PUA.Win32.MyWebSearch.IQ

Publish Date: 14 maggio 2021

Analizzato da: Thea Patrice Tajonera

Win32/LuluSoftware.K (NOD32)

Piattaforma:

Windows

Valutazione del rischio complessivo:

Potenziale dannoso: :

Potenziale di distribuzione: :

Reported Infection:

Informazioni esposizione: :

Basso

Medio

Alto

Critico

Tipo di minaccia informatica:
Potentially Unwanted Application
Distruttivo?:
No
Crittografato?:
In the wild::
Sì

Panoramica e descrizione

Canale infezione: Descargado de Internet, Eliminado por otro tipo de malware

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Dettagli tecnici

Dimensione file: 37,492,928 bytes

Tipo di file: EXE

Residente in memoria: Sì

Data di ricezione campioni iniziali: 16 aprile 2021

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las carpetas siguientes:

%User Temp%\is-{5 Random Characters}.tmp
%Program Files%\PDFCreator
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How Tos
%Program Files%\PDFCreator\COM Scripts\Perl
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Python
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Ruby
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests
%Program Files%\PDFCreator\Ghostscript
%Program Files%\PDFCreator\Ghostscript\Lib
%Program Files%\PDFCreator\Languages
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES
%Program Files%\PDFCreator\PDF Architect
%Common Programs%\PDFCreator
%Common Programs%\PDFCreator\Licenses
%ProgramData%\PDF Architect 7
%ProgramData%\PDF Architect 7\Installation

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

)

Infiltra los archivos siguientes:

%User Temp%\is-{5 Random Characters}.tmp\{Malware Filename}.tmp
%User Temp%\Setup Log {Date Installed} #001.txt
%User Temp%\is-{5 Random Characters}.tmp\idp.dll - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.tmp - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\_isetup\_shfoldr.dll - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\PDFArchitectAd2_English.bmp - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\PDFArchitectAd3_English.bmp - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\architect-setup.exe - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.tmp - deleted afterwards
%Program Files%\PDFCreator\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How To\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Perl\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Python\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Ruby\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Ghostscript\Lib\is-{5 Random Characters}.tmp - deleted afterwards
%System%\spool\drivers\w32x86\PSCRIPT5.DL - deleted afterwards
%System%\spool\drivers\w32x86\PS5UI.DLL - deleted afterwards
%System%\spool\drivers\w32x86\PSCRIPT.HLP - deleted afterwards
%System%\spool\drivers\w32x86\PDFCREAT.PPD - deleted afterwards
%System%\spool\drivers\w32x86\PS_SCHM.GDL - deleted afterwards
%System%\spool\drivers\w32x86\PSCRIPT.NTF - deleted afterwards
%System%\pdfcmon.dll - deleted afterwards
%Program Files%\PDFCreator\unins000.dat
%ProgramData%\PDF Architect 7\Installation\Statistics.dll
%ProgramData%\PDF Architect 7\Installation\statistic.xml
%Public%\Desktop\PDFCreator.lnk
%Program Files%\PDFCreator\PDF Architect\architect-setup.exe
%Program Files%\PDFCreator\PDFCreator.url
%Program Files%\PDFCreator\PDFCreator.COM.tlb
%Program Files%\PDFCreator\PrinterHelperSetupLog.txt
%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe
%Program Files%\PDFCreator\SetupLog.txt
%Common Programs%\PDFCreator\PDFCreator.lnk
%Common Programs%\PDFCreator\Licenses\AFPL License.lnk
%Common Programs%\PDFCreator\Licenses\GPL License.lnk
%Common Programs%\PDFCreator\Licenses\FairPlay License.lnk
%Common Programs%\PDFCreator\PDFCreator on the Web.lnk
%Common Programs%\PDFCreator\PDFCreator Help.lnk

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

. %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

)

Agrega los procesos siguientes:

"%User Temp%\is-{5 Random Characters}.tmp\install.tmp" /SL5="$1303A4,36975106,57856,{Malware Path}\{Malware Filename|.exe"
"%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe" /verysilent /URL=https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt/Filename="%User Temp%\is-{5 Random Characters}.tmp\update-info.txt" /TimeOut=30000
"%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.tmp" /SL5="$1B03BE,269828,56832,%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe" /verysilent /URL=https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt /Filename="%User Temp%\is-{5 Random Characters}.tmp\update-info.txt" /TimeOut=30000
"%User Temp%\is-{5 Random Characters}.tmp\architect-setup.exe" /quiet /run_application=0 /default_application=0 /application_language=en /desktop_shortcut=1 /firefox_integration /ie_integration /enable_automatic_updates=yes /win_explorer_integration /install_messenger
regsvr32.exe /s "%ProgramData%\PDF Architect 7\Installation\Statistics.dll"
"C:\Program Files\PDFCreator\SetupHelper.exe" /ComInterface=Register
"%Windows%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "%Program Files%\PDFCreator\PDFCreator.COM.dll" /codebase /tlb
"%Program Files%\PDFCreator\SetupHelper.exe" /FileExtensions=Add
"%Windows%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "%Program Files%\PDFCreator\PDFCreatorShell.dll" /codebase
"%Program Files%\PDFCreator\PrinterHelper.exe" /InstallPrinter "PDFCreator" /PortApplication "%Program Files%\PDFCreator\PDFCreator.exe" /Log "%Program Files%\PDFCreator\PrinterHelperSetupLog.txt"
"%Program Files%\PDFCreator\PDFCreator.exe" /InitializeSettings
"%Program Files%\Internet Explorer\iexplore.exe" -nohome
"%Program Files%\Internet Explorer\iexplore.exe" SCODEF:2156 CREDAT:14337
new process;"%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe" /verysilent /p=1 /v=3.5.0.6811 /ud=0 /lc=en /b=2 /e=0 /f=program,pdfarchitect,pdfarchitect\firefox,pdfarchitect\internetexplorer /g=6.01.7601 /brk="HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links\params" /brd="partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=%buuid%" /j=0 /i=0 /k=4.7.2 /l=0 /m=bdb5b2b91235375316c120c54568b040582334fe /o=SUCCESS /q=14 /r=1136 /s=1
"%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.tmp" /SL5="$1503A4,137611,56832,%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe" /verysilent /p=1 /v=3.5.0.6811 /ud=0 /lc=en /b=2 /e=0 /f=program,pdfarchitect,pdfarchitect\firefox,pdfarchitect\internetexplorer /g=6.01.7601 /brk="HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links\params" /brd="partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=%buuid%" /j=0 /i=0 /k=4.7.2 /l=0 /m=bdb5b2b91235375316c120c54568b040582334fe /o=SUCCESS /q=14 /r=1136 /s=1

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
cmp =

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
key1 = inst_pdfcreator_new

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
params = partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
partner = default

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
redirector_link = http://paygw.{BLOCKED}hitect.org/redirect/

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
ref = {BLOCKED}hitect.org

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
uid = {ID}

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options\General
Send user statistics = 1

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Installation
INSTALL_FOLDER = %Program Files%\PDF Architect 7

HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\
PDFCreator\Program
ApplicationVersion = 3.5.0.6811

HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\
PDFCreator\Program
ApplicationPath = %Program Files\PDFCreator

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
ConversionTimeout = 60

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
EnableTips = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
Language = en

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
LoggingLevel = Error

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
NextUpdate = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
UnitOfMeasurement = Centimeter

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
UpdateInterval = Weekly

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\DropboxAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\FtpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\HttpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\SmtpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts
numClasses = 3

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
AccountId = {ID}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
IsSecured = False

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
Password = {Password}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
Url = {Any of the following URL: https://{BLOCKED}a.org/tsr , http://timestamp.{BLOCKED}sign.com/scripts/timestamp.dll, http://timestamp.{BLOCKED}rt.com }

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
UserName =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Capacity = 30

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Column = Author

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Enabled = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastDateFrom = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastDateTo = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastSearchText =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings
numClasses = 1

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}
PrinterName = PDFCreator

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}
ProfileGuid = DefaultGuid

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed
Enable = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed
LatestRssUpdate = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement
numClasses = 58

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
Replace =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
ReplacementType = Start

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
Search = {File Extension}

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links

HKEY_CURRENT_USER\Software\PDF Architect 7

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options\General

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Installation

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\DropboxAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\FtpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\HttpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\SmtpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
UsageStatistics

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\AttachmentPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\AutoSave

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\BackgroundPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\CoverPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\CustomScript

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\DropboxSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\EmailClientSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\EmailSmtpSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Ftp

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Ghostscript

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\HttpSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\JpegSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\CompressColorAndGray

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\CompressMonochrome

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\Security

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\DefaultViewers\
{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\CreatorAppSettings

HKEY_CURRENT_USER\Software\pdfforge

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Printing

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Properties

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Scripting

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Stamping

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\TextSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\TiffSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\UserTokens

It connects to the following possibly malicious URL:

https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt
https://download.{BLOCKED}ge.org/download/pdfcreator/4.2.0/PDFCreator-4_2_0-Setup.exe?file=PDFCreator-4_2_0-Setup.exe&download
https://download.{BLOCKED}ge.org/go/op/lsop.exe

Soluzioni

Motore di scansione minimo: 9.800

File di pattern SSAPI: 2.187.00

Data di pubblicazione del pattern SSAPI: 27 giugno 2019

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Buscar y eliminar este archivo

[ learnMore ]

Puede que algunos de los archivos del componente estén ocultos. Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todos los archivos y carpetas ocultos.

%Common Programs%\PDFCreator\PDFCreator.lnk
%Common Programs%\PDFCreator\Licenses\AFPL License.lnk
%Common Programs%\PDFCreator\Licenses\GPL License.lnk
%Common Programs%\PDFCreator\Licenses\FairPlay License.lnk
%Common Programs%\PDFCreator\PDFCreator on the Web.lnk
%Common Programs%\PDFCreator\PDFCreator Help.lnk
%User Temp%\is-{5 Random Characters}.tmp\{Malware Filename}.tmp
%User Temp%\Setup Log {Date Installed} #001.txt
%Program Files%\PDFCreator\unins000.dat
%ProgramData%\PDF Architect 7\Installation\Statistics.dll
%ProgramData%\PDF Architect 7\Installation\statistic.xml
%Public%\Desktop\PDFCreator.lnk
%Program Files%\PDFCreator\PDF Architect\architect-setup.exe
%Program Files%\PDFCreator\PDFCreator.url
%Program Files%\PDFCreator\PDFCreator.COM.tlb
%Program Files%\PDFCreator\PrinterHelperSetupLog.txt
%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe
%Program Files%\PDFCreator\SetupLog.txt

Step 4

Buscar y eliminar esta carpeta

[ learnMore ]

Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todas las carpetas ocultas.

%User Temp%\is-{5 Random Characters}.tmp
%Program Files%\PDFCreator
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How Tos
%Program Files%\PDFCreator\COM Scripts\Perl
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Python
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Ruby
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests
%Program Files%\PDFCreator\Ghostscript
%Program Files%\PDFCreator\Ghostscript\Lib
%Program Files%\PDFCreator\Languages
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES
%Program Files%\PDFCreator\PDF Architect
%Common Programs%\PDFCreator
%Common Programs%\PDFCreator\Licenses
%ProgramData%\PDF Architect 7
%ProgramData%\PDF Architect 7\Installation

Para eliminar la carpeta de malware/grayware/spyware:

Haga clic con el botón derecho en Inicio y haga clic en Buscar....
En el cuadro de entrada Nombre, escriba:

%User Temp%\is-{5 Random Characters}.tmp
%Program Files%\PDFCreator
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How Tos
%Program Files%\PDFCreator\COM Scripts\Perl
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Python
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Ruby
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests
%Program Files%\PDFCreator\Ghostscript
%Program Files%\PDFCreator\Ghostscript\Lib
%Program Files%\PDFCreator\Languages
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES
%Program Files%\PDFCreator\PDF Architect
%Common Programs%\PDFCreator
%Common Programs%\PDFCreator\Licenses
%ProgramData%\PDF Architect 7
%ProgramData%\PDF Architect 7\Installation
En la lista desplegable Buscar en, seleccione Mi PC y pulse Intro.
Una vez haya encontrado la carpeta, selecciónela y, a continuación, pulse MAYÚS+SUPR para eliminarla definitivamente.

Step 5

Eliminar este valor del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- cmp
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- key1 = inst_pdfcreator_new
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- params = partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- partner = default
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- redirector_link = http://paygw.{BLOCKED}hitect.org/redirect/
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- ref = {BLOCKED}hitect.org
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- uid = 1006694
In HKEY_CURRENT_USER\Software\PDF Architect 7\Options\General
- Send user statistics = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Installation
- INSTALL_FOLDER = %Program Files%\PDF Architect 7
In HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\PDFCreator\Program
- ApplicationVersion = 3.5.0.6811
In HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\PDFCreator\Program
- ApplicationPath = %Program Files\PDFCreator
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- ConversionTimeout = 60
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- EnableTips = True
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- Language = en
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- LoggingLevel = Error
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- NextUpdate = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- UnitOfMeasurement = Centimeter
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- UpdateInterval = Weekly
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\DropboxAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\FtpAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\HttpAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\SmtpAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts
- numClasses = 3
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- AccountId = {ID}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- IsSecured = False
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- Password = {Password}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- Url = {Any of the following URL: https://{BLOCKED}a.org/tsr , http://timestamp.{BLOCKED}sign.com/scripts/timestamp.dll }
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- UserName =
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- Capacity = 30
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- Column = Author
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- Enabled = True
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- LastDateFrom = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- LastDateTo = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- LastSearchText =
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings
- numClasses = 1
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
- PrinterName = PDFCreator
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
- ProfileGuid = DefaultGuid
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
- Enable = True
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
- LatestRssUpdate = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement
- numClasses = 58
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
- Replace =
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
- ReplacementType = Start
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
- Search = {File Extension}

Para eliminar el valor del Registro que este malware ha creado:

Abra el Editor del Registro. Para ello, haga clic en Inicio>Ejecutar, escriba regedit en el cuadro de texto y pulse Intro.
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>PDF Architect
7>Links
En el panel derecho, busque y elimine la entrada:
cmp =
En el panel derecho, busque y elimine la entrada:
key1 = inst_pdfcreator_new
En el panel derecho, busque y elimine la entrada:
params = partner
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>PDF
Architect 7>Links
En el panel derecho, busque y elimine la entrada:
partner = default
En el panel derecho, busque y elimine la entrada:
redirector_link = http://paygw.{BLOCKED}hitect.org/redirect/
En el panel derecho, busque y elimine la entrada:
ref = {BLOCKED}hitect.org
En el panel derecho, busque y elimine la entrada:
uid = 1006694
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>PDF
Architect 7>Options>General
En el panel derecho, busque y elimine la entrada:
Send user statistics = 1
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>PDF Architect 7>Installation
En el panel derecho, busque y elimine la entrada:
INSTALL_FOLDER = %Program Files%\PDF Architect
7
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>pdfforge>PDFCreator>Program
En el panel derecho, busque y elimine la entrada:
ApplicationVersion = 3.5.0.6811
En el panel derecho, busque y elimine la entrada:
ApplicationPath = %Program Files\PDFCreator
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings
En el panel derecho, busque y elimine la entrada:
ConversionTimeout = 60
En el panel derecho, busque y elimine la entrada:
EnableTips = True
En el panel derecho, busque y elimine la entrada:
Language = en
En el panel derecho, busque y elimine la entrada:
LoggingLevel = Error
En el panel derecho, busque y elimine la entrada:
NextUpdate = {Date Installed}
En el panel derecho, busque y elimine la entrada:
UnitOfMeasurement = Centimeter
En el panel derecho, busque y elimine la entrada:
UpdateInterval = Weekly
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>DropboxAccounts
En el panel derecho, busque y elimine la entrada:
numClasses = 0
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>FtpAccounts
En el panel derecho, busque y elimine la entrada:
numClasses = 0
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>HttpAccounts
En el panel derecho, busque y elimine la entrada:
numClasses = 0
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>SmtpAccounts
En el panel derecho, busque y elimine la entrada:
numClasses = 0
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>TimeServerAccounts
En el panel derecho, busque y elimine la entrada:
numClasses = 3
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>TimeServerAccounts>{Number}
En el panel derecho, busque y elimine la entrada:
AccountId = {ID}
En el panel derecho, busque y elimine la entrada:
IsSecured = False
En el panel derecho, busque y elimine la entrada:
Password = {Password}
En el panel derecho, busque y elimine la entrada:
Url = {Any of the following URL: https://{BLOCKED}a.org/tsr ,
http://timestamp.{BLOCKED}sign.com/scripts/timestamp.dll ,
http://timestamp. {BLOCKED}rt.com
En el panel derecho, busque y elimine la entrada:
UserName =
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>JobHistory
En el panel derecho, busque y elimine la entrada:
Capacity = 30
En el panel derecho, busque y elimine la entrada:
Column = Author
En el panel derecho, busque y elimine la entrada:
Enabled = True
En el panel derecho, busque y elimine la entrada:
LastDateFrom = {Date
Installed}
En el panel derecho, busque y elimine la entrada:
LastDateTo = {Date Installed}
En el panel derecho, busque y elimine la entrada:
LastSearchText =
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>PrinterMappings
En el panel derecho, busque y elimine la entrada:
numClasses = 1
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>PrinterMappings>{Number}
En el panel derecho, busque y elimine la entrada:
PrinterName = PDFCreator
En el panel derecho, busque y elimine la entrada:
ProfileGuid = DefaultGuid
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>RssFeed
En el panel derecho, busque y elimine la entrada:
Enable = True
En el panel derecho, busque y elimine la entrada:
LatestRssUpdate = {Date Installed}
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>TitleReplacement
En el panel derecho, busque y elimine la entrada:
numClasses = 58
En el panel izquierdo de la ventana Editor del Registro, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>TitleReplacement>{Number}
En el panel derecho, busque y elimine la entrada:
Replace =
En el panel derecho, busque y elimine la entrada:
ReplacementType = Start
En el panel derecho, busque y elimine la entrada:
Search = {File Extension}
Cierre el Editor del Registro.

Step 6

Eliminar esta clave del Registro

[ learnMore ]

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
HKEY_CURRENT_USER\Software\PDF Architect 7
HKEY_CURRENT_USER\Software\PDF Architect 7\Options
HKEY_CURRENT_USER\Software\PDF Architect 7\Options\General
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Installation
HKEY_CURRENT_USER\Software\pdfforge
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\DropboxAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\FtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\HttpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\SmtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\UsageStatistics
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AttachmentPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AutoSave
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\BackgroundPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CoverPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CustomScript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\DropboxSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailClientSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailSmtpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ftp
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ghostscript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\HttpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\JpegSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressColorAndGray
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressMonochrome
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Security
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Signature
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PngSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Printing
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Properties
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Scripting
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Stamping
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TextSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TiffSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\UserTokens
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\CreatorAppSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\DefaultViewers\{Number}

Para eliminar las claves del Registro que este malware/grayware/spyware ha creado:

Abra el Editor del Registro. Para ello, haga clic en Inicio>Ejecutar, escriba regedit en el cuadro de texto y pulse Intro.

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
HKEY_CURRENT_USER\Software\PDF Architect 7
HKEY_CURRENT_USER\Software\PDF Architect 7\Options
HKEY_CURRENT_USER\Software\PDF Architect 7\Options\General
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Installation
HKEY_CURRENT_USER\Software\pdfforge
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\DropboxAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\FtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\HttpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\SmtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\UsageStatistics
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AttachmentPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AutoSave
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\BackgroundPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CoverPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CustomScript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\DropboxSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailClientSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailSmtpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ftp
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ghostscript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\HttpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\JpegSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressColorAndGray
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressMonochrome
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Security
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Signature
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PngSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Printing
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Properties
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Scripting
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Stamping
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TextSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TiffSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\UserTokens
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\CreatorAppSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\DefaultViewers\{Number}

Cierre el Editor del Registro.

Step 7

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como PUA.Win32.MyWebSearch.IQ En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.

Sondaggio

PUA.Win32.MyWebSearch.IQ

Panoramica e descrizione

Dettagli tecnici

Soluzioni

Risorse

Assistenza

Informazioni su Trend

Sede legale nazionale