PUA.Win32.MyWebSearch.IQ

May 14, 2021

Analysis by: Thea Patrice Tajonera

ALIASES:

Win32/LuluSoftware.K (NOD32)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Potentially Unwanted Application
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

Infection Channel: Downloaded from the Internet, Dropped by other malware

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

TECHNICAL DETAILS

File Size: 37,492,928 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 16 Apr 2021

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following folders:

%User Temp%\is-{5 Random Characters}.tmp
%Program Files%\PDFCreator
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How Tos
%Program Files%\PDFCreator\COM Scripts\Perl
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Python
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Ruby
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests
%Program Files%\PDFCreator\Ghostscript
%Program Files%\PDFCreator\Ghostscript\Lib
%Program Files%\PDFCreator\Languages
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES
%Program Files%\PDFCreator\PDF Architect
%Common Programs%\PDFCreator
%Common Programs%\PDFCreator\Licenses
%ProgramData%\PDF Architect 7
%ProgramData%\PDF Architect 7\Installation

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It drops the following files:

%User Temp%\is-{5 Random Characters}.tmp\{Malware Filename}.tmp
%User Temp%\Setup Log {Date Installed} #001.txt
%User Temp%\is-{5 Random Characters}.tmp\idp.dll - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.tmp - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\_isetup\_shfoldr.dll - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\PDFArchitectAd2_English.bmp - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\PDFArchitectAd3_English.bmp - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\architect-setup.exe - deleted afterwards
%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.tmp - deleted afterwards
%Program Files%\PDFCreator\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How To\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Perl\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Python\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Ruby\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests\is-{5 Random Characters}.tmp - deleted afterwards
%Program Files%\PDFCreator\Ghostscript\Lib\is-{5 Random Characters}.tmp - deleted afterwards
%System%\spool\drivers\w32x86\PSCRIPT5.DL - deleted afterwards
%System%\spool\drivers\w32x86\PS5UI.DLL - deleted afterwards
%System%\spool\drivers\w32x86\PSCRIPT.HLP - deleted afterwards
%System%\spool\drivers\w32x86\PDFCREAT.PPD - deleted afterwards
%System%\spool\drivers\w32x86\PS_SCHM.GDL - deleted afterwards
%System%\spool\drivers\w32x86\PSCRIPT.NTF - deleted afterwards
%System%\pdfcmon.dll - deleted afterwards
%Program Files%\PDFCreator\unins000.dat
%ProgramData%\PDF Architect 7\Installation\Statistics.dll
%ProgramData%\PDF Architect 7\Installation\statistic.xml
%Public%\Desktop\PDFCreator.lnk
%Program Files%\PDFCreator\PDF Architect\architect-setup.exe
%Program Files%\PDFCreator\PDFCreator.url
%Program Files%\PDFCreator\PDFCreator.COM.tlb
%Program Files%\PDFCreator\PrinterHelperSetupLog.txt
%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe
%Program Files%\PDFCreator\SetupLog.txt
%Common Programs%\PDFCreator\PDFCreator.lnk
%Common Programs%\PDFCreator\Licenses\AFPL License.lnk
%Common Programs%\PDFCreator\Licenses\GPL License.lnk
%Common Programs%\PDFCreator\Licenses\FairPlay License.lnk
%Common Programs%\PDFCreator\PDFCreator on the Web.lnk
%Common Programs%\PDFCreator\PDFCreator Help.lnk

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.)

It adds the following processes:

"%User Temp%\is-{5 Random Characters}.tmp\install.tmp" /SL5="$1303A4,36975106,57856,{Malware Path}\{Malware Filename|.exe"
"%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe" /verysilent /URL=https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt/Filename="%User Temp%\is-{5 Random Characters}.tmp\update-info.txt" /TimeOut=30000
"%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.tmp" /SL5="$1B03BE,269828,56832,%User Temp%\is-{5 Random Characters}.tmp\DownloadUpdateInfo.exe" /verysilent /URL=https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt /Filename="%User Temp%\is-{5 Random Characters}.tmp\update-info.txt" /TimeOut=30000
"%User Temp%\is-{5 Random Characters}.tmp\architect-setup.exe" /quiet /run_application=0 /default_application=0 /application_language=en /desktop_shortcut=1 /firefox_integration /ie_integration /enable_automatic_updates=yes /win_explorer_integration /install_messenger
regsvr32.exe /s "%ProgramData%\PDF Architect 7\Installation\Statistics.dll"
"C:\Program Files\PDFCreator\SetupHelper.exe" /ComInterface=Register
"%Windows%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "%Program Files%\PDFCreator\PDFCreator.COM.dll" /codebase /tlb
"%Program Files%\PDFCreator\SetupHelper.exe" /FileExtensions=Add
"%Windows%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "%Program Files%\PDFCreator\PDFCreatorShell.dll" /codebase
"%Program Files%\PDFCreator\PrinterHelper.exe" /InstallPrinter "PDFCreator" /PortApplication "%Program Files%\PDFCreator\PDFCreator.exe" /Log "%Program Files%\PDFCreator\PrinterHelperSetupLog.txt"
"%Program Files%\PDFCreator\PDFCreator.exe" /InitializeSettings
"%Program Files%\Internet Explorer\iexplore.exe" -nohome
"%Program Files%\Internet Explorer\iexplore.exe" SCODEF:2156 CREDAT:14337
new process;"%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe" /verysilent /p=1 /v=3.5.0.6811 /ud=0 /lc=en /b=2 /e=0 /f=program,pdfarchitect,pdfarchitect\firefox,pdfarchitect\internetexplorer /g=6.01.7601 /brk="HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links\params" /brd="partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=%buuid%" /j=0 /i=0 /k=4.7.2 /l=0 /m=bdb5b2b91235375316c120c54568b040582334fe /o=SUCCESS /q=14 /r=1136 /s=1
"%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.tmp" /SL5="$1503A4,137611,56832,%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe" /verysilent /p=1 /v=3.5.0.6811 /ud=0 /lc=en /b=2 /e=0 /f=program,pdfarchitect,pdfarchitect\firefox,pdfarchitect\internetexplorer /g=6.01.7601 /brk="HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links\params" /brd="partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=%buuid%" /j=0 /i=0 /k=4.7.2 /l=0 /m=bdb5b2b91235375316c120c54568b040582334fe /o=SUCCESS /q=14 /r=1136 /s=1

Other System Modifications

This Potentially Unwanted Application adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
cmp =

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
key1 = inst_pdfcreator_new

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
params = partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
partner = default

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
redirector_link = http://paygw.{BLOCKED}hitect.org/redirect/

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
ref = {BLOCKED}hitect.org

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links
uid = {ID}

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options\General
Send user statistics = 1

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Installation
INSTALL_FOLDER = %Program Files%\PDF Architect 7

HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\
PDFCreator\Program
ApplicationVersion = 3.5.0.6811

HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\
PDFCreator\Program
ApplicationPath = %Program Files\PDFCreator

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
ConversionTimeout = 60

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
EnableTips = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
Language = en

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
LoggingLevel = Error

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
NextUpdate = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
UnitOfMeasurement = Centimeter

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings
UpdateInterval = Weekly

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\DropboxAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\FtpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\HttpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\SmtpAccounts
numClasses = 0

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts
numClasses = 3

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
AccountId = {ID}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
IsSecured = False

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
Password = {Password}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
Url = {Any of the following URL: https://{BLOCKED}a.org/tsr , http://timestamp.{BLOCKED}sign.com/scripts/timestamp.dll, http://timestamp.{BLOCKED}rt.com }

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}
UserName =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Capacity = 30

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Column = Author

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
Enabled = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastDateFrom = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastDateTo = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory
LastSearchText =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings
numClasses = 1

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}
PrinterName = PDFCreator

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}
ProfileGuid = DefaultGuid

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed
Enable = True

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed
LatestRssUpdate = {Date Installed}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement
numClasses = 58

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
Replace =

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
ReplacementType = Start

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}
Search = {File Extension}

Other Details

This Potentially Unwanted Application adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Links

HKEY_CURRENT_USER\Software\PDF Architect 7

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options

HKEY_CURRENT_USER\Software\PDF Architect 7\
Options\General

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\
Installation

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\DropboxAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\FtpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\HttpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\SmtpAccounts

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
Accounts\TimeServerAccounts\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
JobHistory

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
PrinterMappings\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
RssFeed

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
TitleReplacement\{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ApplicationSettings\
UsageStatistics

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\AttachmentPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\AutoSave

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\BackgroundPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\CoverPage

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\CustomScript

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\DropboxSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\EmailClientSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\EmailSmtpSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Ftp

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Ghostscript

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\HttpSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\JpegSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\CompressColorAndGray

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\CompressMonochrome

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\PdfSettings\Security

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\DefaultViewers\
{Number}

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\CreatorAppSettings

HKEY_CURRENT_USER\Software\pdfforge

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Printing

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Properties

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Scripting

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\Stamping

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\TextSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\TiffSettings

HKEY_CURRENT_USER\Software\pdfforge\
PDFCreator\Settings\ConversionProfiles\
{Number}\UserTokens

It connects to the following possibly malicious URL:

https://update.{BLOCKED}ge.org/pdfcreator/update-info.txt
https://download.{BLOCKED}ge.org/download/pdfcreator/4.2.0/PDFCreator-4_2_0-Setup.exe?file=PDFCreator-4_2_0-Setup.exe&download
https://download.{BLOCKED}ge.org/go/op/lsop.exe

However, as of this writing, the said sites are inaccessible.

SOLUTION

Minimum Scan Engine: 9.800

SSAPI PATTERN File: 2.187.00

SSAPI PATTERN Date: 27 Jun 2019

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Search and delete this file

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Common Programs%\PDFCreator\PDFCreator.lnk
%Common Programs%\PDFCreator\Licenses\AFPL License.lnk
%Common Programs%\PDFCreator\Licenses\GPL License.lnk
%Common Programs%\PDFCreator\Licenses\FairPlay License.lnk
%Common Programs%\PDFCreator\PDFCreator on the Web.lnk
%Common Programs%\PDFCreator\PDFCreator Help.lnk
%User Temp%\is-{5 Random Characters}.tmp\{Malware Filename}.tmp
%User Temp%\Setup Log {Date Installed} #001.txt
%Program Files%\PDFCreator\unins000.dat
%ProgramData%\PDF Architect 7\Installation\Statistics.dll
%ProgramData%\PDF Architect 7\Installation\statistic.xml
%Public%\Desktop\PDFCreator.lnk
%Program Files%\PDFCreator\PDF Architect\architect-setup.exe
%Program Files%\PDFCreator\PDFCreator.url
%Program Files%\PDFCreator\PDFCreator.COM.tlb
%Program Files%\PDFCreator\PrinterHelperSetupLog.txt
%User Temp%\is-{5 Random Characters}.tmp\InstallCheck.exe
%Program Files%\PDFCreator\SetupLog.txt

Step 4

Search and delete this folder

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%User Temp%\is-{5 Random Characters}.tmp
%Program Files%\PDFCreator
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How Tos
%Program Files%\PDFCreator\COM Scripts\Perl
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Python
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Ruby
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests
%Program Files%\PDFCreator\Ghostscript
%Program Files%\PDFCreator\Ghostscript\Lib
%Program Files%\PDFCreator\Languages
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES
%Program Files%\PDFCreator\PDF Architect
%Common Programs%\PDFCreator
%Common Programs%\PDFCreator\Licenses
%ProgramData%\PDF Architect 7
%ProgramData%\PDF Architect 7\Installation

To delete the malware/grayware folder:

Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the Named input box, type:

%User Temp%\is-{5 Random Characters}.tmp
%Program Files%\PDFCreator
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest
%Program Files%\PDFCreator\COM Scripts\C++\CppCOMTest\FilesForTests\
%Program Files%\PDFCreator\COM Scripts\JS Scripts\Basics
%Program Files%\PDFCreator\COM Scripts\JS Scripts\How Tos
%Program Files%\PDFCreator\COM Scripts\Perl
%Program Files%\PDFCreator\COM Scripts\Perl\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Python
%Program Files%\PDFCreator\COM Scripts\Python\FilesForTests
%Program Files%\PDFCreator\COM Scripts\Ruby
%Program Files%\PDFCreator\COM Scripts\Ruby\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\FilesForTests
%Program Files%\PDFCreator\COM Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project
%Program Files%\PDFCreator\COM Scripts\VB6\VB6_COMTest\FilesForTests
%Program Files%\PDFCreator\Ghostscript
%Program Files%\PDFCreator\Ghostscript\Lib
%Program Files%\PDFCreator\Languages
%Program Files%\PDFCreator\Languages\ca\LC_MESSAGES
%Program Files%\PDFCreator\Languages\co-FR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\cs\LC_MESSAGES
%Program Files%\PDFCreator\Languages\da\LC_MESSAGES
%Program Files%\PDFCreator\Languages\de\LC_MESSAGES
%Program Files%\PDFCreator\Languages\es\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fa\LC_MESSAGES
%Program Files%\PDFCreator\Languages\fr\LC_MESSAGES
%Program Files%\PDFCreator\Languages\hu\LC_MESSAGES
%Program Files%\PDFCreator\Languages\it\LC_MESSAGES
%Program Files%\PDFCreator\Languages\lt\LC_MESSAGES
%Program Files%\PDFCreator\Languages\nl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\pt-BR\LC_MESSAGES
%Program Files%\PDFCreator\Languages\ru\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sk\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sl\LC_MESSAGES
%Program Files%\PDFCreator\Languages\sv\LC_MESSAGES
%Program Files%\PDFCreator\Languages\zh-HANS\LC_MESSAGES
%Program Files%\PDFCreator\PDF Architect
%Common Programs%\PDFCreator
%Common Programs%\PDFCreator\Licenses
%ProgramData%\PDF Architect 7
%ProgramData%\PDF Architect 7\Installation
In the Look In drop-down list, select My Computer, then press Enter.
Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.

Step 5

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- cmp
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- key1 = inst_pdfcreator_new
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- params = partner=default&uid=1006694&ref={BLOCKED}hitect.org&cmp=&key1=inst_pdfcreator_new&key2=
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- partner = default
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- redirector_link = http://paygw.{BLOCKED}hitect.org/redirect/
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- ref = {BLOCKED}hitect.org
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
- uid = 1006694
In HKEY_CURRENT_USER\Software\PDF Architect 7\Options\General
- Send user statistics = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Installation
- INSTALL_FOLDER = %Program Files%\PDF Architect 7
In HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\PDFCreator\Program
- ApplicationVersion = 3.5.0.6811
In HKEY_LOCAL_MACHINE\SOFTWARE\pdfforge\PDFCreator\Program
- ApplicationPath = %Program Files\PDFCreator
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- ConversionTimeout = 60
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- EnableTips = True
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- Language = en
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- LoggingLevel = Error
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- NextUpdate = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- UnitOfMeasurement = Centimeter
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings
- UpdateInterval = Weekly
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\DropboxAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\FtpAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\HttpAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\SmtpAccounts
- numClasses = 0
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts
- numClasses = 3
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- AccountId = {ID}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- IsSecured = False
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- Password = {Password}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- Url = {Any of the following URL: https://{BLOCKED}a.org/tsr , http://timestamp.{BLOCKED}sign.com/scripts/timestamp.dll }
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
- UserName =
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- Capacity = 30
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- Column = Author
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- Enabled = True
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- LastDateFrom = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- LastDateTo = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
- LastSearchText =
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings
- numClasses = 1
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
- PrinterName = PDFCreator
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
- ProfileGuid = DefaultGuid
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
- Enable = True
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
- LatestRssUpdate = {Date Installed}
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement
- numClasses = 58
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
- Replace =
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
- ReplacementType = Start
In HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
- Search = {File Extension}

To delete the registry value this malware created:

Open Registry Editor. To do this:
» For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>PDF Architect 7>Links
In the right panel, locate and delete the entry:
cmp =
Again In the right panel, locate and delete the entry:
key1 = inst_pdfcreator_new
Again In the right panel, locate and delete the entry:
params = partner
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>PDF Architect 7>Links
In the right panel, locate and delete the entry:
partner = default
Again In the right panel, locate and delete the entry:
redirector_link = http://paygw.{BLOCKED}hitect.org/redirect/
Again In the right panel, locate and delete the entry:
ref = {BLOCKED}hitect.org
Again In the right panel, locate and delete the entry:
uid = 1006694
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>PDF Architect 7>Options>General
In the right panel, locate and delete the entry:
Send user statistics = 1
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>PDF Architect 7>Installation
In the right panel, locate and delete the entry:
INSTALL_FOLDER = %Program Files%\PDF Architect 7
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>pdfforge>PDFCreator>Program
In the right panel, locate and delete the entry:
ApplicationVersion = 3.5.0.6811
Again In the right panel, locate and delete the entry:
ApplicationPath = %Program Files\PDFCreator
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings
In the right panel, locate and delete the entry:
ConversionTimeout = 60
Again In the right panel, locate and delete the entry:
EnableTips = True
Again In the right panel, locate and delete the entry:
Language = en
Again In the right panel, locate and delete the entry:
LoggingLevel = Error
Again In the right panel, locate and delete the entry:
NextUpdate = {Date Installed}
Again In the right panel, locate and delete the entry:
UnitOfMeasurement = Centimeter
Again In the right panel, locate and delete the entry:
UpdateInterval = Weekly
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>DropboxAccounts
In the right panel, locate and delete the entry:
numClasses = 0
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>FtpAccounts
In the right panel, locate and delete the entry:
numClasses = 0
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>HttpAccounts
In the right panel, locate and delete the entry:
numClasses = 0
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>SmtpAccounts
In the right panel, locate and delete the entry:
numClasses = 0
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>TimeServerAccounts
In the right panel, locate and delete the entry:
numClasses = 3
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>Accounts>TimeServerAccounts>{Number}
In the right panel, locate and delete the entry:
AccountId = {ID}
Again In the right panel, locate and delete the entry:
IsSecured = False
Again In the right panel, locate and delete the entry:
Password = {Password}
Again In the right panel, locate and delete the entry:
Url = {Any of the following URL: https://{BLOCKED}a.org/tsr , http://timestamp.{BLOCKED}sign.com/scripts/timestamp.dll , http://timestamp. {BLOCKED}rt.com
Again In the right panel, locate and delete the entry:
UserName =
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>JobHistory
In the right panel, locate and delete the entry:
Capacity = 30
Again In the right panel, locate and delete the entry:
Column = Author
Again In the right panel, locate and delete the entry:
Enabled = True
Again In the right panel, locate and delete the entry:
LastDateFrom = {Date Installed}
Again In the right panel, locate and delete the entry:
LastDateTo = {Date Installed}
Again In the right panel, locate and delete the entry:
LastSearchText =
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>PrinterMappings
In the right panel, locate and delete the entry:
numClasses = 1
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>PrinterMappings>{Number}
In the right panel, locate and delete the entry:
PrinterName = PDFCreator
Again In the right panel, locate and delete the entry:
ProfileGuid = DefaultGuid
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>RssFeed
In the right panel, locate and delete the entry:
Enable = True
Again In the right panel, locate and delete the entry:
LatestRssUpdate = {Date Installed}
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>TitleReplacement
In the right panel, locate and delete the entry:
numClasses = 58
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>pdfforge>PDFCreator>Settings>ApplicationSettings>TitleReplacement>{Number}
In the right panel, locate and delete the entry:
Replace =
Again In the right panel, locate and delete the entry:
ReplacementType = Start
Again In the right panel, locate and delete the entry:
Search = {File Extension}
Close Registry Editor.

Step 6

Delete this registry key

[ Learn More ]

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
HKEY_CURRENT_USER\Software\PDF Architect 7
HKEY_CURRENT_USER\Software\PDF Architect 7\Options
HKEY_CURRENT_USER\Software\PDF Architect 7\Options\General
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Installation
HKEY_CURRENT_USER\Software\pdfforge
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\DropboxAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\FtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\HttpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\SmtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\UsageStatistics
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AttachmentPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AutoSave
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\BackgroundPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CoverPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CustomScript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\DropboxSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailClientSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailSmtpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ftp
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ghostscript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\HttpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\JpegSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressColorAndGray
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressMonochrome
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Security
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Signature
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PngSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Printing
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Properties
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Scripting
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Stamping
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TextSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TiffSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\UserTokens
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\CreatorAppSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\DefaultViewers\{Number}

To delete registry keys this malware/grayware created:

Open Registry Editor. To do this:
» For Windows 7 and Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.

HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Links
HKEY_CURRENT_USER\Software\PDF Architect 7
HKEY_CURRENT_USER\Software\PDF Architect 7\Options
HKEY_CURRENT_USER\Software\PDF Architect 7\Options\General
HKEY_LOCAL_MACHINE\SOFTWARE\PDF Architect 7\Installation
HKEY_CURRENT_USER\Software\pdfforge
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\DropboxAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\FtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\HttpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\SmtpAccounts
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\Accounts\TimeServerAccounts\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\JobHistory
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\PrinterMappings\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\RssFeed
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\TitleReplacement\{Number}
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ApplicationSettings\UsageStatistics
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AttachmentPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\AutoSave
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\BackgroundPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CoverPage
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\CustomScript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\DropboxSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailClientSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\EmailSmtpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ftp
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Ghostscript
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\HttpSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\JpegSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressColorAndGray
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\CompressMonochrome
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Security
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PdfSettings\Signature
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\PngSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Printing
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Properties
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Scripting
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\Stamping
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TextSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\TiffSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\ConversionProfiles\{Number}\UserTokens
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\CreatorAppSettings
HKEY_CURRENT_USER\Software\pdfforge\PDFCreator\Settings\DefaultViewers\{Number}

Close Registry Editor.

Step 7

Scan your computer with your Trend Micro product to delete files detected as PUA.Win32.MyWebSearch.IQ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

Did this description help? Tell us how we did.

PUA.Win32.MyWebSearch.IQ

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Trend Vision One™ - Proactive Security Starts Here.

Resources

Support

About Trend

Country Headquarters