PLATFORM:

Windows

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
Low
Medium
High
Critical

  • Threat Type:
    Trojan

  • Destructiveness:
    No

  • Encrypted:
     

  • In the wild::
    Yes

  OVERVIEW

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Este malware se elimina tras la ejecución.

  TECHNICAL DETAILS

File size: 37,632 bytes
File type: EXE
Memory resident: No
INITIAL SAMPLES RECEIVED DATE: 26 февраля 2015

Instalación

Crea las carpetas siguientes:

  • %User Profile%\10.0\Forms
  • %User Profile%\10.0\Collab
  • %User Profile%\10.0\Security
  • %User Profile%\Security\CRLCache

(Nota: %User Profile% es la carpeta de perfil del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario} y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}).

)

Otras modificaciones del sistema

Elimina los archivos siguientes:

  • %User Temp%\dWfMRF68.exe:Zone.Identifier
  • %User Profile%\10.0\ReaderMessages-journal
  • %Application Data%\Adobe\Acrobat\10.0\SharedDataEvents-journal

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

. %User Profile% es la carpeta de perfil del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario} y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}).

. %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data).

)

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\Software\Adobe\
Adobe Acrobat\10.0

HKEY_CURRENT_USER\Software\Adobe\
Adobe Synchronizer\10.0

HKEY_LOCAL_MACHINE\System\Acrobatbrokerserverdispatchercpp789

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Installer\
Migrated

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Originals

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\AVGeneral

HKEY_CURRENT_USER\Software\Adobe\
Adobe Synchronizer\10.0\Acrobat.com

HKEY_CURRENT_USER\Software\Adobe\
Adobe Synchronizer\10.0\Acrobat.com.v2

HKEY_CURRENT_USER\Software\Adobe\
Adobe Acrobat\10.0\DiskCabs

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter\cSettings

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cEmailDistribution

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cEmailDistribution\cSettings

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cInitiationWizardFirstLaunch

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cHandlers

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c290FA7E61053E8763C6055E6333A99EFB83ECACB

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c290FA7E61053E8763C6055E6333A99EFB83ECACB\cAdobe_OCSPRevChecker

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c290FA7E61053E8763C6055E6333A99EFB83ECACB\cAdobe_OCSPRevChecker\cAuthorizedResponder

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c290FA7E61053E8763C6055E6333A99EFB83ECACB\cAdobe_OCSPRevChecker\cAuthorizedResponder\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0\cValue

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSendNonce

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSendNonce\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignCertOID

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignCertOID\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignRequest

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignRequest\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cURLToConsult

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cURLToConsult\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0\cValue

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSendNonce

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSendNonce\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignCertOID

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignCertOID\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignRequest

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignRequest\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cURLToConsult

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cURLToConsult\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_CRLRevChecker

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_CRLRevChecker\cRequireAKI

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_CRLRevChecker\cRequireAKI\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_ChainBuilder

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cAllowCAToIssueAC

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cAllowCAToIssueAC\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cCheckCABasicConstraints

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cCheckCABasicConstraints\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cAllowOCSPNoCheck

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cAllowOCSPNoCheck\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cRequireOCSPCertHash

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cRequireOCSPCertHash\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_Validation

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_Validation\cValidityModel

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_Validation\cValidityModel\
c0

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cPPKHandler

HKEY_CURRENT_USER\Software\Microsoft\
SystemCertificates\ADDRESSBOOK

HKEY_CURRENT_USER\Software\Microsoft\
SystemCertificates\ADDRESSBOOK\Certificates

HKEY_CURRENT_USER\Software\Microsoft\
SystemCertificates\ADDRESSBOOK\CRLs

HKEY_CURRENT_USER\Software\Microsoft\
SystemCertificates\ADDRESSBOOK\CTLs

HKEY_LOCAL_MACHINE\Software\Adobe\
Acrobat Reader\10.0\AdobeViewer

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
marker_gjru_fbegrihlgm = "TRUE"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Installer\
Migrated
{AC76BA86-7AD7-1033-7B44-AA0000000001} = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Originals
bDisplayedSplash = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\AVGeneral
bLastExitNormal = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter
bAlwaysUseServer = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter
bAlwaysUseServerFD = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter
bDefault = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter
bDefaultFD = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter
tDistMethod = "UPLOAD"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter\cSettings
tcSetting = "https://api.{BLOCKED}e.acrobat.com"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter
tUI = "Acrobat.com (Recommended)"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cDocumentCenter
tURL = "urn://ns.{BLOCKED}e.com/Collaboration/SharedReview/Acrobat.com"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cEmailDistribution
bAlwaysUseServerFD = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cEmailDistribution
bDefaultFD = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cEmailDistribution
tDistMethod = "EMAIL"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cEmailDistribution
tUI = "Manually collect responses in my email inbox"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cEmailDistribution
tURL = "urn://ns.{BLOCKED}e.com/Collaboration/Forms/Email"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cInitiationWizardFirstLaunch
bIsFirstLaunchER = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cInitiationWizardFirstLaunch
bIsFirstLaunchFD = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cInitiationWizardFirstLaunch
bIsFirstLaunchSF = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cInitiationWizardFirstLaunch
bIsFirstLaunchSR = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Collab\
cInitiationWizardFirstLaunch
bIsFirstLaunchUF = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cHandlers
aPrivKey = "Adobe.PPKLite"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c290FA7E61053E8763C6055E6333A99EFB83ECACB\cAdobe_OCSPRevChecker\cAuthorizedResponder\
c0
bValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0
iEnd = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0
iStart = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0\cValue
s0 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0\cValue
s1 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1
iEnd = "2"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1
iStart = "2"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s0 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s1 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s2 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s3 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s4 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s5 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s6 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s7 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s8 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s9 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s10 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s11 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder\
c0
bValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSendNonce\
c0
iValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignCertOID\
c0
sValue = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignRequest\
c0
bValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cURLToConsult\
c0
iValue = "3"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0
iEnd = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0
iStart = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0\cValue
s0 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c0\cValue
s1 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1
iEnd = "2"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1
iStart = "2"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s0 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s1 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s2 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s3 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s4 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s5 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s6 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s7 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s8 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s9 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s10 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\
c1\cValue
s11 = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder\
c0
bValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSendNonce\
c0
iValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignCertOID\
c0
sValue = "{random values}"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignRequest\
c0
bValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cURLToConsult\
c0
iValue = "3"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_CRLRevChecker\cRequireAKI\
c0
bValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cAllowCAToIssueAC\
c0
bValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cCheckCABasicConstraints\
c0
bValue = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cAllowOCSPNoCheck\
c0
bValue = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cRequireOCSPCertHash\
c0
bValue = "0"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cASPKI\cASPKI\cCustomCertPrefs\
c312E332E33362E382E312E310000\cAdobe_Validation\cValidityModel\
c0
iValue = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\Security\
cPPKHandler
bCustomPrefsCreated = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\
Acrobat Reader\10.0\AdobeViewer
EULA = "1"

HKEY_CURRENT_USER\Software\Adobe\
Acrobat Reader\10.0\AdobeViewer
EULA = "1"

Rutina de infiltración

Infiltra los archivos siguientes:

  • %User Temp%\bestAF1E.txt
  • %User Temp%\bestviewer.exe
  • viagra.pdf
  • %User Temp%\dWfMRF68.exe
  • %Application Data%\Adobe\Color\ACECache11.lst
  • %Application Data%\Adobe\Acrobat\10.0\UserCache.bin
  • %User Temp%\Temporary Internet Files
  • %User Temp%\Temporary Internet Files\Content.IE5
  • %User Temp%\Temporary Internet Files\Content.IE5\XJO7ORM8
  • %User Temp%\Temporary Internet Files\Content.IE5\0BGT0L6F
  • %User Temp%\Temporary Internet Files\Content.IE5\SDQ7GXMB
  • %User Temp%\Temporary Internet Files\Content.IE5\IGHOGANP
  • %User Temp%\Cookies
  • %User Temp%\History
  • %User Temp%\History\History.IE5
  • %User Profile%\10.0\rdrmessage.zip
  • %User Profile%\10.0\Forms
  • %User Profile%\10.0\Collab
  • %User Profile%\10.0\Security
  • %User Profile%\Security\CRLCache
  • %User Profile%\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl
  • %User Profile%\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl
  • %User Profile%\Security\addressbook.acrodata

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

. %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data).

. %User Profile% es la carpeta de perfil del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario} y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}).

)

Otros detalles

Este malware se elimina tras la ejecución.

  SOLUTION

Minimum scan engine: 9.700

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Eliminar esta clave del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat
    • 10.0
  • In HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer
    • 10.0
  • In HKEY_LOCAL_MACHINE\System
    • Acrobatbrokerserverdispatchercpp789
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Installer
    • Migrated
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0
    • Originals
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0
    • AVGeneral
  • In HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\10.0
    • Acrobat.com
  • In HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\10.0
    • Acrobat.com.v2
  • In HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\10.0
    • DiskCabs
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0
    • Collab
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab
    • cDocumentCenter
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • cSettings
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab
    • cEmailDistribution
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cEmailDistribution
    • cSettings
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab
    • cInitiationWizardFirstLaunch
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0
    • Security
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security
    • cHandlers
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security
    • cASPKI
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security
    • cASPKI
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI
    • cCustomCertPrefs
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs
    • c290FA7E61053E8763C6055E6333A99EFB83ECACB
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c290FA7E61053E8763C6055E6333A99EFB83ECACB
    • cAdobe_OCSPRevChecker
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c290FA7E61053E8763C6055E6333A99EFB83ECACB\cAdobe_OCSPRevChecker
    • cAuthorizedResponder
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c290FA7E61053E8763C6055E6333A99EFB83ECACB\cAdobe_OCSPRevChecker\cAuthorizedResponder
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs
    • c312E322E3834302E3131343032312E310000
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000
    • cAdobe_ChainBuilder
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder
    • cAcceptablePolicyOIDs
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0
    • cValue
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs
    • c1
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1
    • cValue
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000
    • cAdobe_OCSPRevChecker
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker
    • cAuthorizedResponder
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker
    • cSendNonce
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSendNonce
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker
    • cSignCertOID
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignCertOID
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker
    • cSignRequest
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignRequest
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker
    • cURLToConsult
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cURLToConsult
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs
    • c312E322E3834302E3131343032312E312E312E310000
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000
    • cAdobe_ChainBuilder
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder
    • cAcceptablePolicyOIDs
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0
    • cValue
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs
    • c1
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1
    • cValue
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000
    • cAdobe_OCSPRevChecker
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker
    • cAuthorizedResponder
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker
    • cSendNonce
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSendNonce
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker
    • cSignCertOID
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignCertOID
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker
    • cSignRequest
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignRequest
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker
    • cURLToConsult
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cURLToConsult
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs
    • c312E332E33362E382E312E310000
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000
    • cAdobe_CRLRevChecker
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_CRLRevChecker
    • cRequireAKI
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_CRLRevChecker\cRequireAKI
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000
    • cAdobe_ChainBuilder
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_ChainBuilder
    • cAllowCAToIssueAC
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cAllowCAToIssueAC
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_ChainBuilder
    • cCheckCABasicConstraints
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cCheckCABasicConstraints
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000
    • cAdobe_OCSPRevChecker
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker
    • cAllowOCSPNoCheck
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cAllowOCSPNoCheck
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker
    • cRequireOCSPCertHash
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cRequireOCSPCertHash
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000
    • cAdobe_Validation
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_Validation
    • cValidityModel
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_Validation\cValidityModel
    • c0
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security
    • cPPKHandler
  • In HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates
    • ADDRESSBOOK
  • In HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\ADDRESSBOOK
    • Certificates
  • In HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\ADDRESSBOOK
    • CRLs
  • In HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\ADDRESSBOOK
    • CTLs
  • In HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\10.0
    • AdobeViewer

Step 3

Eliminar este valor del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
    • marker_gjru_fbegrihlgm = "TRUE"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Installer\Migrated
    • {AC76BA86-7AD7-1033-7B44-AA0000000001} = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Originals
    • bDisplayedSplash = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\AVGeneral
    • bLastExitNormal = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • bAlwaysUseServer = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • bAlwaysUseServerFD = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • bDefault = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • bDefaultFD = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • tDistMethod = "UPLOAD"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter\cSettings
    • tcSetting = "https://api.{BLOCKED}e.acrobat.com"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • tUI = "Acrobat.com (Recommended)"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cDocumentCenter
    • tURL = "urn://ns.{BLOCKED}e.com/Collaboration/SharedReview/Acrobat.com"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cEmailDistribution
    • bAlwaysUseServerFD = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cEmailDistribution
    • bDefaultFD = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cEmailDistribution
    • tDistMethod = "EMAIL"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cEmailDistribution
    • tUI = "Manually collect responses in my email inbox"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cEmailDistribution
    • tURL = "urn://ns.{BLOCKED}e.com/Collaboration/Forms/Email"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cInitiationWizardFirstLaunch
    • bIsFirstLaunchER = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cInitiationWizardFirstLaunch
    • bIsFirstLaunchFD = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cInitiationWizardFirstLaunch
    • bIsFirstLaunchSF = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cInitiationWizardFirstLaunch
    • bIsFirstLaunchSR = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Collab\cInitiationWizardFirstLaunch
    • bIsFirstLaunchUF = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cHandlers
    • aPrivKey = "Adobe.PPKLite"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c290FA7E61053E8763C6055E6333A99EFB83ECACB\cAdobe_OCSPRevChecker\cAuthorizedResponder\c0
    • bValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0
    • iEnd = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0
    • iStart = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0\cValue
    • s0 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0\cValue
    • s1 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1
    • iEnd = "2"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1
    • iStart = "2"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s0 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s1 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s2 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s3 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s4 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s5 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s6 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s7 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s8 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s9 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s10 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s11 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder\c0
    • bValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSendNonce\c0
    • iValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignCertOID\c0
    • sValue = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cSignRequest\c0
    • bValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E310000\cAdobe_OCSPRevChecker\cURLToConsult\c0
    • iValue = "3"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0
    • iEnd = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0
    • iStart = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0\cValue
    • s0 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c0\cValue
    • s1 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1
    • iEnd = "2"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1
    • iStart = "2"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s0 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s1 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s2 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s3 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s4 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s5 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s6 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s7 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s8 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s9 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s10 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_ChainBuilder\cAcceptablePolicyOIDs\c1\cValue
    • s11 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cAuthorizedResponder\c0
    • bValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSendNonce\c0
    • iValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignCertOID\c0
    • sValue = "{random values}"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cSignRequest\c0
    • bValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E322E3834302E3131343032312E312E312E310000\cAdobe_OCSPRevChecker\cURLToConsult\c0
    • iValue = "3"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_CRLRevChecker\cRequireAKI\c0
    • bValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cAllowCAToIssueAC\c0
    • bValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_ChainBuilder\cCheckCABasicConstraints\c0
    • bValue = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cAllowOCSPNoCheck\c0
    • bValue = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_OCSPRevChecker\cRequireOCSPCertHash\c0
    • bValue = "0"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cASPKI\cASPKI\cCustomCertPrefs\c312E332E33362E382E312E310000\cAdobe_Validation\cValidityModel\c0
    • iValue = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\Security\cPPKHandler
    • bCustomPrefsCreated = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\10.0\AdobeViewer
    • EULA = "1"
  • In HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\10.0\AdobeViewer
    • EULA = "1"

Step 4

Buscar y eliminar estos archivos

[ learnMore ]
Puede que algunos de los archivos del componente estén ocultos. Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción "Más opciones avanzadas" para que el resultado de la búsqueda incluya todos los archivos y carpetas ocultos.
  • %User Temp%\bestAF1E.txt
  • %User Temp%\bestviewer.exe
  • viagra.pdf
  • %User Temp%\dWfMRF68.exe
  • %Application Data%\Adobe\Color\ACECache11.lst
  • %Application Data%\Adobe\Acrobat\10.0\UserCache.bin
  • %User Temp%\Temporary Internet Files
  • %User Temp%\Temporary Internet Files\Content.IE5
  • %User Temp%\Temporary Internet Files\Content.IE5\XJO7ORM8
  • %User Temp%\Temporary Internet Files\Content.IE5\0BGT0L6F
  • %User Temp%\Temporary Internet Files\Content.IE5\SDQ7GXMB
  • %User Temp%\Temporary Internet Files\Content.IE5\IGHOGANP
  • %User Temp%\Cookies
  • %User Temp%\History
  • %User Temp%\History\History.IE5
  • %User Profile%\10.0\rdrmessage.zip
  • %User Profile%\10.0\Forms
  • %User Profile%\10.0\Collab
  • %User Profile%\10.0\Security
  • %User Profile%\Security\CRLCache
  • %User Profile%\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl
  • %User Profile%\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl
  • %User Profile%\Security\addressbook.acrodata

Step 5

Buscar y eliminar estas carpetas

[ learnMore ]
Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todas las carpetas ocultas.
  • %User Profile%\10.0\Forms
  • %User Profile%\10.0\Collab
  • %User Profile%\10.0\Security
  • %User Profile%\Security\CRLCache

Step 6

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como TROJ_UPATRE.MSS En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Did this description help? Tell us how we did.