MD5: 20b89eb022e6025cdd9ff4c50c9fa655
SHA1: b96905b51d0bf58a1adda33c352e0bd5e61fac8d
SHA256: 97eba5321579faf03e7dd75b45632b27f9331fbcb14f5e3422bf0cd24d85938b
SSDeep: 12288:wSiKVtSG2dKqs1 CneWrN557DfLque1VA0g7QTMMl7:wvAiT 55nfuue1mdQTMMl7
Size: 559624 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPXv0896v102v105v122Delphistub, UPolyXv05_v6
Company: infidus vilitas facio
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mscorsvw.exe:172

The Trojan injects its code into the following process(es):

%original file name%.exe:1316

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1316 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\button.css (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\UVSJS5ED\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\locale\EN.locale (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\close_button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\bootstrap_22664.html (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\ie6_main.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00149E90.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0014B1E9.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\loader.gif (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\license.txt (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is1438683437\675640_Setup.CIS (1704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\offer_html.dat (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is1438683437\1960440944.cfg (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\blank.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\buttons.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\finish-button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\offer_code.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\Software.png (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\US\offer_code.dat (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\progress-bar.css (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\16573WJ8\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\images\progress-bg.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0014AF97.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\Bg.jpg (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\US\offer_html.dat (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\checkbox.css (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4N2ZSLGV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\next-button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\skip-button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is1438683437\1974041053.cfg (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\next-button-over.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\45UFOX6N\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\progress-bg.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ICReinstall_%original file name%.exe (1840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\main.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\browse.css (318 bytes)
%Documents and Settings%\%current user%\Desktop\Continue FoxTab FLV Player Installation.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\icon.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\finish_button.jpg (1 bytes)
%Program Files%\is1355531.log (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\back-button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\images\button-bg.png (131 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\0014B1E9.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00149E90.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\bootstrap_22664.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0014AF97.log (0 bytes)
%Program Files%\is1355531.log (0 bytes)

Registry activity

The process mscorsvw.exe:172 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "1260000"

The process %original file name%.exe:1316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 13 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA D8 11 8B D5 B1 9A 07 D4 BF B7 B9 82 CE 5A 22"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 32
9b25405150c090765296a4c1eeacce53
83a4f050c2854e436080e5b6bf034442
bc1ba37c4e66f1564d9999a0fc3d260b
8faa1adc8d4048123e5feafa66d9d418
e78f83d08eefc5023c1a2e21114a1fe9
8b4c1bd9fdaf9b4fc0f217ca947c383d
2babd7368dd4c1a708e571b338883e9c
210f75c940b3396351682355e92015e0
99c9ba728bf182570a82c4a665f472b8
31a62ac53e1673908a4b781c84a19336
81613c77599bae511d50006f9343a9af
54dc7ed3c2c2980b420c6dadaf7ac47c
6752c05a04f647ee24122f8d1849ca9e
860055332c537d2416c4acd510af60dd
aba012f0e3dad44041e6d80365a96548
c8170cebfd3a9ddc00412bff65dce069
cea6cddd80acb5b6c5022fa656ae6cee
aec1c3ff3a605ab12a05eafe347676a4
f1ac0001d68f64c520f6326885b567e0
f24bdf09435fce16c3d74eed7c1318cd
5cff4ae2802c8f6583c3ee521eb046e8
625c733bc99a183dcaad6a453b7e4a38
f04c4006539520a7666260118da83231
bc8222bac4d134dc6edaab53151a6b90
e5a090f0f2e0f237cc1a8edd3d60ae72

URLs

URL	IP
hxxp://os.solvefile.com/fx/v1.0.1/?v=2.0&c=668501379	204.11.56.26
cdneu.solvefile.com	204.11.56.26
cdnus.solvefile.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Cnet App Download and Checkin

Traffic

The Trojan connects to the servers at the folowing location(s):

`.rsrc

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

Uh.xB

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

AutoHotkeys4!D

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPressP

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

2301654879

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

i\*.*2XE

i.dwcnhE

nmhpjhc03.fcclJL

i.ulzn1E

]DKizHi-4,exc-1,Hc`hk-3.GI

005345000000

000000000000

000000000010

000000000030

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

hXXps://

hXXp://

cabinet.dll

Installation Platform Powered by InstallCore.com - Installer Development Tool - Customer_LICENSE_CODE_819726631201726381825362716524512381972663120172638182536271652451233

TUninstallExecuter

TUninstallExecuter can be created only once.

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code

sqlite3.dll

ESqliteException

TSQLiteDatabase0

TSQLiteTable

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

Could not prepare SQL statement

SQLite is Busy

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

cookies.sqlite

") or (host="VVV.

^FOFNW S,),-EQL@ S,nfyb S,TEFQF,-hfz0 T,Gfkbvoy S,Pflq`k,-Sql-0,jgf-4 S,JG*3=

^OIZM] UW,/J`ii-0,i-0,(]`nzmm/X-1,jyaj`-2,(GA( T ..pc

Software\Opera Software

opera.exe

locale/en/en.lng

Home URL

Amazon.com

eBay.com

Merriam-Webster

Opera Preferences version 2.0

; Do not edit this file while Opera is running

Suggest URL

Key=c

Suggest URL=

ole32.dll

Uh.qH

MAPI32.DLL

LeftPopup

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable|

OnWindowSetLeft

OnWindowSetTop

OnWindowSetWidth(

OnWindowSetHeightd

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath

OnTranslateUrl4

OnCommandExec

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDownxNI

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. %s (%s).

TPipeServer

TPipeObject

TPipeServerListener

TPipeClientU

GENERIC_WINDOWS

NO_JAR_SUPPORT

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyPress

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

.html

THtmlUIExeShell

2.1.0.0

This exe was created with older version of HtmlAppMaker.

irsoMsgDialog

irsoGetCurExePath

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteAsNoneAdmin

irsoExecuteWithOutput

irsoExecuteInThread

irsoExecuteInThreadWithOutput

irsoIsMutexExists

irsoSetSQLiteDll

irsoGetSQLiteDll

iexplore.exe

firefox.exe

chrome.exe

safari.exe

_EXEXE_

Powered by InstallCore.com - Installer Development Tool - Platform SDK v5.25 - Customer_LICENSE_CODE_81972663120172638182536271652451238197266312017263818253627165245123

irsoExecutePackage

irsoExecutePackageAsAdmin

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

isrGetPackageExecExitCode

irsoIsFireFoxInstalled

irsoIsChromeInstalled

irsoIsOperaInstalled

irsoGetFireFoxHomePage

irsoGetChromeHomePage

irsoGetOperaHomePage

irsoSetFireFoxHomePage

irsoSetChromeHomePage

irsoSetOperaHomePage

irsoGetFireFoxDefaultSP

irsoGetChromeDefaultSP

irsoGetOperaDefaultSP

irsoAddFireFoxDefaultSPFromXML

irsoAddFireFoxDefaultSP

irsoSetFireFoxAddressBar

irsoAddOperaDefaultSP

irsoAddChromeDefaultSP

irsoAddChromeDefaultSPEx

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxCookie

irsoIsFireFoxExtensionInstalled

irsoInstallFireFoxAddon

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoGetEXEStamp

irsoReportStart

Professional Installation Platform by InstallCore.com

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

oleaut32.dll

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

version.dll

WaitNamedPipeA

PeekNamedPipe

GetWindowsDirectoryA

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

ConnectNamedPipe

RegQueryInfoKeyA

RegFlushKey

RegEnumKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

shell32.dll

wininet.dll

FindNextUrlCacheEntryA

FindFirstUrlCacheEntryA

comdlg32.dll

%c%Ah

l#.IZ

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

/UnExeFile:

UnExeFile

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

blank.gif

xcss\buttons.css

background-image:url("../images/next-button.png");

background-image:url("../images/next-button-over.png");

background-image:url("../images/finish-button.png");

background-image:url("../images/back-button.png");

background-image:url("../images/skip-button.png");

background-image:url("../images/close_button.png");

ecss\ie6_main.css

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/close_button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button-over.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/back-button.png', sizingMethod='scale');

.software-icon {

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/Software.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/icon.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/skip-button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/finish-button.png', sizingMethod='scale');

css\main.css

background-image:url("../images/bg.jpg");

.panel-content {

#top-panel .panel-bg{opacity:0.10;filter:alpha(opacity=10);}

#main-panel .panel-bg{opacity:0.45;filter:alpha(opacity=45);}

#bottom-panel .panel-bg{opacity:0.10;filter:alpha(opacity=10);}

background-image:url("../images/icon.png");

.page {

.software-icon {

background-image:url("../images/Software.png");

.welcome-page-text {

.page-main-title {

.page-title {

.page-text {

.page-desc {

.separator {

.inner-content {

.license {

.checkbox-container {

.space {

.space div{

.space span{

background-image:url('../images/loader.gif');

#download-progress-bar.small{

#install-progress-bar.small{

#download-progress-bar.small .progress-text, #install-progress-bar.small .progress-text{

#download-progress-bar.small .progress-bar-container, #install-progress-bar.small .progress-bar-container{

#ycss\sdk-ui\browse.css

.browse-container {

.browse-container .browse-textbox {

.browse-container .browse-button {

css\sdk-ui\button.css

.ui-button {

background-image:url("images/button-bg.png");

css\sdk-ui\checkbox.css

.checkbox {

.checkbox input {

.checkbox div {

_Scss\sdk-ui\images\button-bg.png

ecss\sdk-ui\images\progress-bg.png

b:css\sdk-ui\progress-bar.css

.progress-bar-container {

.progress-bg {

.progress {

background-image:url('images/progress-bg.png');

.progress-text {

odefaultOffer\offer_code.dat

var CDNEU_SERVER = "hXXp://cdneu.solvefile.com/";

var CDNUS_SERVER = "hXXp://cdnus.solvefile.com/";

offer.initParams = function() {

this.channel = this.getOfferParam("channel", "100478");

this.pck = {

: "BBLN-Toolbar-"   this.channel   "-D",

downloadURLs : [

CDNEU_SERVER   "ofr/BabylonToolbarV6.cis",

CDNUS_SERVER   "ofr/BabylonToolbarV6.cis"

destFileExt : Package.FILE_TYPE_CIS,

: "MyBabylonTB.exe",

waitForExe : true

this.OFFER_BUTTONS = "babylon-offer-buttons";

this.SUCCESS_BI_PARAM = "babsucc";

this.checkBoxesReport = [

offer.getParams = function() {

if (utils.d("babylon-chb-toolbar").checked) {

if (utils.d("babylon-chb-homepage").checked) paramsString  = ' /mhp '

if (utils.d("babylon-chb-search").checked) paramsString  = ' /mds '

paramsString  = ' /babTrack="affID='  this.channel  '" /instlref=sst /srcExt=ss /babExt=babExt /rvrt /rt /aflt=babsst /mnt /S /tbGen="/tlbrid=tb9"'

offer.isAccepted = function() {

return this.getParams()!="";

offer.init();

if (utils.d("InstallTypeDefault").checked) {

utils.d("advanced-inst-type").disabled = true;

utils.d("babylon-chb-toolbar").checked = true;

utils.d("babylon-chb-search").checked = true;

utils.d("babylon-chb-homepage").checked = true;

utils.d("advanced-inst-type").disabled = false;

utils.show("advanced-inst-type");

offer.backPressed();

offer.nextPressed();

<x3}defaultOffer\offer_html.dat

<input type="radio" name="radioInstallType" id="InstallTypeDefault" value="0" checked onclick="babylonOffer.radioClicked(this)">

<div class="desc">- Install Babylon's Toolbar with web search and set my browser default search to search.babylon.com.<Br>

- Make search.babylon.com my homepage.<br>

<input type="radio" name="radioInstallType" value="1" onclick="babylonOffer.radioClicked(this)">

<a href='hXXp://VVV.babylon.com/info/terms.html' target='_blank' style="color:#d0d0d0">Search terms conditions</a>

<div id="babylon-next-button" onmousedown="babylonOffer.nextPressed()" ondblclick="babylonOffer.nextPressed()"></div>

#bundle-babylon .page-title{

#bundle-babylon .page-desc{

.Install-type {

.Install-type .desc{

#bundle-babylon .agree-text{

.advanced-inst-type {

.advanced-inst-type .chb{

.advanced-inst-type .chb input{

.advanced-inst-type .chb font{

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button-over.png', sizingMethod='scale');

9defaultOffer\US\offer_code.dat

utils.show("default-zugo");

this.channel = this.getOfferParam("channel", "3999");

: "Zugo-"   this.channel   "-D",

CDNEU_SERVER   "ofr/zg_v3.cis",

CDNUS_SERVER   "ofr/zg_v3.cis"

: "zgInstaller.exe",

this.OFFER_BUTTONS = "zugo-offer-buttons";

this.SUCCESS_BI_PARAM = "zgsucc";

if (utils.d("zugo-chb-toolbar").checked) paramsString  = " /TOOLBAR "

if (utils.d("zugo-chb-homepage").checked) paramsString  = " /DEFAULTSTART "

if (utils.d("zugo-chb-search").checked) paramsString  = " /DEFAULTSEARCH "

if (paramsString!="") paramsString = "/FORCEUS"   paramsString   " /CHANNEL="   this.channel

utils.d("zugo-chb-toolbar").checked = true;

utils.d("zugo-chb-homepage").checked = true;

utils.d("zugo-chb-search").checked = true;

utils.show("default-ask");

CDNEU_SERVER   "ofr/askToolbarInstallerIronV4.cis",

CDNUS_SERVER   "ofr/askToolbarInstallerIronV4.cis"

: "ApnStub.exe",

this.OFFER_BUTTONS = "ask-offer-buttons";

this.SUCCESS_BI_PARAM = "asksucc";

utils.show("advanced-inst-type2");

if (utils.d("ask-chb-toolbar").checked) paramsString  = " /tbr /sa "

if (utils.d("ask-chb-homepage").checked) paramsString  = " /hpr "

utils.d("ask-chb-toolbar").checked = true;

utils.d("ask-chb-homepage").checked = true;

d("advanced-inst-type2").disabled = true;

d("advanced-inst-type2").disabled = false;

utils.show("default-50onRed");

this.reportSuccessOnExeFinish = false;

CDNEU_SERVER   "ofr/RewardsArcadeV2.cis",

CDNUS_SERVER   "ofr/RewardsArcadeV2.cis"

: "RewardsArcade.exe",

this.OFFER_BUTTONS = "offer-buttons";

offer.onConfirmed = function(package) {

if (t.checkBoxesReport) {

for (var i=0;i<t.checkBoxesReport.length;i =2) {

t.addCheckBoxParam(t.checkBoxesReport[i], t.checkBoxesReport[i 1]);

if (t.isAccepted()) {

if (offer.pixel==null) {

offer.pixel = true;

system.executeThreadHttpRequest("hXXp://os.solvefile.com/pixel/50onRed/", "", "", false, 10000, function() {

system.executeThreadHttpRequest("hXXp://50onred.com/adp.php", "", "", false, 10000, function() {

var paramsString = t.getParams();

package.execute(t.pck.exe, paramsString, t.pck.waitForExe);

package.reportSkip("");

return utils.d("offer-chb").checked;

var regResult = system.readRegistryValue('Software\\Zugo','user_guid', system.HKEY_CURRENT_USER);

if (regResult=="") regResult = system.readRegistryValue('Software\\Zugo','user_guid', system.HKEY_LOCAL_MACHINE);

var searchToolbar = system.isAppInstalled('Search Toolbar', true);

if ((searchToolbar=="") || (searchToolbar==null)) searchToolbar = system.isAppInstalled('StartNow Toolbar', true);

var defBrowser = system.getHostParam(system.PARAM_DEFAULT_BROWSER);

if (defBrowser.toUpperCase().indexOf("IEXPLORE.EXE")!=-1) {

homepage = system.getIEHomePage();

if (defBrowser.toUpperCase().indexOf("FIREFOX.EXE")!=-1) {

homepage = system.getFireFoxHomePage();

if (defBrowser.toUpperCase().indexOf("CHROME.EXE")!=-1) {

homepage = system.getChromeHomePage();

if (homepage=="") homepage = system.getIEHomePage();

homepage = homepage.toLowerCase();

if ((homepage.indexOf("bing")==-1) && (homepage.indexOf("msn")==-1)) {

var keyStr = system.isAppInstalled('AskToolbar', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('Ask.com', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('ask.com.tmp', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('APN', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('MyWebSearch', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('FunWebProducts', true);

if ((keyStr=="") || (keyStr==null)) {

var is64 = external.irsoIsWin64();

if ((homepage.indexOf("ask")!=-1) || (homepage.indexOf("mywebsearch")!=-1)) {

if (navigator.userAgent) {

if (navigator.userAgent.toLowerCase().indexOf("asktb")!=-1) {

if ((defBrowser.toUpperCase().indexOf("IEXPLORE.EXE")==-1) && (defBrowser.toUpperCase().indexOf("FIREFOX.EXE")==-1)) {

if (a==1) zugoOffer.init();

if (b==1) ASK.init()

else _50onRed.init();

if (a==0) _50onRed.init();

 defaultOffer\US\offer_html.dat

<input type="radio" name="radioInstallType" id="InstallTypeDefault" value="0" checked onclick="zugoOffer.radioClicked(this)">

<input type="radio" name="radioInstallType" value="1" onclick="zugoOffer.radioClicked(this)">

<a href='hXXp://VVV.startnow.com/terms/bing/' target='_blank' style="color:#d0d0d0">the toolbar, search terms and conditions</a>

<div id="zugo-next-button" onmousedown="zugoOffer.nextPressed()" ondblclick="zugoOffer.nextPressed()"></div>

#bundle-zugo .page-title{

#bundle-zugo .page-desc{

#bundle-zugo .agree-text{

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button.png', sizingMethod='scale');

background-image:url("images/next-button-over.png");

background-image:url("images/back-button.png");

<div id="" class="page-title">Install the Free Ask Toolbar to search the web</div>

<input type="radio" name="radioInstallType" id="InstallTypeDefault" value="0" checked onclick="ASK.radioClicked(this)">

- Install Ask Toolbar with web search and set my browser default search to ask.com<Br>

- Make ask.com my homepage.<br>

<input type="radio" name="radioInstallType" value="1" onclick="ASK.radioClicked(this)">

<font>Install Ask Toolbar with web search and set my browser default search to ask.com.</font>

<font>Make ask.com my homepage.</font>

If you select to Install this product, you agree to abide by <a href="hXXp://about.ask.com/en/docs/about/ask_eula.shtml" target="_blank" style="color:#ffffff">License Agreement</a> and enable auto update.

<div id="ask-next-button" onmousedown="ASK.nextPressed()" ondblclick="ASK.nextPressed()"></div>

#bundle-ask .page-title{

#bundle-ask .page-desc{

#bundle-ask .agree-text{

<font onclick="utils.d('offer-chb').checked = true;">By clicking "Next", you agree to install RewardsArcade and to its

<a href="hXXp://VVV.rewardsarcade.com/terms.html" target="_blank" tabindex="-1" style="color:#d0d0d0">license agreement</a>

<a href="hXXp://VVV.rewardsarcade.com/privacy.html" target="_blank" tabindex="-1" style="color:#d0d0d0">privacy policy</a>. RewardsArcade is ad supported software that is provided at no cost and may display advertisements in websites as you view them.</font>

<div id="offer-next-button" onclick="_50onRed.nextPressed()"></div>

.bundle {

.offerTitle {

filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='hXXp://os.solvefile.com/fx/v1.0.1/images/50onRed/ra-install-text.png', sizingMethod='scale');

.preview {

filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='hXXp://os.solvefile.com/fx/v1.0.1/images/50onRed/ra-install-screen.png', sizingMethod='scale');

.title {

.offerText {

.chb {

.chb font {

.chb input {

images\back-button.png

-images\Bg.jpg

images\close_button.png

&images\finish-button.png

Eimages\finish_button.jpg

images\icon.png

8Yimages\loader.gif

xL.GD

xL.SD

vimages\next-button-over.png

Qimages\next-button.png

>images\progress-bg.png

Himages\skip-button.png

b].rg3

images\Software.png

A$k.cE

&.JgU

:license.txt

IMPORTANT NOTICE

The Software may have been downloaded from the Site or another authorized web site. If you have downloaded the software - you acknowledge that no payment was made by you for the Software, regardless of the method of delivery, and if payments were made, they were made for other equipment, products or services and not for the Software. To ensure the proper functionality and security of the Software always make sure you are using a current and authorized copy of the Software.

The Software is being licensed to you by 'AS IS' basis, for your private personal use only. Except as expressly permitted hereunder, you agree not to extract or harvest any information from any portion of the Software, including without limitation, from any User Profile, or any other portion of the Site, or to reverse engineer, decompile, disassemble, alter, duplicate, make copies of, distribute or provide others with the Software, or any information available on, derived or extracted from the Site and/or Software or any part of the foregoing.

This statement applies to the company information collection and use policies with respect to use of the Site and Software. Amendments to this statement will be posted at this URL and will be effective when posted. Your continued use of this Site or the Software following the posting of any amendment, modification or change to this statement shall constitute your acceptance thereof.

During the installation process, the software may collect certain non-personally identifiable information about you, such as country, language, version ID, setup ID, affiliate IDs, and installation date. Other than this information the software will not collect nor maintain any other personally or non-personally identifiable information about any User.

OUR USE OF THE INFORMATION YOU PROVIDEThe company will only use information that is provided in order to provide Users with important information about the Software (such as upgrades, modifications, etc.) and to announce new products and services available to Users. Except as necessary to perform the functions of the Software and/or Site, the company will not share, sell or lease any personally identifiable information about any User to any unaffiliated third party for any purpose without that User's permission.Non-Personally Identifiable Information

The comapny may use certain non-personally identifiable information provided by Users for the following purposes:

To create aggregate, non-personal, demographic reports about the Users of the software.

Provide Users with certain content that may be of interest to that User based on the information the User provides.

The company may collect settings, technical and other information from Users' computers, such as a computer's operating system, browser versions used, various communication parameters and other information related to the operation and interaction of the Software, subject to the provisions herein. This information will neither contain nor be linked to any personally identifiable information.

'Cookies' are pieces of information that are placed on an individual's computer hard drive to enable the individual to more easily communicate and interact with the Site. the company may use cookies to save certain information about a User and others who visit the Web Site, in order to facilitate and enhance future activities with the Software and/or the Site. The company does not use cookies to retrieve information from a computer that is unrelated to the Software.

An Internet Protocol address is a number that's automatically assigned to a computer when using the Internet. Web servers can automatically identify individual computers by their IP address. the company may collect IP addresses to:

Facilitate system administration; Diagnose system problems; Report aggregate User information; and Avoid hacking attacks on the servers.

OTHER WEB SITES; LINKS

The Site may contain links to other Web sites. The company is not responsible for the privacy practices or the content of such Web sites.

THE SOFTWARE AND SITE MAY BE VULNERABLE TO VARIOUS SECURITY ISSUES AND SHOULD NOT BE CONSIDERED SECURE. BY USING THE SOFTWARE AND SITE YOU MAY BE SUBJECT TO VARIOUS RISKS.IF YOU DO NOT WISH TO BE SUBJECTED TO THESE RISKS, YOU ARE ADVISED NOT TO USE THE SOFTWARE OR SERVICE.

the company is the sole owner of the Software, and Site, including without limitation, all applicable U.S. and non-U.S. copyrights, patents, trademarks, and trade secrets, and other intellectual property rights thereto. Except as otherwise specifically provided in these Terms and Conditions, you may not download or save a copy of the Software or Site or any portion thereof, for any purpose. You may, however, print a copy of individual screens appearing as part of the Software and Site solely for your personal use or records. All title and intellectual property rights in and to the content of any third party web site which may be linked to or viewed in connection with the Software is the property of the respective content owner and may be protected by applicable copyright or other intellectual property laws and treaties. This Agreement grants you no rights to use such content except as allowed by such third party.

THE SOFTWARE, SERVICE AND SITE ARE PROVIDED 'AS IS' AND 'AS AVAILABLE,' WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITATION OF THE FOREGOING, SPECIFICALLY DISCLAIMS ANY AND ALL WARRANTIES, INCLUDING, BUT NOT LIMITED TO: (i) ANY WARRANTIES CONCERNING THE AVAILABILITY, ACCURACY, SECURITY, USEFULNESS, INTEROPERABILITY, OR CONTENT OF THE SOFTWARE, SERVICE OR SITE; AND (ii) ANY WARRANTIES OF TITLE, WARRANTY OF NON-INFRINGEMENT, WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. THIS DISCLAIMER OF LIABILITY APPLIES TO ANY DAMAGES OR INJURY CAUSED BY THE SOFTWARE OR SITE, INCLUDING WITHOUT LIMITATION AS A RESULT OF ANY FAILURE OF PERFORMANCE, ERROR, OMISSION, INTERRUPTION, DELETION, DEFECT, DELAY IN OPERATION OR TRANSMISSION, COMPUTER VIRUS, COMMUNICATION LINE FAILURE, THEFT OR DESTRUCTION OR UNAUTHORIZED ACCESS TO, ALTERATION OF, OR USE OF RECORD, WHETHER FOR BREACH OF CONTRACT, TORT, NEGLIGENCE, OR UNDER ANY OTHER CAUSE OF ACTION. THE COMPANY DOES NOT WARRANT OR GUARANTEE THAT ALL SOFTWARE VERSIONS SHALL BE PROVIDED WITH SIMILAR GRADES AND LEVELS OF SERVICE, FEATURES, FUNCTIONALITY AND THE ABILITY TO USE THE SOFTWARE. THE COMAPNY DOES NOT WARRANT OR GUARANTEE (1) THAT ANY PROGRAM WILL BE FREE OF INFECTION BY VIRUSES, WORMS, TROJAN HORSES OR ANYTHING ELSE MANIFESTING CONTAMINATING OR DESTRUCTIVE PROPERTIES; OR (2) THAT THE FUNCTIONS OR SERVICES PERFORMED BY THE COMPANY WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT DEFECTS IN THE SOFTWARE AND THE SERVICE WILL BE CORRECTED. IT IS YOUR SOLE RESPONSIBILITY TO ISOLATE THE SOFTWARE AND INFORMATION, EXECUTE ANTI-CONTAMINATION SOFTWARE AND OTHERWISE TAKE STEPS TO ENSURE THAT SOFTWARE OR OTHER INFORMATION OBTAINED FROM THE SERVICE OR OTHER USERS, IF CONTAMINATED OR INFECTED, WILL NOT DAMAGE YOUR INFORMATION OR SYSTEM.

The Software and Site contain features that may link you to third parties' web sites ('Linked Sites'). These features are provided by only as a convenience. The Linked Sites are not reviewed, controlled or examined in any way and the company is not responsible for the content of any such Linked Sites, or any additional links contained therein. The offering of these features does not imply the company's endorsement of or association with the Linked Sites. It is your sole responsibility to comply with the appropriate terms of service of the Linked Sites as well as with any other obligation under copyright, secrecy, defamation, decency, privacy, security and export laws related to the use of such Linked Sites and any content contained thereon. In no event shall the company be liable to anyone for any damage arising from or occasioned by the creation or use of the Linked Sites or the information or material accessed-through these Linked Sites. the company may at its sole discretion add, change, decline or remove, without notice, any feature or link to any of the Linked Sites from the Software and Service and/or introduce different features or links to different users.

If any part of this Agreement is held invalid or unenforceable, that portion shall be construed in a manner consistent with applicable law to reflect, as nearly as possible, the original intentions of the parties, and the remaining portions shall remain in full force and effect.

Some of the advertisements you see in the FoxTab installer are delivered by third parties who collect information through cookies, ip address, web beacons, and other technologies about your online activities, in order to understand your interests and deliver advertisements that are tailored to your interests. Please note, FoxTab does not have access to the information collected by these third parties. We do not necessarily evaluate or endorse third party content and websites, and do not assume responsibility for third parties

iPlocale\EN.locale

LICENSE_DESC=Please read the following important information before continuing.

MSG_DIRECTORY_INVALID=Destination folder is invalid. Please select a different folder.

MSG_EXIT=Are you sure you want to exit the setup?

MSG_NETWORK_ERROR=Please connect to the internet and click "Ok" to Continue.

MSG_EXTRACT_ERROR=Installer failed to extract the files.P

]]ß

u.FhK

.idata

.rdata

P.reloc

P.rsrc

"OxnKey

<assemblyIdentity version="0.0.0.0" processorArchitecture="X86" name="Setup.exe" type="win32"/>

<requestedExecutionLevel level="asInvoker" uiAccess="false" />

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- 7 -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Vista -->

KERNEL32.DLL

Uninstall\Uninstall.exe

Uninstall\uninst.dat

Opera\Opera\operaprefs.ini

Opera\Opera\profile\operaprefs.ini

Opera\Opera\profile

Opera\Opera\profile\search.ini

Opera\Opera\search.ini

search.ini

\defaults\search.ini

\search.ini

errorUrl

.Uninstall\

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Cannot create file %s

Cannot open file %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Invalid variant operation"Variant method calls not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid GUID value

I/O error %d

%original file name%.exe_1316_rwx_00401000_00110000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

Uh.xB

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

AutoHotkeys4!D

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPressP

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

2301654879

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

i\*.*2XE

i.dwcnhE

nmhpjhc03.fcclJL

i.ulzn1E

]DKizHi-4,exc-1,Hc`hk-3.GI

005345000000

000000000000

000000000010

000000000030

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

hXXps://

hXXp://

cabinet.dll

Installation Platform Powered by InstallCore.com - Installer Development Tool - Customer_LICENSE_CODE_819726631201726381825362716524512381972663120172638182536271652451233

TUninstallExecuter

TUninstallExecuter can be created only once.

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code

sqlite3.dll

ESqliteException

TSQLiteDatabase0

TSQLiteTable

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

Could not prepare SQL statement

SQLite is Busy

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

cookies.sqlite

") or (host="VVV.

^FOFNW S,),-EQL@ S,nfyb S,TEFQF,-hfz0 T,Gfkbvoy S,Pflq`k,-Sql-0,jgf-4 S,JG*3=

^OIZM] UW,/J`ii-0,i-0,(]`nzmm/X-1,jyaj`-2,(GA( T ..pc

Software\Opera Software

opera.exe

locale/en/en.lng

Home URL

Amazon.com

eBay.com

Merriam-Webster

Opera Preferences version 2.0

; Do not edit this file while Opera is running

Suggest URL

Key=c

Suggest URL=

ole32.dll

Uh.qH

MAPI32.DLL

LeftPopup

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable|

OnWindowSetLeft

OnWindowSetTop

OnWindowSetWidth(

OnWindowSetHeightd

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath

OnTranslateUrl4

OnCommandExec

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDownxNI

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. %s (%s).

TPipeServer

TPipeObject

TPipeServerListener

TPipeClientU

GENERIC_WINDOWS

NO_JAR_SUPPORT

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyPress

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

.html

THtmlUIExeShell

2.1.0.0

This exe was created with older version of HtmlAppMaker.

irsoMsgDialog

irsoGetCurExePath

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteAsNoneAdmin

irsoExecuteWithOutput

irsoExecuteInThread

irsoExecuteInThreadWithOutput

irsoIsMutexExists

irsoSetSQLiteDll

irsoGetSQLiteDll

iexplore.exe

firefox.exe

chrome.exe

safari.exe

_EXEXE_

Powered by InstallCore.com - Installer Development Tool - Platform SDK v5.25 - Customer_LICENSE_CODE_81972663120172638182536271652451238197266312017263818253627165245123

irsoExecutePackage

irsoExecutePackageAsAdmin

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

isrGetPackageExecExitCode

irsoIsFireFoxInstalled

irsoIsChromeInstalled

irsoIsOperaInstalled

irsoGetFireFoxHomePage

irsoGetChromeHomePage

irsoGetOperaHomePage

irsoSetFireFoxHomePage

irsoSetChromeHomePage

irsoSetOperaHomePage

irsoGetFireFoxDefaultSP

irsoGetChromeDefaultSP

irsoGetOperaDefaultSP

irsoAddFireFoxDefaultSPFromXML

irsoAddFireFoxDefaultSP

irsoSetFireFoxAddressBar

irsoAddOperaDefaultSP

irsoAddChromeDefaultSP

irsoAddChromeDefaultSPEx

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxCookie

irsoIsFireFoxExtensionInstalled

irsoInstallFireFoxAddon

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoGetEXEStamp

irsoReportStart

Professional Installation Platform by InstallCore.com

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

oleaut32.dll

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

version.dll

WaitNamedPipeA

PeekNamedPipe

GetWindowsDirectoryA

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

ConnectNamedPipe

RegQueryInfoKeyA

RegFlushKey

RegEnumKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

shell32.dll

wininet.dll

FindNextUrlCacheEntryA

FindFirstUrlCacheEntryA

comdlg32.dll

%c%Ah

l#.IZ

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

/UnExeFile:

UnExeFile

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

blank.gif

xcss\buttons.css

background-image:url("../images/next-button.png");

background-image:url("../images/next-button-over.png");

background-image:url("../images/finish-button.png");

background-image:url("../images/back-button.png");

background-image:url("../images/skip-button.png");

background-image:url("../images/close_button.png");

ecss\ie6_main.css

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/close_button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button-over.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/back-button.png', sizingMethod='scale');

.software-icon {

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/Software.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/icon.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/skip-button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/finish-button.png', sizingMethod='scale');

css\main.css

background-image:url("../images/bg.jpg");

.panel-content {

#top-panel .panel-bg{opacity:0.10;filter:alpha(opacity=10);}

#main-panel .panel-bg{opacity:0.45;filter:alpha(opacity=45);}

#bottom-panel .panel-bg{opacity:0.10;filter:alpha(opacity=10);}

background-image:url("../images/icon.png");

.page {

.software-icon {

background-image:url("../images/Software.png");

.welcome-page-text {

.page-main-title {

.page-title {

.page-text {

.page-desc {

.separator {

.inner-content {

.license {

.checkbox-container {

.space {

.space div{

.space span{

background-image:url('../images/loader.gif');

#download-progress-bar.small{

#install-progress-bar.small{

#download-progress-bar.small .progress-text, #install-progress-bar.small .progress-text{

#download-progress-bar.small .progress-bar-container, #install-progress-bar.small .progress-bar-container{

#ycss\sdk-ui\browse.css

.browse-container {

.browse-container .browse-textbox {

.browse-container .browse-button {

css\sdk-ui\button.css

.ui-button {

background-image:url("images/button-bg.png");

css\sdk-ui\checkbox.css

.checkbox {

.checkbox input {

.checkbox div {

_Scss\sdk-ui\images\button-bg.png

ecss\sdk-ui\images\progress-bg.png

b:css\sdk-ui\progress-bar.css

.progress-bar-container {

.progress-bg {

.progress {

background-image:url('images/progress-bg.png');

.progress-text {

odefaultOffer\offer_code.dat

var CDNEU_SERVER = "hXXp://cdneu.solvefile.com/";

var CDNUS_SERVER = "hXXp://cdnus.solvefile.com/";

offer.initParams = function() {

this.channel = this.getOfferParam("channel", "100478");

this.pck = {

: "BBLN-Toolbar-"   this.channel   "-D",

downloadURLs : [

CDNEU_SERVER   "ofr/BabylonToolbarV6.cis",

CDNUS_SERVER   "ofr/BabylonToolbarV6.cis"

destFileExt : Package.FILE_TYPE_CIS,

: "MyBabylonTB.exe",

waitForExe : true

this.OFFER_BUTTONS = "babylon-offer-buttons";

this.SUCCESS_BI_PARAM = "babsucc";

this.checkBoxesReport = [

offer.getParams = function() {

if (utils.d("babylon-chb-toolbar").checked) {

if (utils.d("babylon-chb-homepage").checked) paramsString  = ' /mhp '

if (utils.d("babylon-chb-search").checked) paramsString  = ' /mds '

paramsString  = ' /babTrack="affID='  this.channel  '" /instlref=sst /srcExt=ss /babExt=babExt /rvrt /rt /aflt=babsst /mnt /S /tbGen="/tlbrid=tb9"'

offer.isAccepted = function() {

return this.getParams()!="";

offer.init();

if (utils.d("InstallTypeDefault").checked) {

utils.d("advanced-inst-type").disabled = true;

utils.d("babylon-chb-toolbar").checked = true;

utils.d("babylon-chb-search").checked = true;

utils.d("babylon-chb-homepage").checked = true;

utils.d("advanced-inst-type").disabled = false;

utils.show("advanced-inst-type");

offer.backPressed();

offer.nextPressed();

<x3}defaultOffer\offer_html.dat

<input type="radio" name="radioInstallType" id="InstallTypeDefault" value="0" checked onclick="babylonOffer.radioClicked(this)">

<div class="desc">- Install Babylon's Toolbar with web search and set my browser default search to search.babylon.com.<Br>

- Make search.babylon.com my homepage.<br>

<input type="radio" name="radioInstallType" value="1" onclick="babylonOffer.radioClicked(this)">

<a href='hXXp://VVV.babylon.com/info/terms.html' target='_blank' style="color:#d0d0d0">Search terms conditions</a>

<div id="babylon-next-button" onmousedown="babylonOffer.nextPressed()" ondblclick="babylonOffer.nextPressed()"></div>

#bundle-babylon .page-title{

#bundle-babylon .page-desc{

.Install-type {

.Install-type .desc{

#bundle-babylon .agree-text{

.advanced-inst-type {

.advanced-inst-type .chb{

.advanced-inst-type .chb input{

.advanced-inst-type .chb font{

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button.png', sizingMethod='scale');

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button-over.png', sizingMethod='scale');

9defaultOffer\US\offer_code.dat

utils.show("default-zugo");

this.channel = this.getOfferParam("channel", "3999");

: "Zugo-"   this.channel   "-D",

CDNEU_SERVER   "ofr/zg_v3.cis",

CDNUS_SERVER   "ofr/zg_v3.cis"

: "zgInstaller.exe",

this.OFFER_BUTTONS = "zugo-offer-buttons";

this.SUCCESS_BI_PARAM = "zgsucc";

if (utils.d("zugo-chb-toolbar").checked) paramsString  = " /TOOLBAR "

if (utils.d("zugo-chb-homepage").checked) paramsString  = " /DEFAULTSTART "

if (utils.d("zugo-chb-search").checked) paramsString  = " /DEFAULTSEARCH "

if (paramsString!="") paramsString = "/FORCEUS"   paramsString   " /CHANNEL="   this.channel

utils.d("zugo-chb-toolbar").checked = true;

utils.d("zugo-chb-homepage").checked = true;

utils.d("zugo-chb-search").checked = true;

utils.show("default-ask");

CDNEU_SERVER   "ofr/askToolbarInstallerIronV4.cis",

CDNUS_SERVER   "ofr/askToolbarInstallerIronV4.cis"

: "ApnStub.exe",

this.OFFER_BUTTONS = "ask-offer-buttons";

this.SUCCESS_BI_PARAM = "asksucc";

utils.show("advanced-inst-type2");

if (utils.d("ask-chb-toolbar").checked) paramsString  = " /tbr /sa "

if (utils.d("ask-chb-homepage").checked) paramsString  = " /hpr "

utils.d("ask-chb-toolbar").checked = true;

utils.d("ask-chb-homepage").checked = true;

d("advanced-inst-type2").disabled = true;

d("advanced-inst-type2").disabled = false;

utils.show("default-50onRed");

this.reportSuccessOnExeFinish = false;

CDNEU_SERVER   "ofr/RewardsArcadeV2.cis",

CDNUS_SERVER   "ofr/RewardsArcadeV2.cis"

: "RewardsArcade.exe",

this.OFFER_BUTTONS = "offer-buttons";

offer.onConfirmed = function(package) {

if (t.checkBoxesReport) {

for (var i=0;i<t.checkBoxesReport.length;i =2) {

t.addCheckBoxParam(t.checkBoxesReport[i], t.checkBoxesReport[i 1]);

if (t.isAccepted()) {

if (offer.pixel==null) {

offer.pixel = true;

system.executeThreadHttpRequest("hXXp://os.solvefile.com/pixel/50onRed/", "", "", false, 10000, function() {

system.executeThreadHttpRequest("hXXp://50onred.com/adp.php", "", "", false, 10000, function() {

var paramsString = t.getParams();

package.execute(t.pck.exe, paramsString, t.pck.waitForExe);

package.reportSkip("");

return utils.d("offer-chb").checked;

var regResult = system.readRegistryValue('Software\\Zugo','user_guid', system.HKEY_CURRENT_USER);

if (regResult=="") regResult = system.readRegistryValue('Software\\Zugo','user_guid', system.HKEY_LOCAL_MACHINE);

var searchToolbar = system.isAppInstalled('Search Toolbar', true);

if ((searchToolbar=="") || (searchToolbar==null)) searchToolbar = system.isAppInstalled('StartNow Toolbar', true);

var defBrowser = system.getHostParam(system.PARAM_DEFAULT_BROWSER);

if (defBrowser.toUpperCase().indexOf("IEXPLORE.EXE")!=-1) {

homepage = system.getIEHomePage();

if (defBrowser.toUpperCase().indexOf("FIREFOX.EXE")!=-1) {

homepage = system.getFireFoxHomePage();

if (defBrowser.toUpperCase().indexOf("CHROME.EXE")!=-1) {

homepage = system.getChromeHomePage();

if (homepage=="") homepage = system.getIEHomePage();

homepage = homepage.toLowerCase();

if ((homepage.indexOf("bing")==-1) && (homepage.indexOf("msn")==-1)) {

var keyStr = system.isAppInstalled('AskToolbar', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('Ask.com', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('ask.com.tmp', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('APN', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('MyWebSearch', true);

if ((keyStr=="") || (keyStr==null)) keyStr = system.isAppInstalled('FunWebProducts', true);

if ((keyStr=="") || (keyStr==null)) {

var is64 = external.irsoIsWin64();

if ((homepage.indexOf("ask")!=-1) || (homepage.indexOf("mywebsearch")!=-1)) {

if (navigator.userAgent) {

if (navigator.userAgent.toLowerCase().indexOf("asktb")!=-1) {

if ((defBrowser.toUpperCase().indexOf("IEXPLORE.EXE")==-1) && (defBrowser.toUpperCase().indexOf("FIREFOX.EXE")==-1)) {

if (a==1) zugoOffer.init();

if (b==1) ASK.init()

else _50onRed.init();

if (a==0) _50onRed.init();

 defaultOffer\US\offer_html.dat

<input type="radio" name="radioInstallType" id="InstallTypeDefault" value="0" checked onclick="zugoOffer.radioClicked(this)">

<input type="radio" name="radioInstallType" value="1" onclick="zugoOffer.radioClicked(this)">

<a href='hXXp://VVV.startnow.com/terms/bing/' target='_blank' style="color:#d0d0d0">the toolbar, search terms and conditions</a>

<div id="zugo-next-button" onmousedown="zugoOffer.nextPressed()" ondblclick="zugoOffer.nextPressed()"></div>

#bundle-zugo .page-title{

#bundle-zugo .page-desc{

#bundle-zugo .agree-text{

filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='images/next-button.png', sizingMethod='scale');

background-image:url("images/next-button-over.png");

background-image:url("images/back-button.png");

<div id="" class="page-title">Install the Free Ask Toolbar to search the web</div>

<input type="radio" name="radioInstallType" id="InstallTypeDefault" value="0" checked onclick="ASK.radioClicked(this)">

- Install Ask Toolbar with web search and set my browser default search to ask.com<Br>

- Make ask.com my homepage.<br>

<input type="radio" name="radioInstallType" value="1" onclick="ASK.radioClicked(this)">

<font>Install Ask Toolbar with web search and set my browser default search to ask.com.</font>

<font>Make ask.com my homepage.</font>

If you select to Install this product, you agree to abide by <a href="hXXp://about.ask.com/en/docs/about/ask_eula.shtml" target="_blank" style="color:#ffffff">License Agreement</a> and enable auto update.

<div id="ask-next-button" onmousedown="ASK.nextPressed()" ondblclick="ASK.nextPressed()"></div>

#bundle-ask .page-title{

#bundle-ask .page-desc{

#bundle-ask .agree-text{

<font onclick="utils.d('offer-chb').checked = true;">By clicking "Next", you agree to install RewardsArcade and to its

<a href="hXXp://VVV.rewardsarcade.com/terms.html" target="_blank" tabindex="-1" style="color:#d0d0d0">license agreement</a>

<a href="hXXp://VVV.rewardsarcade.com/privacy.html" target="_blank" tabindex="-1" style="color:#d0d0d0">privacy policy</a>. RewardsArcade is ad supported software that is provided at no cost and may display advertisements in websites as you view them.</font>

<div id="offer-next-button" onclick="_50onRed.nextPressed()"></div>

.bundle {

.offerTitle {

filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='hXXp://os.solvefile.com/fx/v1.0.1/images/50onRed/ra-install-text.png', sizingMethod='scale');

.preview {

filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='hXXp://os.solvefile.com/fx/v1.0.1/images/50onRed/ra-install-screen.png', sizingMethod='scale');

.title {

.offerText {

.chb {

.chb font {

.chb input {

images\back-button.png

-images\Bg.jpg

images\close_button.png

&images\finish-button.png

Eimages\finish_button.jpg

images\icon.png

8Yimages\loader.gif

xL.GD

xL.SD

vimages\next-button-over.png

Qimages\next-button.png

>images\progress-bg.png

Himages\skip-button.png

b].rg3

images\Software.png

A$k.cE

&.JgU

:license.txt

IMPORTANT NOTICE

The Software may have been downloaded from the Site or another authorized web site. If you have downloaded the software - you acknowledge that no payment was made by you for the Software, regardless of the method of delivery, and if payments were made, they were made for other equipment, products or services and not for the Software. To ensure the proper functionality and security of the Software always make sure you are using a current and authorized copy of the Software.

The Software is being licensed to you by 'AS IS' basis, for your private personal use only. Except as expressly permitted hereunder, you agree not to extract or harvest any information from any portion of the Software, including without limitation, from any User Profile, or any other portion of the Site, or to reverse engineer, decompile, disassemble, alter, duplicate, make copies of, distribute or provide others with the Software, or any information available on, derived or extracted from the Site and/or Software or any part of the foregoing.

This statement applies to the company information collection and use policies with respect to use of the Site and Software. Amendments to this statement will be posted at this URL and will be effective when posted. Your continued use of this Site or the Software following the posting of any amendment, modification or change to this statement shall constitute your acceptance thereof.

During the installation process, the software may collect certain non-personally identifiable information about you, such as country, language, version ID, setup ID, affiliate IDs, and installation date. Other than this information the software will not collect nor maintain any other personally or non-personally identifiable information about any User.

OUR USE OF THE INFORMATION YOU PROVIDEThe company will only use information that is provided in order to provide Users with important information about the Software (such as upgrades, modifications, etc.) and to announce new products and services available to Users. Except as necessary to perform the functions of the Software and/or Site, the company will not share, sell or lease any personally identifiable information about any User to any unaffiliated third party for any purpose without that User's permission.Non-Personally Identifiable Information

The comapny may use certain non-personally identifiable information provided by Users for the following purposes:

To create aggregate, non-personal, demographic reports about the Users of the software.

Provide Users with certain content that may be of interest to that User based on the information the User provides.

The company may collect settings, technical and other information from Users' computers, such as a computer's operating system, browser versions used, various communication parameters and other information related to the operation and interaction of the Software, subject to the provisions herein. This information will neither contain nor be linked to any personally identifiable information.

'Cookies' are pieces of information that are placed on an individual's computer hard drive to enable the individual to more easily communicate and interact with the Site. the company may use cookies to save certain information about a User and others who visit the Web Site, in order to facilitate and enhance future activities with the Software and/or the Site. The company does not use cookies to retrieve information from a computer that is unrelated to the Software.

An Internet Protocol address is a number that's automatically assigned to a computer when using the Internet. Web servers can automatically identify individual computers by their IP address. the company may collect IP addresses to:

Facilitate system administration; Diagnose system problems; Report aggregate User information; and Avoid hacking attacks on the servers.

OTHER WEB SITES; LINKS

The Site may contain links to other Web sites. The company is not responsible for the privacy practices or the content of such Web sites.

THE SOFTWARE AND SITE MAY BE VULNERABLE TO VARIOUS SECURITY ISSUES AND SHOULD NOT BE CONSIDERED SECURE. BY USING THE SOFTWARE AND SITE YOU MAY BE SUBJECT TO VARIOUS RISKS.IF YOU DO NOT WISH TO BE SUBJECTED TO THESE RISKS, YOU ARE ADVISED NOT TO USE THE SOFTWARE OR SERVICE.

the company is the sole owner of the Software, and Site, including without limitation, all applicable U.S. and non-U.S. copyrights, patents, trademarks, and trade secrets, and other intellectual property rights thereto. Except as otherwise specifically provided in these Terms and Conditions, you may not download or save a copy of the Software or Site or any portion thereof, for any purpose. You may, however, print a copy of individual screens appearing as part of the Software and Site solely for your personal use or records. All title and intellectual property rights in and to the content of any third party web site which may be linked to or viewed in connection with the Software is the property of the respective content owner and may be protected by applicable copyright or other intellectual property laws and treaties. This Agreement grants you no rights to use such content except as allowed by such third party.

THE SOFTWARE, SERVICE AND SITE ARE PROVIDED 'AS IS' AND 'AS AVAILABLE,' WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITATION OF THE FOREGOING, SPECIFICALLY DISCLAIMS ANY AND ALL WARRANTIES, INCLUDING, BUT NOT LIMITED TO: (i) ANY WARRANTIES CONCERNING THE AVAILABILITY, ACCURACY, SECURITY, USEFULNESS, INTEROPERABILITY, OR CONTENT OF THE SOFTWARE, SERVICE OR SITE; AND (ii) ANY WARRANTIES OF TITLE, WARRANTY OF NON-INFRINGEMENT, WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. THIS DISCLAIMER OF LIABILITY APPLIES TO ANY DAMAGES OR INJURY CAUSED BY THE SOFTWARE OR SITE, INCLUDING WITHOUT LIMITATION AS A RESULT OF ANY FAILURE OF PERFORMANCE, ERROR, OMISSION, INTERRUPTION, DELETION, DEFECT, DELAY IN OPERATION OR TRANSMISSION, COMPUTER VIRUS, COMMUNICATION LINE FAILURE, THEFT OR DESTRUCTION OR UNAUTHORIZED ACCESS TO, ALTERATION OF, OR USE OF RECORD, WHETHER FOR BREACH OF CONTRACT, TORT, NEGLIGENCE, OR UNDER ANY OTHER CAUSE OF ACTION. THE COMPANY DOES NOT WARRANT OR GUARANTEE THAT ALL SOFTWARE VERSIONS SHALL BE PROVIDED WITH SIMILAR GRADES AND LEVELS OF SERVICE, FEATURES, FUNCTIONALITY AND THE ABILITY TO USE THE SOFTWARE. THE COMAPNY DOES NOT WARRANT OR GUARANTEE (1) THAT ANY PROGRAM WILL BE FREE OF INFECTION BY VIRUSES, WORMS, TROJAN HORSES OR ANYTHING ELSE MANIFESTING CONTAMINATING OR DESTRUCTIVE PROPERTIES; OR (2) THAT THE FUNCTIONS OR SERVICES PERFORMED BY THE COMPANY WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT DEFECTS IN THE SOFTWARE AND THE SERVICE WILL BE CORRECTED. IT IS YOUR SOLE RESPONSIBILITY TO ISOLATE THE SOFTWARE AND INFORMATION, EXECUTE ANTI-CONTAMINATION SOFTWARE AND OTHERWISE TAKE STEPS TO ENSURE THAT SOFTWARE OR OTHER INFORMATION OBTAINED FROM THE SERVICE OR OTHER USERS, IF CONTAMINATED OR INFECTED, WILL NOT DAMAGE YOUR INFORMATION OR SYSTEM.

The Software and Site contain features that may link you to third parties' web sites ('Linked Sites'). These features are provided by only as a convenience. The Linked Sites are not reviewed, controlled or examined in any way and the company is not responsible for the content of any such Linked Sites, or any additional links contained therein. The offering of these features does not imply the company's endorsement of or association with the Linked Sites. It is your sole responsibility to comply with the appropriate terms of service of the Linked Sites as well as with any other obligation under copyright, secrecy, defamation, decency, privacy, security and export laws related to the use of such Linked Sites and any content contained thereon. In no event shall the company be liable to anyone for any damage arising from or occasioned by the creation or use of the Linked Sites or the information or material accessed-through these Linked Sites. the company may at its sole discretion add, change, decline or remove, without notice, any feature or link to any of the Linked Sites from the Software and Service and/or introduce different features or links to different users.

If any part of this Agreement is held invalid or unenforceable, that portion shall be construed in a manner consistent with applicable law to reflect, as nearly as possible, the original intentions of the parties, and the remaining portions shall remain in full force and effect.

Some of the advertisements you see in the FoxTab installer are delivered by third parties who collect information through cookies, ip address, web beacons, and other technologies about your online activities, in order to understand your interests and deliver advertisements that are tailored to your interests. Please note, FoxTab does not have access to the information collected by these third parties. We do not necessarily evaluate or endorse third party content and websites, and do not assume responsibility for third parties

iPlocale\EN.locale

LICENSE_DESC=Please read the following important information before continuing.

MSG_DIRECTORY_INVALID=Destination folder is invalid. Please select a different folder.

MSG_EXIT=Are you sure you want to exit the setup?

MSG_NETWORK_ERROR=Please connect to the internet and click "Ok" to Continue.

MSG_EXTRACT_ERROR=Installer failed to extract the files.P

]]ß

u.FhK

.idata

.rdata

P.reloc

P.rsrc

Uninstall\Uninstall.exe

Uninstall\uninst.dat

Opera\Opera\operaprefs.ini

Opera\Opera\profile\operaprefs.ini

Opera\Opera\profile

Opera\Opera\profile\search.ini

Opera\Opera\search.ini

search.ini

\defaults\search.ini

\search.ini

errorUrl

.Uninstall\

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Cannot create file %s

Cannot open file %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Invalid variant operation"Variant method calls not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid GUID value

I/O error %d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   mscorsvw.exe:172
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\button.css (417 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\UVSJS5ED\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\locale\EN.locale (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\close_button.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\bootstrap_22664.html (156 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\ie6_main.css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\00149E90.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0014B1E9.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\loader.gif (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\license.txt (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is1438683437\675640_Setup.CIS (1704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\offer_html.dat (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is1438683437\1960440944.cfg (216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\blank.gif (49 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\buttons.css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\finish-button.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\offer_code.dat (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\Software.png (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\US\offer_code.dat (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\progress-bar.css (501 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\16573WJ8\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\images\progress-bg.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0014AF97.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\Bg.jpg (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\defaultOffer\US\offer_html.dat (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\checkbox.css (190 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4N2ZSLGV\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\next-button.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\skip-button.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is1438683437\1974041053.cfg (216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\next-button-over.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\45UFOX6N\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\progress-bg.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ICReinstall_%original file name%.exe (1840 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\main.css (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\browse.css (318 bytes)
   %Documents and Settings%\%current user%\Desktop\Continue FoxTab FLV Player Installation.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\icon.png (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\finish_button.jpg (1 bytes)
   %Program Files%\is1355531.log (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\images\back-button.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1351328\css\sdk-ui\images\button-bg.png (131 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.