Program.Unwanted.1511

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ReviverSoft Smart Monitor Service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ReviverSoft Smart Monitor Service] 'ImagePath' = '%TEMP%\DriverReviverPortable\App\DriverReviver64\Smart Monitor\ReviverSoft Smart Monitor Service.exe'

Creates the following services

'ReviverSoft Smart Monitor Service' %TEMP%\DriverReviverPortable\App\DriverReviver64\Smart Monitor\ReviverSoft Smart Monitor Service.exe

Modifies file system

Creates the following files

%TEMP%\driverreviverportable\app\appinfo\appicon.ico
%TEMP%\driverreviverportable\app\driverreviver64\defaults\turkish.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\turkish1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\turkish2
%TEMP%\driverreviverportable\app\driverreviver64\driverreviver.mab
%TEMP%\driverreviverportable\app\driverreviver64\driverreviverupdater.mab
%TEMP%\driverreviverportable\app\driverreviver64\lci.lci
%TEMP%\driverreviverportable\app\driverreviver64\lci.lci.lnk
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\apps
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\reviversoft smart monitor service.mab
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\systeminfo-vc100-mt.mab
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\german.xml
%TEMP%\driverreviverportable\app\driverreviver64\tray.mab
%TEMP%\driverreviverportable\data\appsettings.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\backups\backupinfo.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\brazilian.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\danish.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\dutch.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\english.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\finnish.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\french.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\tradchinese2
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\reviversoftsmartmonitor.mab
%TEMP%\driverreviverportable\app\driverreviver64\defaults\tradchinese1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\portuguese.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\italian.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\italian1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\italian2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\japanese.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\japanese1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\japanese2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\norwegian.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\norwegian1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\norwegian2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\portuguese1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\swedish2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\portuguese2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\russian.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\russian1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\russian2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\spanish.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\spanish1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\spanish2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\swedish.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\swedish1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\tradchinese.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\italian.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\japanese.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\norwegian.xml
%TEMP%\driverreviverportable\app\driverreviver64\driverreviverupdater.exe
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\msvcp100.dll
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\msvcr100.dll
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\reviversoft smart monitor service.exe
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\reviversoftsmartmonitor.exe
%TEMP%\driverreviverportable\app\driverreviver64\smart monitor\systeminfo-vc100-mt.dll
%TEMP%\driverreviverportable\app\driverreviver64\tray.exe
%TEMP%\driverreviverportable\driverreviverportable.exe
%TEMP%\driverreviverportable\app\driverreviver64\7za.exe
%TEMP%\driverreviverportable\app\driverreviver64\driverreviver.exe
%TEMP%\nsbb73e.tmp
%TEMP%\nsrb74f.tmp\nsexec.dll
%TEMP%\nsrb74f.tmp\launcher.ini
%TEMP%\nsrb74f.tmp\splash.jpg
%TEMP%\nsrb74f.tmp\newadvsplash.dll
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\s-1-5-21-1960123792-2022915161-3775307078-1001\appsettings.xml
%TEMP%\driverreviverportable\data\portableapps.comlauncherruntimedata-driverreviverportable.ini
%TEMP%\nsrb74f.tmp\runtimedata.ini
%ALLUSERSPROFILE%\reviversoft\driver reviver\s-1-5-21-1960123792-2022915161-3775307078-1001\app_log.log
%TEMP%\nsrb74f.tmp\system.dll
%TEMP%\nsrb74f.tmp\uac.dll
%TEMP%\driverreviverportable\app\driverreviver\tray.exe
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\systeminfo-vc100-mt.dll
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\reviversoftsmartmonitor.exe
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\spanish.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\swedish.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\tradchinese.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\turkish.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\s-1-5-21-21974952-4067909286-404801097-1002\appsettings.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\s-1-5-21-21974952-4067909286-404801097-1002\app_log.log
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\s-1-5-21-21974952-4067909286-404801097-1002\drmanager_log.log
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\s-1-5-21-21974952-4067909286-404801097-1002\du_statistic
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\s-1-5-21-21974952-4067909286-404801097-1002\request.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\language\russian.xml
%TEMP%\driverreviverportable\data\reviversoft\driver reviver\s-1-5-21-21974952-4067909286-404801097-1002\response.xml
%TEMP%\driverreviverportable\data\settings\reviversoftsmartmonitorservice.exe.reg
%TEMP%\driverreviverportable\data\settings\reviversoftsmartmonitorservice.reg
%TEMP%\driverreviverportable\data\settings\{2a2423ae-1ad9-4b60-a021-bbd75766c2fd}.reg
%TEMP%\driverreviverportable\app\driverreviver\7za.exe
%TEMP%\driverreviverportable\app\driverreviver\driverreviver.exe
%TEMP%\driverreviverportable\app\driverreviver\driverreviverupdater.exe
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\msvcp100.dll
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\msvcr100.dll
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\reviversoft smart monitor service.exe
%TEMP%\driverreviverportable\data\settings\driverreviverportablesettings.ini
%TEMP%\driverreviverportable\app\driverreviver64\defaults\german2
%TEMP%\driverreviverportabletemp\cab203c.tmp
%TEMP%\driverreviverportable\app\driverreviver64\defaults\german1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\french2
%TEMP%\driverreviverportable\app\driverreviver\defaults\danish.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\danish1
%TEMP%\driverreviverportable\app\driverreviver\defaults\danish2
%TEMP%\driverreviverportable\app\driverreviver\defaults\dutch.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\dutch1
%TEMP%\driverreviverportable\app\driverreviver\defaults\dutch2
%TEMP%\driverreviverportable\app\driverreviver\defaults\english.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\english1
%TEMP%\driverreviverportable\app\driverreviver\defaults\english2
%TEMP%\driverreviverportable\app\driverreviver\defaults\finnish1
%TEMP%\driverreviverportable\app\driverreviver\defaults\italian2
%TEMP%\driverreviverportable\app\driverreviver\defaults\finnish2
%TEMP%\driverreviverportable\app\driverreviver\defaults\french.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\french1
%TEMP%\driverreviverportable\app\driverreviver\defaults\french2
%TEMP%\driverreviverportable\app\driverreviver\defaults\german.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\german1
%TEMP%\driverreviverportable\app\driverreviver\defaults\german2
%TEMP%\driverreviverportable\app\driverreviver\defaults\italian.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\italian1
%TEMP%\driverreviverportable\app\driverreviver\defaults\brazilian2
%TEMP%\driverreviverportable\app\driverreviver\defaults\finnish.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\brazilian1
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\german.xml
%TEMP%\driverreviverportable\app\appinfo\appinfo.ini
%TEMP%\driverreviverportable\app\appinfo\launcher\driverreviverportable.ini
%TEMP%\driverreviverportable\app\defaultdata\appsettings.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\brazilian.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\danish.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\dutch.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\english.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\finnish.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\french.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\italian.xml
%TEMP%\driverreviverportable\app\defaultdata\settings\{2a2423ae-1ad9-4b60-a021-bbd75766c2fd}.reg
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\japanese.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\norwegian.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\russian.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\spanish.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\swedish.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\tradchinese.xml
%TEMP%\driverreviverportable\app\defaultdata\reviversoft\driver reviver\language\turkish.xml
%TEMP%\driverreviverportable\app\defaultdata\settings\reviversoftsmartmonitorservice.exe.reg
%TEMP%\driverreviverportable\app\defaultdata\settings\reviversoftsmartmonitorservice.reg
%TEMP%\driverreviverportable\app\driverreviver\defaults\brazilian.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\japanese.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\japanese1
%TEMP%\driverreviverportable\app\driverreviver\defaults\japanese2
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\systeminfo-vc100-mt.mab
%TEMP%\driverreviverportable\app\driverreviver\tray.mab
%TEMP%\driverreviverportable\app\driverreviver64\defaults\brazilian.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\brazilian1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\brazilian2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\danish.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\danish1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\danish2
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\reviversoft smart monitor service.mab
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\reviversoftsmartmonitor.mab
%TEMP%\driverreviverportable\app\driverreviver64\defaults\dutch.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\english.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\english1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\english2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\finnish.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\finnish1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\finnish2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\french.xml
%TEMP%\driverreviverportable\app\driverreviver64\defaults\french1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\dutch1
%TEMP%\driverreviverportable\app\driverreviver64\defaults\dutch2
%TEMP%\driverreviverportable\app\driverreviver\smart monitor\apps
%TEMP%\driverreviverportable\app\driverreviver\driverreviverupdater.mab
%TEMP%\driverreviverportable\app\driverreviver\driverreviver.mab
%TEMP%\driverreviverportable\app\driverreviver\defaults\norwegian1
%TEMP%\driverreviverportable\app\driverreviver\defaults\norwegian2
%TEMP%\driverreviverportable\app\driverreviver\defaults\portuguese.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\portuguese1
%TEMP%\driverreviverportable\app\driverreviver\defaults\portuguese2
%TEMP%\driverreviverportable\app\driverreviver\defaults\russian.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\russian1
%TEMP%\driverreviverportable\app\driverreviver\defaults\russian2
%TEMP%\driverreviverportable\app\driverreviver\defaults\spanish.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\norwegian.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\spanish1
%TEMP%\driverreviverportable\app\driverreviver\defaults\swedish.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\swedish1
%TEMP%\driverreviverportable\app\driverreviver\defaults\swedish2
%TEMP%\driverreviverportable\app\driverreviver\defaults\tradchinese.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\tradchinese1
%TEMP%\driverreviverportable\app\driverreviver\defaults\tradchinese2
%TEMP%\driverreviverportable\app\driverreviver\defaults\turkish.xml
%TEMP%\driverreviverportable\app\driverreviver\defaults\turkish1
%TEMP%\driverreviverportable\app\driverreviver\defaults\turkish2
%TEMP%\driverreviverportable\app\driverreviver\defaults\spanish2
%TEMP%\driverreviverportable\app\driverreviver64\defaults\german.xml
%TEMP%\driverreviverportabletemp\tar203d.tmp

Sets the 'hidden' attribute to the following files

%TEMP%\driverreviverportable\app\driverreviver64\lci.lci

Deletes the following files

%TEMP%\driverreviverportabletemp\cab203c.tmp
%TEMP%\driverreviverportabletemp\tar203d.tmp

Network activity

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

HTTP POST requests

http://ap#.##viversoft.com/license

'ss#.####le-analytics.com':443

UDP

DNS ASK ap#.##viversoft.com
DNS ASK ss#.####le-analytics.com
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: 'MainWnd' WindowName: 'Driver Reviver'

Creates and executes the following

'%TEMP%\driverreviverportable\driverreviverportable.exe'
'%TEMP%\driverreviverportable\app\driverreviver64\driverreviver.exe'
'%TEMP%\driverreviverportable\driverreviverportable.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "<SYSTEM32>\sc.exe create "ReviverSoft Smart Monitor Service" binpath= "%TEMP%\DriverReviverPortable\App\DriverReviver64\Smart Monitor\ReviverSoft Smart Monitor Service.exe" DisplayName= "R...' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /C "<SYSTEM32>\sc.exe create "ReviverSoft Smart Monitor Service" binpath= "%TEMP%\DriverReviverPortable\App\DriverReviver64\Smart Monitor\ReviverSoft Smart Monitor Service.exe" DisplayName= "R...
'<SYSTEM32>\sc.exe' create "ReviverSoft Smart Monitor Service" binpath= "%TEMP%\DriverReviverPortable\App\DriverReviver64\Smart Monitor\ReviverSoft Smart Monitor Service.exe" DisplayName= "ReviverSoft Smart Monit...

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial