PUA.Win32.MyWebSearch.IQ

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

ただし、情報公開日現在、このWebサイトにはアクセスできません。

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のフォルダを追加します。

• %User Temp%\is-{5 Random Characters}.tmp
• %Program Files%\PDFCreator
• %Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\FilesForTests
• %Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties
• %Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest
• %Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest
• %Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\
• %Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics
• %Program Files%\PDFCreator\COM Scripts\JS Scripts\How Tos
• %Program Files%\PDFCreator\COM Scripts\Perl
• %Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests
• %Program Files%\PDFCreator\COM Scripts\Python
• %Program Files%\PDFCreator\COM Scripts\Python\FilesForTests
• %Program Files%\PDFCreator\COM Scripts\Ruby
• %Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project
• %Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests
• %Program Files%\PDFCreator\Ghostscript
• %Program Files%\PDFCreator\Ghostscript\Lib
• %Program Files%\PDFCreator\Languages
• %Program Files%\PDFCreator\Languages\ca\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\cs\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\da\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\de\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\es\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\fa\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\fr\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\hu\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\it\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\lt\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\nl\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\pl\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\ru\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\sk\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\sl\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\sv\LC_MESSAGES
• %Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES
• %Program Files%\PDFCreator\PDF Architect
• %Common Programs%\PDFCreator
• %Common Programs%\PDFCreator\Licenses
• %ProgramData%\PDF Architect 7
• %ProgramData%\PDF Architect 7\Installation

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %Common Programs%フォルダは、共通プログラムグループが含まれるフォルダです。Windows 2000、XP、Server 2003の場合、通常 "C:\Documents and Settings\All Users\Start Menu\Programs" です。また、Windows Vista、7、8の場合、通常 "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" です。. %ProgramData%フォルダは、マルチユーザーシステムにおいて任意のユーザがプログラムに変更を加えることができるプログラムファイルフォルダのバージョンです。これには、すべてのユーザのアプリケーションデータが含まれます。Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData" です。Windows Server 2003(32-bit)、2000(32-bit)、XPの場合、通常 "C:\Documents and Settings\All Users" です。 )

プログラムは、以下のファイルを作成します。

• %User Temp%\is-{5 Random Characters}.tmp\{Malware Filename}.tmp
• %User Temp%\Setup Log {Date Installed} #001.txt
• %User Temp%\is-{5 Random Characters}.tmp\idp.dll - deleted afterwards
• %User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe - deleted afterwards
• %User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.tmp - deleted afterwards
• %User Temp%\is-{5 Random Characters}.tmp\_isetup\_shfoldr.dll - deleted afterwards
• %User Temp%\is-{5 Random Characters}.tmp\PDFArchitectAd2_English.bmp - deleted afterwards
• %User Temp%\is-{5 Random Characters}.tmp\PDFArchitectAd3_English.bmp - deleted afterwards
• %User Temp%\is-{5 Random Characters}.tmp\architect-setup.exe - deleted afterwards
• %User Temp%\is-{5 Random Characters}.tmp\InstallCheck.tmp - deleted afterwards
• %Program Files%\PDFCreator\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\ca\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\cs\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\da\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\de\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\es\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\fa\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\fr\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\hu\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\it\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\lt\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\nl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\pl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\ru\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\sk\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\sl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\sv\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\JS Scripts\How To\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\Perl\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\Python\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\Python\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\Ruby\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
• %Program Files%\PDFCreator\Ghostscript\Lib\is-{5 Random Characters}.tmp - deleted afterwards
• %System%\spool\drivers\w32x86\PSCRIPT5.DL - deleted afterwards
• %System%\spool\drivers\w32x86\PS5UI.DLL - deleted afterwards
• %System%\spool\drivers\w32x86\PSCRIPT.HLP - deleted afterwards
• %System%\spool\drivers\w32x86\PDFCREAT.PPD - deleted afterwards
• %System%\spool\drivers\w32x86\PS_SCHM.GDL - deleted afterwards
• %System%\spool\drivers\w32x86\PSCRIPT.NTF - deleted afterwards
• %System%\pdfcmon.dll - deleted afterwards
• %Program Files%\PDFCreator\unins000.dat
• %ProgramData%\PDF Architect 7\Installation\Statistics.dll
• %ProgramData%\PDF Architect 7\Installation\statistic.xml
• %Public%\Desktop\PDFCreator.lnk
• %Program Files%\PDFCreator\PDF Architect\architect-setup.exe
• %Program Files%\PDFCreator\PDFCreator.url
• %Program Files%\PDFCreator\PDFCreator.COM.tlb
• %Program Files%\PDFCreator\PrinterHelperSetupLog.txt
• %User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe
• %Program Files%\PDFCreator\SetupLog.txt
• %Common Programs%\PDFCreator\PDFCreator.lnk
• %Common Programs%\PDFCreator\Licenses\AFPL License.lnk
• %Common Programs%\PDFCreator\Licenses\GPL License.lnk
• %Common Programs%\PDFCreator\Licenses\FairPlay License.lnk
• %Common Programs%\PDFCreator\PDFCreator on the Web.lnk
• %Common Programs%\PDFCreator\PDFCreator Help.lnk

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.. %ProgramData%フォルダは、マルチユーザーシステムにおいて任意のユーザがプログラムに変更を加えることができるプログラムファイルフォルダのバージョンです。これには、すべてのユーザのアプリケーションデータが含まれます。Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData" です。Windows Server 2003(32-bit)、2000(32-bit)、XPの場合、通常 "C:\Documents and Settings\All Users" です。 . %Public%フォルダは、すべてのユーザ共通のファイルまたはフォルダのリポジトリとして機能するフォルダです。Windows Vista、7、8の場合、通常 "C:\Users\Public" です。. %Common Programs%フォルダは、共通プログラムグループが含まれるフォルダです。Windows 2000、XP、Server 2003の場合、通常 "C:\Documents and Settings\All Users\Start Menu\Programs" です。また、Windows Vista、7、8の場合、通常 "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" です。)

プログラムは、以下のプロセスを追加します。

• "%User Temp%\is-{5 Random Characters}.tmp\install.tmp" /SL5="$1303A4,36975106,57856,{Malware Path}\{Malware Filename|.exe"
• "%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe" /verysilent /URL=https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt/Filename="%User Temp%\is-{5 Random Characters}.tmp\update-info.txt" /TimeOut=30000
• "%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.tmp" /SL5="$1B03BE,269828,56832,%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe" /verysilent /URL=https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt /Filename="%User Temp%\is-{5 Random Characters}.tmp\update-info.txt" /TimeOut=30000
• "%User Temp%\is-{5 Random Characters}.tmp\architect-setup.exe" /quiet /run_application=0 /default_application=0 /application_language=en /desktop_shortcut=1 /firefox_integration /ie_integration /enable_automatic_updates=yes /win_explorer_integration /install_messenger
• regsvr32.exe /s "%ProgramData%\PDF Architect 7\Installation\Statistics.dll"
• "C:\Program Files\PDFCreator\SetupHelper.exe" /ComInterface=Register
• "%Windows%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "%Program Files%\PDFCreator\PDFCreator.COM.dll" /codebase /tlb
• "%Program Files%\PDFCreator\SetupHelper.exe" /FileExtensions=Add
• "%Windows%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "%Program Files%\PDFCreator\PDFCreatorShell.dll" /codebase
• "%Program Files%\PDFCreator\PrinterHelper.exe" /InstallPrinter "PDFCreator" /PortApplication "%Program Files%\PDFCreator\PDFCreator.exe" /Log "%Program Files%\PDFCreator\PrinterHelperSetupLog.txt"
• "%Program Files%\PDFCreator\PDFCreator.exe" /InitializeSettings
• "%Program Files%\Internet Explorer\iexplore.exe" -nohome
• "%Program Files%\Internet Explorer\iexplore.exe" SCODEF:2156 CREDAT:14337
• new process;"%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe" /verysilent /p=1 /v=3.5.0.6811 /ud=0 /lc=en /b=2 /e=0 /f=program,pdfarchitect,pdfarchitect\firefox,pdfarchitect\internetexplorer /g=6.01.7601 /brk="HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links\params" /brd="partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=%buuid%" /j=0 /i=0 /k=4.7.2 /l=0 /m=bdb5b2b91235375316c120c54568b040582334fe /o=SUCCESS /q=14 /r=1136 /s=1
• "%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.tmp" /SL5="$1503A4,137611,56832,%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe" /verysilent /p=1 /v=3.5.0.6811 /ud=0 /lc=en /b=2 /e=0 /f=program,pdfarchitect,pdfarchitect\firefox,pdfarchitect\internetexplorer /g=6.01.7601 /brk="HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links\params" /brd="partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=%buuid%" /j=0 /i=0 /k=4.7.2 /l=0 /m=bdb5b2b91235375316c120c54568b040582334fe /o=SUCCESS /q=14 /r=1136 /s=1

他のシステム変更

プログラムは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
cmp =

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
key1 = inst_pdfcreator_new

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
params = partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
partner = default

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
redirector_link = http://paygw.{BLOCKED}hitect.org/redirect/

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
ref = {BLOCKED}hitect.org

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
uid = {ID}

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options\General
Send user statistics = 1

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Installation
INSTALL_FOLDER = %Program Files%\PDF Architect 7

HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\
PDFCreator\Program
ApplicationVersion = 3.5.0.6811

HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\
PDFCreator\Program
ApplicationPath = %Program Files\PDFCreator

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
ConversionTimeout = 60

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
EnableTips = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
Language = en

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
LoggingLevel = Error

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
NextUpdate = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
UnitOfMeasurement = Centimeter

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
UpdateInterval = Weekly

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\DropboxAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\FtpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\HttpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\SmtpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts
numClasses = 3

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
AccountId = {ID}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
IsSecured = False

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
Password = {Password}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
Url = {Any of the following URL: https://{BLOCKED}a.org/tsr , http://timestamp.{BLOCKED}sign.com/scripts/timestamp.dll, http://timestamp.{BLOCKED}rt.com  }

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
UserName =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Capacity = 30

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Column = Author

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Enabled = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastDateFrom = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastDateTo = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastSearchText =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings
numClasses = 1

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}
PrinterName = PDFCreator

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}
ProfileGuid = DefaultGuid

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed
Enable = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed
LatestRssUpdate = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement
numClasses = 58

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
Replace =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
ReplacementType = Start

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
Search = {File Extension}

その他

プログラムは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links

HKEY_CURRENT_USER\Software\PDF Architect 7

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options\General

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Installation

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\DropboxAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\FtpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\HttpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\SmtpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
UsageStatistics

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\AttachmentPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\AutoSave

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\BackgroundPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\CoverPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\CustomScript

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\DropboxSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\EmailClientSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\EmailSmtpSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Ftp

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Ghostscript

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\HttpSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\JpegSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\CompressColorAndGray

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\CompressMonochrome

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\Security

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\DefaultViewers\
{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\CreatorAppSettings

HKEY_CURRENT_USER\Software\pdfforge

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Printing

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Properties

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Scripting

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Stamping

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\TextSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\TiffSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\UserTokens

プログラムは、以下の不正なWebサイトにアクセスします。

• https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt
• https://download.{BLOCKED}ge.org/download/pdfcreator/4.2.0/PDFCreator-4_2_0-Setup.exe?file=PDFCreator-4_2_0-Setup.exe&download
• https://download.{BLOCKED}ge.org/go/op/lsop.exe

ただし、情報公開日現在、このWebサイトにはアクセスできません。