MD5: d685394675e2c8dd2355d6541d408896
SHA1: 19243fa1970f0029fdee224fdba320b478dfd976
SHA256: cadbdd7219e0600180c63aef23b752dea8417cd9a4c569026f72d4e6154184de
SSDeep: 49152:Jm75c3C2PeW0vbRdldjbTih9TnROynTFwI:JOc3C2PMv9dXTih6TI
Size: 1989144 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: SafeInstall, LLC
Created at: 2014-07-31 19:30:33
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):
No processes have been created.
The Application injects its code into the following process(es):

%original file name%.exe:320

Mutexes

The following mutexes were created/opened:

RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
ShimCacheMutex
QuickStartApp
VdiMsiLock
InstallIQUninstallOptionLock
InstallIQFirefoxLock
W3i_CoreBrowserShutdown
W3iFFPrefslock
DialogCloseProcessLock
CPackageZlib::CPackageZlib
W3iCoreLogger
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
DDrawDriverObjectListMutex
DDrawWindowListMutex
__DDrawExclMode__
__DDrawCheckExclMode__
_!SHMSFTHISTORY!_
c:!documents and settings!adm!local settings!history!history.ie5!mshist012014082120140822!

File activity

The process %original file name%.exe:320 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\arcadeparlor.vi.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\smartpccleaner.vi.zip (930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\btn-win-cancel.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPMF4TEB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\view.petite_oo_v4.vi.json (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_keepmysettingsx.vi.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\resultsbay.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\petite_oo_v4.vi.json (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\uninstallhelper.vi.json (725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\nortoninternetsecurity.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\searchdonkey.vi.zip (861 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\fulldiskfighter.vi.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C12BKDMB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screenfactory.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\petite_oo_v4.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\slowpcfighter.vi.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\freeflvconverting.vi.zip (999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\offerbox.vi.zip (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\petite_oo_v4.vi.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\rockettab.vi.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\winferno.vi.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\registryhelper.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\common.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_startpage.test.vi.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\noyahoo.js (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\pcspeedup.vi.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\d685394675e2c8dd2355d6541d408896.log (2981670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\blitzmediaplayeroffer.vi.zip (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\pcoptimizerpro.vi.zip (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_startpage.vi.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\driverscanner.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\truedownloader.vi.zip (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\abiword_12658.txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\driversupport.vi.zip (882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\abiword.vi.zip (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\D56U39WD\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\driverfighter.vi.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\blasteroids.vi.zip (833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\smartdriverupdater.vi.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\.DS_Store (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\secureweb.vi.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\knctr.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\nortonantivirus.vi.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\yahoo.js (851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\websearches.vi.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\savepathdeals.vi.zip (870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\linkey.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\nortonsecurityscan.vi.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_defaultsearch.vi.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoosuite.vi.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screenconfig.js (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\genieo.vi.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\resultsbay.vi.zip (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\severeweatheralerts.vi.zip (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\smartdriverupdater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\abiword\abiword_tn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\config.xml (14776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\contentexplorer.vi.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\kaspersky.vi.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\ping.response.json (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\smartweb.vi.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MP5LTVUV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\muvic.vi.zip (786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\speedupmypc_sales_r2_v2.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\seaapp.vi.zip (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\driverscanner.vi.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\speedupmypc_sales_r2_v2.vi.zip (825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_defaultsearch.test.vi.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\weatherbug.vi.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\abiword.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\converterfreeonline.vi.zip (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\showpass.vi.zip (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\convertfilesforfree.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\mypcbackup.vi.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\uninstallhelper.vi.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\defaulttab.vi.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\btn.png (392 bytes)

Registry activity

The process %original file name%.exe:320 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePrefix" = ":2014082120140822:"
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheLimit" = "8192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\InstallIQ]
"test" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1406824233"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 96 96 D2 6A 55 91 99 D7 44 29 32 A3 33 CD 79"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014082120140822\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\InstallIQ]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\InstallIQ]
"test"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Screenshot

VersionInfo

Company Name: SafeInstall, LLC
Product Name: SafeInstaller
Product Version: 1.0.56.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: safeinstall.exe
Internal Name: SafeInstaller
File Version: 1.0.56.0
File Description: Safe Installer
Comments:
Language: Finnish (Finland)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://1-vinstaller.com/api/productsession	66.77.96.160

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /api/productsession HTTP/1.1

Content-Type: application/json; charset=utf-8

Accept: application/json

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Host: 1-vinstaller.com

Content-Length: 258

Cache-Control: no-cache

{"CampaignName":"","ShortName":"abiword","ProductSubId":-1,"AccountId":13230,"VersionId":-1,"InstallerVersion":"1.0.56.0","OSId":5,"TemplateId":309,"LangId":1033,"ParentOfferIds":[],"Browsers":[{"Key":"IE","Value":6}],"DefaultBrowser":{"Key":"IE","Value":6}}
HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: application/json; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="PSA OUR DEM"

X-Robots-Tag: noindex, nofollow

Date: Thu, 21 Aug 2014 07:27:58 GMT

Content-Length: 8194
{"Response":{"configuration":{"month":8,"week":34,"year":2014,"targetb
rowser":{"Key":"IE","Value":"6"},"pingurl":"hXXp://1-vinstaller.com/ap
i/productsession","postbackurl":"hXXp://1-vinstaller.com/api/trackoffe
rinstalldetails","errorurl":"hXXp://1-vinstaller.com/api/installerror"
,"host":"hXXp://dl2.vib7installer.com/lm/","compliant":true,"randomoff
ersort":false},"productsession":{"productid":1686,"productsubid":-1,"p
roductsessionid":"de89a55a-f2ed-4fd3-93d1-ab84e3fa079a","shortname":"a
biword","deviceclienttype":7,"guiclienttype":7,"versionid":-1,"session
":{"accountid":13230,"vendorid":6413,"campaignid":4522101,"campaignnam
e":"Default","countryid":804,"country":"UA"}},"accountconfiguration":{
"accountid":13230,"accountverticalid":20,"showwelcomescreen":true,"sho
wdownloadmanager":true,"showfirstofferinwelcomescreen":true,"allowicon
drop":true,"active":true},"offers":[{"accountid":13230,"offerid":20294
,"parentofferid":5793,"position":1,"active":true,"offerversion":0.0,"c
onfiguration":{"configid":"ResultsBay","type":"exe","displayname":"Res
ultsBay","downloadurl":"bundles/resultsbay/20140431/ResultsBaySetup.ex
e","chrome.commandline":"/noIE=1 /noFF=1 /np 1 /is w3ws#IPCOUNTRY#","c
mdline_all":"/np 1 /is w3ws#IPCOUNTRY#","cmdline_chrome":"/noIE=1 /noF
F=1 /np 1 /is w3ws#IPCOUNTRY#","cmdline_firefox":"/noIE=1 /np 1 /is w3
ws#IPCOUNTRY#","cmdline_iexplore":"/noFF=1 /np 1 /is w3ws#IPCOUNTRY#",
"firefox.commandline":"/noIE=1 /np 1 /is w3ws#IPCOUNTRY#","msie.comman
dline":"/noFF=1 /np 1 /is w3ws#IPCOUNTRY#"}},{"accountid":13230,"o
<<< skipped >>>

The Application connects to the servers at the folowing location(s):

.text

`.text-qu

`.text-co

`.text-co]

`.text-co"(

`.text-tig

`.text-co;

`.rdata

@.data

.data-qu)

.data-co

.data-co8

.data-co(

.data-co,

.data-co)

.data-cot

.data-ti

.rsrc

CSShZ

t.Sh0

CSSh4

CSSh9

CSSh>

CSShl

CSSh[

D$ h %S

<-t}<.

<*u%F

CSSh`

<:%u4

t8Ht.HHt#

.FGy1

Af;FP}%S3

|$|.tD

#t.Ht

 2 34 567

u.SSV

1t.Ht

9sxv%UW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

GetProcessWindowStation

Operation not permitted

Inappropriate I/O control operation

Broken pipe

0xX

Invalid CRT parameter

QuickStartApp.cpp

vi.engine.xml

chk_firefox

chk_chrome

%s[%d]

position=%d, active=%d

%d,%d,%d

** Debug mode: simulating stopping Firefox

** Debug mode: simulating stopping Chrome

%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.

Firefox

Google Chrome

%d err: %s

Chrome

firefox

chrome

opera

searchprotector.exe

view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s

.json

control.txt

00000000-0000-0000-0000-000000000000

QuickStartProcess.cpp

%programfiles%\Free Offers from Freeze.com

disabling offer because system doesn't have Firefox

disabling offer because system doesn't have Chrome

%s[%s]: view=%s accept=%s

%s,%s

WindowsErrorCode

targetbrowser/key

%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d

%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s

%d,%d,%s,%s,%s,%s

%d,%d,%d,%d,%d

%d,%d,%s,%s,%s,%s,%s

%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s

offers

%s,%s,%s,%s,%s,%s,%s,%s

%s,%d,%s,%s

%s,%s,%u,%u,%d,%s

Unable to open thankyou page; url is empty or invalid!

statsd.response.txt

Web.Installer.VDI.CommError

Web.Installer.VDI.InstallError

Web.Installer.VDI.OfferDownloadError

Web.Installer.VDI.OfferInstallError

Web.Installer.VDI.OfferInstallFailed

hXXp://dl2.v47installer.com/lm/bundles/keepmysettingsx/keepmysettingsx.zip

hXXp://sdspapi.com/api/values

hXXp://us.yhs4.search.yahoo.com/yhs/search?p={searchTerms}&ei=UTF-8&hspart=w3i&hsimp=yhs-synd1&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635

Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallX Search Protect for Yahoo

hXXp://dl2.v47installer.com/lm/bundles/keepmysettingsx/spv1.zip

spv1.zip

.html

MainWnd.cpp

OfferThread.cpp

Setting offer checkbox value: key=

COfferExe::GetXpiFilename

c:\tfs.vs2012\admin\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h

downloadurl

downloadurl.64bit

msie.downloadurl

msie.commandline

firefox.downloadurl

firefox.commandline

chrome.downloadurl

chrome.commandline

allbrowser.downloadurl

allbrowser.commandline

regkeyadd

ieregkey

firefox.pref

firefox.xpimethod

firefox.xpilocation

firefox.xpidelete

LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser

iconurl

residenturl

configuration/downloadurl

configuration/downloadurl.64bit

configuration/msie.downloadurl

configuration/msie.commandline

configuration/firefox.downloadurl

configuration/firefox.commandline

configuration/chrome.downloadurl

configuration/chrome.commandline

configuration/allbrowser.downloadurl

configuration/allbrowser.commandline

configuration/regkeyadd

configuration/ieregkey

configuration/firefox.pref

configuration/firefox.xpimethod

configuration/firefox.xpilocation

configuration/firefox.xpidelete

configuration/iconurl

configuration/residenturl

adding %s entry, ourVal='%s', theirVal='%s'

COfferExe::Download

Download url is empty!

_firefox is NULL!

COfferExe::OnInstall

Install is a dropfile; no exe to run...

Icon offer (in exe config) detected, running icon install

COfferExe::Run

COfferExe::HandleFirefoxOptions

firefoxoffer

HandleFirefoxOptions called with incorrect preferences set in config!

COfferExe::BuildCommandLine

msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress

msiexec.exe /i "%s" %s

Could not find firefox exe to install

Offer is installing XPI for Firefox 8 or higher, enabling GUI.

"%s" "%s"

"%s" %s

COfferExe::RunSearchProtectInstall

COfferExe::WaitForInstallProcess

OfferExe.cpp

COfferExe::WaitForProcessStarted

waiting for registry key:

COfferExe::WaitForRegistryValue

Registry key found.

Registry key found (64-bit).

COfferExe::WaitForFile

COfferExe::InstallXpi

Bad RegKeyAdd config; not correct format: (missing hive \ )

Bad RegKeyAdd config; not correct format: (missing , )

Bad RegKeyAdd config; not correct format: (missing = )

unable to set regkey from following RegKeyAdd:

RegKeyAdd:

unrecognized values in RegKeyAdd:

unable to set regkey from following IERegKey:

IERegKeyAdd:

unrecognized values in IERegKey:

COfferExe::FinishXpiInstall

COfferExe::CancelXpiInstall

COfferExe::RunIconInstall

%s_%s.url

COfferExe::InstallResident

residentUrl is NULL!

~.exe

installx.dat

installx.cfg

hXXp://click.freeze.com/?clname=resident

sessionurl

configuration/url

configuration/msie.url

configuration/firefox.url

configuration/chrome.url

All urls are empty!

COfferStartPage::InstallFirefox

_firefox is NULL!

** Debug mode: simulated setting Firefox startpage:

Error writing Firefox pref for startpage!

Error setting Firefox new tab!

Set new tab in Firefox.

Firefox startpage set successful.

chromeoffer

COfferStartPage::InstallChrome

_chrome is NULL!

** Debug mode: simulated setting Chrome startpage:

Error setting Chrome startpage: browser is still running!

Error writing Chrome pref for startpage!

Can't set new tab Chrome, function is not implemented.

Chrome startpage set successful.

OfferStartPage.cpp

startpageurl

oldstartpageurl

hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}

hXXp://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=#REVENUE_TAG#

hXXp://search.yahoo.com/favicon.ico

configuration/msie.searchname

configuration/firefox.searchname

configuration/firefox.suggesturl

configuration/firefox.selectedengine

configuration/firefox.keywordurl

configuration/chrome.selectedengine

configuration/chrome.keyword

configuration/chrome.faviconurl

configuration/chrome.suggesturl

Error setting IE search: url is empty!

Internet Explorer version 6 or older does not support default search!

COfferDefaultSearch::InstallFirefox

** Debug mode: simulated setting Firefox default search:

Failed to write Yahoo xml for Firefox!

Firefox default search set successful.

COfferDefaultSearch::InstallChrome

** Debug mode: simulated setting Chrome default search:

Failed to set search pref for chrome!

Chrome default search set successful.

OfferDefaultSearch.cpp

searchurl

oldsearchurl

hXXp://vinstaller.com/api/trackofferinstalldetails

hXXp://vinstaller.com/api/installerror

ping.response.json

postback.response.json

config.xml

pingurl

postbackurl

errorurl

statsdurl

uninstalloptionurl

PingUrl

PostbackUrl

Sending session request, url=

Ping url is empty!

Ping url is invalid!

hXXp://dl5.v1installer.com/

PingResponse.cpp

targetbrowser/Key

PingThread.cpp

offer %s[%s]: isInstalled=%d canShow=%d

rule %s[%s]: isInstalled=%d

QuickStartDetectThread.cpp

ResourceThread.cpp

Sending postback request, url=

Postback url is empty!

Postback url is invalid!

Response/url

passed

CRequirementManager::RunExecute

CRequirementManager::ParseExecuteResult

invalid flag in execute result:

Software\Microsoft\Windows\CurrentVersion\RunOnce

Running requirement.OnInstall:

Running requirement.OnCancel:

requirement.OnCancel is empty, skipping.

Running requirement.OnExit:

requirement.OnExit is empty, skipping.

%programdata%\W3i\UninstallHelper\iqu.ini

2.0.1.0

%programdata%\W3i\UninstallHelper\import

quickstart.xml

quickstart%d.xml

Failed to save IQU data, too many import files in directory!

%programfiles%\W3i\UninstallHelper\UninstallHelper.exe

quickstart_si.xml

quickstart_si%d.xml

Failed to save SoftwareInfo data, too many import files in directory!

hXXp://dl.installiq.com/API/IQU/SoftwareInfo.aspx

UH executable not found!

"%s" /silent /noswinfo

%s:%d

handling firefox cookies...

FF.GetCookiesError

FF.NoCookies

firefox: no cookies found

FF.SetCookieError

FF.SetCookies

firefox: set cookies

getting firefox cookies for

CCookieManager::GetFirefoxCookies

Error enumerating firefox cookies!

firefoxenum

hXXp://

cookie.dat

Vista.NoResult

Vista.SavedLow

Vista.NoCookies

Vista.CopiedLow

%a, %d-%b-%Y %H:%M:%S GMT

cookieman.exe

Vista.ExtractError

Vista.CreateLowError

handling chrome cookies

Chrome.GetCookiesError

Chrome.NoCookies

Chrome: no cookies found

Chrome.SetCookieError

Chrome.SetCookies

Chrome: set cookies succeeded

getting Chrome cookies for

CCookieManager::GetChromeCookies

Error enumerating chrome cookies!

chromeenum

Safari.GetCookiesError

Safari.NoCookies

Safari.SetCookieError

Safari.SetCookies

ErrorLogger.cpp

explorer.exe

CDialogWindowJson::OnBeforeNavigate2, url=

DialogWindowJson.cpp

%s: view=%s accept=%s

chk_%s=

checkbox found; %s=%s

adding disclosure(%s): %s

installedbrowsers/firefox

installedbrowsers/chrome

installedbrowsers/opera

view.buildconfig.json

view.productconfig.json

ProgressDialog.cpp

Installing %d of %d

uninstalloption.exe

InstallIQFirefoxLock

postinstallexecute

postinstallexecuteintegrity

stopfirefox

stopchrome

configuration/postinstallexecute

configuration/postinstallexecuteintegrity

/msie.autoconfirm

/firefox.autoconfirm

/chrome.autoconfirm

msie.autoconfirm

firefox.autoconfirm

chrome.autoconfirm

COffer::WaitForFirefoxLock

Offer.cpp

_firefoxLock is already created!

Waiting for Firefox lock...

Firefox lock status:

Releasing Firefox lock

PostInstallExecute:

iexplore.exe

** Debug mode: simulating PostInstallExecute:

Cannot run post-install execute, file does not exist:

COffer::PostInstallExecute

PostInstallExecute command failed!

http:

Adding UH data: %s|%s,%s

Failed to extract uninstall option exe!

Error; uninstalloption.exe doesn't exist (after download and extract!)

Error copying uninstalloption.exe to program files!

error downloading uninstall option url!

hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe

%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

"%s" %s "%s"

AdobeAirInstaller.exe

Uninstall keys:

/uninstallkeys/uninstallkey

%s/uninstallkeys/uninstallkey[%d]/type/text()

%s/uninstallkeys/uninstallkey[%d]/value/text()

%firefoxprofiles%

Unknown uninstall key type encountered, skipping lookup

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

HRESULT:0x%X

crterr:%d

Win32Err:%d

@ line %d in function <%s>.

wininet.dll

Unknown error: %d

IDispatch error #%d

LoadLibrary failed in loading current exe:

CoreResource.cpp

CStringW.GetBuffer failed!

0xx

%s. {%s} @ line %d in function <%s> in module %s.

HRESULT:0x%X

HttpStatus:%d

Win32Err:%d

Error:%d

L%d:d.d.d_d:d:d.d

-- %s line %d --

[X]

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d

%s_%x%x%x%x%x

CoreFile.cpp

Exception %X in module %s at: 0x%p.

dbghelp.dll

0x%p %s

CoreProcess.cpp

CCoreProcess::ShellExecuteCommand

ShellExecuteCommand:

CCoreProcess::ShellExecuteCommandAndWait

Failed to execute command:

CCoreProcess::CloseProcessWindowsByModuleName

CCoreProcess::GetProcessExe32

CCoreProcess::GetProcessExe64

kernel32.dll

CoreXml.cpp

_ftprintf_s failed writing header to

]/Key/text()

CCoreXml::ParseRequiredKeyValue

CCoreXml::ParseRequiredKeyInt

CoreThread.cpp

PTF://

hXXps://

CoreSystem.cpp

CCoreSystem::GetWindowsVersionId

Missing windows version, check the code!!

%s (Build %d)

Unknown OS! Major: 0xX, Minor: 0xX

CCoreSystem::CacheWindowsInfo

%system%

%windows%

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Þsktop%

Þsktopdir%

%userprofile%

%s0x%.2x%.2x%.2x%.2x%.2x%.2x-

SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322

SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727

SOFTWARE\Microsoft\.NETFramework\policy\v1.0

3321-3705

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

Iphlpapi.dll

%windows%\Desktop

VBoxService.exe

vboxtray.exe

proc.vboxsvc

vmtoolsd.exe

proc.vboxtray

vmicsvc.exe

proc.vmtools

proc.hvsvc

reg.vboxguest

reg.vboxmouse

reg.vboxsvc

reg.vboxsf

reg.vboxvid

reg.vboxbios

%system%\vboxhook.dll

reg.vboxsguest

file.vboxhook

reg.vmvid

reg.vmpci

reg.vmdbg

reg.vmcrd

reg.vmmem

reg.vmmouse

reg.vmdsk

reg.vmtools

reg.vmsnap

reg.vmnet64

reg.hvgenctr

reg.hvvmbus

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000

reg.hvvid

SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000

reg.hvscsi

reg.hvinput

reg.vboxdisk

reg.vmdisk

reg.hvdisk

sng.vmt1

sng.vmt3

sng.vmt2

gen.dbg

sng.vmt4

gen.diftime

CCoreRegKey::Create

Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.

RegCreateKeyEx failed on key=

RegOpenKeyEx failed on key=

CCoreRegKey::Open

Registry key is not open! (

CCoreRegKey::GetValueType

CoreRegKey.cpp

CCoreRegKey::GetValueSize

CCoreRegKey::GetValue

CCoreRegKey::GetValueString

CCoreRegKey::SetValue

CCoreRegKey::DeleteValue

CCoreRegKey::DeleteKey

RegDeleteKeyEx failed on

RegDeleteKeyExA

RegDeleteKey failed on

CCoreRegKey::EnumSubKeys

CCoreRegKey::CopyTree

SHCopyKey failed for

CCoreEntryPoint<long (__stdcall*)(struct HKEY__ *,char const *,unsigned long,unsigned long)>::CCoreEntryPoint

CCoreEntryPoint<long (__stdcall*)(struct HKEY__ *,char const *,unsigned long,unsigned long)>::LoadProcAddress

Advapi32.dll

UniqueId.cpp

subKey is NULL!

%u,%u,%u,%u

0.0.0.0

\/:*?"<>|

createurlfilefail

Failed to create URL file!

Encryption key not initialized!

CoreEvent.cpp

shell32.dll

CoreVista.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_USERS

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

%Y-%m-%dT%H:%M:%S

CommandLine.cpp

%s.%s

iexplore,ie.http

Failed to get IE version key!

Loading IE cookies for url:[

wrote %d cookies

CoreInternetExplorer.cpp

Unable to find iexplore.exe, using shell execute (with possible warnings)

-noframemerging "%s"

ie.http\shell\open\command

Default search regkey not found (may be a brand new install)

ieframe.dll

EnumSubKeys failed!

hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

url is empty!

Replacing existing provider url:

Error setting provider url!

FindFirstUrlCacheEntry() failed!!

CCoreInternetExplorer::FindFirstHistoryUrl

CCoreInternetExplorer::FindNextHistoryUrl

findfirsturlfailed

FindNextUrlCacheEntry() failed!!

FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??

CCoreInternetExplorer::FindCloseHistoryUrl

findnexturlfailed

findcloseurlfailed

FindCloseUrlCache() failed!!

msgTitle is required!

msgText is required!

browser.search.defaultenginename

keyword.URL

browser.search.selectedEngine

MozillaUIWindowClass

browser.startup.homepage

firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox

MozillaWindowClass

Software\Mozilla\Mozilla Firefox

Failed to get Firefox version key!

CCoreFirefox::GetVersion

Profile%d

firefoxver

%appdata%\Mozilla\Firefox

Firefox versions prior to 3 are not supported by LoadProfileCookies!

profiles.ini

Loading Firefox3 cookies for url:[

%s=%s

cookies.sqlite

Enumerating Firefox3 cookies for

cookies.txt

Enumerating Firefox cookies for

Found partial cookie in Firefox profile:

firefox.exe

-requestPending -osint -new-window "%s"

PathToExe

prefs.js

%programfiles%\Mozilla Firefox

CoreFirefox.cpp

CCoreFirefox::GetPrefString

CCoreFirefox::SetPrefString

user_pref("%s", %s%s%s);

CCoreFirefox::SetDefaultSearch

searchUrl is empty!

Can't set search engine while Firefox is running!

suggestionUrl is empty!

Setting Firefox default search engine:

SuggestionUrl=

SearchUrl=

Failed to write Yahoo search prefs for Firefox!

hXXp://VVV.mozilla.org/2006/browser/search/

browser.search.order.1

browser.search.order.2

places.sqlite

downloads.sqlite

select source from moz_downloads where source like '%%%s%%' order by id desc

Failed to open downloads.sqlite database!

select url from moz_places where url like '%%%s%%' order by id desc

Failed to open places.sqlite database!

cannot set startpage; firefox is currently running!

CCoreFirefox::SetStartpage

browser.startup.page

Cannot set newtab because firefox is running!

CCoreFirefox::SetNewTab

browser.newtab.url

firefox pref: keyword.URL=

browser.search.param.yahoo-fr

firefox pref: browser.search.param.yahoo-fr=

c:\tfs.vs2012\admin\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h

CCoreChrome::SetCookie

Chrome_WidgetWin_0

Chrome_WindowImpl_0

Chrome_WidgetWin_1

Chrome_RenderWidgetHostHWND

%local_appdata%\Google\Chrome\User Data\Default\Cookies

chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium

Loading Google Chrome cookies for url:[

CCoreChrome; Cookie file does not exist

host_key like '%

select name, value, host_key, path, expires_utc from cookies where

CCoreChrome::EnumCookiesLegacy

Enumerating Google Chrome cookies for

Chrome cookie file does not exist

Enumerating Google Chrome cookies (v33) for

select host_key, name, value, path, expires_utc from cookies where host_key like '%

select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%

CCoreChrome::EnumCookiesV33

Chrome cookie:

Failed to decrypt chrome cookie:

--new-window "%s"

chrome.dll

chrome.exe

Unable to find chrome.exe, using shell execute (with possible warnings)

%local_appdata%\Google\Chrome\Application

ChromeHTML\shell\open\command

CCoreChrome::GetStartpage

%programfiles%\Google\Chrome\Application

session/urls_to_restore_on_startup

CCoreChrome::GetStartupPages

CoreChrome.cpp

session/startup_urls

CCoreChrome::IsMultiStartPageEnabled

CCoreChrome::SetStartpage

CCoreChrome::SetStartPageOld

CCoreChrome::SetStartPageNew

SELECT value FROM meta WHERE key='Default Search Provider ID'

%local_appdata%\Google\Chrome\User Data\Default\Web Data

SELECT id, short_name, url FROM keywords where id = %s

CCoreChrome::GetDSUrlFromPrefTemplate

default_search_provider_data/template_url_data

default_search_provider_data/template_url_data/url

{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

default_search_provider_data/template_url_data/id

default_search_provider_data/template_url_data/short_name

CCoreChrome: Name param cannot be blank

CCoreChrome::SetDefaultSearch

CCoreChrome: url param cannot be blank

CCoreChrome: keyword param cannot be blank

Found existing default search in Chrome: id=

hXXp://VVV.yahoo.com/favicon.ico

Successfully set Default Search provider in chrome

failed to set Database keyword search!!

CCoreChrome::SetDatabaseKeywordSearch

keywords

UPDATE meta SET value='%s' WHERE key='Default Search Provider ID'

sql string is empty

CCoreChrome::SetPrefDefaultSearchTemplate

Successfully added default search data to keyword and meta tables

chrome preferences failed to load!

keyword

default_search_provider_data/template_url_data/

favicon_url

suggestions_url

originating_url

instant_url

image_url

search_terms_replacement_key

suggestions_url_post_params

search_url_post_params

image_url_post_params

instant_url_post_params

new_tab_url

CCoreChrome::FindSearchEntryID

url = '

keyword like '%

url like '%

SELECT id FROM keywords WHERE

Setting existing default search in Chrome:

CCoreChrome::SetExistingDefaultSearchUrl

Error opening Chrome Web Data!

CCoreChrome::LookupExistingDefaultSearchUrl

Looking up default search url:

SELECT * FROM keywords WHERE url='%s'

Sqlite is not open!

LookupDefaultSearchUrl: url not found in table

SELECT * FROM keywords WHERE short_name='%s'

LookupDefaultSearchUrl: id not found in row

CCoreChrome::GetPreference

CCoreChrome::LoadChromePreferences

%local_appdata%\Google\Chrome\User Data\Default\Preferences

suggest_url

suggest_url_post_params

, show_in_default_list=%s, safe_for_autoreplace=%s, input_encodings='%s'

UPDATE %s set short_name='%s', keyword='%s', url='%s', favicon_url='%s'

WHERE id=%s

, suggest_url='%s'

keywords_backup

INSERT INTO %s (

short_name, keyword, favicon_url, url,

input_encodings, show_in_default_list, suggest_url, prepopulate_id,

safe_for_autoreplace, originating_url, date_created, usage_count,

created_by_policy, instant_url, last_modified, sync_guid) VALUES (

%s, '%s', %s, %s,

'%s', '%s', '%s', '%s',

%s, '%s', %s, '%s')

'%s', %s, '%s', %s,

%local_appdata%\Google\Chrome\User Data\Default\History

select url from downloads_url_chains where url like '%%%s%%' order by id desc

CoreFirefoxXPIInstaller.cpp

CCoreFirefoxXpiInstaller::Install

CCoreFirefoxXpiInstaller::GetXpiInfo

install.rdf

xml.LoadBuffer failed on

Firefox.exe not found!

Installing Firefox add-ons via package...

installiq.xpi

Create install.rdf failed!

CCoreFirefoxXpiInstaller::InstallAsPackage

Running Firefox to install add-ons:

Error running Firefox!

<?xml version="1.0"?><RDF xmlns="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"

xmlns:NC="hXXp://home.netscape.com/NC-rdf#"

xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">

<Description about="urn:mozilla:install-manifest">

<em:id>[email protected]</em:id>

<em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>

<em:maxVersion>*.*.*</em:maxVersion>

Error creating install.rdf!

CCoreFirefoxXpiInstaller::CreateInstallRDF

Installed Firefox extension:

CCoreFirefoxXpiInstaller::SetResult

Can't get Firefox default profiles folder!

CCoreFirefoxXpiInstaller::GetExtensionsFolder

c:\tfs.vs2012\admin\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h

keepmysettingsx.exe

hXXps://installer.freeze.com/LogError.aspx

Restoring V1 toolbar uninstall key...

Error replacing toolbar uninstall key!

Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion

Software\Microsoft\Windows\CurrentVersion\Uninstall\KeepMySettingsX

Renaming V1 uninstall key...

Error opeing uninstall registry key in HKLM\

Error copying V1 registry key!

CoreSearchProtectorApp.cpp

Error removing V1 registry key from HKLM\

CCoreSearchProtectorApp.ShutDown: window not found

Software\Microsoft\Windows\CurrentVersion\Run

Error removing registry key from HKLM\

apiurl

dsotherurl

spotherurl

searchkeyword

hXXp://bing.com

%s/provider[%d]

hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=

hXXp://google.com

firefoxstartpage

firefoxsearch

chromestartpage

chromesearch

config.dat

Yahoo uninstall key not found

Error replacing Yahoo Toolbar uninstall key!

UninstallKey

Software\Microsoft\Windows\CurrentVersion\Uninstall\

UninstallKey=

ChromeStartPage

ChromePriorSearchUrl

FirefoxPriorSearchUrl

ChromePriorStartPage

FirefoxPriorStartPage

CoreBrowserOptionUninstaller.cpp

c:\tfs.vs2012\admin\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h

safari.exe,safariurl,safari

%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies

Loading Safari cookies for url:[

CoreSafari.cpp

%appdata%\Apple Computer\Safari\Cookies\Cookies.plist

Failed to get Safari version key!

safari.exe

-url "%s"

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

Can't find shell associations or shell command reg keys!

CoreBrowser.cpp

Dll %s failed, resultcode = %x

SymCCIS.dll

SymCCIS2.zip

RunDLL productlist="%s" resultcodes="%s"

SymCCIS_CheckCriteria.txt

SCCLog.txt

SymInstallStub.txt

SymCCISDll.txt

Detect.cpp

/executeresult/text()

/execute/text()

Missing ExecuteResult in requirement config!

%programfiles%\iTunes\iTunes.exe

SOFTWARE\Microsoft\Windows Live\Messenger

ydetect.ytb

msnmsgr.exe

ydetect.yhp

ydetect.yas

Rules.cpp

RegKeyExists

regkey

chromeprefs

firefoxprefs

CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf

CDetectionYahooToolbar::IsInstalledFirefox

KeyExists

SourceKey

hkey_local_machine

hkey_current_user

hkey_current_config

hkey_classes_root

multireg: key found:

multireg%d

multireg: unable to parse key:

1.1.0.6

//flag[%d]/text()

Cannot evaluate .NET Version, .NET may not be installed!

DetectionFile.cpp

wajam_validate.zip

wajamexemissing

extracted wajam exe file not found!

Timed out waiting for wajam_validate.exe!

Unable to get returncode from wajam_validate.exe!

wajam_validate.exe detection process result = %d

yahoo.com

live.com

google.com

ask.com

msn.com

aol.com

CDetectionFirefoxPrefs::OnEvaluate

DetectionFirefoxPrefs.cpp

CDetectionChromePrefs::OnEvaluate

DetectionChromePrefs.cpp

)] disabled because of minimum windows version.

minwindowsversion

DetectionRule.cpp

Disabled; Firefox is not installed

Disabled; rule target is not Firefox

Disabled; Chrome is not installed

Disabled; rule target is not Chrome

asktbdet.zip

Ask detection process result = %d

CoreWininet.cpp

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

wininet: connecting to %s:%d

HTTPSendRequest:

wininet: HttpOpenRequest failed!

CCoreWininet::HTTPSendRequest

wininet: Request handle is NULL after HttpSendRequest!

httpopenrequest

unable to set wininet http decoding

httpreqerr

Content-Type: application/x-www-form-urlencoded

httpaddheaders

wininet: HttpAddRequestHeaders (post flag) failed!

Range: bytes=%u-%u

Range: bytes=%u-

httpaddheader

wininet: HttpAddRequestHeaders (range specification) failed!

wininet: HttpSendRequest failed! (verb=

httpsendreq

wininet: HttpSendRequest failed!

httptimeout

httpqueryinfo

wininet: HttpQueryInfo failed!

httpproxy

httpstatus

wininet: Server responded with error: %d, %s. %s %s

wininet: HttpSendRequest: status OK received

wininet: HttpQueryInfo for file size failed!

wininet: HttpQueryInfo for content range failed!

wininet: Operation cancelled by caller.

Software\Microsoft\Windows\CurrentVersion\Internet Settings

HTTP Status %d: %s

apiUrl is null!

API url is invalid!

%m/%d/%Y

Url is null!

%s, %s, l=0xx

[0x%X]

d:%s

01234567

%s(%s);

CoreJSON2.cpp

Node path not valid; node "%s" in path "%s" is not type Node!

PackageZlib.cpp

Error: %d bytes of %d read from file %s.

unzOpenCurrentFilePassword failed!

Error: %d bytes of %d were written to file %s.

unzOpenCurrentFilePassword failed! err=

Package.cpp

autorun.txt

CCoreSqlite::OpenDatabase

CCoreSqlite::CloseDatabase

CCoreSqlite::ExecuteStatement

dbexecerror

sqlite3_exec failed, returned error:

CoreSqlite.cpp

CCoreSqlite::StandardExecuteCallback

CCoreSqlite::PrepareCompiledStmt

Cannot prepare statement, sql is empty!

Failed to prepare compiled statement, sqlite returned error: %d

sqlempty

sqliteerror

CCoreSqlite::BindTextToCompiledStmt

bind text failed, errorcode=%d

CCoreSqlite::ExecuteCompiledStmt

sqlite3_step failed, errorcode=%d

CCoreSqlite::CheckStmtRowValid

sqlitestepfailed

Cannot get row results: statement has not executed!!

sqlite3_finalize failed, errorcode=%d

CCoreSqlite::CloseCompiledStmt

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

CREATE TABLE sqlite_master(

sql text

3.7.5

CREATE TEMP TABLE sqlite_temp_master(

zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll

unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll

1.2.7

deflate 1.2.7 Copyright 1995-2012 Jean-loup Gailly and Mark Adler

inflate 1.2.7 Copyright 1995-2012 Mark Adler

SQLITE_

d:d:d

d-d-d d:d:d

d-d-d

failed memory resize %u to %u bytes

failed to allocate %u bytes of memory

API call with %s database connection pointer

922337203685477580

RowKey

%s-shm

OsError 0x%x (%u)

%s\etilqs_

Recovered %d frames from WAL file %s

invalid page number %d

Failed to read ptrmap key=%d

2nd reference to page %d

%d of %d pages missing from overflow list starting at %d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

freelist leaf count too big on page %d

failed to get page %d

unable to get the page. error code=%d

Page %d:

On tree page %d cell %d:

btreeInitPage() returns error code %d

On page %d at right child:

Corruption detected in cell %d on page %d

Fragmentation of %d bytes reported as %d on page %d

Multiple uses for byte %d of page %d

Pointer map page %d is referenced

Page %d is never used

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjX

foreign key constraint failed

bind on a busy prepared statement: [%s]

unable to use function %s in the requested context

zeroblob(%d)

abort at %d in [%s]: %s

cannot open savepoint - SQL statements in progress

constraint failed at %d in [%s]

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot rollback transaction - SQL statements in progress

sqlite_master

sqlite_temp_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

database table is locked: %s

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

no such column: "%s"

cannot open view: %s

indexed

foreign key

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s

%s: %s.%s.%s

not authorized to use function: %s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

too many SQL variables

variable number must be between ?1 and ?%d

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

sqlite_rename_table

%s%.*s"%w"

sqlite_rename_parent

sqlite_rename_trigger

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

there is already another table or index with this name: %s

view %s may not be altered

table %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

sqlite_sequence

Cannot add a PRIMARY KEY column

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

DELETE FROM %Q.%s WHERE tbl=%Q

CREATE TABLE %Q.%s(%s)

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

too many attached databases - max %d

invalid name: "%s"

database %s is already in use

no such database: %s

unable to open database: %s

cannot detach database %s

sqlite_detach

database %s is locked

%s %T cannot reference objects in database %s

sqlite_attach

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

duplicate column name: %s

too many columns on %s

table "%s" has more than one primary key

default value of column [%s] is not constant

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

CREATE TABLE %Q.sqlite_sequence(name,seq)

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

view %s is circularly defined

use DROP TABLE to delete table %s

table %s may not be dropped

DELETE FROM %s.sqlite_sequence WHERE name=%Q

use DROP VIEW to delete view %s

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

number of columns in foreign key does not match the number of columns in the referenced table

foreign key on %s should reference only one column of table %T

indexed columns are not unique

unknown column "%s" in foreign key definition

views may not be indexed

table %s may not be indexed

there is already a table named %s

virtual tables may not be indexed

sqlite_autoindex_%s_%d

index %s already exists

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

no such index: %S

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

table %s may not be modified

unable to identify the object to be reindexed

cannot modify %s because it is a view

sqlite_version

sqlite_compileoption_used

sqlite_source_id

sqlite_compileoption_get

foreign key mismatch

%d values for %d columns

table %S has %d columns but %d values were supplied

table %S has no column named %s

PRIMARY KEY must be unique

%s.%s may not be NULL

unable to open shared library [%s]

sqlite3_extension_init

error during initialization: %s

no entry point [%s] in shared library [%s]

automatic extension loading failed: %s

foreign_keys

foreign_key_list

*** in database %s ***

unsupported encoding: %s

%s - %s

malformed database schema (%s)

unsupported file format

database schema is locked: %s

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

RIGHT and FULL OUTER JOINs are not currently supported

unknown or unsupported join type: %T %T%s%T

cannot have both ON and USING clauses in the same join

a NATURAL join may not have an ON or USING clause

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

LIMIT clause should come after %s not before

ORDER BY clause should come after %s not before

no such index: %s

SELECTs to the left and right of %s do not have the same number of result columns

no such table: %s

sqlite_subquery_%p_

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

cannot create INSTEAD OF trigger on table: %S

no such trigger: %S

no such column: %s

-- TRIGGER %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor did not declare schema: %s

vtable constructor failed: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s AS %s

%s TABLE %s

%s USING INTEGER PRIMARY KEY

%s USING %s%sINDEX%s%s%s

%s (rowid>? AND rowid<?)

%s (rowid=?)

%s (rowid<?)

%s (rowid>?)

%s (~%lld rows)

%s VIRTUAL TABLE INDEX %d:%s

cannot use index: %s

at most %d tables in a join

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such vfs: %s

misuse at line %d of [%.10s]

database corruption at line %d of [%.10s]

cannot open file at line %d of [%.10s]

&#xX;

%s="%s"

%s='%s'

</%s>

<!--%s-->

<![CDATA[%s]]>

encoding="%s"

version="%s"

standalone="%s"

CoreDialogCloseProcess.cpp

CoreHtmlDialog.cpp

onBeforeNavigate2 called, url=

CoreIEControl.cpp

uxtheme.dll

Error getting IExecAction!

CCoreWinTask::AddExecAction

CCoreOpera::EnumCookies

c:\tfs.vs2012\admin\windows\main\core.cpplib\core.cpplib.browser\CoreOpera.h

LoadCookies is not implemented for Opera!

CCoreOpera::SetCookie

EnumCookies is not implemented for Opera!

CCoreOpera::LoadCookies

OpenURL is not implemented for Opera!

opera.exe,opera.protocol,opera.url,opera,operanext,operastable

SetCookie is not implemented for Opera!

CCoreOpera::OpenUrl

opera.exe

Software\Opera Software

launcher.exe

%programfiles%\Opera

%programfiles%\Opera Next

CoreIEHost.cpp

m_WebBrowserEvents failed

IWebBrowser2 failed

_WebBrowserEvents failed

Not initialized or _webBrowser is NULL!

Sending Quit to web browser...

IWebBrowser failed!

_webBrowser->Quit failed!

CCoreIEHost::DeleteHistoryUrl

WebBrowser object is NULL!

CCoreIEHost.OnDocumentComplete:

Error: Collection didn't support IHTMLElementCollection!

*** set key code to 0 ****

c:\tfs.vs2012\admin\windows\main\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb

KERNEL32.dll

USER32.dll

OLEAUT32.dll

SHDeleteEmptyKeyA

SHLWAPI.dll

COMCTL32.dll

GetProcessHeap

GetCPInfo

ShellExecuteExA

SHELL32.dll

ole32.dll

PSAPI.DLL

VERSION.dll

USERENV.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCombineUrlA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestA

HttpQueryInfoA

WININET.dll

UrlEscapeA

SHCopyKeyA

gdiplus.dll

IsValidURL

urlmon.dll

GetWindowsDirectoryA

EnumWindows

EnumChildWindows

GetKeyboardState

GDI32.dll

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

RegDeleteKeyA

RegQueryInfoKeyA

RegEnumKeyExA

ADVAPI32.dll

CRYPT32.dll

zcÁ

.?AV?$_Ref_count@VCOfferExe@@@std@@

.?AV?$_Ref_count_obj@VCOfferExe@@@std@@

.?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@

.?AVCOfferExe@@

.?AVCCoreStringUrl@@

.?AV?$CFlags@W4WebArgFlag@@@@

.?AV?$CCoreEntryPoint@P6GJPAUHKEY__@@PBDKK@Z@@

.?AVCCoreRegKey@@

.?AV?$CAtlArray@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@@ATL@@

.?AVCCoreFirefox@@

.?AV?$CFlags@W4CoreFirefoxCache@@@@

.?AV?$_Func_impl@U?$_Callable_obj@V?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@$0A@@std@@V?$allocator@V?$_Func_class@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@@2@XPAVCCoreSqlite@@U_Nil@2@U52@U52@U52@U52@U52@@std@@

.?AVCCoreChrome@@

.?AV?$CFlags@W4CoreChromeCache@@@@

.?AV?$_Func_base@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@

.?AV?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@

.?AVCCoreFirefoxXpiInstaller@@

.?AV?$_Ref_count_obj@VCCoreOpera@@@std@@

.?AV?$_Ref_count_obj@VCCoreChrome@@@std@@

.?AV?$_Ref_count_obj@VCCoreFirefox@@@std@@

.?AV?$_Ref_count_obj@VCDetectionChromePrefs@@@std@@

.?AV?$_Ref_count_obj@VCDetectionFirefoxPrefs@@@std@@

.?AVCDetectionFirefoxPrefs@@

.?AVCDetectionChromePrefs@@

.?AV?$CAtlArray@UWebArg@@V?$CElementTraits@UWebArg@@@ATL@@@ATL@@

.?AVCCoreWebArgs@@

.?AVCCoreSqlite@@

.?AV?$CAtlArray@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@V?$CElementTraits@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@@2@@ATL@@

.?AVCCoreSqliteResult@@

.?AVexecution_error@TinyXPath@@

.?AVCCoreOpera@@

.?AV?$CFlags@W4CoreOperaCache@@@@

.?AVCCoreWebBrowserEvents@@

.?AUDWebBrowserEvents2@@

c:\%original file name%.exe

@.reloc

Vista.BadArgs

\cookie.ini

\cookie.dat

Vista.BadArgs2

Domain%d

Name%d

\cookie%d.dat

\cookie%d.ini

Vista.NoAppLow

Vista.WideFail

Vista.GetCookieFail

Vista.AllocFail

Vista.CreateFileError

Vista.WriteFileError

Vista.SetCookie

SetCookie%d

Vista.SetCookieError

Error: %d. %s

c:\tfs.vs2012\admin\windows\main\Installer.QuickStart.Application\ReleaseNoMFC\Installer.CookieMan.pdb

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

3 3%3,323

.ao &

$.OA[W

C_.jN

fs.MJ

\%S6j

<.Vmx

<R.RI

;.Ur?

7:.Vmeu

-N.sZ

v.GEJh

}N5%d

.nX9k

U;9%u

g 8%U

'/O.Axy

f7%X[

@: .pI^

wajam_validate.exe

R2dmjg

a.PEj

T8.JEfg

petite_oo_v4.vi.zip

%S^X.

Fm%U*

RgtcP #a

H7n%X

[Q:%d>_

.F'i.OL

&%d$f

*PY'%X;2`

,.nbY

m%FO?

%Shy)

abiword.vi.zip

=?.Hr

@%fpN

rockettab.vi.zip%

offerbox.vi.zip

pcoptimizerpro.vi.zip

pcspeedup.vi.zipb

registryhelper.vi.zip\

driverscanner.vi.zip

fulldiskfighter.vi.zip

smartpccleaner.vi.zip

speedupmypc_sales_r2_v2.vi.zip4g

weatherbug.vi.zip(~x

nortonsecurityscan.vi.zip_

winferno.vi.zip

uninstallhelper.vi.zip

4IWE(.gi],

driverfighter.vi.zip

-e}UJ

kaspersky.vi.zip,R

E.MRG

slowpcfighter.vi.zip

genieo.vi.zip

searchdonkey.vi.zip

nortoninternetsecurity.vi.zip

defaulttab.vi.zip

knctr.vi.zip

yahoosuite.vi.zip3

arcadeparlor.vi.zip6

severeweatheralerts.vi.zip

seaapp.vi.zip_

nortonantivirus.vi.zip

secureweb.vi.zip

yahoo_hpds_defaultsearch.test.vi.zip%s

resultsbay.vi.zipl

blitzmediaplayeroffer.vi.zip|

mypcbackup.vi.zip

convertfilesforfree.vi.zip

[.nT 

driversupport.vi.zipT

contentexplorer.vi.zip:

muvic.vi.zip

freeflvconverting.vi.zipl

`S.XY

smartdriverupdater.vi.zip

g.IahR

truedownloader.vi.zip

yahoo_hpds_startpage.test.vi.zip4,

converterfreeonline.vi.zip

linkey.vi.zip

blasteroids.vi.zipW

smartweb.vi.zip

websearches.vi.zip

savepathdeals.vi.zip

showpass.vi.zipH

yahoo_hpds_defaultsearch.vi.zipD

yahoo_hpds_startpage.vi.zipRH

yahoo_keepmysettingsx.vi.zip

abiword_12658.txt<)52

config.xmlPK

petite_oo_v4.vi.zipPK

abiword.vi.zipPK

rockettab.vi.zipPK

offerbox.vi.zipPK

pcoptimizerpro.vi.zipPK

pcspeedup.vi.zipPK

registryhelper.vi.zipPK

driverscanner.vi.zipPK

fulldiskfighter.vi.zipPK

smartpccleaner.vi.zipPK

speedupmypc_sales_r2_v2.vi.zipPK

weatherbug.vi.zipPK

nortonsecurityscan.vi.zipPK

winferno.vi.zipPK

uninstallhelper.vi.zipPK

driverfighter.vi.zipPK

kaspersky.vi.zipPK

slowpcfighter.vi.zipPK

genieo.vi.zipPK

searchdonkey.vi.zipPK

nortoninternetsecurity.vi.zipPK

defaulttab.vi.zipPK

knctr.vi.zipPK

yahoosuite.vi.zipPK

arcadeparlor.vi.zipPK

severeweatheralerts.vi.zipPK

seaapp.vi.zipPK

nortonantivirus.vi.zipPK

secureweb.vi.zipPK

yahoo_hpds_defaultsearch.test.vi.zipPK

resultsbay.vi.zipPK

blitzmediaplayeroffer.vi.zipPK

mypcbackup.vi.zipPK

convertfilesforfree.vi.zipPK

driversupport.vi.zipPK

contentexplorer.vi.zipPK

muvic.vi.zipPK

freeflvconverting.vi.zipPK

smartdriverupdater.vi.zipPK

truedownloader.vi.zipPK

yahoo_hpds_startpage.test.vi.zipPK

converterfreeonline.vi.zipPK

linkey.vi.zipPK

blasteroids.vi.zipPK

smartweb.vi.zipPK

websearches.vi.zipPK

savepathdeals.vi.zipPK

showpass.vi.zipPK

yahoo_hpds_defaultsearch.vi.zipPK

yahoo_hpds_startpage.vi.zipPK

yahoo_keepmysettingsx.vi.zipPK

abiword_12658.txtPK

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS></application></compatibility></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Emscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

combase.dll

777705555443332

5555443332

5555443332

mscoree.dll

Please email Customer Support at [email protected] if you need further assistance.

Installer.QuickStart

1.0.56.0

safeinstall.exe

%original file name%.exe_320_rwx_00EB0000_00002000:

The procedure %s could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

%original file name%.exe_320_rwx_10001000_00082000:

SSSSh

tcPW

QSSSSSSh

t%SWh

1.3.6.1.4.1.311.10.3.5

1.3.6.1.4.1.311.10.3.6

1.3.6.1.5.5.7.3.3

2.5.4.6

2.5.4.8

2.5.4.7

2.5.4.10

2.5.4.11

2.5.4.3

WINTRUST.dll

CRYPT32.dll

{X-X-X-XX-XXXXXX}

operator

GetProcessWindowStation

SCC_CheckCriteria_Web

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

2.1.0.20

CryptCATCatalogInfoFromContext

CryptMsgClose

CertCloseStore

CertFreeCertificateContext

CertFindCertificateInStore

CryptMsgGetParam

CertGetEnhancedKeyUsage

CertNameToStrW

CertGetNameStringW

URLOpenStreamW

urlmon.dll

DeleteUrlCacheEntryW

HttpOpenRequestW

HttpAddRequestHeadersW

HttpSendRequestW

WININET.dll

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExW

RegDeleteKeyW

RegCreateKeyExW

ADVAPI32.dll

ShellExecuteExW

SHELL32.dll

ole32.dll

SHLWAPI.dll

USERENV.dll

GetProcessHeap

GetWindowsDirectoryW

GetCPInfo

MsgWaitForMultipleObjectsEx

RegEnumKeyExW

RegQueryInfoKeyW

OLEAUT32.dll

SHDeleteKeyW

SHDeleteEmptyKeyW

SYMCCIS.dll

zcÁ

c:\%original file name%.exe

0xX

..\Source\ccVerifyTrustStatic.cpp

%SymEFA%

EFACli.dll

CLSID\%s\LocalServer32

CLSID\%s\InprocServer32

NTDLL.DLL

..\Source\ccVerifyTrustImpl.cpp

..\Source\FileCache.cpp

g..\Source\VerifyFile.cpp

..\Source\ccVerifyTrustPolicy.cpp

..\Source\CatalogIterator.cpp

..\Source\CatalogFileHash.cpp

WinTrust.dll

..\Source\CatalogContext.cpp

..\Source\ccSymModuleLifetimeMgrImpl.cpp

%s, %s, %s, %s(%ld)

..\Source\ccModule.cpp

..\Source\ccSystemInfo.cpp

..\Source\ccRegistry.cpp

..\Source\ccStringConvert.cpp

CSIDL_WINDOWS

SOFTWARE\Microsoft\Windows\CurrentVersion

..\Source\ccPathExpansion.cpp

\\?\UNC

..\Source\ccSplitPath.cpp

..\Source\ccOSInfo.cpp

\wpeutil.dll

\FACTORY.exe

\wpeinit.exe

..\Source\ccMemory.cpp

..\Source\ccFile.cpp

..\Source\ccWow64FsRedirection.cpp

%s\%s

CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_FILE_NOT_FOUND

CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_ACCESS_DENIED

isolate.ini

%COMMON_SILO_DATA%

..\Source\ccEncryptedString.cpp

..\Source\ccSynchronize.cpp

..\Source\ccSymDllLifetimeMgr.cpp

kernel32.dll

KERNEL32.DLL

PSAPI.DLL

..\Source\ccPEBReader.cpp

..\Source\ccPrivilege.cpp

..\Source\ccSymIndexValueCollectionImpl.cpp

AWTSAPI32.DLL

..\Source\ccSymDllLifetimeMgrLocal.cpp

..\Source\ccSymIndexValueCollection.cpp

..\Source\ccSymValueCollection.cpp

ÌROOT%

rcPFRes.dll

rcPxyEvt.dll

rcProxy.dll

rcSvcHst.dll

rcEmlPxy.dll

rcLgView.dll

rcErrDsp.dll

rcAlert.dll

rcApp.dll

ccEmlPxy.dll

ccGLog.dll

ccJobMgr.dll

ccGEvt.dll

ccIPC.dll

ccRkSn.dll

PFPriv.dll

ccPxyIns.dll

ccPxyEvt.dll

ccInst64.dll

ccEvtCli.dll

ccTrstPc.dll

ccSvc.dll

ccEraser.dll

OEHeur.dll

ccCharCv.dll

ccInst.dll

DefUtDCD.dll

ccScanw.dll

ccScan.dll

dec_abi.dll

ccDec.dll

ccALEng.dll

ccErrDsp.dll

ccProSub.dll

ccVrTrst.dll

ccSetEvt.dll

ccSet.dll

ccAlert.dll

..\Source\ccArchive.cpp

..\Source\ccDummyArchive.cpp

..\Source\ccInstanceFactory.cpp

..\Source\ccSymValueCollectionConvert.cpp

..\Source\ccSymStreamArchive.cpp

Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion

ÌROOT%\

ÌDATA%\

..\Source\ccSymInstalledApps.cpp

..\Source\ccSymDigest.cpp

..\Source\ccSymKeyValueCollectionImpl.cpp

..\Source\ccSymMemoryImpl.cpp

Archive.Write(CMemoryImpl::CSerializeImpl::Version) == FALSE

Archive.Read(nVersion) == FALSE

..\Source\ccSymStringImpl.cpp

Archive.Write(CStringImpl::Version) == FALSE

..\Source\ccSymInstanceFactoryImpl.cpp

t..\Source\ccMessageLock.cpp

..\Source\ccSymKeyValueCollection.cpp

..\Source\ccSymPersist.cpp

ÌROOT%\ccSet.dll

..\Source\ccSymObjectRepository.cpp

CommonClient\OBJID\%s

..\Source\ccMemoryArchive.cpp

..\Source\ccSymMemoryStreamImpl.cpp

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

FileDownloader::callURLOpenStream

CHttpRequest::CHttpRequest

CHttpRequest::~CHttpRequest

CHttpRequest::RequestPage

CHttpRequest::ParseURLW

https

[s d, d - d:d:d:d]

%s %ld

%s %s

%s 0x%x

hXXp://cps.qalabs.symantec.com/teams/isp/symccis

hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Staging

hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production

SymCCIS.dll

SCC.dll

OfferUI.dll

SymInstallStub.exe

SymCCISDll.txt

Total CheckCriteria execution time in seconds =

NortonOfferEngineImpl::CheckCriteria_Web

downloadStubInstallerExe() failed, HR =

Failed to delete downloaded SCC.dll, GetLastError =

Failed to delete existing SCC.dll, GetLastError =

NortonOfferEngineImpl::downloadStubInstallerExe

Failed to delete existing SymInstallStub.exe, GetLastError =

NortonOfferEngineImpl::buildComponentDownloadURL

NortonOfferEngineImpl::getTestEnvironmentRootURL

NortonOfferEngineImpl::getISExeDestPath

getISExeDestPath() returned =

NortonOfferEngineImpl::sendPingForCheckCriteriaWeb

NortonOfferEngineImpl::getCheckCriteriaPingDataWeb

NortonOfferEngineImpl::getStubInstallerCmdLine

getStubInstallerCmdLine() returned =

NortonOfferEngineImpl::deleteDeclineCountRegKeyForThisProduct

NortonOfferEngineImpl::deleteDeclineCountParentKeyIfNoMoreProductsExist

Deleting DeclineCount subkey for partner =

Failed to create/open DECLINE_COUNT_REG_KEY

Advapi32.dll

hXXp://stats.norton.com/n/p?

PingData::SendCheckCriteriaWebPing

PingData::createBaseURL

PingData::getCheckCriteriaPingURL

PingData::getCheckCriteriaWebPingURL

PingData::getInstallProductsPingURL

PingData::getOfferAcceptancePingURL

pingURL =

X.X

%u.%u.%u.%u.%u

Utility::LaunchProcessWithShellExecute

ShellExecuteEx failed, GetLastError =

---8#-8-@

%original file name%.exe_320_rwx_10084000_00002000:

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

NRTN_OfferEngine_CheckCriteria_Web

kernel32.dll

urlmon.dll

URLOpenStreamW

WININET.dll

USER32.dll

MsgWaitForMultipleObjectsEx

ADVAPI32.dll

SHELL32.dll

ole32.dll

SHLWAPI.dll

USERENV.dll

OLEAUT32.dll

2.1.0.20

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Application file.
   
3. Delete or disinfect the following files created/modified by the Application:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\arcadeparlor.vi.zip (889 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\smartpccleaner.vi.zip (930 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\btn-win-cancel.png (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPMF4TEB\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\title-bar.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\jquery.min.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\view.petite_oo_v4.vi.json (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\offerparser.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_keepmysettingsx.vi.zip (412 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\resultsbay.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\petite_oo_v4.vi.json (74 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\uninstallhelper.vi.json (725 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\nortoninternetsecurity.vi.zip (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\step-contents.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\searchdonkey.vi.zip (861 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\fulldiskfighter.vi.zip (968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screenmanager.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C12BKDMB\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\checkbox.png (650 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screenfactory.js (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\petite_oo_v4.vi.html (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\testsuitemanager.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\slowpcfighter.vi.zip (926 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\freeflvconverting.vi.zip (999 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\offerbox.vi.zip (793 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\config.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\installprogress.png (998 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\responsemanager.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\petite_oo_v4.vi.zip (9352 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\rockettab.vi.zip (883 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\step-contents-stepped.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\winferno.vi.zip (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screen.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\registryhelper.vi.zip (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\minmax.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\common.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_startpage.test.vi.zip (739 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\close.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\noyahoo.js (224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\pcspeedup.vi.zip (820 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\d685394675e2c8dd2355d6541d408896.log (2981670 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\blitzmediaplayeroffer.vi.zip (852 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\pcoptimizerpro.vi.zip (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_startpage.vi.zip (422 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\custom-check.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\driverscanner.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\truedownloader.vi.zip (818 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\abiword_12658.txt (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\bg-installprogress.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\driversupport.vi.zip (882 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\abiword.vi.zip (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\D56U39WD\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\driverfighter.vi.zip (939 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\blasteroids.vi.zip (833 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\smartdriverupdater.vi.zip (928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\script.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\.DS_Store (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\filewhiz_tn.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\secureweb.vi.zip (821 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\knctr.vi.zip (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\nortonantivirus.vi.zip (892 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\yahoo.js (851 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\css\style.css (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\websearches.vi.zip (731 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\savepathdeals.vi.zip (870 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\linkey.vi.zip (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\nortonsecurityscan.vi.zip (834 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_defaultsearch.vi.zip (434 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoosuite.vi.zip (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\clickmanager.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\screenconfig.js (240 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\genieo.vi.zip (904 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\container-separator.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\resultsbay.vi.zip (920 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\severeweatheralerts.vi.zip (816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\btn-win.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\smartdriverupdater.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\abiword\abiword_tn.png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\config.xml (14776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\contentexplorer.vi.zip (823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\lodash.custom.min.js (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\kaspersky.vi.zip (888 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\ping.response.json (388 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\smartweb.vi.zip (821 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MP5LTVUV\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\muvic.vi.zip (786 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\speedupmypc_sales_r2_v2.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\seaapp.vi.zip (885 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\driverscanner.vi.zip (811 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\speedupmypc_sales_r2_v2.vi.zip (825 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\product-icon.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\yahoo_hpds_defaultsearch.test.vi.zip (739 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\weatherbug.vi.zip (889 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\abiword.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\converterfreeonline.vi.zip (690 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\utils.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\showpass.vi.zip (616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\convertfilesforfree.vi.zip (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\mypcbackup.vi.zip (904 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\uninstallhelper.vi.zip (507 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\js\json2.js (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\defaulttab.vi.zip (866 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qs_71bb2a40\dialogs\library\images\btn.png (392 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.