MD5: c1d03a0334bdd042274f03d21527f968
SHA1: 6744a0b22ab9b4d81bd76f17ffd0a8b1a1412522
SHA256: ddecdeb7fe3d62a337a69ec0f8c9fdbc0bcdb796a4875d3d90933734a8df3e84
SSDeep: 49152:zvlwvmA2vDTXj5lppfNH5DlhsZCTQ1H4RS6agLMZa:zvQmAy5lDnsZFYQ1Za
Size: 2211840 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: SafeInstall, LLC
Created at: 2015-02-09 19:29:11
Analyzed on: WindowsXP SP3 32-bit

Summary:

PUP. Potentially Unwanted Program. An application that does not display malicious behavior yet is installed without having first sought affirmative user consent for installation. Users may not realize, due to the nature of the installation procedure, that an application they have not explicitly agreed to has been installed. This category can also be used to classify other applications which in a certain context can be wanted e.g. remote administration tools or IRC clients.

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):
No processes have been created.
The PUP injects its code into the following process(es):

%original file name%.exe:1756

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012015030420150305!
_!SHMSFTHISTORY!_
__DDrawCheckExclMode__
__DDrawExclMode__
DDrawDriverObjectListMutex
DDrawWindowListMutex
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
VdiMsiLock
InstallIQUninstallOptionLock
InstallIQFirefoxLock
RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
ShimCacheMutex
QuickStartApp
W3i_CoreBrowserShutdown
W3iFFPrefslock
DialogCloseProcessLock
CPackageZlib::CPackageZlib
W3iCoreLogger
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex

File activity

The process %original file name%.exe:1756 makes changes in the file system.
The PUP creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\uifactory.js (381 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\1D677809-65E4-4CBA-B3B2-1705755F5F07.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\radio.png (870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\jquery-1.10.2.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\vd1-yahoo-toolbar.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\smartdriverupdater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\0393A455-8396-4E79-8339-7DAEDC83567B.zip (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\84190795-2638-4854-AEFA-6A486B49C8AB.zip (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\slowpcfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\adobeflashplayer_mundo\adobe_50x50.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\driverscanner.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\darkux_3step_r2_v5.vi.json (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\screenfactory.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\fulldiskfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\pcmechanic.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\pcoptimizerpro_offer.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\yahoo-widget.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\adobeflashplayer_mundo.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\9332870F-9082-4684-AFF2-8C852FCEE8D7.zip (747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\441493C8-0E32-4504-B8CC-7851FFF110EC.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\custom-form-elements.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\btn-win-cancel.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\bg-loadingbar.png (297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\kaspersky.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\common.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1BL93J4S\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\winferno.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\nortonsecurityscan.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F3823C96-34C1-478F-BA9E-3F84F3D6094F.zip (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\process.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\view.darkux_3step_r2_v5.vi.json (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\session.response.json (1924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\ECBFC9AB-A637-4487-9A66-817881951C55.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\c1d03a0334bdd042274f03d21527f968.log (1275553 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\1E00B2CE-84B4-4764-A567-81130045EEE4.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B7F6A91D-8542-4B59-A285-EF08E6922F28.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M783414Z\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\adobeflashplayerinstaller_14038.txt (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\config.xml (17904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\noyahoo.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\driverfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\988E6415-56A2-4711-9270-F71450CD0B9B.zip (11960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\yahoo.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\gamehug.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\screen.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\smartweb.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\wecarecleanwater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\BB13E620-1EBA-47D8-A623-39986DE12F1F.zip (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\8C58D003-E863-4399-A7CF-A32275393FD1.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0AGXT1AW\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QLQ060IZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\loadingbar.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\darkux_3step_r2_v5.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\saferbrowser.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\kmsxSuite.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\point-loadingbar.png (205 bytes)

Registry activity

The process %original file name%.exe:1756 makes changes in the system registry.
The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015030420150305]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015030420150305]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015030420150305]
"CachePrefix" = ":2015030420150305:"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\InstallIQ]
"test" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015030420150305]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1423502951"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 6B 93 6C CF 6F F9 09 34 FE 7D FD 7F 30 FF 41"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015030420150305]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015030420150305\"

The PUP modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The PUP modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The PUP deletes the following registry key(s):

[HKLM\SOFTWARE\InstallIQ]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\InstallIQ]
"test"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: SafeInstall, LLC
Product Name: SafeInstaller
Product Version: 1.0.72.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: safeinstall.exe
Internal Name: SafeInstaller
File Version: 1.0.72.0
File Description: Safe Installer
Comments:
Language: Spanish (Spain, International Sort)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://2-vinstaller.com/off/mundo	66.77.96.162

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /off/mundo HTTP/1.1

Content-Type: application/json; charset=utf-8

Accept: application/json;

installerversion: 1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Host: 2-vinstaller.com

Content-Length: 622

Cache-Control: no-cache

{"Content":"FrsQsDi7LOYAjhttwW2VRdfK0jpCMx3l6iYIV8EoK8i4kEENoN3GcZMtQZxts3/VncC7qBIw/uR0v bRebbfxYCgQx4OrsXrxIKen8k20cMHHU/iFbE/il0mOO XfCoqq6AXUsn2IkoPj1b3ZK1wg4l69CzV6jZ1SPs5/fRFJP0xiioRcPkBpd9I0L/NuxJi2xCsaQqpFb1hXqNjgb6yjDN2ARPjvD wgtIIC8qFlFdjBsVkbZpARtBNK8fwPOpj7glNr tijG5H5vuWQnpQhLa794QmpFeGT1PR45 Q xkYkl6Tb1G 1XGS4/SVYfxN2GgfhHIeVZbJoVFGlC1RDBANz/JotGlmAxz uq5cOkDAvsQSdyjNnQyggh/cMy02aDj9539HJ2i8dxWSsJKWROz1CMtXZdZmtuJCfjkSYJbz1MZu4Pb5lZjHciX SnWp3V3mZC1oeBzrdYoAwg 8NxzQ2UiKXJ61E1EK2Pel2tUZ9z L0wj1cAS9ucofwsB3KHOzZA6xQhjxWUnpZoqk8Dy0oGeszxmhfI1DNcSSTBLmt9Xwom/4r6UEOhRGZXe0htIj4tIOzHM2KTBzPyXTwZR2NdF43jQ="}
HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: application/json; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="PSA OUR DEM"

X-Robots-Tag: noindex, nofollow

Set-Cookie: dtCookie=3$9956E48A67212E0D81D6DCCAAB29FA4C|2-vinstaller.com|1; Path=/; Domain=.2-vinstaller.com

Date: Tue, 03 Mar 2015 22:28:02 GMT

Content-Length: 23818
{"Content":"FrsBtCa7IuEUhXc21yrUEJuOl39kKRPj9wcHGJ5xM4e2mloH54GZPMIyVJ
Vn6CCWxILqpRY94KM8r/rCHOiS1ZSxUCgPrv7gkcvW3Mcu64IvF0OuW9oS7UU7Lo3DJnNt
3/9HF4LkYCEbxAK9IPM 6N0r6DnN9mkoMaxm PREOatqxHdaMvlV JxXnfWJ2yxe0Vb5fg
qpMbd/Wq1jlrCOmn1uCx2phCqu37RDG93CzQojXoZ4c5BWHdBWNY33Jucj7RVH6b5ilylB
pLnBCD8P0a3n58Fm5BSETR3S/dvU8VJewgTKM0aohimc7rHSLONXwX8V1DNdTYnTuxQV0m
cfSVkH1vEuuS87Ghbn6rNXPUbAscMea2HHlkO110eSb3hhPmTn6XEWIWS aR2YuZ2MBbP 
CNdUaZQjrecOIHtOI9Ln1MNv5vDowcPNZizkSyq/yxmsOX4rN0r6dY0Sxwm8fk/P2QLVAt
biIEQR2bvrpoZMoGHgxwm4LiqD4Zso0sZkeSzsJgCpaRG8dlnzMMPjygr/4yuTylfuO5gc
YIn/WAiS/4qosTGh2eNYdUpCJma80JRQtZoaw2gaVCJoflGej5J7eJk6zShcZNf/PwlHUQ
YolqIl2P0tMMhvRXFHDVs zExqZ1totcKBOSHK05DhUyrjFN9C8/Op2RKROcpfchJE2rKu
zt4YfFlnyf0vmlEdAw4OR5i9q/Y85NXwOEfQHC98iDpdCgf9Zww/JylpeCuH545li0epfM
Im9bT6A2vhVZPGfpUfnzC r1A8ALpxy0wxtlnqZ 45l50a2fI JjjVUwfU9clViUvyGzmz
OOG2dZDc/h8PHNSFWRaCj5KKWSydHAeYzCvvzqWi2mCIwbVLQjQ95nEfuQuH3NY0oEIYoi
ciKNeQjZaUIRN/GzRSEGulXqpPJG0nZRzS02dH0S/MdJfmW0rOcCEbj3yQQSTxklw9Bv/Z
U3HxDpiNTjQkbwBFV3MYNj3Aw9NtXO9kQpYjat7fnMCgQrA6uJW95dUlRaELH4ibcURNLw
FI48jECYYrCs9KIrEKeEUVAH/zZMbTCG/ vfEOyp/VHvzQKR0PtXtr5tiElunNU4eG PqV
3k1iJ9oztIFb2EtF/QoQUOhYlmTTYdnlfsYRI7HuysfIAMtRLI88Y pjxReCjzgPOmnekr
STTkQd/A6yGJ7IFB9R/MeRcYEWIyHAmbO49BePyBKVWeGSrfZrvzwP7oN59cofMgwqBap3
ATUtkXD 4OGM330WOcOmrYirlyA14r2LgkAGGEUfo3wb9ABN8x2hNy0ayiCnNb2b47L9iy
0Y88bgqUhZObk3B8ws2Ngb063Mp19joBEluO85adQGjfpbc9pTEC 7v0VcKmhE33oPKh/H
KtsWy6viUiiMPJMVfUT89v/ZWlZHsRfjggB/gFBjNSDSE1JE FyEiWjdtULvSxNv1ejOJV
ThFO07Zn0hYrE9jLPDrPJI8b yGnS1q/z28HIQG4mMZDu0I5rUf4520P0Jd 5KVDqB
<<< skipped >>>

The PUP connects to the servers at the folowing location(s):

.text

`.text-quS

`.text-co

`.text-co8:

`.text-co (

`.text-tig

`.text-co;

`.rdata

@.data

.data-qu)

.data-co

.data-co8

.data-co(

.data-co,

.data-co)

.data-cot

.data-ti

.rsrc

CSShZ

t.ShPvR

CSSh4

CSSh9

CSSh>

CSShl

CSSh[

<-t}<.

<*u%F

CSSh`

<:%u4

t8Ht.HHt#

.FGy1

Af;FP}%S3

|$|.tD

#t.Ht

 2 34 567

u.SSV

1t.Ht

9sxv%UW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

GetProcessWindowStation

Operation not permitted

Inappropriate I/O control operation

Broken pipe

0xX

Invalid CRT parameter

QuickStartApp.cpp

vi.engine.xml

chk_firefox

chk_chrome

OfferManager.cpp

position=%d, active=%d

%s[%d]

%d,%d,%d

** Debug mode: simulating stopping Firefox

** Debug mode: simulating stopping Chrome

%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.

Firefox

Google Chrome

%d err: %s

Chrome

firefox

chrome

opera

sxexaxrxcxhxpxrxoxtxexcxtxoxrx.xexxxex

view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s

control.txt

00000000-0000-0000-0000-000000000000

QuickStartProcess.cpp

%programfiles%\Free Offers from Freeze.com

disabling offer because system doesn't have Firefox

disabling offer because system doesn't have Chrome

%s[%s]: view=%s accept=%s

%s,%s

WindowsErrorCode

targetbrowser/key

%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d

%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s

%d,%d,%s,%s,%s,%s

%d,%d,%d,%d,%d

%d,%d,%s,%s,%s,%s,%s

%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s

offers

%s,%s,%s,%s,%s,%s,%s,%s

%s,%d,%s,%s

%s,%s,%u,%u,%d,%s

Unable to open thankyou page; url is empty or invalid!

statsd.response.txt

Web.Installer.VDI.CommError

Web.Installer.VDI.InstallError

Web.Installer.VDI.OfferDownloadError

Web.Installer.VDI.OfferInstallError

Web.Installer.VDI.OfferInstallFailed

hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xkxexexpxmxyxsxextxtxixnxgxsxxx.xzxixpx

hxtxtxpx:x/x/xsxdxsxpxaxpxix.xcxoxmx/xaxpxix/xvxaxlxuxexsx

hXXps://search.yahoo.com/yhs/web?hspart=w3i&hsimp=yhs-syctransfer&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635

hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxpxvx1x.xzxixpx

spv1.zip

hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xtxrxaxcxkxoxfxfxexrxixnxsxtxaxlxlxdxextxaxixlxsx

hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xixnxsxtxaxlxlxexrxrxoxrx

session.response.json

postback.response.json

vmtest.txt

vmtest.txt is present, enbaling offers for vmtest

config.xml

pingurl

postbackurl

errorurl

statsdurl

uninstalloptionurl

encryptionkey

PingUrl

PostbackUrl

Config.cpp

stub.xml

.json

MainWnd.cpp

.html

OfferThread.cpp

Setting offer checkbox value: key=

COfferExe::GetXpiFilename

g:\winapps\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h

configuration/downloadurl

configuration/downloadurl.64bit

configuration/msie.downloadurl

configuration/msie.commandline

configuration/firefox.downloadurl

configuration/firefox.commandline

configuration/chrome.downloadurl

configuration/chrome.commandline

configuration/allbrowser.downloadurl

configuration/allbrowser.commandline

configuration/regkeyadd

regkeyadd

configuration/ieregkey

ieregkey

configuration/firefox.pref

firefox.pref

configuration/firefox.xpimethod

configuration/firefox.xpilocation

configuration/firefox.xpidelete

LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser

configuration/iconurl

adding %s entry, ourVal='%s', theirVal='%s'

COfferExe::Download

Download url is empty!

_firefox is NULL!

COfferExe::OnInstall

Install is a dropfile; no exe to run...

Icon offer (in exe config) detected, running icon install

COfferExe::Run

COfferExe::HandleFirefoxOptions

firefoxoffer

HandleFirefoxOptions called with incorrect preferences set in config!

COfferExe::BuildCommandLine

msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress

msiexec.exe /i "%s" %s

Could not find firefox exe to install

Offer is installing XPI for Firefox 8 or higher, enabling GUI.

"%s" "%s"

"%s" %s

COfferExe::RunSearchProtectInstall

COfferExe::WaitForInstallProcess

OfferExe.cpp

COfferExe::WaitForProcessStarted

waiting for registry key:

COfferExe::WaitForRegistryValue

Registry key found.

Registry key found (64-bit).

COfferExe::WaitForFile

COfferExe::InstallXpi

Bad RegKeyAdd config; not correct format: (missing hive \ )

Bad RegKeyAdd config; not correct format: (missing , )

Bad RegKeyAdd config; not correct format: (missing = )

unable to set regkey from following RegKeyAdd:

RegKeyAdd:

unrecognized values in RegKeyAdd:

unable to set regkey from following IERegKey:

IERegKeyAdd:

unrecognized values in IERegKey:

COfferExe::FinishXpiInstall

COfferExe::CancelXpiInstall

COfferExe::RunIconInstall

%s_%s.url

configuration/url

configuration/msie.url

configuration/firefox.url

configuration/firefox.newtaburl

configuration/chrome.extensionid

configuration/chrome.extensionparam

All urls are empty!

COfferStartPage::InstallFirefox

_firefox is NULL!

** Debug mode: simulated setting Firefox startpage:

Error writing Firefox pref for startpage!

Error setting Firefox new tab!

Set new tab in Firefox.

Firefox startpage set successful.

chromeoffer

COfferStartPage::InstallChrome

_chrome is NULL!

** Debug mode: simulated setting Chrome startpage:

Error setting Chrome startpage: browser is still running!

Error writing Chrome pref for startpage!

Can't set new tab Chrome, function is implemented with Default Search.

Chrome startpage set successful.

OfferStartPage.cpp

startpageurl

oldstartpageurl

hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}

configuration/msie.searchname

configuration/firefox.searchname

configuration/firefox.suggesturl

configuration/firefox.selectedengine

Error setting IE search: url is empty!

Internet Explorer version 6 or older does not support default search!

COfferDefaultSearch::InstallFirefox

** Debug mode: simulated setting Firefox default search:

Failed to write Yahoo xml for Firefox!

Firefox default search set successful.

COfferDefaultSearch::InstallChrome

** Debug mode: simulated setting Chrome default search by extension:

Failed to install default search extension for chrome!

Chrome default search set successful.

OfferDefaultSearch.cpp

searchurl

hxtxtxpx:x/x/xdxlx5x.xvx1xixnxsxtxaxlxlxexrx.xcxoxmx/x

PingResponse.cpp

targetbrowser/Key

PingThread.cpp

offer %s[%s]: isInstalled=%d canShow=%d

rule %s[%s]: isInstalled=%d

QuickStartDetectThread.cpp

ResourceThread.cpp

Response/url

passed

CRequirementManager::RunExecute

CRequirementManager::ParseExecuteResult

invalid flag in execute result:

Software\Microsoft\Windows\CurrentVersion\RunOnce

Running requirement.OnInstall:

Running requirement.OnCancel:

requirement.OnCancel is empty, skipping.

Running requirement.OnExit:

requirement.OnExit is empty, skipping.

%programdata%\W3i\UninstallHelper\iqu.ini

2.0.1.0

%xpxrxoxgxrxaxmxdxaxtxax%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xixmxpxoxrxtx

quickstart.xml

quickstart%d.xml

Failed to save IQU data, too many import files in directory!

%xpxrxoxgxrxaxmxfxixlxexsx%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xUxnxixnxsxtxaxlxlxHxexlxpxexrx.xexxxex

quickstart_si.xml

quickstart_si%d.xml

Failed to save SoftwareInfo data, too many import files in directory!

hxtxtxpx:x/x/xdxlx.xixnxsxtxaxlxlxixqx.xcxoxmx/xAxPxIx/xIxQxUx/xSxoxfxtxwxaxrxexIxnxfxox.xaxsxpxxx

UH executable not found!

"%s" /silent /noswinfo

%s:%d

handling firefox cookies...

FF.GetCookiesError

FF.NoCookies

firefox: no cookies found

FF.SetCookieError

FF.SetCookies

firefox: set cookies

getting firefox cookies for

CCookieManager::GetFirefoxCookies

Error enumerating firefox cookies!

firefoxenum

hXXp://

cookie.dat

Vista.NoResult

Vista.SavedLow

Vista.NoCookies

Vista.CopiedLow

%a, %d-%b-%Y %H:%M:%S GMT

cookieman.exe

Vista.ExtractError

Vista.CreateLowError

handling chrome cookies

Chrome.GetCookiesError

Chrome.NoCookies

Chrome: no cookies found

Chrome.SetCookieError

Chrome.SetCookies

Chrome: set cookies succeeded

getting Chrome cookies for

CCookieManager::GetChromeCookies

Error enumerating chrome cookies!

chromeenum

Safari.GetCookiesError

Safari.NoCookies

Safari.SetCookieError

Safari.SetCookies

Sending session request, url=

Request url is empty!

Request url is invalid!

ErrorLogger.cpp

explorer.exe

CDialogWindowJson::OnBeforeNavigate2, url=

DialogWindowJson.cpp

%s: view=%s accept=%s

chk_%s=

checkbox found; %s=%s

adding disclosure(%s): %s

installedbrowsers/firefox

installedbrowsers/chrome

installedbrowsers/opera

view.buildconfig.json

view.productconfig.json

ProgressDialog.cpp

Installing %d of %d

uninstalloption.exe

InstallIQFirefoxLock

configuration/postinstallexecute

configuration/postinstallexecuteintegrity

stopfirefox

stopchrome

disablechromeextensions

/msie.autoconfirm

/firefox.autoconfirm

/chrome.autoconfirm

COffer::WaitForFirefoxLock

Offer.cpp

_firefoxLock is already created!

Waiting for Firefox lock...

Firefox lock status:

Releasing Firefox lock

PostInstallExecute:

iexplore.exe

** Debug mode: simulating PostInstallExecute:

Cannot run post-install execute, file does not exist:

COffer::PostInstallExecute

PostInstallExecute command failed!

http:

Adding UH data: %s|%s,%s

Failed to extract uninstall option exe!

Error; uninstalloption.exe doesn't exist (after download and extract!)

Error copying uninstalloption.exe to program files!

error downloading uninstall option url!

%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe

"%s" %s "%s"

AdobeAirInstaller.exe

JsonResponse.cpp

%firefoxprofiles%

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

Unknown uninstall key type encountered, skipping lookup

HRESULT:0x%X

crterr:%d

Win32Err:%d

@ line %d in function <%s>.

wininet.dll

Unknown error: %d

IDispatch error #%d

LoadLibrary failed in loading current exe:

CoreResource.cpp

CStringW.GetBuffer failed!

0xx

%s. {%s} @ line %d in function <%s> in module %s.

Win32Err:%d

HRESULT:0x%X

Error:%d

HttpStatus:%d

L%d:d.d.d_d:d:d.d

-- %s line %d --

[X]

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d

%s_%x%x%x%x%x

CoreFile.cpp

Exception %X in module %s at: 0x%p.

dbghelp.dll

0x%p %s

CoreProcess.cpp

CCoreProcess::ShellExecuteCommand

ShellExecuteCommand:

CCoreProcess::ShellExecuteCommandAndWait

Failed to execute command:

CCoreProcess::CloseProcessWindowsByModuleName

CCoreProcess::GetProcessExe32

CCoreProcess::GetProcessExe64

kernel32.dll

CoreXml.cpp

_ftprintf_s failed writing header to

]/Key/text()

CCoreXml::ParseRequiredKeyValue

CCoreXml::ParseRequiredKeyInt

CoreThread.cpp

PTF://

hXXps://

CCoreSystem::GetWindowsVersionId

Missing windows version, check the code!!

CoreSystem.cpp

%s (Build %d)

CCoreSystem::CacheWindowsInfo

Unknown OS! Major: 0xX, Minor: 0xX

%windows%

%system%

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Þsktop%

Þsktopdir%

%userprofile%

%s0x%.2x%.2x%.2x%.2x%.2x%.2x-

SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322

SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727

SOFTWARE\Microsoft\.NETFramework\policy\v1.0

3321-3705

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

Iphlpapi.dll

%windows%\Desktop

proc.vboxsvc

VBoxService.exe

proc.vboxtray

vboxtray.exe

proc.vmtools

vmtoolsd.exe

proc.hvsvc

vmicsvc.exe

reg.vboxguest

reg.vboxmouse

reg.vboxsvc

reg.vboxsf

reg.vboxvid

reg.vboxbios

reg.vboxsguest

file.vboxhook

%system%\vboxhook.dll

reg.vmvid

reg.vmpci

reg.vmdbg

reg.vmcrd

reg.vmmem

reg.vmmouse

reg.vmdsk

reg.vmtools

reg.vmsnap

reg.vmnet64

reg.hvgenctr

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

reg.hvvmbus

reg.hvvid

reg.hvscsi

SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000

reg.hvinput

SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000

reg.vboxdisk

reg.vmdisk

reg.hvdisk

sng.vmt2

sng.vmt1

sng.vmt4

sng.vmt3

gen.dbg

CCoreRegKey::Create

Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.

CCoreRegKey::Open

RegCreateKeyEx failed on key=

RegOpenKeyEx failed on key=

Registry key is not open! (

CoreRegKey.cpp

CCoreRegKey::GetValueType

CCoreRegKey::GetValueSize

CCoreRegKey::GetValueString

CCoreRegKey::GetValue

CCoreRegKey::SetValue

CCoreRegKey::DeleteValue

RegDeleteKeyExA

CCoreRegKey::DeleteKey

RegDeleteKey failed on

RegDeleteKeyEx failed on

CCoreRegKey::EnumSubKeys

SHCopyKey failed for

CCoreRegKey::CopyTree

CCoreEntryPoint<long (__stdcall*)(struct HKEY__ *,char const *,unsigned long,unsigned long)>::LoadProcAddress

CCoreEntryPoint<long (__stdcall*)(struct HKEY__ *,char const *,unsigned long,unsigned long)>::CCoreEntryPoint

Advapi32.dll

UniqueId.cpp

subKey is NULL!

%u,%u,%u,%u

0.0.0.0

\/:*?"<>|

createurlfilefail

Failed to create URL file!

Encryption key not initialized!

%Y-%m-%dT%H:%M:%S

CommandLine.cpp

CoreEvent.cpp

shell32.dll

CoreVista.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_CURRENT_CONFIG

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

%s.%s

iexplore,ie.http

Failed to get IE version key!

Loading IE cookies for url:[

wrote %d cookies

CoreInternetExplorer.cpp

-noframemerging "%s"

ie.http\shell\open\command

Unable to find iexplore.exe, using shell execute (with possible warnings)

Default search regkey not found (may be a brand new install)

EnumSubKeys failed!

ieframe.dll

hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

url is empty!

Replacing existing provider url:

Error setting provider url!

CCoreInternetExplorer::FindFirstHistoryUrl

findfirsturlfailed

FindFirstUrlCacheEntry() failed!!

FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??

CCoreInternetExplorer::FindNextHistoryUrl

findnexturlfailed

FindNextUrlCacheEntry() failed!!

FindCloseUrlCache() failed!!

CCoreInternetExplorer::FindCloseHistoryUrl

findcloseurlfailed

msgTitle is required!

msgText is required!

browser.search.defaultenginename

browser.search.selectedEngine

MozillaUIWindowClass

browser.startup.homepage

firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox

MozillaWindowClass

Software\Mozilla\Mozilla Firefox

Failed to get Firefox version key!

CCoreFirefox::GetVersion

Profile%d

firefoxver

%appdata%\Mozilla\Firefox

Firefox versions prior to 3 are not supported by LoadProfileCookies!

profiles.ini

Loading Firefox3 cookies for url:[

%s=%s

cookies.sqlite

Enumerating Firefox3 cookies for

cookies.txt

Enumerating Firefox cookies for

Found partial cookie in Firefox profile:

firefox.exe

-requestPending -osint -new-window "%s"

PathToExe

prefs.js

%programfiles%\Mozilla Firefox

CoreFirefox.cpp

CCoreFirefox::GetPrefString

CCoreFirefox::SetPrefString

user_pref("%s", %s%s%s);

CCoreFirefox::SetDefaultSearch

searchUrl is empty!

Can't set search engine while Firefox is running!

suggestionUrl is empty!

Setting Firefox default search engine:

SuggestionUrl=

SearchUrl=

Failed to write search hash for Firefox!

Failed to write search engine plug-in xml for Firefox!

hXXp://VVV.mozilla.org/2006/browser/search/

browser.search.order.2

browser.search.order.1

downloads.sqlite

Failed to open downloads.sqlite database!

places.sqlite

select source from moz_downloads where source like '%%%s%%' order by id desc

Failed to open places.sqlite database!

select url from moz_places where url like '%%%s%%' order by id desc

CCoreFirefox::SetStartpage

browser.startup.page

cannot set startpage; firefox is currently running!

CCoreFirefox::SetNewTab

Cannot set newtab because firefox is running!

/SearchPlugin/Url

browser.newtab.url

browser.search.param.yahoo-fr

firefox pref: browser.search.param.yahoo-fr=

CCoreFirefox::WriteSearchHash

search-metadata.json

nss3.dll

CCoreFirefox::GetVerificationHash

secmod.db

By modifying this file, I agree that I am doing so only within Firefox itself, using official, user-driven search engine selection processes, and in a way which does not circumvent user consent. I acknowledge that any attempt to change this file from outside of Firefox is a malicious act, and will be responded to accordingly.

CCoreChrome::SetCookie

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h

Chrome_WidgetWin_0

Chrome_WindowImpl_0

Chrome_WidgetWin_1

Chrome_RenderWidgetHostHWND

chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium

CCoreChrome; Cookie file does not exist

%local_appdata%\Google\Chrome\User Data\Default\Cookies

select name, value, host_key, path, expires_utc from cookies where

Loading Google Chrome cookies for url:[

Enumerating Google Chrome cookies for

host_key like '%

Chrome cookie file does not exist

CCoreChrome::EnumCookiesLegacy

select host_key, name, value, path, expires_utc from cookies where host_key like '%

CCoreChrome::EnumCookiesV33

Enumerating Google Chrome cookies (v33) for

CCoreChrome::EnumCookieRowCallback

select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%

Failed to decrypt chrome cookie:

CoreChrome.cpp

chrome.dll

Chrome cookie:

Unable to find chrome.exe, using shell execute (with possible warnings)

--new-window "%s"

ChromeHTML\shell\open\command

chrome.exe

%programfiles%\Google\Chrome\Application

%local_appdata%\Google\Chrome\Application

CCoreChrome::GetStartpage

session/startup_urls

CCoreChrome::IsMultiStartPageEnabled

/preferences/session.restore_on_startup

/manifest/chrome_settings_overrides/search_provider/

CCoreChrome::GetDefaultSearchUrl

%local_appdata%\Google\Chrome\User Data\Default\Web Data

search_url

SELECT value FROM meta WHERE key='Default Search Provider ID'

SELECT id, short_name, url FROM keywords where id = %s

default_search_provider_data/template_url_data

CCoreChrome::GetDSUrlFromPrefTemplate

{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

default_search_provider_data/template_url_data/short_name

default_search_provider_data/template_url_data/url

default_search_provider_data/template_url_data/id

CCoreChrome::GetPreference

CCoreChrome::LoadPreferences

%local_appdata%\Google\Chrome\User Data\Default\Preferences

CCoreChrome::LoadSecurePreferences

%local_appdata%\Google\Chrome\User Data\Default\Secure Preferences

%local_appdata%\Google\Chrome\User Data\Default\History

select url from downloads_url_chains where url like '%%%s%%' order by id desc

Found chrome extension

chrome_url_overrides

Setting chrome extension [

Software\Wow6432Node\Google\Chrome\Extensions

Installing extension from web store:

CCoreChrome::InstallExtensionFromWebStore

Software\Google\Chrome\Extensions

hXXps://clients2.google.com/service/update2/crx

Error setting update_url in registry!

update_url

%local_appdata%\Google\Chrome\User Data\Default\Extensions

CCoreFirefoxXpiInstaller::Install

CoreFirefoxXPIInstaller.cpp

CCoreFirefoxXpiInstaller::GetXpiInfo

install.rdf

xml.LoadBuffer failed on

Installing Firefox add-ons via package...

Create install.rdf failed!

Firefox.exe not found!

CCoreFirefoxXpiInstaller::InstallAsPackage

installiq.xpi

Running Firefox to install add-ons:

Error running Firefox!

CCoreFirefoxXpiInstaller::CreateInstallRDF

<?xml version="1.0"?><RDF xmlns="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"

xmlns:NC="hXXp://home.netscape.com/NC-rdf#"

xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">

<Description about="urn:mozilla:install-manifest">

<em:id>[email protected]</em:id>

<em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>

<em:maxVersion>*.*.*</em:maxVersion>

CCoreFirefoxXpiInstaller::SetResult

Error creating install.rdf!

CCoreFirefoxXpiInstaller::GetExtensionsFolder

Installed Firefox extension:

Can't get Firefox default profiles folder!

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h

kxexexpxmxyxsxextxtxixnxgxsxxx.xexxxex

hxtxtxpxsx:x/x/xixnxsxtxaxlxlxexrx.xfxrxexexzxex.xcxoxmx/xLxoxgxExrxrxoxrx.xaxsxpxxx

KxexexpxMxyxSxextxtxixnxgxsxXx

hxtxtxpx:x/x/xdxoxwxnxlxoxaxdx.xixnxsxtxaxlxlxixqx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxoxfxtxwxaxrxexixnxsxtxaxlxlxaxtxixoxnx_x1x3x4x7x1x.xexxxex

Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion

Restoring V1 toolbar uninstall key...

Renaming V1 uninstall key...

Error replacing toolbar uninstall key!

Error opeing uninstall registry key in HKLM\

Sxoxfxtxwxaxrxex\xMxixcxrxoxsxoxfxtx\xWxixnxdxoxwxsx\xCxuxrxrxexnxtxVxexrxsxixoxnx\xUxnxixnxsxtxaxlxlx\xKxexexpxMxyxSxextxtxixnxgxsxXx

CoreSearchProtectorApp.cpp

Error removing V1 registry key from HKLM\

Error copying V1 registry key!

CCoreSearchProtectorApp.ShutDown: window not found

Error removing registry key from HKLM\

Software\Microsoft\Windows\CurrentVersion\Run

apiurl

offerurl

dsotherurl

spotherurl

%s/provider[%d]

hXXp://google.com

hXXp://bing.com

hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=

firefoxsearch

chromesearch

firefoxstartpage

chromestartpage

keyword.URL

config.dat

Error replacing Yahoo Toolbar uninstall key!

Yahoo uninstall key not found

Software\Microsoft\Windows\CurrentVersion\Uninstall\

UninstallKey

ChromeSearchExtensionId

UninstallKey=

FirefoxPriorSearchUrl

ChromeStartPageExtensionId

FirefoxPriorStartPage

CoreBrowserOptionUninstaller.cpp

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h

safari.exe,safariurl,safari

%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies

Loading Safari cookies for url:[

CoreSafari.cpp

%appdata%\Apple Computer\Safari\Cookies\Cookies.plist

Failed to get Safari version key!

safari.exe

-url "%s"

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

Can't find shell associations or shell command reg keys!

CoreBrowser.cpp

Dll %s failed, resultcode = %x

SymCCIS2.zip

SymCCIS.dll

RunDLL productlist="%s" resultcodes="%s"

SCCLog.txt

SymCCISDll.txt

SymCCIS_CheckCriteria.txt

SymInstallStub.txt

Detect.cpp

/executeresult/text()

/execute/text()

Missing ExecuteResult in requirement config!

%programfiles%\iTunes\iTunes.exe

SOFTWARE\Microsoft\Windows Live\Messenger

msnmsgr.exe

ydetect.yas

ydetect.ytb

ydetect.yhp

Rules.cpp

RegKeyExists

regkey

firefoxprefs

chromeprefs

CDetectionYahooToolbar::IsInstalledFirefox

CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf

KeyExists

SourceKey

hkey_current_user

hkey_classes_root

hkey_local_machine

hkey_current_config

multireg%d

multireg: unable to parse key:

multireg: key found:

1.1.0.6

//flag[%d]/text()

Cannot evaluate .NET Version, .NET may not be installed!

DetectionFile.cpp

wajam_validate.zip

wajamexemissing

extracted wajam exe file not found!

Timed out waiting for wajam_validate.exe!

Unable to get returncode from wajam_validate.exe!

wajam_validate.exe detection process result = %d

yahoo.com

live.com

google.com

ask.com

msn.com

aol.com

CDetectionFirefoxPrefs::OnEvaluate

DetectionFirefoxPrefs.cpp

CDetectionChromePrefs::OnEvaluate

DetectionChromePrefs.cpp

)] disabled because of minimum windows version.

minwindowsversion

DetectionRule.cpp

Disabled; Firefox is not installed

Disabled; rule target is not Firefox

Disabled; Chrome is not installed

Disabled; rule target is not Chrome

asktbdet.zip

Ask detection process result = %d

CoreWininet.cpp

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

wininet: connecting to %s:%d

HTTPSendRequest:

wininet: HttpOpenRequest failed!

CCoreWininet::HTTPSendRequest

wininet: Request handle is NULL after HttpSendRequest!

httpopenrequest

unable to set wininet http decoding

httpreqerr

Content-Type: application/x-www-form-urlencoded

httpaddheaders

wininet: HttpAddRequestHeaders (post flag) failed!

Range: bytes=%u-%u

Range: bytes=%u-

httpaddheader

wininet: HttpAddRequestHeaders (range specification) failed!

wininet: HttpSendRequest failed! (verb=

httpsendreq

wininet: HttpSendRequest failed!

httptimeout

httpqueryinfo

wininet: HttpQueryInfo failed!

httpproxy

wininet: Server responded with error: %d, %s. %s %s

wininet: HttpSendRequest: status OK received

httpstatus

wininet: HttpQueryInfo for content range failed!

wininet: HttpQueryInfo for file size failed!

wininet: Operation cancelled by caller.

Software\Microsoft\Windows\CurrentVersion\Internet Settings

HTTP Status %d: %s

API url is invalid!

apiUrl is null!

%m/%d/%Y

Url is null!

%s, %s, l=0xx

[0x%X]

d:%s

01234567

%s(%s);

CoreJSON2.cpp

Node path not valid; node "%s" in path "%s" is not type Node!

PackageZlib.cpp

Error: %d bytes of %d read from file %s.

unzOpenCurrentFilePassword failed!

Error: %d bytes of %d were written to file %s.

unzOpenCurrentFilePassword failed! err=

Package.cpp

autorun.txt

CCoreSqlite::OpenDatabase

CCoreSqlite::CloseDatabase

CCoreSqlite::ExecuteStatement

dbexecerror

sqlite3_exec failed, returned error:

CoreSqlite.cpp

CCoreSqlite::StandardExecuteCallback

CCoreSqlite::PrepareCompiledStmt

Cannot prepare statement, sql is empty!

Failed to prepare compiled statement, sqlite returned error: %d

sqlempty

sqliteerror

CCoreSqlite::BindTextToCompiledStmt

bind text failed, errorcode=%d

CCoreSqlite::ExecuteCompiledStmt

sqlite3_step failed, errorcode=%d

CCoreSqlite::CheckStmtRowValid

sqlitestepfailed

Cannot get row results: statement has not executed!!

sqlite3_finalize failed, errorcode=%d

CCoreSqlite::CloseCompiledStmt

SQLITE_

d-d-d

d-d-d d:d:d

d:d:d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

%s-shm

%s\etilqs_

OsError 0x%x (%u)

invalid page number %d

Recovered %d frames from WAL file %s

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

2nd reference to page %d

Failed to read ptrmap key=%d

Page %d:

unable to get the page. error code=%d

failed to get page %d

freelist leaf count too big on page %d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Corruption detected in cell %d on page %d

Page %d is never used

Pointer map page %d is referenced

unknown database %s

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

%s(%d)

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

abort at %d in [%s]: %s

zeroblob(%d)

no such savepoint: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot %s savepoint - SQL statements in progress

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

sqlite_temp_master

sqlite_master

cannot change %s wal mode from within a transaction

database table is locked: %s

cannot open value of type %s

statement aborts at %d: [%s] %s

cannot open view: %s

no such column: "%s"

cannot open virtual table: %s

cannot open %s column for writing

foreign key

indexed

misuse of aliased aggregate %s

%s: %s

not authorized to use function: %s

%s: %s.%s.%s

%s: %s.%s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

variable number must be between ?1 and ?%d

too many SQL variables

Expression tree is too large (maximum depth %d)

too many columns in %s

EXECUTE %s%s SUBQUERY %d

%.*s"%w"%s

misuse of aggregate: %s()

sqlite_rename_trigger

sqlite_rename_parent

%s%.*s"%w"

sqlite_rename_table

type='trigger' AND (%s)

%s OR name=%Q

table %s may not be altered

view %s may not be altered

there is already another table or index with this name: %s

sqlite_

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_stat1

sqlite_altertab_%s

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

database %s is already in use

invalid name: "%s"

too many attached databases - max %d

unable to open database: %s

no such database: %s

database %s is locked

sqlite_detach

cannot detach database %s

access to %s.%s.%s is prohibited

sqlite_attach

%s %T cannot reference objects in database %s

access to %s.%s is prohibited

object name reserved for internal use: %s

too many columns on %s

duplicate column name: %s

there is already an index named %s

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

default value of column [%s] is not constant

table "%s" has more than one primary key

no such collation sequence: %s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE %s %.*s

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

table %s may not be dropped

use DROP TABLE to delete table %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

unknown column "%s" in foreign key definition

indexed columns are not unique

virtual tables may not be indexed

there is already a table named %s

table %s may not be indexed

views may not be indexed

table %s has no column named %s

index %s already exists

sqlite_autoindex_%s_%d

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

CREATE%s INDEX %.*s

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

a JOIN clause is required before %s

cannot modify %s because it is a view

unable to identify the object to be reindexed

table %s may not be modified

sqlite_version

sqlite_compileoption_get

sqlite_source_id

sqlite_compileoption_used

table %S has %d columns but %d values were supplied

%d values for %d columns

foreign key mismatch

%s.%s may not be NULL

PRIMARY KEY must be unique

table %S has no column named %s

no entry point [%s] in shared library [%s]

error during initialization: %s

sqlite3_extension_init

unable to open shared library [%s]

automatic extension loading failed: %s

foreign_keys

foreign_key_list

*** in database %s ***

unsupported encoding: %s

unsupported file format

malformed database schema (%s)

%s - %s

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

cannot join using column %s - column not present in both tables

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

COMPOUND SUBQUERIES %d AND %d %s(%s)

USE TEMP B-TREE FOR %s

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

sqlite_subquery_%p_

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

cannot create %s trigger on view: %S

-- TRIGGER %s

no such column: %s

no such trigger: %S

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

vtable constructor failed: %s

vtable constructor did not declare schema: %s

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

no such module: %s

table %s: xBestIndex returned an invalid plan

%s AS %s

%s SUBQUERY %d

%s TABLE %s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s USING %s%sINDEX%s%s%s

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (rowid>? AND rowid<?)

%s (rowid>?)

cannot use index: %s

%s (~%lld rows)

at most %d tables in a join

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

SQL logic error or missing database

unknown operation

large file support is disabled

no such vfs: %s

unknown database: %s

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

database corruption at line %d of [%.10s]

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

CREATE TABLE sqlite_master(

sql text

3.7.5

CREATE TEMP TABLE sqlite_temp_master(

zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll

unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll

1.2.7

deflate 1.2.7 Copyright 1995-2012 Jean-loup Gailly and Mark Adler

inflate 1.2.7 Copyright 1995-2012 Mark Adler

&#xX;

%s="%s"

</%s>

<!--%s-->

%s='%s'

version="%s"

<![CDATA[%s]]>

standalone="%s"

encoding="%s"

CoreDialogCloseProcess.cpp

CoreHtmlDialog.cpp

onBeforeNavigate2 called, url=

CoreIEControl.cpp

uxtheme.dll

Error getting IExecAction!

CCoreWinTask::AddExecAction

CCoreOpera::EnumCookies

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreOpera.h

LoadCookies is not implemented for Opera!

CCoreOpera::SetCookie

EnumCookies is not implemented for Opera!

CCoreOpera::LoadCookies

OpenURL is not implemented for Opera!

opera.exe,opera.protocol,opera.url,opera,operanext,operastable

SetCookie is not implemented for Opera!

CCoreOpera::OpenUrl

opera.exe

Software\Opera Software

launcher.exe

%programfiles%\Opera

%programfiles%\Opera Next

CoreIEHost.cpp

m_WebBrowserEvents failed

IWebBrowser2 failed

_WebBrowserEvents failed

Not initialized or _webBrowser is NULL!

Sending Quit to web browser...

IWebBrowser failed!

_webBrowser->Quit failed!

CCoreIEHost::DeleteHistoryUrl

WebBrowser object is NULL!

CCoreIEHost.OnDocumentComplete:

Error: Collection didn't support IHTMLElementCollection!

*** set key code to 0 ****

G:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb

KERNEL32.dll

USER32.dll

OLEAUT32.dll

SHDeleteEmptyKeyA

SHLWAPI.dll

COMCTL32.dll

GetProcessHeap

GetCPInfo

ShellExecuteExA

SHELL32.dll

ole32.dll

PSAPI.DLL

VERSION.dll

USERENV.dll

InternetCreateUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCombineUrlA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestA

HttpQueryInfoA

WININET.dll

UrlEscapeA

SHCopyKeyA

gdiplus.dll

IsValidURL

urlmon.dll

GetWindowsDirectoryA

EnumWindows

EnumChildWindows

GetKeyboardState

GDI32.dll

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

RegDeleteKeyA

RegQueryInfoKeyA

RegEnumKeyExA

ADVAPI32.dll

CRYPT32.dll

zcÁ

.?AV?$_Ref_count@VCOfferExe@@@std@@

.?AV?$_Ref_count_obj@VCOfferExe@@@std@@

.?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@

.?AVCOfferExe@@

.?AVCCoreStringUrl@@

.?AV?$CFlags@W4WebArgFlag@@@@

.?AV?$CAtlArray@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@@ATL@@

.?AV?$CCoreEntryPoint@P6GJPAUHKEY__@@PBDKK@Z@@

.?AVCCoreRegKey@@

.?AVCCoreFirefox@@

.?AV?$CFlags@W4CoreFirefoxCache@@@@

.?AV?$_Func_impl@U?$_Callable_obj@V?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@$0A@@std@@V?$allocator@V?$_Func_class@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@@2@XPAVCCoreSqlite@@U_Nil@2@U52@U52@U52@U52@U52@@std@@

.?AVCCoreChrome@@

.?AV?$CFlags@W4CoreChromeCache@@@@

.?AV?$_Func_base@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@

.?AV?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@

.?AVCCoreFirefoxXpiInstaller@@

.?AV?$_Ref_count_obj@VCCoreOpera@@@std@@

.?AV?$_Ref_count_obj@VCCoreChrome@@@std@@

.?AV?$_Ref_count_obj@VCCoreFirefox@@@std@@

.?AV?$_Ref_count_obj@VCDetectionChromePrefs@@@std@@

.?AV?$_Ref_count_obj@VCDetectionFirefoxPrefs@@@std@@

.?AVCDetectionFirefoxPrefs@@

.?AVCDetectionChromePrefs@@

.?AV?$CAtlArray@UWebArg@@V?$CElementTraits@UWebArg@@@ATL@@@ATL@@

.?AVCCoreWebArgs@@

.?AVCCoreSqlite@@

.?AV?$CAtlArray@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@V?$CElementTraits@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@@2@@ATL@@

.?AVCCoreSqliteResult@@

.?AVexecution_error@TinyXPath@@

.?AVCCoreOpera@@

.?AV?$CFlags@W4CoreOperaCache@@@@

.?AVCCoreWebBrowserEvents@@

.?AUDWebBrowserEvents2@@

c:\%original file name%.exe

@.reloc

Vista.BadArgs

\cookie.ini

\cookie.dat

Vista.BadArgs2

Domain%d

Name%d

\cookie%d.dat

\cookie%d.ini

Vista.NoAppLow

Vista.WideFail

Vista.GetCookieFail

Vista.AllocFail

Vista.CreateFileError

Vista.WriteFileError

Vista.SetCookie

SetCookie%d

Vista.SetCookieError

Error: %d. %s

g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\Installer.CookieMan.pdb

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

3 3%3,323

.ao &

$.OA[W

C_.jN

fs.MJ

\%S6j

<.Vmx

<R.RI

;.Ur?

7:.Vmeu

-N.sZ

v.GEJh

}N5%d

.nX9k

U;9%u

g 8%U

'/O.Axy

f7%X[

@: .pI^

wajam_validate.exe

R2dmjg

UfgjoTakI kOh2sBpiiXQ5aHkH54PEyalEhJGoQ2f4 uk1sGoYXII9RwB8Vo DeTxpfw8Udvo7Ur/67FEOmIkpb2UXRD9L/t1dyPgYtx58cRG16ybPJ7iEc3MKjKJXR8k6QIRJ74KGwJyAq2NPI6uoto SjL7z10av8n4vhYdvB4wHRNNLlX pRG/5nP1GELg1H3MVbqKL9iQK5vkOXHx3ItXE gmTmwi/oBTM65rkRwCscofpZHXMZXLMvncbI4tFUfsf4h2GhLo6XaEy5DsIX95YkyrBLbDFaPosTZoRgam1iaeULjiyKes7HTPYMojzta1iMJQJTTpllBmWtVEBgB1qgvp2l8AxH v Q0RBKB/Y9HaSbKnlvo3xaNdWB ZS/n XBCK2WgbRCdtJaKCer3BJRIat4usvMOIHsfY8To39Zp  6i7vOLJ2C3Eif8mh28N3k1IUzlLpYV2hboc1qG1gTOA8HjIlwU2Ov/9twSvTmr01S6PzGE tRywMBzL3SgdEf aw/tHyawZJCmhRzk/iqI2we4J8cNd8n1Tx Q/8X4uXD4jLsHKBUNdDrj0pkNqMZZmDUQUD06bwHd35Rhe9VDqWkRIdX5cAlbUQIrlbw3laBhc8R3WGxIBU043h4LCAlqucDZLzLA35vmTDfpF8JY4 6lgU2YJ9QXdB5E2bWv094DaEBsgqpxzBZVa3ZdDtfz/uF7vZevcBbBHCh4hDBdTFLxKwEzJSJvKG/SrN862RzzLYdosrboCGrgQ5XVMsNJzmz9vX9VQfchihklvVPhK7ByzMtanKFsZHPYQR7F MxB2RCvWS/0YaybVdGNo11MW53JUxeElYeUTDbHMzeA2Dvj0KKi2GCQ3K0NFXcG1DQHtlPczdBpp0MbunhiIt6OhI JIQN7FTQRTXX1S7BcLiZEG1WW0X1KhnSXJNK2V0rMcTcQlzTED3/7nlM3BumWCiGnQd SGFZZOEUJFCAGJy/XwtJ9QKFgXpAif8jSwMGhQbEnrpilpNUxWKMJF4yVLQUYZ1xO8oWSCYoxD8UdXcheNwNTWWP/fdLaC3/0suYS3p7VCazDL0YTpWkkqNabn TIVZOa8 zZvDdgPY5h/ZEZk0RV/QIKWaUSln/JatG7MJcVMLr41YCBdMUdJIIseP5h3RGW2WtRYHKeyvHfUlYa9RC0DMibSkhLtprNb94CPy3Anqi//h6S0QLeDLrU6Kh5kEZAvcotoMgQaFl T 1kBCgjnGTk7vrbhy8bbsS/rp2o3nAn76ablU1LTQ9g3DkX9k8X8BayIyQN3CerKebRp/WiyTFLoIfjrk5OJ70mAMAwg5IUmKHN9zQA50Rr9vg/aNwGjuZsSM5FAH6spUlZLGFL0j8LBWWEZYtCnqPlTySQKZQIPxv47qmFQg0R81 30UxpjFQtdWfEVEJb RKYiW6fvRW7DSwTlMTdPkjiCf46KWxFJOsphvDKs75V9b hCm mqrvxs3kdCsOIZzjoIpmXbZg8w MCd/VGXXnQdCi8vXqFOWqea ogWVfgEwgvERwqlIVRLcgIwSMP1UR0cwLYGZNRjjvvJ32FqxiT2U 33BDSzJ5PTzZdvf0NcUvakZMKt3wTVYB4MXHyDQ71F9tsIzGqYqyJKVFgvzlO8wqisAMSlbjB5VqybyjMnf6UEWOejD9iWWYlX6xXqcjCn5RX88mXh5defsE0lOj/lBAeEAAio ILAnC9UIWByN /j2buu1e6NsMoBwwpFFOK85hEOetBj7d4DRRCZ NoRPu1m9lx2LYq9AxTEforidhyqv0MF5N bjo9aLwR4s4a5WDuBqDi63sEvIglPJGiswG1jxmL5SIgzNdd2wu3jxyl3OnHTKqEaVi86ulG0xr90SeDqYIxppGriUgMzi2utx5R/fD/JudAi Nln/KX sB5bYdlBPKgTPF2YLkEA4EWpkXab86QD1fiwT6Rf/YYtYiD/EYlbMTWUhl1Y Ezn/WEQavgOtydGK7S01e33zFFoP9VQg/IontfUEwamwKx/wfK5pkI9tzwi9/rqo8verIJXaieHLkfwlx4HFqxymmDpaTPa9SaiCQY3sxnfjDXChGylaok1HvVekrD6bwlvYmcG/lmIojvQCyyGgN4m51ypVZSuwpJbMysixPif46VbhCM6Pk  99EJOTN 1OLEFTszK0EI34JhYpB22JYJSq4zvqym3H4or7F/2tjTyDMrE xmPQUnQ3c J8IFXnAMGDVraU5Z5UmKbN3mtUKztPUqMrwzNl3bGgbiNRx/6UGhhVTPK

config.xmlvT

Yo.OF

%sk*I

:%Di 

7w.Ae

2g.hb

=.golQ"

Chkr.KJ"

yEu%s

4D%dO

.POYA60'

5.WS7

DL

~.LTL~

.dw5Lv

,y\%S

i-o}E

rq!.cw

55997C50-1F00-4D74-BAEF-46A658272B17.zipnF

E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip=>

4594AF2F-4D07-4B39-B15B-443A87882878.zipKJ

AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip

F80287B7-718C-4676-AC71-3F1AB04A60E1.zip

B7109C6A-73CA-4979-B038-5AE45CBE649F.zip

AD04DC3C-8B12-4879-83E3-523DF600D9DE.zipf

theanswerfinder.vi.zip

099AEF6E-E690-4A5C-85F8-481343649504.zip

c.LZ>

E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip

7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip0

BB13E620-1EBA-47D8-A623-39986DE12F1F.zipEY2v%

B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip

42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip

7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip

73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip

5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip

C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip

ECBFC9AB-A637-4487-9A66-817881951C55.zip

8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip

B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip

80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipR

0393A455-8396-4E79-8339-7DAEDC83567B.zip'Ff

441493C8-0E32-4504-B8CC-7851FFF110EC.zipo

13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip

404D0823-2D00-44F7-AC98-92F79F87E4F2.zip

AF33782B-57D0-466B-831D-0CE47455F809.zipW&

9332870F-9082-4684-AFF2-8C852FCEE8D7.zip

{c

F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip

4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip

224505F1-4910-4879-A9AD-B70D1AE1A120.zipe

66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip

2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip

DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip

2704D408-C40A-4848-BC30-B5478423E8C9.zip

BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip

1E00B2CE-84B4-4764-A567-81130045EEE4.zip

226383C9-5E0D-4ABD-8308-30F31DD040A6.zip

B7F6A91D-8542-4B59-A285-EF08E6922F28.zip_ 

F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip8*

8C58D003-E863-4399-A7CF-A32275393FD1.zip

F3823C96-34C1-478F-BA9E-3F84F3D6094F.zipj

225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip

3927F92B-2CF0-4555-8A62-C42865E873C2.zip`

1D677809-65E4-4CBA-B3B2-1705755F5F07.zip@S

00EB7EC2-4B2C-4603-9043-79A1C36414EE.zipI1

84190795-2638-4854-AEFA-6A486B49C8AB.zip

988E6415-56A2-4711-9270-F71450CD0B9B.zip

<=%x*

tIE%s

P2%cG)

yz.HA

v_.Cox

}l..kh

.Fl-_

b.DNk

4.wsk8

%UrTg

adobeflashplayerinstaller_14038.txt

config.xmlPK

55997C50-1F00-4D74-BAEF-46A658272B17.zipPK

E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zipPK

4594AF2F-4D07-4B39-B15B-443A87882878.zipPK

AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipPK

F80287B7-718C-4676-AC71-3F1AB04A60E1.zipPK

B7109C6A-73CA-4979-B038-5AE45CBE649F.zipPK

AD04DC3C-8B12-4879-83E3-523DF600D9DE.zipPK

theanswerfinder.vi.zipPK

099AEF6E-E690-4A5C-85F8-481343649504.zipPK

E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zipPK

7E447291-0A05-4EB1-98E9-49ECF3C139D1.zipPK

BB13E620-1EBA-47D8-A623-39986DE12F1F.zipPK

B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zipPK

42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zipPK

7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipPK

73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipPK

5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zipPK

C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipPK

ECBFC9AB-A637-4487-9A66-817881951C55.zipPK

8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zipPK

B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipPK

80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipPK

0393A455-8396-4E79-8339-7DAEDC83567B.zipPK

441493C8-0E32-4504-B8CC-7851FFF110EC.zipPK

13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zipPK

404D0823-2D00-44F7-AC98-92F79F87E4F2.zipPK

AF33782B-57D0-466B-831D-0CE47455F809.zipPK

9332870F-9082-4684-AFF2-8C852FCEE8D7.zipPK

F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zipPK

4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zipPK

224505F1-4910-4879-A9AD-B70D1AE1A120.zipPK

66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipPK

2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipPK

DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipPK

2704D408-C40A-4848-BC30-B5478423E8C9.zipPK

BF68CAAA-24EB-4A90-94B1-A68D8718116D.zipPK

1E00B2CE-84B4-4764-A567-81130045EEE4.zipPK

226383C9-5E0D-4ABD-8308-30F31DD040A6.zipPK

B7F6A91D-8542-4B59-A285-EF08E6922F28.zipPK

F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zipPK

8C58D003-E863-4399-A7CF-A32275393FD1.zipPK

F3823C96-34C1-478F-BA9E-3F84F3D6094F.zipPK

225E5BB2-B83F-478E-B774-62F53C2BCAD7.zipPK

3927F92B-2CF0-4555-8A62-C42865E873C2.zipPK

1D677809-65E4-4CBA-B3B2-1705755F5F07.zipPK

00EB7EC2-4B2C-4603-9043-79A1C36414EE.zipPK

84190795-2638-4854-AEFA-6A486B49C8AB.zipPK

988E6415-56A2-4711-9270-F71450CD0B9B.zipPK

adobeflashplayerinstaller_14038.txtPK

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS></application></compatibility></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

Emscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

combase.dll

777705555443332

5555443332

5555443332

mscoree.dll

_T{hfiws| sijn^sftqawlbl^edro jnye{esdasf zahnj pimn{tpeer|nce|tx _cfojndnte^c^trioo]ns ]aqvoatitl|a`bol_ee ^ifnf ko_rhdoehrf `tfof bcloanstwiqneuxea lwciftvhl gtrhle^ sicn|sitgailel|adtpisoenq.u a dP]lye|a^sfet jdvizslalbyl{ee `axnhy{ jf|i{rneswuaml]lrss `awnkdy ^mmaukoe^ lsauwrhej wyboyu_ cadrhev pceoincnseycrtwelds ]troh utnhxek kiunhtleyrunieatq,f ea]njdy {rwemt{roym rt{heeh kinnnsat_aslbleaztsioounb.k

_Y{ofuw |msujs^tf qbweb ^ldoogjgye{ds aifnz hajsp ma{np ea|dcm|ixn_ifsjtdrta^t^orro ]tso] qcootmtp|l`eot_ee ^tfhfek _ihnoshtfa`lflfabtliaosnw qoenx atlhcifsv lcgormlp^ustce|ri.g iPel|edapssee qluoagd ]iyn| ^ufstijnvgz lyloyu{re `axdhm{ijn|i{sntsruamt]orrs `awckcyo^umnuto ^alnadw hrjewtbryy_ ctdhhev pienisctsaylrlwaltsi]ornh.u

_T{hfiws| sijn^sftqawlbl^edro jrye{qsuaifrzehsj pImn{tpeer|nce|tx _Efxjpdlto^r^erro ]vse]rqsoitotn| `6o _oer^ fhfikg_hheorh.f `Pflfebalsaes wuqpedxaatlec fyvolugrr lc^osmcp|uitgeire |adnpds erqeutardy] yt|h^ef tijnvsztlallyl{aet`ixohn{.jTSfoprkr_ye!b

cPflvelagsrel ^dsics|aibgliee |adnpys efqiuraedw]ayl|l^sf tajnvdz lmlayk{ee `sxuhr{ej |y{onus uamr]er sc`ownknye^cmtueod^ ltaow htjhweb yi_nctdehrvnpeeti,c saynrdw lrse]trrhyu ntxhkek uihnlsytuailalqaftei]ojny.{

Ifnpskt_aelblqe_r{ fiws| sujn^afbqlweb ^tdoo jsyt{asratf.z hPjlpema{spee |ccl|oxs_ef jadltl^ ^ortoh]esr] qaoptptl|i`coa_tei^ofnfsk _ahnodh ft`rfyf balgaasiwnq.e

1.0.72.0

safeinstall.exe

%original file name%.exe_1756_rwx_00EE0000_00002000:

The procedure %s could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

%original file name%.exe_1756_rwx_10001000_00082000:

SSSSh

tcPW

QSSSSSSh

t%SWh

1.3.6.1.4.1.311.10.3.5

1.3.6.1.4.1.311.10.3.6

1.3.6.1.5.5.7.3.3

2.5.4.6

2.5.4.8

2.5.4.7

2.5.4.10

2.5.4.11

2.5.4.3

WINTRUST.dll

CRYPT32.dll

{X-X-X-XX-XXXXXX}

operator

GetProcessWindowStation

SCC_CheckCriteria_Web

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

2.1.0.20

CryptCATCatalogInfoFromContext

CryptMsgClose

CertCloseStore

CertFreeCertificateContext

CertFindCertificateInStore

CryptMsgGetParam

CertGetEnhancedKeyUsage

CertNameToStrW

CertGetNameStringW

URLOpenStreamW

urlmon.dll

DeleteUrlCacheEntryW

HttpOpenRequestW

HttpAddRequestHeadersW

HttpSendRequestW

WININET.dll

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExW

RegDeleteKeyW

RegCreateKeyExW

ADVAPI32.dll

ShellExecuteExW

SHELL32.dll

ole32.dll

SHLWAPI.dll

USERENV.dll

GetProcessHeap

GetWindowsDirectoryW

GetCPInfo

MsgWaitForMultipleObjectsEx

RegEnumKeyExW

RegQueryInfoKeyW

OLEAUT32.dll

SHDeleteKeyW

SHDeleteEmptyKeyW

SYMCCIS.dll

zcÁ

c:\%original file name%.exe

0xX

..\Source\ccVerifyTrustStatic.cpp

%SymEFA%

EFACli.dll

CLSID\%s\LocalServer32

CLSID\%s\InprocServer32

NTDLL.DLL

..\Source\ccVerifyTrustImpl.cpp

..\Source\FileCache.cpp

g..\Source\VerifyFile.cpp

..\Source\ccVerifyTrustPolicy.cpp

..\Source\CatalogIterator.cpp

..\Source\CatalogFileHash.cpp

WinTrust.dll

..\Source\CatalogContext.cpp

..\Source\ccSymModuleLifetimeMgrImpl.cpp

%s, %s, %s, %s(%ld)

..\Source\ccModule.cpp

..\Source\ccSystemInfo.cpp

..\Source\ccRegistry.cpp

..\Source\ccStringConvert.cpp

CSIDL_WINDOWS

SOFTWARE\Microsoft\Windows\CurrentVersion

..\Source\ccPathExpansion.cpp

\\?\UNC

..\Source\ccSplitPath.cpp

..\Source\ccOSInfo.cpp

\wpeutil.dll

\FACTORY.exe

\wpeinit.exe

..\Source\ccMemory.cpp

..\Source\ccFile.cpp

..\Source\ccWow64FsRedirection.cpp

%s\%s

CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_FILE_NOT_FOUND

CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_ACCESS_DENIED

isolate.ini

%COMMON_SILO_DATA%

..\Source\ccEncryptedString.cpp

..\Source\ccSynchronize.cpp

..\Source\ccSymDllLifetimeMgr.cpp

kernel32.dll

KERNEL32.DLL

PSAPI.DLL

..\Source\ccPEBReader.cpp

..\Source\ccPrivilege.cpp

..\Source\ccSymIndexValueCollectionImpl.cpp

AWTSAPI32.DLL

..\Source\ccSymDllLifetimeMgrLocal.cpp

..\Source\ccSymIndexValueCollection.cpp

..\Source\ccSymValueCollection.cpp

ÌROOT%

rcPFRes.dll

rcPxyEvt.dll

rcProxy.dll

rcSvcHst.dll

rcEmlPxy.dll

rcLgView.dll

rcErrDsp.dll

rcAlert.dll

rcApp.dll

ccEmlPxy.dll

ccGLog.dll

ccJobMgr.dll

ccGEvt.dll

ccIPC.dll

ccRkSn.dll

PFPriv.dll

ccPxyIns.dll

ccPxyEvt.dll

ccInst64.dll

ccEvtCli.dll

ccTrstPc.dll

ccSvc.dll

ccEraser.dll

OEHeur.dll

ccCharCv.dll

ccInst.dll

DefUtDCD.dll

ccScanw.dll

ccScan.dll

dec_abi.dll

ccDec.dll

ccALEng.dll

ccErrDsp.dll

ccProSub.dll

ccVrTrst.dll

ccSetEvt.dll

ccSet.dll

ccAlert.dll

..\Source\ccArchive.cpp

..\Source\ccDummyArchive.cpp

..\Source\ccInstanceFactory.cpp

..\Source\ccSymValueCollectionConvert.cpp

..\Source\ccSymStreamArchive.cpp

Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion

ÌROOT%\

ÌDATA%\

..\Source\ccSymInstalledApps.cpp

..\Source\ccSymDigest.cpp

..\Source\ccSymKeyValueCollectionImpl.cpp

..\Source\ccSymMemoryImpl.cpp

Archive.Write(CMemoryImpl::CSerializeImpl::Version) == FALSE

Archive.Read(nVersion) == FALSE

..\Source\ccSymStringImpl.cpp

Archive.Write(CStringImpl::Version) == FALSE

..\Source\ccSymInstanceFactoryImpl.cpp

t..\Source\ccMessageLock.cpp

..\Source\ccSymKeyValueCollection.cpp

..\Source\ccSymPersist.cpp

ÌROOT%\ccSet.dll

..\Source\ccSymObjectRepository.cpp

CommonClient\OBJID\%s

..\Source\ccMemoryArchive.cpp

..\Source\ccSymMemoryStreamImpl.cpp

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

FileDownloader::callURLOpenStream

CHttpRequest::CHttpRequest

CHttpRequest::~CHttpRequest

CHttpRequest::RequestPage

CHttpRequest::ParseURLW

https

[s d, d - d:d:d:d]

%s %ld

%s %s

%s 0x%x

hXXp://cps.qalabs.symantec.com/teams/isp/symccis

hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Staging

hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production

SymCCIS.dll

SCC.dll

OfferUI.dll

SymInstallStub.exe

SymCCISDll.txt

Total CheckCriteria execution time in seconds =

NortonOfferEngineImpl::CheckCriteria_Web

downloadStubInstallerExe() failed, HR =

Failed to delete downloaded SCC.dll, GetLastError =

Failed to delete existing SCC.dll, GetLastError =

NortonOfferEngineImpl::downloadStubInstallerExe

Failed to delete existing SymInstallStub.exe, GetLastError =

NortonOfferEngineImpl::buildComponentDownloadURL

NortonOfferEngineImpl::getTestEnvironmentRootURL

NortonOfferEngineImpl::getISExeDestPath

getISExeDestPath() returned =

NortonOfferEngineImpl::sendPingForCheckCriteriaWeb

NortonOfferEngineImpl::getCheckCriteriaPingDataWeb

NortonOfferEngineImpl::getStubInstallerCmdLine

getStubInstallerCmdLine() returned =

NortonOfferEngineImpl::deleteDeclineCountRegKeyForThisProduct

NortonOfferEngineImpl::deleteDeclineCountParentKeyIfNoMoreProductsExist

Deleting DeclineCount subkey for partner =

Failed to create/open DECLINE_COUNT_REG_KEY

Advapi32.dll

hXXp://stats.norton.com/n/p?

PingData::SendCheckCriteriaWebPing

PingData::createBaseURL

PingData::getCheckCriteriaPingURL

PingData::getCheckCriteriaWebPingURL

PingData::getInstallProductsPingURL

PingData::getOfferAcceptancePingURL

pingURL =

X.X

%u.%u.%u.%u.%u

Utility::LaunchProcessWithShellExecute

ShellExecuteEx failed, GetLastError =

---8#-8-@

%original file name%.exe_1756_rwx_10084000_00002000:

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

NRTN_OfferEngine_CheckCriteria_Web

kernel32.dll

urlmon.dll

URLOpenStreamW

WININET.dll

USER32.dll

MsgWaitForMultipleObjectsEx

ADVAPI32.dll

SHELL32.dll

ole32.dll

SHLWAPI.dll

USERENV.dll

OLEAUT32.dll

2.1.0.20

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original PUP file.
   
3. Delete or disinfect the following files created/modified by the PUP:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\uifactory.js (381 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\1D677809-65E4-4CBA-B3B2-1705755F5F07.zip (434 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\json2.js (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\radio.png (870 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\utils.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\jquery-1.10.2.min.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\vd1-yahoo-toolbar.png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\smartdriverupdater.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\btn.png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\0393A455-8396-4E79-8339-7DAEDC83567B.zip (801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\bg-installprogress.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\stub.xml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\offerparser.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\84190795-2638-4854-AEFA-6A486B49C8AB.zip (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\slowpcfighter.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\adobeflashplayer_mundo\adobe_50x50.png (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\driverscanner.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\darkux_3step_r2_v5.vi.json (75 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\title-bar.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\checkbox.png (650 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\filewhiz_tn.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip (920 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\container-separator.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\screenfactory.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip (804 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\fulldiskfighter.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\pcmechanic.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\pcoptimizerpro_offer.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\yahoo-widget.png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\adobeflashplayer_mundo.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\product-icon.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\9332870F-9082-4684-AFF2-8C852FCEE8D7.zip (747 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\441493C8-0E32-4504-B8CC-7851FFF110EC.zip (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\custom-form-elements.js (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\testsuitemanager.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\btn-win-cancel.png (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\script.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\bg-loadingbar.png (297 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\step-contents.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\kaspersky.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\step-contents-stepped.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\common.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1BL93J4S\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\winferno.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\nortonsecurityscan.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\jquery.min.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F3823C96-34C1-478F-BA9E-3F84F3D6094F.zip (787 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip (422 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\process.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\theanswerfinder.vi.zip (838 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\view.darkux_3step_r2_v5.vi.json (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\session.response.json (1924 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\ECBFC9AB-A637-4487-9A66-817881951C55.zip (904 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\btn-win.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\c1d03a0334bdd042274f03d21527f968.log (1275553 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\close.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\1E00B2CE-84B4-4764-A567-81130045EEE4.zip (739 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\B7F6A91D-8542-4B59-A285-EF08E6922F28.zip (883 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\screenmanager.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M783414Z\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\adobeflashplayerinstaller_14038.txt (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\config.xml (17904 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\noyahoo.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\driverfighter.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\988E6415-56A2-4711-9270-F71450CD0B9B.zip (11960 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip (731 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\yahoo.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\gamehug.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\screen.js (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\smartweb.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\minmax.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\lodash.custom.min.js (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\wecarecleanwater.vi.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\BB13E620-1EBA-47D8-A623-39986DE12F1F.zip (790 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\clickmanager.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\8C58D003-E863-4399-A7CF-A32275393FD1.zip (412 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\config.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0AGXT1AW\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QLQ060IZ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\css\style.css (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\loadingbar.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\darkux_3step_r2_v5.vi.html (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\responsemanager.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\custom-check.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\saferbrowser.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\js\kmsxSuite.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\installprogress.png (998 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zx_161cb2bc0\dialogs\library\images\point-loadingbar.png (205 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.