PUP.Win32.YahooCompanion_f7b1dc2d7f – Adaware

PUPYahooCompanion.YR, SearchProtectToolbar.YR, PUPAirInstaller.YR (Lavasoft MAS)Behaviour: Installer, PUP

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: f7b1dc2d7f64c1c371baed7ea93ec0dd

SHA1: 0555865a6ee83b0eae05821b07c72e5bdff4a283

SHA256: b12077ca00b5d5b5b30fe6a41d5413524f3db3922ad05a9afdf7b5f17f2d94ee

SSDeep: 49152:rOEmLWOu/az54rNKQUoqu2ZSjTN788Ft Zp:rOEty5wUq2Zk8V

Size: 2140672 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: SafeInstall, LLC

Created at: 2015-02-25 16:49:21

Analyzed on: WindowsXP SP3 32-bit

Summary: PUP. Potentially Unwanted Program. An application that does not display malicious behavior yet is installed without having first sought affirmative user consent for installation. Users may not realize, due to the nature of the installation procedure, that an application they have not explicitly agreed to has been installed. This category can also be used to classify other applications which in a certain context can be wanted e.g. remote administration tools or IRC clients.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):No processes have been created.The PUP injects its code into the following process(es):

%original file name%.exe:376

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012015040220150403!_!SHMSFTHISTORY!___DDrawCheckExclMode____DDrawExclMode__DDrawDriverObjectListMutexCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003DDrawWindowListMutexVdiMsiLockInstallIQFirefoxLockRasPbFileInstallIQUninstallOptionLockWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutexQuickStartAppW3i_CoreBrowserShutdownW3iFFPrefslockDialogCloseProcessLockCPackageZlib::CPackageZlibW3iCoreLoggerZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutex

File activity

The process %original file name%.exe:376 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\config.xml (17616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\yahoo.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\.DS_Store (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\0393A455-8396-4E79-8339-7DAEDC83567B.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\session.response.json (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\view.petite_oo_v5.vi.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenfactory.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\noyahoo.js (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.json (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\kmsxSuite.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\FC7B0DC7-475B-489A-970D-27D5F49C54FA.zip (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenconfig.js (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\f7b1dc2d7f64c1c371baed7ea93ec0dd.log (430371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\saferbrowser.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\BDAAF9E7-1317-4A08-A774-4E8B122DA876.zip (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\8388CA31-64D2-4B18-853D-6E8F73B33C4A.zip (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\java_14552.txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java\java_tn.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\common.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zip (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3AD49606-8E98-404B-8DB4-767574E46DBB.zip (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\988E6415-56A2-4711-9270-F71450CD0B9B.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win-cancel.png (776 bytes)

The PUP deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410\index.dat (0 bytes)

Registry activity

The process %original file name%.exe:376 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CachePrefix" = ":2015040220150403:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CacheOptions" = "11"
"CacheLimit" = "8192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\InstallIQ]
"test" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1424875761"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015040220150403\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 13 CE 88 FA 6B 63 8F C4 D1 0A 60 33 F0 ED B4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The PUP modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The PUP modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The PUP deletes the following registry key(s):

[HKLM\SOFTWARE\InstallIQ]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040920140410]

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\InstallIQ]
"test"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

Dropped PE files

MD5	File path
6bec059e9f70b59873807c4f2a72a8b5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SymCCIS.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original PUP file.
Delete or disinfect the following files created/modified by the PUP:
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\config.xml (17616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\yahoo.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\.DS_Store (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\0393A455-8396-4E79-8339-7DAEDC83567B.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\session.response.json (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\view.petite_oo_v5.vi.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenfactory.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\noyahoo.js (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.json (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\kmsxSuite.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\FC7B0DC7-475B-489A-970D-27D5F49C54FA.zip (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenconfig.js (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\f7b1dc2d7f64c1c371baed7ea93ec0dd.log (430371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\saferbrowser.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\BDAAF9E7-1317-4A08-A774-4E8B122DA876.zip (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\8388CA31-64D2-4B18-853D-6E8F73B33C4A.zip (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\java_14552.txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java\java_tn.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\common.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zip (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3AD49606-8E98-404B-8DB4-767574E46DBB.zip (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\988E6415-56A2-4711-9270-F71450CD0B9B.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win-cancel.png (776 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: SafeInstall, LLC
Product Name: SafeInstaller
Product Version: 1.0.73.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: safeinstall.exe
Internal Name: SafeInstaller
File Version: 1.0.73.0
File Description: Safe Installer
Comments:
Language: English (United States)

Company Name: SafeInstall, LLCProduct Name: SafeInstallerProduct Version: 1.0.73.0Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: safeinstall.exeInternal Name: SafeInstallerFile Version: 1.0.73.0File Description: Safe InstallerComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	495737	496128	4.50055	eacbc95c9ed4581ae3c4f55cfabc6ec9
.text-qu	503808	3923	4096	4.20452	97250a2453f354d02fd01e35f04b19f2
.text-co	507904	88205	88576	4.49095	3125e03fc18ae36452de39b85c1ce00e
.text-co	598016	75433	75776	4.46088	866aaf5899bc16b6d78fa87831f13987
.text-co	675840	48588	48640	4.49468	8c4a97b53f59efdb41abb8c63368a037
.text-co	724992	14904	15360	4.40949	6d42f78ec4272a1f2344dddee4c3647d
.text-co	741376	27320	27648	4.61586	ded2001ef9229973104294adb8de2eaf
.text-co	770048	10272	10752	4.36135	fbdd36f604e15916f49b5763385dc762
.text-co	782336	263610	263680	4.59423	d7e12a1c3a7fe565fb233e3050fbbd79
.text-ti	1048576	43367	43520	4.58001	b3b92b28aaf4f6638c2d896e2fdb91af
.text-co	1093632	16103	16384	4.3716	312013803e5c472a2393e39874c72442
.text-co	1110016	59	512	0.606205	b93d46b36642bdf35f83073cd1db88ac
.text-co	1114112	12737	12800	4.42334	f2cdaa8cf5120ab1006e7de4af21369a
.rdata	1130496	267004	267264	3.89234	9551880b413cba74371a6005c601d232
.data	1400832	27492	17408	3.39326	3af4dcaef998567e95dbfe24bbce1759
.data-qu	1429504	41	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1433600	188	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1437696	56	512	0.042395	e7d0abf57dfaebcc790cb19fb02f668a
.data-co	1441792	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1445888	44	512	0.014135	2d5fe836dd5a60fa37b7c590cfc70410
.data-co	1449984	41	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1454080	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1458176	2932	3072	1.34082	9ed02dcd88cf9a78a3b2fc9ce26f50a7
.data-ti	1462272	1176	1536	1.01208	ebb67f64a312161d58e41913f7a95bf3
.data-co	1466368	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1470464	4	512	0.014135	d340f23a7d18057bb02252a3cb40b877
.data-co	1474560	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.rsrc	1478656	735972	736256	5.35924	a3850b2023490a6bbb2852a40a418355

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://2-vinstaller.com/7a29ae39-7c7b-40c2-b2df-bd957391d3ab/f635c5bc-aa13-400d-ac76-6c0e9f461cc7	66.77.96.162

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /7a29ae39-7c7b-40c2-b2df-bd957391d3ab/f635c5bc-aa13-400d-ac76-6c0e9f461cc7 HTTP/1.1

Content-Type: application/json; charset=utf-8

Accept: application/json;

installerversion: 1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Host: 2-vinstaller.com

Content-Length: 718

Cache-Control: no-cache

{"Content":"FrsQsDi7LOYAjhttwW2VRdfK0jpCMx3l6iYIV8EoK8izlVgO55eIQJIqVYVvvknSlues/klxo60k3KmQRrHe1bynFXdK b2/0pSR IBm48kLHHPoQ8Jom1ImIPnrJHV8nKkJRNLPKXEYxAO0d7tw 8k5rnqKqGMlMrwE3dROaOU hDlrJbpG 5AMl9qL1nsbkxDaPUjsCLwuFP4yxujXynAgXVC2hjP83/0NRYPRiEYmR8Uua4dRVp8bKNDsK/Zv9BNM/qIp1GVNsumUWHMZiLi/988hvVGPVFTN5JiF/AxLlVnFewDjg3SVoOCEO71DmzlW1H0NSpHTqkRCkX8bVEdakLpo7y8sXU27 btKPV3CtM4PfDvWmE3x2kaCaHAsZTL482oGczrhLF3Tq5abSOf8CtNGYttksucQNH1NK93lk4sxuK6 kZzcdSnjSyHyhRy7P358bgq JchSmkrwPhDAmh7OA9m1eUta3/yl9N8W/Car01ntZ27Mt4o4xM5sMniqdEPlfwq0e0iyfp23lVv06TGbwhy6ct0MbcuqE0TQu9DlvmzinvVRORVWciii36AJ9c5Cgh4ZCnctVBfBj9tISsds4TtedoagbxsBBD820oUh0rdnfuBTAi8MNUkm2EUkOB83xMzHGDLF0YDuSwH0FdxF7/HuwVOEXo1BJUEF/57pjIg6ZEV3juUigA4W"}

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: application/json; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="PSA OUR DEM"

X-Robots-Tag: noindex, nofollow

Date: Wed, 01 Apr 2015 22:54:18 GMT

Content-Length: 4694

{"Content":"FrsBtCa7IuEUhXc21yrUEJuOl39kKRPj9wcHGJ5xM4e2mloH54GePMIyVJVn6CCWwILqpRY94KM8r/rCHOiS1ZSxUCgPrv7gkcvW3Mcu64IvF0OuW9oS7UU7Lo3DJnNt3/9HF4LkYCEbxAK9IPM 6N0r6DnN9mkoMaxm PREOatqxHdaMvlV JxXx6CKx3gZiQe7axPvcfU4Hvww2LmZjSlhUgjzlD/p0vlcHMSEiwdkG9dwKccSHodcaJCue E14U1L7rMhlm9B5fvLSHJFj7fqpos shTREUaCsc7W6lNGgVKEPkDylXze7uqadedM3G8bmnMaV8jDoFsAxjpYDR5byLxntn4jXFKj6ONaY1OT7JtWfC3FyUiuhEmAMnE cDStr2gGIDK1NBDI6JbVE776UZZFNIFl8udVdHEQKI20hdUk7KCwwZzZdS/lWyX/y1P8Pm4qJASmP8xM2A 8LwHVlx7CH5z0LF1XhP 3ptBNp37vhkyxKHLUpdtunc5hOnXsL06zLlS2dBijctOzlhzz6STJmUa1NJ1JO4jiVFOb5p7z7mW wOJcfAITJze3mcEM5IkA1DkQH2Z9J1Ha2ZVjLcRhxyUDL4Osb11KUBc5kaIozudzP8Z7D2dBFEYmwkFiLQtmu4OKMSfP2ZTsS2G8HMpa ebg2VrHe4xXahRB0L6508UecQs4jaZ0xRYWSl4NXJi3t/FqrZ2yZwzMF341mndDWlLiMA4oLSI LGzbsp9zmAPvJpB/tLbsGG3nQ9iYcZ4KjXj87BYqAqNyz1YlsV/gLLAjlIwXj/E aCjQAUeRpZZUyhGmTj 8Y/XEUo/bo08JWpmfCUHEgNLaDGeKVlLSjHWigaPvlSyW0roIWjpK0TYUrUTA3tk qlkCoj09I5PD3c/EJxJ/FzYZT37zS7BcLjpzJlmUhzgElnKWLNKgGBOeLGFE1yiGViPrmFI/TaGASyGqQdWLSC86fEcTBSlEY3qPk8BtXKkxRI0yLcjL25/2GfY2rpah690mRqkBXNXHNV5Ba0YOqsaFG4M0HMBEPqwfekZRXy/sZd3pVDim5rZRi47fDvyGYRAUpDx9/I3Y1qTZVZGH4uyekwdiSP1jvJlb2EtF6gwTW74BjXjAbcO8LsgDLLvym9 JedEQLoMqYutk1VzcnDcPPmnHhvnSQk0O9witGc6GTEUEoJrZcctGaWiMnrSx5QWYzRXYDrHS bYi CJCp55/6cBdMkVwRv9yGDEiiWrt5fiE3nJTZtfl 4 8zmd4o7qKm1JCS0MeonZRsApZ/BakJCQL1iStKPzTtvmjhTUP7t3j7A1NJ7QsGcohlYwEg6HT6wN tREy9bkxZc4Gn71DeJoXSWil/AlVJWlIySsXMjT5aYkS0KnvXS6KbtsBcUvx97jXQgB0oASgmg44i10ua3bYG0xRtgffjWjGsUL5SzNemsPLMknlGbVkJ2hAI/I90P7UqvFP8r7xRDDr5beioWkTBMqeeTD0OICPdcNjgKZOZ 5JV3zS

<<< skipped >>>

Map

The PUP connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_376:

.text

`.text-quS

`.text-co

`.text-co8:

`.text-co (

`.text-tig

`.text-co;

`.rdata

@.data

.data-qu)

.data-co

.data-co8

.data-co(

.data-co,

.data-co)

.data-cot

.data-ti

.rsrc

CSShZ

CSSh4

CSSh9

CSSh>

CSShl

CSSh[

CSSh`

<:>

t8Ht.HHt#

.FGy1

Af;FP}%S3

|$|.tD

#t.Ht

2 34 567

u.SSV

1t.Ht

9sxv%UW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

GetProcessWindowStation

Operation not permitted

Inappropriate I/O control operation

Broken pipe

0xX

Invalid CRT parameter

QuickStartApp.cpp

vi.engine.xml

chk_firefox

chk_chrome

OfferManager.cpp

position=%d, active=%d

%s[%d]

%d,%d,%d

** Debug mode: simulating stopping Firefox

** Debug mode: simulating stopping Chrome

%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.

Firefox

Google Chrome

%d err: %s

Chrome

firefox

chrome

opera

sxexaxrxcxhxpxrxoxtxexcxtxoxrx.xexxxex

view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s

control.txt

00000000-0000-0000-0000-000000000000

QuickStartProcess.cpp

%programfiles%\Free Offers from Freeze.com

disabling offer because system doesn't have Firefox

disabling offer because system doesn't have Chrome

%s[%s]: view=%s accept=%s

%s,%s

WindowsErrorCode

targetbrowser/key

%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d

%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s

%d,%d,%s,%s,%s,%s

%d,%d,%d,%d,%d

%d,%d,%s,%s,%s,%s,%s

%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s

offers

%s,%s,%s,%s,%s,%s,%s,%s

%s,%d,%s,%s

%s,%s,%u,%u,%d,%s

Unable to open thankyou page; url is empty or invalid!

statsd.response.txt

Web.Installer.VDI.CommError

Web.Installer.VDI.InstallError

Web.Installer.VDI.OfferDownloadError

Web.Installer.VDI.OfferInstallError

Web.Installer.VDI.OfferInstallFailed

hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xkxexexpxmxyxsxextxtxixnxgxsxxx.xzxixpx

hxtxtxpx:x/x/xsxdxsxpxaxpxix.xcxoxmx/xaxpxix/xvxaxlxuxexsx

hXXps://search.yahoo.com/yhs/web?hspart=w3i&hsimp=yhs-syctransfer&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635

hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxpxvx1x.xzxixpx

spv1.zip

hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xtxrxaxcxkxoxfxfxexrxixnxsxtxaxlxlxdxextxaxixlxsx

hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xixnxsxtxaxlxlxexrxrxoxrx

session.response.json

postback.response.json

vmtest.txt

vmtest.txt is present, enbaling offers for vmtest

config.xml

pingurl

postbackurl

errorurl

statsdurl

uninstalloptionurl

encryptionkey

PingUrl

PostbackUrl

Config.cpp

stub.xml

.json

MainWnd.cpp

.html

OfferThread.cpp

Setting offer checkbox value: key=

COfferExe::GetXpiFilename

g:\winapps\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h

configuration/downloadurl

configuration/downloadurl.64bit

configuration/msie.downloadurl

configuration/msie.commandline

configuration/firefox.downloadurl

configuration/firefox.commandline

configuration/chrome.downloadurl

configuration/chrome.commandline

configuration/allbrowser.downloadurl

configuration/allbrowser.commandline

configuration/regkeyadd

regkeyadd

configuration/ieregkey

ieregkey

configuration/firefox.pref

firefox.pref

configuration/firefox.xpimethod

configuration/firefox.xpilocation

configuration/firefox.xpidelete

LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser

configuration/iconurl

adding %s entry, ourVal='%s', theirVal='%s'

COfferExe::Download

Download url is empty!

_firefox is NULL!

COfferExe::OnInstall

Install is a dropfile; no exe to run...

Icon offer (in exe config) detected, running icon install

COfferExe::Run

COfferExe::HandleFirefoxOptions

firefoxoffer

HandleFirefoxOptions called with incorrect preferences set in config!

COfferExe::BuildCommandLine

msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress

msiexec.exe /i "%s" %s

Could not find firefox exe to install

Offer is installing XPI for Firefox 8 or higher, enabling GUI.

"%s" "%s"

"%s" %s

COfferExe::RunSearchProtectInstall

COfferExe::WaitForInstallProcess

OfferExe.cpp

COfferExe::WaitForProcessStarted

waiting for registry key:

COfferExe::WaitForRegistryValue

Registry key found.

Registry key found (64-bit).

COfferExe::WaitForFile

COfferExe::InstallXpi

Bad RegKeyAdd config; not correct format: (missing hive \ )

Bad RegKeyAdd config; not correct format: (missing , )

Bad RegKeyAdd config; not correct format: (missing = )

unable to set regkey from following RegKeyAdd:

RegKeyAdd:

unrecognized values in RegKeyAdd:

unable to set regkey from following IERegKey:

IERegKeyAdd:

unrecognized values in IERegKey:

COfferExe::FinishXpiInstall

COfferExe::CancelXpiInstall

COfferExe::RunIconInstall

%s_%s.url

configuration/url

configuration/msie.url

configuration/firefox.url

configuration/firefox.newtaburl

configuration/chrome.extensionid

configuration/chrome.extensionparam

All urls are empty!

COfferStartPage::InstallFirefox

_firefox is NULL!

** Debug mode: simulated setting Firefox startpage:

Error writing Firefox pref for startpage!

Error setting Firefox new tab!

Set new tab in Firefox.

Firefox startpage set successful.

chromeoffer

COfferStartPage::InstallChrome

_chrome is NULL!

** Debug mode: simulated setting Chrome startpage:

Error setting Chrome startpage: browser is still running!

Error writing Chrome pref for startpage!

Can't set new tab Chrome, function is implemented with Default Search.

Chrome startpage set successful.

OfferStartPage.cpp

startpageurl

oldstartpageurl

hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}

configuration/msie.searchname

configuration/firefox.searchname

configuration/firefox.suggesturl

configuration/firefox.selectedengine

Error setting IE search: url is empty!

Internet Explorer version 6 or older does not support default search!

COfferDefaultSearch::InstallFirefox

** Debug mode: simulated setting Firefox default search:

Failed to write Yahoo xml for Firefox!

Firefox default search set successful.

COfferDefaultSearch::InstallChrome

** Debug mode: simulated setting Chrome default search by extension:

Failed to install default search extension for chrome!

Chrome default search set successful.

OfferDefaultSearch.cpp

searchurl

hxtxtxpx:x/x/xdxlx5x.xvx1xixnxsxtxaxlxlxexrx.xcxoxmx/x

PingResponse.cpp

targetbrowser/Key

PingThread.cpp

offer %s[%s]: isInstalled=%d canShow=%d

rule %s[%s]: isInstalled=%d

QuickStartDetectThread.cpp

ResourceThread.cpp

Response/url

passed

CRequirementManager::RunExecute

CRequirementManager::ParseExecuteResult

invalid flag in execute result:

Software\Microsoft\Windows\CurrentVersion\RunOnce

Running requirement.OnInstall:

Running requirement.OnCancel:

requirement.OnCancel is empty, skipping.

Running requirement.OnExit:

requirement.OnExit is empty, skipping.

%programdata%\W3i\UninstallHelper\iqu.ini

2.0.1.0

%xpxrxoxgxrxaxmxdxaxtxax%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xixmxpxoxrxtx

quickstart.xml

quickstart%d.xml

Failed to save IQU data, too many import files in directory!

%xpxrxoxgxrxaxmxfxixlxexsx%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xUxnxixnxsxtxaxlxlxHxexlxpxexrx.xexxxex

quickstart_si.xml

quickstart_si%d.xml

Failed to save SoftwareInfo data, too many import files in directory!

hxtxtxpx:x/x/xdxlx.xixnxsxtxaxlxlxixqx.xcxoxmx/xAxPxIx/xIxQxUx/xSxoxfxtxwxaxrxexIxnxfxox.xaxsxpxxx

UH executable not found!

"%s" /silent /noswinfo

%s:%d

handling firefox cookies...

FF.GetCookiesError

FF.NoCookies

firefox: no cookies found

FF.SetCookieError

FF.SetCookies

firefox: set cookies

getting firefox cookies for

CCookieManager::GetFirefoxCookies

Error enumerating firefox cookies!

firefoxenum

hXXp://

cookie.dat

Vista.NoResult

Vista.SavedLow

Vista.NoCookies

Vista.CopiedLow

%a, %d-%b-%Y %H:%M:%S GMT

cookieman.exe

Vista.ExtractError

Vista.CreateLowError

handling chrome cookies

Chrome.GetCookiesError

Chrome.NoCookies

Chrome: no cookies found

Chrome.SetCookieError

Chrome.SetCookies

Chrome: set cookies succeeded

getting Chrome cookies for

CCookieManager::GetChromeCookies

Error enumerating chrome cookies!

chromeenum

Safari.GetCookiesError

Safari.NoCookies

Safari.SetCookieError

Safari.SetCookies

Sending session request, url=

Request url is empty!

Request url is invalid!

ErrorLogger.cpp

explorer.exe

CDialogWindowJson::OnBeforeNavigate2, url=

DialogWindowJson.cpp

%s: view=%s accept=%s

chk_%s=

checkbox found; %s=%s

adding disclosure(%s): %s

installedbrowsers/firefox

installedbrowsers/chrome

installedbrowsers/opera

view.buildconfig.json

view.productconfig.json

ProgressDialog.cpp

Installing %d of %d

uninstalloption.exe

InstallIQFirefoxLock

configuration/postinstallexecute

configuration/postinstallexecuteintegrity

stopfirefox

stopchrome

disablechromeextensions

/msie.autoconfirm

/firefox.autoconfirm

/chrome.autoconfirm

COffer::WaitForFirefoxLock

Offer.cpp

_firefoxLock is already created!

Waiting for Firefox lock...

Firefox lock status:

Releasing Firefox lock

PostInstallExecute:

iexplore.exe

** Debug mode: simulating PostInstallExecute:

Cannot run post-install execute, file does not exist:

COffer::PostInstallExecute

PostInstallExecute command failed!

http:

Adding UH data: %s|%s,%s

Failed to extract uninstall option exe!

Error; uninstalloption.exe doesn't exist (after download and extract!)

Error copying uninstalloption.exe to program files!

error downloading uninstall option url!

hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe

%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

"%s" %s "%s"

AdobeAirInstaller.exe

JsonResponse.cpp

Unknown uninstall key type encountered, skipping lookup

%firefoxprofiles%

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

crterr:%d

Win32Err:%d

HRESULT:0x%X

@ line %d in function .

Unknown error: %d

wininet.dll

IDispatch error #%d

LoadLibrary failed in loading current exe:

CoreResource.cpp

CStringW.GetBuffer failed!

0xx

%s. {%s} @ line %d in function in module %s.

HRESULT:0x%X

HttpStatus:%d

Win32Err:%d

Error:%d

-- %s line %d --

[X]

L%d:d.d.d_d:d:d.d

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d

%s_%x%x%x%x%x

CoreFile.cpp

Exception %X in module %s at: 0x%p.

dbghelp.dll

0x%p %s

CoreProcess.cpp

ShellExecuteCommand:

Failed to execute command:

CCoreProcess::ShellExecuteCommand

CCoreProcess::CloseProcessWindowsByModuleName

CCoreProcess::ShellExecuteCommandAndWait

CCoreProcess::GetProcessExe32

CCoreProcess::GetProcessExe64

kernel32.dll

CoreXml.cpp

_ftprintf_s failed writing header to

CCoreXml::ParseRequiredKeyValue

]/Key/text()

CCoreXml::ParseRequiredKeyInt

CoreThread.cpp

hXXps://

PTF://

CoreSystem.cpp

CCoreSystem::GetWindowsVersionId

Missing windows version, check the code!!

%s (Build %d)

Unknown OS! Major: 0xX, Minor: 0xX

CCoreSystem::CacheWindowsInfo

%system%

%windows%

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Ãžsktopdir%

Ãžsktop%

%userprofile%

%s0x%.2x%.2x%.2x%.2x%.2x%.2x-

SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727

SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322

SOFTWARE\Microsoft\.NETFramework\policy\v1.0

3321-3705

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

Iphlpapi.dll

%windows%\Desktop

VBoxService.exe

vboxtray.exe

proc.vboxsvc

vmtoolsd.exe

proc.vboxtray

vmicsvc.exe

proc.vmtools

proc.hvsvc

reg.vboxguest

reg.vboxmouse

reg.vboxsvc

reg.vboxsf

reg.vboxvid

reg.vboxbios

%system%\vboxhook.dll

reg.vboxsguest

file.vboxhook

reg.vmvid

reg.vmpci

reg.vmdbg

reg.vmcrd

reg.vmmem

reg.vmmouse

reg.vmdsk

reg.vmtools

reg.vmsnap

reg.vmnet64

reg.hvgenctr

reg.hvvmbus

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000

reg.hvvid

SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000

reg.hvscsi

reg.hvinput

reg.vboxdisk

reg.vmdisk

reg.hvdisk

sng.vmt1

sng.vmt3

sng.vmt2

gen.dbg

sng.vmt4

CCoreRegKey::Create

Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.

RegCreateKeyEx failed on key=

RegOpenKeyEx failed on key=

CCoreRegKey::Open

Registry key is not open! (

CCoreRegKey::GetValueType

CoreRegKey.cpp

CCoreRegKey::GetValueSize

CCoreRegKey::GetValue

CCoreRegKey::GetValueString

CCoreRegKey::SetValue

CCoreRegKey::DeleteValue

CCoreRegKey::DeleteKey

RegDeleteKeyEx failed on

RegDeleteKeyExA

RegDeleteKey failed on

CCoreRegKey::EnumSubKeys

CCoreRegKey::CopyTree

SHCopyKey failed for

CCoreEntryPoint::CCoreEntryPoint

CCoreEntryPoint::LoadProcAddress

Advapi32.dll

UniqueId.cpp

subKey is NULL!

0.0.0.0

%u,%u,%u,%u

\/:*?"|

Failed to create URL file!

createurlfilefail

Encryption key not initialized!

%Y-%m-%dT%H:%M:%S

CommandLine.cpp

CoreEvent.cpp

shell32.dll

CoreVista.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_USERS

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

%s.%s

iexplore,ie.http

Failed to get IE version key!

Loading IE cookies for url:[

wrote %d cookies

CoreInternetExplorer.cpp

Unable to find iexplore.exe, using shell execute (with possible warnings)

-noframemerging "%s"

ie.http\shell\open\command

Default search regkey not found (may be a brand new install)

ieframe.dll

EnumSubKeys failed!

hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

url is empty!

Replacing existing provider url:

Error setting provider url!

FindFirstUrlCacheEntry() failed!!

CCoreInternetExplorer::FindFirstHistoryUrl

CCoreInternetExplorer::FindNextHistoryUrl

findfirsturlfailed

FindNextUrlCacheEntry() failed!!

FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??

CCoreInternetExplorer::FindCloseHistoryUrl

findnexturlfailed

findcloseurlfailed

FindCloseUrlCache() failed!!

msgText is required!

msgTitle is required!

browser.search.selectedEngine

browser.search.defaultenginename

browser.startup.homepage

MozillaWindowClass

MozillaUIWindowClass

firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox

CCoreFirefox::GetVersion

Software\Mozilla\Mozilla Firefox

firefoxver

Failed to get Firefox version key!

Profile%d

profiles.ini

%appdata%\Mozilla\Firefox

Loading Firefox3 cookies for url:[

Firefox versions prior to 3 are not supported by LoadProfileCookies!

cookies.sqlite

%s=%s

Enumerating Firefox3 cookies for

cookies.txt

Found partial cookie in Firefox profile:

Enumerating Firefox cookies for

-requestPending -osint -new-window "%s"

firefox.exe

%programfiles%\Mozilla Firefox

PathToExe

CCoreFirefox::GetPrefString

prefs.js

CoreFirefox.cpp

user_pref("%s", %s%s%s);

CCoreFirefox::SetPrefString

CCoreFirefox::SetDefaultSearch

suggestionUrl is empty!

searchUrl is empty!

Setting Firefox default search engine:

Can't set search engine while Firefox is running!

SearchUrl=

SuggestionUrl=

Failed to write search engine plug-in xml for Firefox!

Failed to write search hash for Firefox!

hXXp://VVV.mozilla.org/2006/browser/search/

browser.search.order.1

browser.search.order.2

places.sqlite

downloads.sqlite

select source from moz_downloads where source like '%%%s%%' order by id desc

Failed to open downloads.sqlite database!

select url from moz_places where url like '%%%s%%' order by id desc

Failed to open places.sqlite database!

cannot set startpage; firefox is currently running!

CCoreFirefox::SetStartpage

browser.startup.page

Cannot set newtab because firefox is running!

CCoreFirefox::SetNewTab

browser.newtab.url

/SearchPlugin/Url

firefox pref: browser.search.param.yahoo-fr=

CCoreFirefox::WriteSearchHash

browser.search.param.yahoo-fr

search-metadata.json

nss3.dll

CCoreFirefox::GetVerificationHash

secmod.db

By modifying this file, I agree that I am doing so only within Firefox itself, using official, user-driven search engine selection processes, and in a way which does not circumvent user consent. I acknowledge that any attempt to change this file from outside of Firefox is a malicious act, and will be responded to accordingly.

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h

CCoreChrome::SetCookie

Chrome_WindowImpl_0

Chrome_RenderWidgetHostHWND

Chrome_WidgetWin_0

chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium

Chrome_WidgetWin_1

%local_appdata%\Google\Chrome\User Data\Default\Cookies

Loading Google Chrome cookies for url:[

CCoreChrome; Cookie file does not exist

host_key like '%

select name, value, host_key, path, expires_utc from cookies where

CCoreChrome::EnumCookiesLegacy

Enumerating Google Chrome cookies for

Chrome cookie file does not exist

Enumerating Google Chrome cookies (v33) for

select host_key, name, value, path, expires_utc from cookies where host_key like '%

select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%

CCoreChrome::EnumCookiesV33

CoreChrome.cpp

CCoreChrome::EnumCookieRowCallback

Chrome cookie:

Failed to decrypt chrome cookie:

--new-window "%s"

chrome.dll

chrome.exe

Unable to find chrome.exe, using shell execute (with possible warnings)

%local_appdata%\Google\Chrome\Application

ChromeHTML\shell\open\command

CCoreChrome::GetStartpage

%programfiles%\Google\Chrome\Application

session/startup_urls

/preferences/session.restore_on_startup

CCoreChrome::IsMultiStartPageEnabled

CCoreChrome::GetDefaultSearchUrl

search_url

/manifest/chrome_settings_overrides/search_provider/

SELECT value FROM meta WHERE key='Default Search Provider ID'

%local_appdata%\Google\Chrome\User Data\Default\Web Data

SELECT id, short_name, url FROM keywords where id = %s

CCoreChrome::GetDSUrlFromPrefTemplate

default_search_provider_data/template_url_data

default_search_provider_data/template_url_data/url

{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

default_search_provider_data/template_url_data/id

default_search_provider_data/template_url_data/short_name

CCoreChrome::GetPreference

%local_appdata%\Google\Chrome\User Data\Default\Preferences

CCoreChrome::LoadPreferences

%local_appdata%\Google\Chrome\User Data\Default\Secure Preferences

CCoreChrome::LoadSecurePreferences

%local_appdata%\Google\Chrome\User Data\Default\History

select url from downloads_url_chains where url like '%%%s%%' order by id desc

Found chrome extension

chrome_url_overrides

Setting chrome extension [

Installing extension from web store:

Software\Google\Chrome\Extensions

Software\Wow6432Node\Google\Chrome\Extensions

CCoreChrome::InstallExtensionFromWebStore

update_url

hXXps://clients2.google.com/service/update2/crx

Error setting update_url in registry!

%local_appdata%\Google\Chrome\User Data\Default\Extensions

CoreFirefoxXPIInstaller.cpp

CCoreFirefoxXpiInstaller::Install

CCoreFirefoxXpiInstaller::GetXpiInfo

install.rdf

xml.LoadBuffer failed on

Firefox.exe not found!

Installing Firefox add-ons via package...

installiq.xpi

Create install.rdf failed!

CCoreFirefoxXpiInstaller::InstallAsPackage

Running Firefox to install add-ons:

Error running Firefox!

xmlns:NC="hXXp://home.netscape.com/NC-rdf#"

xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">

multi@installiq.com

{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

*.*.*

Error creating install.rdf!

CCoreFirefoxXpiInstaller::CreateInstallRDF

Installed Firefox extension:

CCoreFirefoxXpiInstaller::SetResult

Can't get Firefox default profiles folder!

CCoreFirefoxXpiInstaller::GetExtensionsFolder

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h

kxexexpxmxyxsxextxtxixnxgxsxxx.xexxxex

KxexexpxMxyxSxextxtxixnxgxsxXx

hxtxtxpx:x/x/xdxoxwxnxlxoxaxdx.xixnxsxtxaxlxlxixqx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxoxfxtxwxaxrxexixnxsxtxaxlxlxaxtxixoxnx_x1x3x4x7x1x.xexxxex

hxtxtxpxsx:x/x/xixnxsxtxaxlxlxexrx.xfxrxexexzxex.xcxoxmx/xLxoxgxExrxrxoxrx.xaxsxpxxx

Restoring V1 toolbar uninstall key...

Error replacing toolbar uninstall key!

Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion

Sxoxfxtxwxaxrxex\xMxixcxrxoxsxoxfxtx\xWxixnxdxoxwxsx\xCxuxrxrxexnxtxVxexrxsxixoxnx\xUxnxixnxsxtxaxlxlx\xKxexexpxMxyxSxextxtxixnxgxsxXx

Renaming V1 uninstall key...

Error opeing uninstall registry key in HKLM\

Error copying V1 registry key!

CoreSearchProtectorApp.cpp

Error removing V1 registry key from HKLM\

CCoreSearchProtectorApp.ShutDown: window not found

Software\Microsoft\Windows\CurrentVersion\Run

Error removing registry key from HKLM\

apiurl

offerurl

dsotherurl

spotherurl

%s/provider[%d]

hXXp://bing.com

hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=

hXXp://google.com

firefoxstartpage

firefoxsearch

chromestartpage

chromesearch

keyword.URL

config.dat

Yahoo uninstall key not found

Error replacing Yahoo Toolbar uninstall key!

UninstallKey

Software\Microsoft\Windows\CurrentVersion\Uninstall\

UninstallKey=

ChromeStartPageExtensionId

ChromeSearchExtensionId

FirefoxPriorStartPage

FirefoxPriorSearchUrl

CoreBrowserOptionUninstaller.cpp

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h

%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies

safari.exe,safariurl,safari

Loading Safari cookies for url:[

CoreSafari.cpp

%appdata%\Apple Computer\Safari\Cookies\Cookies.plist

Failed to get Safari version key!

-url "%s"

safari.exe

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

CoreBrowser.cpp

Can't find shell associations or shell command reg keys!

Dll %s failed, resultcode = %x

SymCCIS.dll

SymCCIS2.zip

RunDLL productlist="%s" resultcodes="%s"

SymCCIS_CheckCriteria.txt

SCCLog.txt

SymInstallStub.txt

SymCCISDll.txt

Detect.cpp

/execute/text()

Missing ExecuteResult in requirement config!

/executeresult/text()

%programfiles%\iTunes\iTunes.exe

SOFTWARE\Microsoft\Windows Live\Messenger

ydetect.ytb

msnmsgr.exe

ydetect.yhp

ydetect.yas

Rules.cpp

RegKeyExists

regkey

chromeprefs

firefoxprefs

CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf

CDetectionYahooToolbar::IsInstalledFirefox

KeyExists

SourceKey

hkey_local_machine

hkey_current_user

hkey_current_config

hkey_classes_root

multireg: key found:

multireg%d

multireg: unable to parse key:

1.1.0.6

//flag[%d]/text()

DetectionFile.cpp

Cannot evaluate .NET Version, .NET may not be installed!

wajam_validate.zip

extracted wajam exe file not found!

wajamexemissing

Timed out waiting for wajam_validate.exe!

Unable to get returncode from wajam_validate.exe!

wajam_validate.exe detection process result = %d

yahoo.com

google.com

msn.com

live.com

aol.com

ask.com

DetectionFirefoxPrefs.cpp

CDetectionFirefoxPrefs::OnEvaluate

DetectionChromePrefs.cpp

CDetectionChromePrefs::OnEvaluate

minwindowsversion

)] disabled because of minimum windows version.

DetectionRule.cpp

Disabled; rule target is not Firefox

Disabled; rule target is not Chrome

Disabled; Firefox is not installed

Disabled; Chrome is not installed

asktbdet.zip

Ask detection process result = %d

CoreWininet.cpp

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

wininet: connecting to %s:%d

CCoreWininet::HTTPSendRequest

HTTPSendRequest:

httpopenrequest

wininet: HttpOpenRequest failed!

httpreqerr

wininet: Request handle is NULL after HttpSendRequest!

unable to set wininet http decoding

wininet: HttpAddRequestHeaders (post flag) failed!

Content-Type: application/x-www-form-urlencoded

Range: bytes=%u-

httpaddheaders

wininet: HttpAddRequestHeaders (range specification) failed!

Range: bytes=%u-%u

httpaddheader

httpsendreq

wininet: HttpSendRequest failed! (verb=

httptimeout

wininet: HttpQueryInfo failed!

wininet: HttpSendRequest failed!

httpqueryinfo

httpproxy

httpstatus

wininet: Server responded with error: %d, %s. %s %s

wininet: HttpSendRequest: status OK received

wininet: HttpQueryInfo for file size failed!

wininet: HttpQueryInfo for content range failed!

wininet: Operation cancelled by caller.

Software\Microsoft\Windows\CurrentVersion\Internet Settings

HTTP Status %d: %s

apiUrl is null!

API url is invalid!

%m/%d/%Y

Url is null!

%s, %s, l=0xx

[0x%X]

d:%s

01234567

%s(%s);

CoreJSON2.cpp

Node path not valid; node "%s" in path "%s" is not type Node!

PackageZlib.cpp

Error: %d bytes of %d read from file %s.

unzOpenCurrentFilePassword failed!

Error: %d bytes of %d were written to file %s.

unzOpenCurrentFilePassword failed! err=

Package.cpp

autorun.txt

CCoreSqlite::OpenDatabase

CCoreSqlite::CloseDatabase

CCoreSqlite::ExecuteStatement

sqlite3_exec failed, returned error:

CCoreSqlite::StandardExecuteCallback

dbexecerror

CoreSqlite.cpp

CCoreSqlite::PrepareCompiledStmt

sqlempty

Cannot prepare statement, sql is empty!

sqliteerror

Failed to prepare compiled statement, sqlite returned error: %d

CCoreSqlite::BindTextToCompiledStmt

bind text failed, errorcode=%d

CCoreSqlite::ExecuteCompiledStmt

sqlitestepfailed

sqlite3_step failed, errorcode=%d

CCoreSqlite::CheckStmtRowValid

Cannot get row results: statement has not executed!!

CCoreSqlite::CloseCompiledStmt

sqlite3_finalize failed, errorcode=%d

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

%s\etilqs_

%s-shm

Recovered %d frames from WAL file %s

OsError 0x%x (%u)

invalid page number %d

2nd reference to page %d

%d of %d pages missing from overflow list starting at %d

failed to get page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

unable to get the page. error code=%d

btreeInitPage() returns error code %d

freelist leaf count too big on page %d

Page %d:

On page %d at right child:

On tree page %d cell %d:

Fragmentation of %d bytes reported as %d on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Page %d is never used

unknown database %s

keyinfo(%d

%s(%d)

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

zeroblob(%d)

bind on a busy prepared statement: [%s]

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot commit transaction - SQL statements in progress

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

database table is locked: %s

statement aborts at %d: [%s] %s

cannot change %s wal mode from within a transaction

cannot open value of type %s

no such column: "%s"

foreign key

cannot open virtual table: %s

cannot open view: %s

indexed

cannot open %s column for writing

%s: %s.%s.%s

misuse of aliased aggregate %s

not authorized to use function: %s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

too many SQL variables

too many columns in %s

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_parent

sqlite_rename_table

sqlite_rename_trigger

there is already another table or index with this name: %s

%s OR name=%Q

type='trigger' AND (%s)

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

sqlite_

table %s may not be altered

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

CREATE TABLE %Q.%s(%s)

sqlite_altertab_%s

sqlite_stat1

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

DELETE FROM %Q.%s WHERE tbl=%Q

database %s is already in use

too many attached databases - max %d

no such database: %s

cannot detach database %s

unable to open database: %s

sqlite_detach

sqlite_attach

database %s is locked

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

duplicate column name: %s

default value of column [%s] is not constant

there is already an index named %s

too many columns on %s

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

table "%s" has more than one primary key

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

view %s is circularly defined

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

table %s may not be indexed

indexed columns are not unique

there is already a table named %s

index %s already exists

views may not be indexed

virtual tables may not be indexed

sqlite_autoindex_%s_%d

table %s has no column named %s

no such index: %S

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

sqlite_version

sqlite_source_id

sqlite_compileoption_used

sqlite_compileoption_get

foreign key mismatch

%d values for %d columns

table %S has no column named %s

table %S has %d columns but %d values were supplied

PRIMARY KEY must be unique

%s.%s may not be NULL

sqlite3_extension_init

error during initialization: %s

automatic extension loading failed: %s

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

foreign_keys

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

%s - %s

database schema is locked: %s

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

unknown or unsupported join type: %T %T%s%T

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

ORDER BY clause should come after %s not before

COMPOUND SUBQUERIES %d AND %d %s(%s)

no such index: %s

sqlite_subquery_%p_

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

no such column: %s

no such trigger: %S

-- TRIGGER %s

cannot VACUUM - SQL statements in progress

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

PRAGMA vacuum_db.synchronous=OFF

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

vtable constructor did not declare schema: %s

vtable constructor failed: %s

table %s: xBestIndex returned an invalid plan

no such module: %s

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s (rowid=?)

%s (rowid>? AND rowid)

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

%s (rowid>?)

%s (rowid)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such vfs: %s

cannot open file at line %d of [%.10s]

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

CREATE TABLE sqlite_master(

sql text

3.7.5

CREATE TEMP TABLE sqlite_temp_master(

1.2.7

%s="%s"

%s='%s'

%s>

encoding="%s"

version="%s"

standalone="%s"

CoreDialogCloseProcess.cpp

CoreHtmlDialog.cpp

onBeforeNavigate2 called, url=

CoreIEControl.cpp

uxtheme.dll

Error getting IExecAction!

CCoreWinTask::AddExecAction

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreOpera.h

EnumCookies is not implemented for Opera!

CCoreOpera::EnumCookies

CCoreOpera::SetCookie

SetCookie is not implemented for Opera!

CCoreOpera::LoadCookies

LoadCookies is not implemented for Opera!

opera.exe,opera.protocol,opera.url,opera,operanext,operastable

CCoreOpera::OpenUrl

OpenURL is not implemented for Opera!

Software\Opera Software

opera.exe

%programfiles%\Opera

launcher.exe

%programfiles%\Opera Next

CoreIEHost.cpp

m_WebBrowserEvents failed

IWebBrowser2 failed

_WebBrowserEvents failed

Sending Quit to web browser...

_webBrowser->Quit failed!

Not initialized or _webBrowser is NULL!

IWebBrowser failed!

CCoreIEHost::DeleteHistoryUrl

CCoreIEHost.OnDocumentComplete:

WebBrowser object is NULL!

Error: Collection didn't support IHTMLElementCollection!

*** set key code to 0 ****

g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb

KERNEL32.dll

USER32.dll

OLEAUT32.dll

SHDeleteEmptyKeyA

SHLWAPI.dll

COMCTL32.dll

GetProcessHeap

GetCPInfo

ShellExecuteExA

SHELL32.dll

ole32.dll

PSAPI.DLL

VERSION.dll

USERENV.dll

InternetCreateUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCombineUrlA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestA

HttpQueryInfoA

WININET.dll

UrlEscapeA

SHCopyKeyA

gdiplus.dll

IsValidURL

urlmon.dll

GetWindowsDirectoryA

EnumWindows

EnumChildWindows

GetKeyboardState

GDI32.dll

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

RegDeleteKeyA

RegQueryInfoKeyA

RegEnumKeyExA

ADVAPI32.dll

CRYPT32.dll

zcÃ

.?AV?$_Ref_count@VCOfferExe@@@std@@

.?AV?$_Ref_count_obj@VCOfferExe@@@std@@

.?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@

.?AVCOfferExe@@

.?AVCCoreStringUrl@@

.?AV?$CFlags@W4WebArgFlag@@@@

.?AV?$CAtlArray@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@@ATL@@

.?AV?$CCoreEntryPoint@P6GJPAUHKEY__@@PBDKK@Z@@

.?AVCCoreRegKey@@

.?AVCCoreFirefox@@

.?AV?$CFlags@W4CoreFirefoxCache@@@@

.?AV?$_Func_impl@U?$_Callable_obj@V?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@$0A@@std@@V?$allocator@V?$_Func_class@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@@2@XPAVCCoreSqlite@@U_Nil@2@U52@U52@U52@U52@U52@@std@@

.?AVCCoreChrome@@

.?AV?$CFlags@W4CoreChromeCache@@@@

.?AV?$_Func_base@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@

.?AV?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@

.?AVCCoreFirefoxXpiInstaller@@

.?AV?$_Ref_count_obj@VCCoreOpera@@@std@@

.?AV?$_Ref_count_obj@VCCoreChrome@@@std@@

.?AV?$_Ref_count_obj@VCCoreFirefox@@@std@@

.?AV?$_Ref_count_obj@VCDetectionChromePrefs@@@std@@

.?AV?$_Ref_count_obj@VCDetectionFirefoxPrefs@@@std@@

.?AVCDetectionFirefoxPrefs@@

.?AVCDetectionChromePrefs@@

.?AV?$CAtlArray@UWebArg@@V?$CElementTraits@UWebArg@@@ATL@@@ATL@@

.?AVCCoreWebArgs@@

.?AVCCoreSqlite@@

.?AV?$CAtlArray@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@V?$CElementTraits@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@@2@@ATL@@

.?AVCCoreSqliteResult@@

.?AVexecution_error@TinyXPath@@

.?AV?$CFlags@W4CoreOperaCache@@@@

.?AVCCoreOpera@@

.?AUDWebBrowserEvents2@@

.?AVCCoreWebBrowserEvents@@

c:\%original file name%.exe

@.reloc

Vista.BadArgs

\cookie.ini

\cookie.dat

Vista.BadArgs2

Domain%d

Name%d

\cookie%d.dat

\cookie%d.ini

Vista.NoAppLow

Vista.WideFail

Vista.GetCookieFail

Vista.AllocFail

Vista.CreateFileError

Vista.WriteFileError

Vista.SetCookie

SetCookie%d

Vista.SetCookieError

Error: %d. %s

g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\Installer.CookieMan.pdb

3 3%3,323

.ao &

$.OA[W

C_.jN

fs.MJ

\%S6j

<.vmx>

;.Ur?

7:.Vmeu

-N.sZ

v.GEJh

}N5%d

.nX9k

U;9%u

g 8%U

'/O.Axy

f7%X[

@: .pI^

wajam_validate.exe

R2dmjg

,i.BP

%%S~"

:.rHH

)[.Uo

9I.tA

u%CO,X

O5d%u

D.EQ,

#i%.fE#

.ia;s

55997C50-1F00-4D74-BAEF-46A658272B17.zipu

86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zip

4594AF2F-4D07-4B39-B15B-443A87882878.zip

AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipb

F80287B7-718C-4676-AC71-3F1AB04A60E1.zip

B7109C6A-73CA-4979-B038-5AE45CBE649F.zip*[

AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip

theanswerfinder.vi.zip-

6P%CH

099AEF6E-E690-4A5C-85F8-481343649504.zip":

E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip

7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip7

8388CA31-64D2-4B18-853D-6E8F73B33C4A.zipR

B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip

42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip

7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipr

73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip2

.adTF

5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip

C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip

E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip

B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipfo

80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipUi

13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip

3AD49606-8E98-404B-8DB4-767574E46DBB.zip[

404D0823-2D00-44F7-AC98-92F79F87E4F2.zip

AF33782B-57D0-466B-831D-0CE47455F809.zip

BDAAF9E7-1317-4A08-A774-4E8B122DA876.zip

4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip]^L

224505F1-4910-4879-A9AD-B70D1AE1A120.zip&

66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip{0

2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip

DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipvh

2704D408-C40A-4848-BC30-B5478423E8C9.zip

.Cfv &

0393A455-8396-4E79-8339-7DAEDC83567B.zip

226383C9-5E0D-4ABD-8308-30F31DD040A6.zipm!>

F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip

5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zip

225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip

3927F92B-2CF0-4555-8A62-C42865E873C2.zipn

FC7B0DC7-475B-489A-970D-27D5F49C54FA.zipUm7

A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip

%f t7)_u

988E6415-56A2-4711-9270-F71450CD0B9B.zipD

keyOm

.dGAK

3u.rOY

.Vt#'

Tq.IuyX

CxS%s

y,~ \6*%6s?

java_14552.txt

config.xmlPK

55997C50-1F00-4D74-BAEF-46A658272B17.zipPK

86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zipPK

4594AF2F-4D07-4B39-B15B-443A87882878.zipPK

AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipPK

F80287B7-718C-4676-AC71-3F1AB04A60E1.zipPK

B7109C6A-73CA-4979-B038-5AE45CBE649F.zipPK

AD04DC3C-8B12-4879-83E3-523DF600D9DE.zipPK

theanswerfinder.vi.zipPK

099AEF6E-E690-4A5C-85F8-481343649504.zipPK

E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zipPK

7E447291-0A05-4EB1-98E9-49ECF3C139D1.zipPK

8388CA31-64D2-4B18-853D-6E8F73B33C4A.zipPK

B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zipPK

42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zipPK

7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipPK

73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipPK

5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zipPK

C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipPK

E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zipPK

B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipPK

80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipPK

13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zipPK

3AD49606-8E98-404B-8DB4-767574E46DBB.zipPK

404D0823-2D00-44F7-AC98-92F79F87E4F2.zipPK

AF33782B-57D0-466B-831D-0CE47455F809.zipPK

BDAAF9E7-1317-4A08-A774-4E8B122DA876.zipPK

4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zipPK

224505F1-4910-4879-A9AD-B70D1AE1A120.zipPK

66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipPK

2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipPK

DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipPK

2704D408-C40A-4848-BC30-B5478423E8C9.zipPK

0393A455-8396-4E79-8339-7DAEDC83567B.zipPK

226383C9-5E0D-4ABD-8308-30F31DD040A6.zipPK

F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zipPK

5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zipPK

225E5BB2-B83F-478E-B774-62F53C2BCAD7.zipPK

3927F92B-2CF0-4555-8A62-C42865E873C2.zipPK

FC7B0DC7-475B-489A-970D-27D5F49C54FA.zipPK

A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zipPK

988E6415-56A2-4711-9270-F71450CD0B9B.zipPK

java_14552.txtPK

PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Emscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

combase.dll

777705555443332

5555443332

mscoree.dll

_T{hfiws| sijn^sftqawlbl^edro jnye{esdasf zahnj pimn{tpeer|nce|tx _cfojndnte^c^trioo]ns ]aqvoatitl|a`bol_ee ^ifnf ko_rhdoehrf `tfof bcloanstwiqneuxea lwciftvhl gtrhle^ sicn|sitgailel|adtpisoenq.u a dP]lye|a^sfet jdvizslalbyl{ee `axnhy{ jf|i{rneswuaml]lrss `awnkdy ^mmaukoe^ lsauwrhej wyboyu_ cadrhev pceoincnseycrtwelds ]troh utnhxek kiunhtleyrunieatq,f ea]njdy {rwemt{roym rt{heeh kinnnsat_aslbleaztsioounb.k

_Y{ofuw |msujs^tf qbweb ^ldoogjgye{ds aifnz hajsp ma{np ea|dcm|ixn_ifsjtdrta^t^orro ]tso] qcootmtp|l`eot_ee ^tfhfek _ihnoshtfa`lflfabtliaosnw qoenx atlhcifsv lcgormlp^ustce|ri.g iPel|edapssee qluoagd ]iyn| ^ufstijnvgz lyloyu{re `axdhm{ijn|i{sntsruamt]orrs `awckcyo^umnuto ^alnadw hrjewtbryy_ ctdhhev pienisctsaylrlwaltsi]ornh.u

_T{hfiws| sijn^sftqawlbl^edro jrye{qsuaifrzehsj pImn{tpeer|nce|tx _Efxjpdlto^r^erro ]vse]rqsoitotn| `6o _oer^ fhfikg_hheorh.f `Pflfebalsaes wuqpedxaatlec fyvolugrr lc^osmcp|uitgeire |adnpds erqeutardy] yt|h^ef tijnvsztlallyl{aet`ixohn{.jTSfoprkr_ye!b

cPflvelagsrel ^dsics|aibgliee |adnpys efqiuraedw]ayl|l^sf tajnvdz lmlayk{ee `sxuhr{ej |y{onus uamr]er sc`ownknye^cmtueod^ ltaow htjhweb yi_nctdehrvnpeeti,c saynrdw lrse]trrhyu ntxhkek uihnlsytuailalqaftei]ojny.{

Ifnpskt_aelblqe_r{ fiws| sujn^afbqlweb ^tdoo jsyt{asratf.z hPjlpema{spee |ccl|oxs_ef jadltl^ ^ortoh]esr] qaoptptl|i`coa_tei^ofnfsk _ahnodh ft`rfyf balgaasiwnq.e

1.0.73.0

safeinstall.exe

%original file name%.exe_376_rwx_00ED0000_00002000:

The procedure %s could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

%original file name%.exe_376_rwx_10001000_00082000:

SSSSh

tcPW

QSSSSSSh

t%SWh

1.3.6.1.4.1.311.10.3.5

1.3.6.1.4.1.311.10.3.6

1.3.6.1.5.5.7.3.3

2.5.4.6

2.5.4.8

2.5.4.7

2.5.4.10

2.5.4.11

2.5.4.3

WINTRUST.dll

CRYPT32.dll

{X-X-X-XX-XXXXXX}

operator

GetProcessWindowStation

SCC_CheckCriteria_Web

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

2.1.0.20

CryptCATCatalogInfoFromContext

CryptMsgClose

CertCloseStore

CertFreeCertificateContext

CertFindCertificateInStore

CryptMsgGetParam

CertGetEnhancedKeyUsage

CertNameToStrW

CertGetNameStringW

URLOpenStreamW

urlmon.dll

DeleteUrlCacheEntryW

HttpOpenRequestW

HttpAddRequestHeadersW

HttpSendRequestW

WININET.dll

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExW

RegDeleteKeyW

RegCreateKeyExW

ADVAPI32.dll

ShellExecuteExW

SHELL32.dll

ole32.dll

SHLWAPI.dll

USERENV.dll

GetProcessHeap

GetWindowsDirectoryW

GetCPInfo

MsgWaitForMultipleObjectsEx

RegEnumKeyExW

RegQueryInfoKeyW

OLEAUT32.dll

SHDeleteKeyW

SHDeleteEmptyKeyW

SYMCCIS.dll

zcÃ

c:\%original file name%.exe

0xX

..\Source\ccVerifyTrustStatic.cpp

%SymEFA%

EFACli.dll

CLSID\%s\LocalServer32

CLSID\%s\InprocServer32

NTDLL.DLL

..\Source\ccVerifyTrustImpl.cpp

..\Source\FileCache.cpp

g..\Source\VerifyFile.cpp

..\Source\ccVerifyTrustPolicy.cpp

..\Source\CatalogIterator.cpp

..\Source\CatalogFileHash.cpp

WinTrust.dll

..\Source\CatalogContext.cpp

..\Source\ccSymModuleLifetimeMgrImpl.cpp

%s, %s, %s, %s(%ld)

..\Source\ccModule.cpp

..\Source\ccSystemInfo.cpp

..\Source\ccRegistry.cpp

..\Source\ccStringConvert.cpp

CSIDL_WINDOWS

SOFTWARE\Microsoft\Windows\CurrentVersion

..\Source\ccPathExpansion.cpp

\\?\UNC

..\Source\ccSplitPath.cpp

..\Source\ccOSInfo.cpp

\wpeutil.dll

\FACTORY.exe

\wpeinit.exe

..\Source\ccMemory.cpp

..\Source\ccFile.cpp

..\Source\ccWow64FsRedirection.cpp

%s\%s

CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_FILE_NOT_FOUND

CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_ACCESS_DENIED

isolate.ini

%COMMON_SILO_DATA%

..\Source\ccEncryptedString.cpp

..\Source\ccSynchronize.cpp

..\Source\ccSymDllLifetimeMgr.cpp

kernel32.dll

KERNEL32.DLL

PSAPI.DLL

..\Source\ccPEBReader.cpp

..\Source\ccPrivilege.cpp

..\Source\ccSymIndexValueCollectionImpl.cpp

AWTSAPI32.DLL

..\Source\ccSymDllLifetimeMgrLocal.cpp

..\Source\ccSymIndexValueCollection.cpp

..\Source\ccSymValueCollection.cpp

ÃŒROOT%

rcPFRes.dll

rcPxyEvt.dll

rcProxy.dll

rcSvcHst.dll

rcEmlPxy.dll

rcLgView.dll

rcErrDsp.dll

rcAlert.dll

rcApp.dll

ccEmlPxy.dll

ccGLog.dll

ccJobMgr.dll

ccGEvt.dll

ccIPC.dll

ccRkSn.dll

PFPriv.dll

ccPxyIns.dll

ccPxyEvt.dll

ccInst64.dll

ccEvtCli.dll

ccTrstPc.dll

ccSvc.dll

ccEraser.dll

OEHeur.dll

ccCharCv.dll

ccInst.dll

DefUtDCD.dll

ccScanw.dll

ccScan.dll

dec_abi.dll

ccDec.dll

ccALEng.dll

ccErrDsp.dll

ccProSub.dll

ccVrTrst.dll

ccSetEvt.dll

ccSet.dll

ccAlert.dll

..\Source\ccArchive.cpp

..\Source\ccDummyArchive.cpp

..\Source\ccInstanceFactory.cpp

..\Source\ccSymValueCollectionConvert.cpp

..\Source\ccSymStreamArchive.cpp

Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion

ÃŒROOT%\

ÃŒDATA%\

..\Source\ccSymInstalledApps.cpp

..\Source\ccSymDigest.cpp

..\Source\ccSymKeyValueCollectionImpl.cpp

..\Source\ccSymMemoryImpl.cpp

Archive.Write(CMemoryImpl::CSerializeImpl::Version) == FALSE

Archive.Read(nVersion) == FALSE

..\Source\ccSymStringImpl.cpp

Archive.Write(CStringImpl::Version) == FALSE

..\Source\ccSymInstanceFactoryImpl.cpp

t..\Source\ccMessageLock.cpp

..\Source\ccSymKeyValueCollection.cpp

..\Source\ccSymPersist.cpp

ÃŒROOT%\ccSet.dll

..\Source\ccSymObjectRepository.cpp

CommonClient\OBJID\%s

..\Source\ccMemoryArchive.cpp

..\Source\ccSymMemoryStreamImpl.cpp

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

FileDownloader::callURLOpenStream

CHttpRequest::CHttpRequest

CHttpRequest::~CHttpRequest

CHttpRequest::RequestPage

CHttpRequest::ParseURLW

https

[s d, d - d:d:d:d]

%s %ld

%s %s

%s 0x%x

hXXp://cps.qalabs.symantec.com/teams/isp/symccis

hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Staging

hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production

SymCCIS.dll

SCC.dll

OfferUI.dll

SymInstallStub.exe

SymCCISDll.txt

Total CheckCriteria execution time in seconds =

NortonOfferEngineImpl::CheckCriteria_Web

downloadStubInstallerExe() failed, HR =

Failed to delete downloaded SCC.dll, GetLastError =

Failed to delete existing SCC.dll, GetLastError =

NortonOfferEngineImpl::downloadStubInstallerExe

Failed to delete existing SymInstallStub.exe, GetLastError =

NortonOfferEngineImpl::buildComponentDownloadURL

NortonOfferEngineImpl::getTestEnvironmentRootURL

NortonOfferEngineImpl::getISExeDestPath

getISExeDestPath() returned =

NortonOfferEngineImpl::sendPingForCheckCriteriaWeb

NortonOfferEngineImpl::getCheckCriteriaPingDataWeb

NortonOfferEngineImpl::getStubInstallerCmdLine

getStubInstallerCmdLine() returned =

NortonOfferEngineImpl::deleteDeclineCountRegKeyForThisProduct

NortonOfferEngineImpl::deleteDeclineCountParentKeyIfNoMoreProductsExist

Deleting DeclineCount subkey for partner =

Failed to create/open DECLINE_COUNT_REG_KEY

Advapi32.dll

hXXp://stats.norton.com/n/p?

PingData::SendCheckCriteriaWebPing

PingData::createBaseURL

PingData::getCheckCriteriaPingURL

PingData::getCheckCriteriaWebPingURL

PingData::getInstallProductsPingURL

PingData::getOfferAcceptancePingURL

pingURL =

X.X

%u.%u.%u.%u.%u

Utility::LaunchProcessWithShellExecute

ShellExecuteEx failed, GetLastError =

---8#-8-@

%original file name%.exe_376_rwx_10084000_00002000:

NRTN_OfferEngine_CheckCriteria_Web

kernel32.dll

urlmon.dll

URLOpenStreamW

WININET.dll

USER32.dll

MsgWaitForMultipleObjectsEx

ADVAPI32.dll

SHELL32.dll

ole32.dll

SHLWAPI.dll

USERENV.dll

OLEAUT32.dll

2.1.0.20