Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Classes\PDFShaperPro\shell\open\command] '' = '"%ProgramFiles%\PDF Shaper Professional\PDFViewer.exe" "%1"'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\autea84.tmp
- %CommonProgramFiles(x86)%\~zkdpbvr.tmp
- %TEMP%\is-5juus.tmp\~zkdpbvr.tmp
- %TEMP%\is-g33oo.tmp\_isetup\_setup64.tmp
- %ProgramFiles%\pdf shaper professional\is-ev098.tmp
- %ProgramFiles%\pdf shaper professional\is-n5opv.tmp
- %ProgramFiles%\pdf shaper professional\is-hmd4n.tmp
- %ProgramFiles%\pdf shaper professional\is-iirep.tmp
- %ProgramFiles%\pdf shaper professional\is-5bm6a.tmp
- %ProgramFiles%\pdf shaper professional\is-na3ma.tmp
- %ProgramFiles%\pdf shaper professional\is-rfm9i.tmp
- %ProgramFiles%\pdf shaper professional\is-aq6pu.tmp
- %ProgramFiles%\pdf shaper professional\is-3g2t3.tmp
- %ProgramFiles%\pdf shaper professional\is-9t737.tmp
- %ProgramFiles%\pdf shaper professional\is-irqgv.tmp
- %ProgramFiles%\pdf shaper professional\is-dss1v.tmp
- %ProgramFiles%\pdf shaper professional\is-cudkb.tmp
- %ProgramFiles%\pdf shaper professional\is-qov2b.tmp
- %ProgramFiles%\pdf shaper professional\is-clu3m.tmp
- %ProgramFiles%\pdf shaper professional\is-t38il.tmp
- %ProgramFiles%\pdf shaper professional\is-t4h6o.tmp
- %ProgramFiles%\pdf shaper professional\is-kl9pg.tmp
- %ProgramFiles%\pdf shaper professional\is-ujfug.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-sdero.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-mai35.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-21lie.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-h3fi5.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-if4gv.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-uukc8.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-lveqs.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-pij3c.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-h4ga2.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-athop.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-gde4j.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-u4dau.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-eg82q.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-m8fjh.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-pk65a.tmp
- %ProgramFiles%\pdf shaper professional\lang\is-chjli.tmp
- %ProgramFiles%\pdf shaper professional\is-tieqv.tmp
- C:\users\public\desktop\pdf shaper professional.lnk
- C:\users\public\desktop\pdf viewer.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pdfshaper\pdf shaper professional.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pdfshaper\pdf viewer.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pdfshaper\uninstall pdf shaper professional.lnk
- %ProgramFiles%\pdf shaper professional\unins000.dat
- %APPDATA%\pdf shaper\pdfshaper.ini
- %TEMP%\{7523f4f3-231b-4000-ab38-a8752118a75c}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{ce641dbe-4cbc-647e-75c5-e322249e7392}.png
Присваивает атрибут 'скрытый' для следующих файлов
- %CommonProgramFiles(x86)%\~zkdpbvr.tmp
Удаляет файлы, которые сам же создал
- %TEMP%\autea84.tmp
- %ProgramFiles%\pdf shaper professional\pdw32.dll
- %TEMP%\is-g33oo.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5juus.tmp\~zkdpbvr.tmp
- %CommonProgramFiles(x86)%\~zkdpbvr.tmp
- %TEMP%\{7523f4f3-231b-4000-ab38-a8752118a75c}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{ce641dbe-4cbc-647e-75c5-e322249e7392}.png
Перемещает следующие файлы
- %ProgramFiles%\pdf shaper professional\is-ev098.tmp в %ProgramFiles%\pdf shaper professional\unins000.exe
- %ProgramFiles%\pdf shaper professional\is-n5opv.tmp в %ProgramFiles%\pdf shaper professional\dark.vsf
- %ProgramFiles%\pdf shaper professional\is-hmd4n.tmp в %ProgramFiles%\pdf shaper professional\ocr.dll
- %ProgramFiles%\pdf shaper professional\is-iirep.tmp в %ProgramFiles%\pdf shaper professional\pdc32.dll
- %ProgramFiles%\pdf shaper professional\is-5bm6a.tmp в %ProgramFiles%\pdf shaper professional\pdffile.ico
- %ProgramFiles%\pdf shaper professional\is-na3ma.tmp в %ProgramFiles%\pdf shaper professional\pdfium.dll
- %ProgramFiles%\pdf shaper professional\is-rfm9i.tmp в %ProgramFiles%\pdf shaper professional\pdfshaper.chm
- %ProgramFiles%\pdf shaper professional\is-aq6pu.tmp в %ProgramFiles%\pdf shaper professional\pdfshaper.exe
- %ProgramFiles%\pdf shaper professional\is-3g2t3.tmp в %ProgramFiles%\pdf shaper professional\pdfspr.dll
- %ProgramFiles%\pdf shaper professional\is-9t737.tmp в %ProgramFiles%\pdf shaper professional\pdfviewer.exe
- %ProgramFiles%\pdf shaper professional\is-irqgv.tmp в %ProgramFiles%\pdf shaper professional\pdw32.dll
- %ProgramFiles%\pdf shaper professional\is-dss1v.tmp в %ProgramFiles%\pdf shaper professional\pdw32.sxs.manifest
- %ProgramFiles%\pdf shaper professional\is-cudkb.tmp в %ProgramFiles%\pdf shaper professional\ssgp.dll
- %ProgramFiles%\pdf shaper professional\is-qov2b.tmp в %ProgramFiles%\pdf shaper professional\ssl32.dll
- %ProgramFiles%\pdf shaper professional\is-clu3m.tmp в %ProgramFiles%\pdf shaper professional\ter29.dll
- %ProgramFiles%\pdf shaper professional\is-t38il.tmp в %ProgramFiles%\pdf shaper professional\txml2.dll
- %ProgramFiles%\pdf shaper professional\is-t4h6o.tmp в %ProgramFiles%\pdf shaper professional\wpcc.dll
- %ProgramFiles%\pdf shaper professional\is-kl9pg.tmp в %ProgramFiles%\pdf shaper professional\wps32.dll
- %ProgramFiles%\pdf shaper professional\is-ujfug.tmp в %ProgramFiles%\pdf shaper professional\wrs13.dll
- %ProgramFiles%\pdf shaper professional\lang\is-sdero.tmp в %ProgramFiles%\pdf shaper professional\lang\brazilian.lng
- %ProgramFiles%\pdf shaper professional\lang\is-mai35.tmp в %ProgramFiles%\pdf shaper professional\lang\catalan.lng
- %ProgramFiles%\pdf shaper professional\lang\is-21lie.tmp в %ProgramFiles%\pdf shaper professional\lang\chinese.lng
- %ProgramFiles%\pdf shaper professional\lang\is-h3fi5.tmp в %ProgramFiles%\pdf shaper professional\lang\czech.lng
- %ProgramFiles%\pdf shaper professional\lang\is-if4gv.tmp в %ProgramFiles%\pdf shaper professional\lang\danish.lng
- %ProgramFiles%\pdf shaper professional\lang\is-uukc8.tmp в %ProgramFiles%\pdf shaper professional\lang\dutch.lng
- %ProgramFiles%\pdf shaper professional\lang\is-lveqs.tmp в %ProgramFiles%\pdf shaper professional\lang\french.lng
- %ProgramFiles%\pdf shaper professional\lang\is-pij3c.tmp в %ProgramFiles%\pdf shaper professional\lang\german.lng
- %ProgramFiles%\pdf shaper professional\lang\is-h4ga2.tmp в %ProgramFiles%\pdf shaper professional\lang\hebrew.lng
- %ProgramFiles%\pdf shaper professional\lang\is-athop.tmp в %ProgramFiles%\pdf shaper professional\lang\hungarian.lng
- %ProgramFiles%\pdf shaper professional\lang\is-gde4j.tmp в %ProgramFiles%\pdf shaper professional\lang\italian.lng
- %ProgramFiles%\pdf shaper professional\lang\is-u4dau.tmp в %ProgramFiles%\pdf shaper professional\lang\japanese.lng
- %ProgramFiles%\pdf shaper professional\lang\is-eg82q.tmp в %ProgramFiles%\pdf shaper professional\lang\polish.lng
- %ProgramFiles%\pdf shaper professional\lang\is-m8fjh.tmp в %ProgramFiles%\pdf shaper professional\lang\slovenian.lng
- %ProgramFiles%\pdf shaper professional\lang\is-pk65a.tmp в %ProgramFiles%\pdf shaper professional\lang\spanish.lng
- %ProgramFiles%\pdf shaper professional\lang\is-chjli.tmp в %ProgramFiles%\pdf shaper professional\lang\turkish.lng
Подменяет следующие файлы
- %ProgramFiles%\pdf shaper professional\pdw32.dll
Сетевая активность
TCP
Другие
- '15#.#01.1.91':443
Другое
Создает и запускает на исполнение
- '%CommonProgramFiles(x86)%\~zkdpbvr.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-5juus.tmp\~zkdpbvr.tmp' /SL5="$80046,11295928,966656,%CommonProgramFiles(x86)%\~zkdpbvr.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles%\PDF Shaper Professional\PDW32.dll"
