoflt' system32\DRIVERS\revoflt.sys
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im ruplp.exe
Registers file system filter
- [HKLM\System\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'
Modifies file system
Creates the following files
- C:\kinghaze\kur.exe
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-3pilo.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-uim0n.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5pniv.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j0742.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-itacn.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d9fg.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-kq6an.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-570g7.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2qtar.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-te6m4.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-subt8.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-iu5k4.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4qfcb.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-48pjr.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tjudn.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ir44f.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-88eug.tmp
- %LOCALAPPDATA%\vs revo group\revo uninstaller pro\logfile.vslog
- <DRIVERS>\setf353.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
- %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.msg
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
- C:\users\public\desktop\revo uninstaller pro.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-uc2sp.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-93lik.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-flh08.tmp
- %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-hjbhk.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-9ttmo.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-eu8mq.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d77p.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-peabj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hobuq.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v2fhf.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h5mrr.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-764od.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h6skb.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qftbb.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0fj2p.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nmnit.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-418r0.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1aqof.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1v6e8.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mjo2h.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c08ul.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bau1p.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-t6t3l.tmp
- %TEMP%\is-c8att.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4cme5.tmp\setup.tmp
- C:\kinghaze\setup.exe
- %LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
- %ProgramFiles%\vs revo group\revo uninstaller pro\is-jerdm.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-64dp5.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7ture.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oasol.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-84vnj.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ohi0v.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h7pug.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvllf.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4cuqt.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f7o3r.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o6prm.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gl9rt.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-giq40.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-usk4l.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-plbl8.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvtud.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4f593.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6srkm.tmp
- %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lvd08.tmp
- %TEMP%\aut27da.tmp
Deletes the following files
- %TEMP%\is-c8att.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4cme5.tmp\setup.tmp
- %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
- %TEMP%\aut27da.tmp
- C:\kinghaze\kur.exe
- C:\kinghaze\setup.exe
Moves the following files
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-t6t3l.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hobuq.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d77p.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-48pjr.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4qfcb.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-iu5k4.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-subt8.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-te6m4.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2qtar.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-peabj.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tjudn.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\thai.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d9fg.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h5mrr.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v2fhf.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-itacn.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-uim0n.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-3pilo.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-570g7.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-kq6an.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-88eug.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-jerdm.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-eu8mq.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-9ttmo.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
- from %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-hjbhk.tmp to %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-flh08.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-93lik.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j0742.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5pniv.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-84vnj.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ohi0v.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h7pug.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c08ul.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1v6e8.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-764od.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1aqof.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-418r0.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nmnit.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0fj2p.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qftbb.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h6skb.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oasol.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mjo2h.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-64dp5.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bau1p.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ir44f.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7ture.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6srkm.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4f593.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvtud.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-plbl8.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-usk4l.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-giq40.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gl9rt.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o6prm.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f7o3r.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4cuqt.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvllf.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lvd08.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\lang\gujarati.ini
- from %ProgramFiles%\vs revo group\revo uninstaller pro\is-uc2sp.tmp to %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
- from <DRIVERS>\setf353.tmp to <DRIVERS>\revoflt.sys
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Substitutes the following files
- %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\kinghaze\kur.exe'
- 'C:\kinghaze\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-4cme5.tmp\setup.tmp' /SL5="$70180,16849616,196608,C:\Kinghaze\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
- '%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\syswow64\taskkill.exe' /f /im ruplp.exe' (with hidden window)
