SearchProtectToolbar_d72cfca395 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1088

Mutexes

The following mutexes were created/opened:

RasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutexQuickStartAppVdiMsiLockInstallIQUninstallOptionLockInstallIQFirefoxLockW3i_CoreBrowserShutdownW3iFFPrefslockDialogCloseProcessLockCPackageZlib::CPackageZlibW3iCoreLoggerZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexCTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003DDrawWindowListMutexDDrawDriverObjectListMutex__DDrawExclMode____DDrawCheckExclMode___!SHMSFTHISTORY!_c:!documents and settings!adm!local settings!history!history.ie5!mshist012014080820140809!

File activity

The process %original file name%.exe:1088 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\config.xml (15904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\arcadeparlor.vi.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\maxthon.vi.zip (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\blitzmediaplayeroffer.vi.zip (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\expertpdf7_1489.txt (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\point-loadingbar.png (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\speedupmypc_sales_r2_v2.vi.zip (825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\view.darkux_3step_r2_v4.vi.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\blasteroids.vi.zip (833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\driverscanner.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\pcoptimizerpro.vi.zip (720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_startpage.vi.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\yahoo.js (806 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\d72cfca3950bb4b3d34db7ffda370d2d.log (3250672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\noyahoo.js (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\speedupmypc_sales_r2_v2.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\weatherchnl.vi.zip (815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_keepmysettingsx.vi.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoosuite.vi.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\nortonantivirus.vi.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\offerbox.vi.zip (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\smartweb.vi.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\smartpccleaner.vi.zip (930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\yahoo-widget.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\muvic.vi.zip (786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\pcspeedup.vi.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\contentexplorer.vi.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dealgest.vi.zip (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\vd1-yahoo-toolbar.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\wecarecleanwater.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\jquery-1.10.2.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\expertpdf7.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\defaulttab.vi.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\process.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\driverscanner.vi.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\pcfixspeed.vi.zip (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\uifactory.js (381 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\screenfactory.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\websearches.vi.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\fulldiskfighter.vi.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\freeflvconverting.vi.zip (999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\wecareaspca.vi.zip (973 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\secureweb.vi.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\seaapp.vi.zip (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\bg-loadingbar.png (297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\darkux_3step_r2_v4.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\custom-form-elements.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\winferno.vi.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\slowpcfighter.vi.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_defaultsearch.test.vi.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\uninstallhelper.vi.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\darkux_3step_r2_v4.vi.json (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\smartdriverupdater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\resultsbay.vi.zip (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\mypcbackup.vi.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\searchdonkey.vi.zip (861 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\common.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\linkey.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\registryhelper.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\wecaresavethechildren.vi.zip (955 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\rockettab.vi.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\genieo.vi.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\driversupport.vi.zip (882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\severeweatheralerts.vi.zip (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\radio.png (870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\knctr.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\expertpdf7.vi.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_startpage.test.vi.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\nortonsecurityscan.vi.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\converterfreeonline.vi.zip (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\ping.response.json (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\loadingbar.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\btn-win-cancel.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\convertfilesforfree.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\weatherbug.vi.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\omigaplus.vi.zip (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\kaspersky.vi.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\expertpdf7\expertpdf7_tn.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_defaultsearch.vi.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\smartdriverupdater.vi.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\darkux_3step_r2_v4.vi.zip (11960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\driverfighter.vi.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\surfcanyon.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\truedownloader.vi.zip (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\nortoninternetsecurity.vi.zip (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410\index.dat (0 bytes)

Registry activity

The process %original file name%.exe:1088 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080820140809]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014080820140809\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\InstallIQ]
"test" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080820140809]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1405711087"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 04 96 49 D9 23 E4 46 79 E6 C5 18 5D FF 24 D6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080820140809]
"CacheLimit" = "8192"
"CachePrefix" = ":2014080820140809:"
"CacheRepair" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\InstallIQ]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040920140410]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\InstallIQ]
"test"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

Dropped PE files

MD5	File path
d0f25e1b717ee325780b5c5a014f9623	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SymCCIS.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\config.xml (15904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\arcadeparlor.vi.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\maxthon.vi.zip (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\blitzmediaplayeroffer.vi.zip (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\expertpdf7_1489.txt (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\point-loadingbar.png (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\speedupmypc_sales_r2_v2.vi.zip (825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\view.darkux_3step_r2_v4.vi.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\blasteroids.vi.zip (833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\driverscanner.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\pcoptimizerpro.vi.zip (720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_startpage.vi.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\yahoo.js (806 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\d72cfca3950bb4b3d34db7ffda370d2d.log (3250672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\noyahoo.js (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\speedupmypc_sales_r2_v2.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\weatherchnl.vi.zip (815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_keepmysettingsx.vi.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoosuite.vi.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\nortonantivirus.vi.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\offerbox.vi.zip (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\smartweb.vi.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\smartpccleaner.vi.zip (930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\yahoo-widget.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\muvic.vi.zip (786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\pcspeedup.vi.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\contentexplorer.vi.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dealgest.vi.zip (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\vd1-yahoo-toolbar.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\wecarecleanwater.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\jquery-1.10.2.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\expertpdf7.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\defaulttab.vi.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\process.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\driverscanner.vi.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\pcfixspeed.vi.zip (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\uifactory.js (381 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\screenfactory.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\websearches.vi.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\fulldiskfighter.vi.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\freeflvconverting.vi.zip (999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\wecareaspca.vi.zip (973 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\secureweb.vi.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\seaapp.vi.zip (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\bg-loadingbar.png (297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\darkux_3step_r2_v4.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\custom-form-elements.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\winferno.vi.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\slowpcfighter.vi.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_defaultsearch.test.vi.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\uninstallhelper.vi.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\darkux_3step_r2_v4.vi.json (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\smartdriverupdater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\resultsbay.vi.zip (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\mypcbackup.vi.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\searchdonkey.vi.zip (861 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\common.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\linkey.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\registryhelper.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\wecaresavethechildren.vi.zip (955 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\rockettab.vi.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\genieo.vi.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\driversupport.vi.zip (882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\severeweatheralerts.vi.zip (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\radio.png (870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\knctr.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\expertpdf7.vi.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_startpage.test.vi.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\nortonsecurityscan.vi.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\converterfreeonline.vi.zip (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\ping.response.json (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\loadingbar.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\btn-win-cancel.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\convertfilesforfree.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\weatherbug.vi.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\omigaplus.vi.zip (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\kaspersky.vi.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\expertpdf7\expertpdf7_tn.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\yahoo_hpds_defaultsearch.vi.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\smartdriverupdater.vi.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\darkux_3step_r2_v4.vi.zip (11960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\driverfighter.vi.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\surfcanyon.vi.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\truedownloader.vi.zip (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qs_1531171500\nortoninternetsecurity.vi.zip (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: SafeInstall, LLC
Product Name: SafeInstaller
Product Version: 1.0.53.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: safeinstall.exe
Internal Name: SafeInstaller
File Version: 1.0.53.0
File Description: Safe Installer
Comments:
Language: Language Neutral

Company Name: SafeInstall, LLCProduct Name: SafeInstallerProduct Version: 1.0.53.0Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: safeinstall.exeInternal Name: SafeInstallerFile Version: 1.0.53.0File Description: Safe InstallerComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	502377	502784	4.4973	b338c4f06bb25d131acfc1ed0d3b910a
.text-qu	507904	3859	4096	4.15753	6861d682397fa6f89f9ccebebe3e2a97
.text-co	512000	85184	85504	4.48632	30c647ed0f8c74d3d2fa45ea6c2bc26e
.text-co	598016	74520	74752	4.4797	9b6992674956ed805eb62620ea7d5933
.text-co	675840	47594	47616	4.49095	560063ecfb14aaf517a8392846689e94
.text-co	724992	14255	14336	4.48791	b8dc82be38e07a88bb69c3376466ce5d
.text-co	741376	28523	28672	4.61182	36e7d2e0a395c1eb492165b684ff21f9
.text-co	770048	10274	10752	4.35717	9d15b25b36a0aec64f6f87914cf03244
.text-co	782336	263610	263680	4.59556	d8fa4b3f2944d095cbff74eff463d0a0
.text-ti	1048576	43367	43520	4.59023	ff372763c3868124b49a3e7baf95ce37
.text-co	1093632	16090	16384	4.36508	f33a4ed5dfd811c5653ac4e6b63e18e8
.text-co	1110016	59	512	0.606205	8757421a283c68152d0bf59cca95f8fa
.text-co	1114112	12734	12800	4.42054	4ab817563c627d908a314e5a9fb542c9
.rdata	1130496	267066	267264	3.89299	83511534e1e3862c29a646f3716b4687
.data	1400832	27140	17408	3.34082	c4d744e255e65effe0c170eaed5ab9e6
.data-qu	1429504	41	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1433600	188	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1437696	56	512	0.042395	8b0a1130def49ef72eb23a88fe9ecc8e
.data-co	1441792	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1445888	44	512	0.014135	2d5fe836dd5a60fa37b7c590cfc70410
.data-co	1449984	41	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1454080	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1458176	2932	3072	1.36231	e950f32e666ef7f6b7e5840a619df91b
.data-ti	1462272	1176	1536	1.01245	97008ba8201369f830a0d0e1ec267fa0
.data-co	1466368	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1470464	4	512	0.014135	d340f23a7d18057bb02252a3cb40b877
.data-co	1474560	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.rsrc	1478656	635752	635904	5.31613	581ff3ba4e5e1634dc04b4794b474059

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://1-vinstaller.com/api/productsession	66.77.96.160

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /api/productsession HTTP/1.1

Content-Type: application/json; charset=utf-8

Accept: application/json

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Host: 1-vinstaller.com

Content-Length: 261

Cache-Control: no-cache

{"CampaignName":"","ShortName":"expertpdf7","ProductSubId":-1,"AccountId":13722,"VersionId":-1,"InstallerVersion":"1.0.53.0","OSId":5,"TemplateId":319,"LangId":1033,"ParentOfferIds":[],"Browsers":[{"Key":"IE","Value":6}],"DefaultBrowser":{"Key":"IE","Value":6}} HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: application/json; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="PSA OUR DEM"

X-Robots-Tag: noindex, nofollow

Date: Thu, 07 Aug 2014 21:49:25 GMT

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1088:

.text

`.text-qu

`.text-co

`.text-coko

`.text-co"(

`.text-tig

`.text-co;

`.rdata

@.data

.data-qu)

.data-co

.data-co8

.data-co(

.data-co,

.data-co)

.data-cot

.data-ti

.rsrc

CSShZ

7SSh$

7SSh.

7SSh3

7SSh8

CSSh3

CSSh8

CSSh=

CSShk

CSSh`

<:>

t8Ht.HHt#

.FGy1

Af;FP}%S3

|$|.tD

#t.Ht

2 34 567

u.SSV

1t.Ht

9sxv%UW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

GetProcessWindowStation

Operation not permitted

Inappropriate I/O control operation

Broken pipe

0xX

Invalid CRT parameter

QuickStartApp.cpp

vi.engine.xml

chk_firefox

chk_chrome

%s[%d]

position=%d, active=%d

%d,%d,%d

** Debug mode: simulating stopping Firefox

** Debug mode: simulating stopping Chrome

%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.

Firefox

Google Chrome

%d err: %s

Chrome

firefox

chrome

opera

searchprotector.exe

view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s

.json

control.txt

00000000-0000-0000-0000-000000000000

QuickStartProcess.cpp

%programfiles%\Free Offers from Freeze.com

disabling offer because system doesn't have Firefox

disabling offer because system doesn't have Chrome

%s[%s]: view=%s accept=%s

%s,%s

WindowsErrorCode

targetbrowser/key

%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d

%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s

%d,%d,%s,%s,%s,%s

%d,%d,%d,%d,%d

%d,%d,%s,%s,%s,%s,%s

%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s

offers

%s,%s,%s,%s,%s,%s,%s,%s

%s,%d,%s,%s

Unable to open thankyou page; url is empty or invalid!

statsd.response.txt

Web.Installer.VDI.CommError

Web.Installer.VDI.InstallError

Web.Installer.VDI.OfferDownloadError

Web.Installer.VDI.OfferInstallError

Web.Installer.VDI.OfferInstallFailed

hXXp://dl2.v47installer.com/lm/bundles/keepmysettingsx/keepmysettingsx.zip

hXXp://sdspapi.com/api/values

hXXp://us.yhs4.search.yahoo.com/yhs/search?p={searchTerms}&ei=UTF-8&hspart=w3i&hsimp=yhs-synd1&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635

Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallX Search Protect for Yahoo

hXXp://dl2.v47installer.com/lm/bundles/keepmysettingsx/spv1.zip

spv1.zip

.html

MainWnd.cpp

OfferThread.cpp

Setting offer checkbox value: key=

COfferExe::GetXpiFilename

c:\tfs.vs2012\admin\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h

downloadurl

downloadurl.64bit

msie.downloadurl

msie.commandline

firefox.downloadurl

firefox.commandline

chrome.downloadurl

chrome.commandline

allbrowser.downloadurl

allbrowser.commandline

regkeyadd

ieregkey

firefox.pref

firefox.xpimethod

firefox.xpilocation

firefox.xpidelete

LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser

iconurl

configuration/downloadurl

configuration/downloadurl.64bit

configuration/msie.downloadurl

configuration/msie.commandline

configuration/firefox.downloadurl

configuration/firefox.commandline

configuration/chrome.downloadurl

configuration/chrome.commandline

configuration/allbrowser.downloadurl

configuration/allbrowser.commandline

configuration/regkeyadd

configuration/ieregkey

configuration/firefox.pref

configuration/firefox.xpimethod

configuration/firefox.xpilocation

configuration/firefox.xpidelete

configuration/iconurl

adding %s entry, ourVal='%s', theirVal='%s'

COfferExe::Download

Download url is empty!

_firefox is NULL!

COfferExe::OnInstall

Install is a dropfile; no exe to run...

Icon offer (in exe config) detected, running icon install

COfferExe::Run

COfferExe::HandleFirefoxOptions

firefoxoffer

HandleFirefoxOptions called with incorrect preferences set in config!

COfferExe::BuildCommandLine

msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress

msiexec.exe /i "%s" %s

Could not find firefox exe to install

Offer is installing XPI for Firefox 8 or higher, enabling GUI.

"%s" "%s"

"%s" %s

COfferExe::RunSearchProtectInstall

COfferExe::WaitForInstallProcess

OfferExe.cpp

COfferExe::WaitForProcessStarted

waiting for registry key:

COfferExe::WaitForRegistryValue

Registry key found.

Registry key found (64-bit).

COfferExe::WaitForFile

COfferExe::InstallXpi

Bad RegKeyAdd config; not correct format: (missing hive \ )

Bad RegKeyAdd config; not correct format: (missing , )

Bad RegKeyAdd config; not correct format: (missing = )

unable to set regkey from following RegKeyAdd:

RegKeyAdd:

unrecognized values in RegKeyAdd:

unable to set regkey from following IERegKey:

IERegKeyAdd:

unrecognized values in IERegKey:

COfferExe::FinishXpiInstall

COfferExe::CancelXpiInstall

COfferExe::RunIconInstall

%s_%s.url

configuration/url

configuration/msie.url

configuration/firefox.url

configuration/chrome.url

All urls are empty!

COfferStartPage::InstallFirefox

_firefox is NULL!

** Debug mode: simulated setting Firefox startpage:

Error writing Firefox pref for startpage!

Error setting Firefox new tab!

Set new tab in Firefox.

Firefox startpage set successful.

chromeoffer

COfferStartPage::InstallChrome

_chrome is NULL!

** Debug mode: simulated setting Chrome startpage:

Error setting Chrome startpage: browser is still running!

Error writing Chrome pref for startpage!

Can't set new tab Chrome, function is not implemented.

Chrome startpage set successful.

OfferStartPage.cpp

startpageurl

oldstartpageurl

hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}

hXXp://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=#REVENUE_TAG#

hXXp://search.yahoo.com/favicon.ico

configuration/msie.searchname

configuration/firefox.searchname

configuration/firefox.suggesturl

configuration/firefox.selectedengine

configuration/firefox.keywordurl

configuration/chrome.selectedengine

configuration/chrome.keyword

configuration/chrome.faviconurl

configuration/chrome.suggesturl

Error setting IE search: url is empty!

Internet Explorer version 6 or older does not support default search!

COfferDefaultSearch::InstallFirefox

** Debug mode: simulated setting Firefox default search:

Failed to write Yahoo xml for Firefox!

Firefox default search set successful.

COfferDefaultSearch::InstallChrome

** Debug mode: simulated setting Chrome default search:

Failed to set search pref for chrome!

Chrome default search set successful.

OfferDefaultSearch.cpp

searchurl

oldsearchurl

hXXp://vinstaller.com/api/trackofferinstalldetails

hXXp://vinstaller.com/api/installerror

ping.response.json

postback.response.json

config.xml

pingurl

postbackurl

errorurl

statsdurl

uninstalloptionurl

PingUrl

PostbackUrl

Sending session request, url=

Ping url is empty!

Ping url is invalid!

hXXp://dl5.v1installer.com/

PingResponse.cpp

targetbrowser/Key

PingThread.cpp

offer %s[%s]: isInstalled=%d canShow=%d

rule %s[%s]: isInstalled=%d

QuickStartDetectThread.cpp

ResourceThread.cpp

Sending postback request, url=

Postback url is empty!

Postback url is invalid!

Response/url

passed

CRequirementManager::RunExecute

CRequirementManager::ParseExecuteResult

invalid flag in execute result:

Software\Microsoft\Windows\CurrentVersion\RunOnce

Running requirement.OnInstall:

Running requirement.OnCancel:

requirement.OnCancel is empty, skipping.

Running requirement.OnExit:

requirement.OnExit is empty, skipping.

%programdata%\W3i\UninstallHelper\iqu.ini

2.0.1.0

%programdata%\W3i\UninstallHelper\import

quickstart.xml

quickstart%d.xml

Failed to save IQU data, too many import files in directory!

%programfiles%\W3i\UninstallHelper\UninstallHelper.exe

quickstart_si.xml

quickstart_si%d.xml

Failed to save SoftwareInfo data, too many import files in directory!

hXXp://dl.installiq.com/API/IQU/SoftwareInfo.aspx

UH executable not found!

"%s" /silent /noswinfo

%s:%d

handling firefox cookies...

FF.GetCookiesError

FF.NoCookies

firefox: no cookies found

FF.SetCookieError

FF.SetCookies

firefox: set cookies

getting firefox cookies for

CCookieManager::GetFirefoxCookies

Error enumerating firefox cookies!

firefoxenum

hXXp://

cookie.dat

Vista.NoResult

Vista.SavedLow

Vista.NoCookies

Vista.CopiedLow

%a, %d-%b-%Y %H:%M:%S GMT

cookieman.exe

Vista.ExtractError

Vista.CreateLowError

handling chrome cookies

Chrome.GetCookiesError

Chrome.NoCookies

Chrome: no cookies found

Chrome.SetCookieError

Chrome.SetCookies

Chrome: set cookies succeeded

getting Chrome cookies for

CCookieManager::GetChromeCookies

Error enumerating chrome cookies!

chromeenum

Safari.GetCookiesError

Safari.NoCookies

Safari.SetCookieError

Safari.SetCookies

ErrorLogger.cpp

explorer.exe

CDialogWindowJson::OnBeforeNavigate2, url=

DialogWindowJson.cpp

%s: view=%s accept=%s

chk_%s=

checkbox found; %s=%s

adding disclosure(%s): %s

installedbrowsers/firefox

installedbrowsers/chrome

installedbrowsers/opera

view.buildconfig.json

view.productconfig.json

ProgressDialog.cpp

Installing %d of %d

uninstalloption.exe

InstallIQFirefoxLock

postinstallexecute

postinstallexecuteintegrity

stopfirefox

stopchrome

configuration/postinstallexecute

configuration/postinstallexecuteintegrity

/msie.autoconfirm

/firefox.autoconfirm

/chrome.autoconfirm

msie.autoconfirm

firefox.autoconfirm

chrome.autoconfirm

COffer::WaitForFirefoxLock

Offer.cpp

_firefoxLock is already created!

Waiting for Firefox lock...

Firefox lock status:

Releasing Firefox lock

PostInstallExecute:

iexplore.exe

** Debug mode: simulating PostInstallExecute:

Cannot run post-install execute, file does not exist:

COffer::PostInstallExecute

PostInstallExecute command failed!

http:

Adding UH data: %s|%s,%s

Failed to extract uninstall option exe!

Error; uninstalloption.exe doesn't exist (after download and extract!)

Error copying uninstalloption.exe to program files!

error downloading uninstall option url!

hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe

%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

"%s" %s "%s"

AdobeAirInstaller.exe

Uninstall keys:

/uninstallkeys/uninstallkey

%s/uninstallkeys/uninstallkey[%d]/type/text()

%s/uninstallkeys/uninstallkey[%d]/value/text()

%firefoxprofiles%

Unknown uninstall key type encountered, skipping lookup

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

crterr:%d

Win32Err:%d

HRESULT:0x%X

@ line %d in function .

Unknown error: %d

wininet.dll

IDispatch error #%d

LoadLibrary failed in loading current exe:

CoreResource.cpp

CStringW.GetBuffer failed!

0xx

%s. {%s} @ line %d in function in module %s.

Win32Err:%d

HRESULT:0x%X

Error:%d

HttpStatus:%d

-- %s line %d --

[X]

L%d:d.d.d_d:d:d.d

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d

%s_%x%x%x%x%x

CoreFile.cpp

Exception %X in module %s at: 0x%p.

dbghelp.dll

0x%p %s

CoreProcess.cpp

ShellExecuteCommand:

Failed to execute command:

CCoreProcess::ShellExecuteCommand

CCoreProcess::CloseProcessWindowsByModuleName

CCoreProcess::ShellExecuteCommandAndWait

CCoreProcess::GetProcessExe32

CCoreProcess::GetProcessExe64

kernel32.dll

CoreXml.cpp

_ftprintf_s failed writing header to

]/Key/text()

CCoreXml::ParseRequiredKeyValue

CCoreXml::ParseRequiredKeyInt

CoreThread.cpp

hXXps://

PTF://

CCoreSystem::GetWindowsVersionId

Missing windows version, check the code!!

CoreSystem.cpp

%s (Build %d)

CCoreSystem::CacheWindowsInfo

Unknown OS! Major: 0xX, Minor: 0xX

%windows%

%system%

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Ãžsktopdir%

Ãžsktop%

%userprofile%

%s0x%.2x%.2x%.2x%.2x%.2x%.2x-

SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727

SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322

SOFTWARE\Microsoft\.NETFramework\policy\v1.0

3321-3705

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

Iphlpapi.dll

%windows%\Desktop

VBoxService.exe

vboxtray.exe

proc.vboxsvc

vmtoolsd.exe

proc.vboxtray

vmicsvc.exe

proc.vmtools

proc.hvsvc

reg.vboxguest

reg.vboxmouse

reg.vboxsvc

reg.vboxsf

reg.vboxvid

reg.vboxbios

%system%\vboxhook.dll

reg.vboxsguest

file.vboxhook

reg.vmvid

reg.vmpci

reg.vmdbg

reg.vmcrd

reg.vmmem

reg.vmmouse

reg.vmdsk

reg.vmtools

reg.vmsnap

reg.vmnet64

reg.hvgenctr

reg.hvvmbus

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000

reg.hvvid

SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000

reg.hvscsi

reg.hvinput

reg.vboxdisk

reg.vmdisk

reg.hvdisk

sng.vmt1

sng.vmt3

sng.vmt2

gen.dbg

sng.vmt4

gen.diftime

CCoreRegKey::Create

Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.

CCoreRegKey::Open

RegCreateKeyEx failed on key=

RegOpenKeyEx failed on key=

Registry key is not open! (

CoreRegKey.cpp

CCoreRegKey::GetValueType

CCoreRegKey::GetValueSize

CCoreRegKey::GetValueString

CCoreRegKey::GetValue

CCoreRegKey::SetValue

CCoreRegKey::DeleteValue

RegDeleteKeyExA

CCoreRegKey::DeleteKey

RegDeleteKey failed on

RegDeleteKeyEx failed on

CCoreRegKey::EnumSubKeys

SHCopyKey failed for

CCoreRegKey::CopyTree

CCoreEntryPoint::LoadProcAddress

CCoreEntryPoint::CCoreEntryPoint

Advapi32.dll

UniqueId.cpp

subKey is NULL!

%u,%u,%u,%u

0.0.0.0

\/:*?"|

createurlfilefail

Failed to create URL file!

Encryption key not initialized!

CoreEvent.cpp

shell32.dll

CoreVista.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_CURRENT_CONFIG

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

%Y-%m-%dT%H:%M:%S

CommandLine.cpp

%s.%s

iexplore,ie.http

Failed to get IE version key!

Loading IE cookies for url:[

wrote %d cookies

CoreInternetExplorer.cpp

-noframemerging "%s"

ie.http\shell\open\command

Unable to find iexplore.exe, using shell execute (with possible warnings)

Default search regkey not found (may be a brand new install)

EnumSubKeys failed!

ieframe.dll

hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

url is empty!

Replacing existing provider url:

Error setting provider url!

CCoreInternetExplorer::FindFirstHistoryUrl

findfirsturlfailed

FindFirstUrlCacheEntry() failed!!

FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??

CCoreInternetExplorer::FindNextHistoryUrl

findnexturlfailed

FindNextUrlCacheEntry() failed!!

FindCloseUrlCache() failed!!

CCoreInternetExplorer::FindCloseHistoryUrl

findcloseurlfailed

msgText is required!

msgTitle is required!

browser.search.selectedEngine

browser.search.defaultenginename

browser.startup.homepage

keyword.URL

MozillaWindowClass

MozillaUIWindowClass

firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox

Software\Mozilla\Mozilla Firefox

CCoreFirefox::GetVersion

firefoxver

Failed to get Firefox version key!

Profile%d

profiles.ini

%appdata%\Mozilla\Firefox

Loading Firefox3 cookies for url:[

Firefox versions prior to 3 are not supported by LoadProfileCookies!

cookies.sqlite

%s=%s

Enumerating Firefox3 cookies for

cookies.txt

Found partial cookie in Firefox profile:

Enumerating Firefox cookies for

-requestPending -osint -new-window "%s"

firefox.exe

%programfiles%\Mozilla Firefox

PathToExe

CCoreFirefox::GetPrefString

prefs.js

CoreFirefox.cpp

user_pref("%s", %s%s%s);

CCoreFirefox::SetPrefString

CCoreFirefox::SetDefaultSearch

suggestionUrl is empty!

searchUrl is empty!

Setting Firefox default search engine:

Can't set search engine while Firefox is running!

SearchUrl=

SuggestionUrl=

Failed to write Yahoo search prefs for Firefox!

hXXp://VVV.mozilla.org/2006/browser/search/

browser.search.order.2

browser.search.order.1

downloads.sqlite

Failed to open downloads.sqlite database!

places.sqlite

select source from moz_downloads where source like '%%%s%%' order by id desc

Failed to open places.sqlite database!

select url from moz_places where url like '%%%s%%' order by id desc

CCoreFirefox::SetStartpage

browser.startup.page

cannot set startpage; firefox is currently running!

CCoreFirefox::SetNewTab

Cannot set newtab because firefox is running!

browser.newtab.url

firefox pref: keyword.URL=

firefox pref: browser.search.param.yahoo-fr=

browser.search.param.yahoo-fr

CCoreChrome::SetCookie

c:\tfs.vs2012\admin\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h

Chrome_WindowImpl_0

Chrome_RenderWidgetHostHWND

Chrome_WidgetWin_0

chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium

Chrome_WidgetWin_1

CCoreChrome; Cookie file does not exist

%local_appdata%\Google\Chrome\User Data\Default\Cookies

select name, value, host_key, path, expires_utc from cookies where

Loading Google Chrome cookies for url:[

Enumerating Google Chrome cookies for

host_key like '%

Chrome cookie file does not exist

CCoreChrome::EnumCookiesLegacy

select host_key, name, value, path, expires_utc from cookies where host_key like '%

CCoreChrome::EnumCookiesV33

Enumerating Google Chrome cookies (v33) for

Failed to decrypt chrome cookie:

select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%

chrome.dll

Chrome cookie:

Unable to find chrome.exe, using shell execute (with possible warnings)

--new-window "%s"

ChromeHTML\shell\open\command

chrome.exe

%programfiles%\Google\Chrome\Application

%local_appdata%\Google\Chrome\Application

CCoreChrome::GetStartpage

CCoreChrome::GetStartupPages

session/startup_urls

session/urls_to_restore_on_startup

CoreChrome.cpp

CCoreChrome::IsMultiStartPageEnabled

CCoreChrome::SetStartpage

CCoreChrome::SetStartPageOld

CCoreChrome::SetStartPageNew

%local_appdata%\Google\Chrome\User Data\Default\Web Data

SELECT value FROM meta WHERE key='Default Search Provider ID'

SELECT id, short_name, url FROM keywords where id = %s

default_search_provider_data/template_url_data

CCoreChrome::GetDSUrlFromPrefTemplate

default_search_provider_data/template_url_data/short_name

default_search_provider_data/template_url_data/url

CCoreChrome::SetDefaultSearch

default_search_provider_data/template_url_data/id

CCoreChrome: keyword param cannot be blank

CCoreChrome: Name param cannot be blank

hXXp://VVV.yahoo.com/favicon.ico

CCoreChrome: url param cannot be blank

failed to set Database keyword search!!

Found existing default search in Chrome: id=

Successfully set Default Search provider in chrome

Chrome v25 or higher detected, skipping keyword_backup and keyword hashing..

Failed to set keyword hash!!

failed to set database keyword search backup table!

CCoreChrome::SetDatabaseKeywordSearch

keywords

UPDATE meta SET value='%s' WHERE key='Default Search Provider ID'

sql string is empty

CCoreChrome::SetDatabaseKeywordSearchBackup

Successfully added default search data to keyword and meta tables

UPDATE meta SET value='%s' WHERE key='Default Search Provider ID Backup'

keywords_backup

CCoreChrome::SetPrefDefaultSearchTemplate

Successfully added default search data to keyword_backup and meta tables

chrome preferences failed to load!

default_search_provider_data/template_url_data/

keyword

favicon_url

suggestions_url

CCoreChrome::FindSearchEntryID

url = '

keyword like '%

url like '%

SELECT id FROM keywords WHERE

Please, don't change this Chrome setting

Setting existing default search in Chrome:

CCoreChrome::SetExistingDefaultSearchUrl

Error opening Chrome Web Data!

Looking up default search url:

unable to set the database keyword hash!

Sqlite is not open!

CCoreChrome::LookupDefaultSearchUrl

SELECT id FROM keywords WHERE short_name='%s'

SELECT id FROM keywords WHERE url='%s'

LookupDefaultSearchUrl: id not found in row

LookupDefaultSearchUrl: url not found in table

CCoreChrome::GetPreference

%local_appdata%\Google\Chrome\User Data\Default\Preferences

CCoreChrome::LoadChromePreferences

UPDATE %s set short_name='%s', keyword='%s', url='%s', favicon_url='%s'

, suggest_url='%s'

, show_in_default_list=%s, safe_for_autoreplace=%s, input_encodings='%s'

INSERT INTO %s (

WHERE id=%s

short_name, keyword, favicon_url, url,

input_encodings, show_in_default_list, suggest_url, prepopulate_id,

safe_for_autoreplace, originating_url, date_created, usage_count,

created_by_policy, instant_url, last_modified, sync_guid) VALUES (

%s, '%s', %s, %s,

'%s', '%s', '%s', '%s',

%s, '%s', %s, '%s')

'%s', %s, '%s', %s,

SELECT id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id || created_by_policy || instant_url || last_modified || sync_guid FROM keywords_backup ORDER BY id ASC

CCoreChrome::GetHashData

INSERT OR REPLACE INTO meta (key,value) VALUES (?,?)

CCoreChrome::InsertHashSignature

%local_appdata%\Google\Chrome\User Data\Default\History

select url from downloads_url_chains where url like '%%%s%%' order by id desc

CoreFirefoxXPIInstaller.cpp

CCoreFirefoxXpiInstaller::Install

CCoreFirefoxXpiInstaller::GetXpiInfo

install.rdf

xml.LoadBuffer failed on

Firefox.exe not found!

Installing Firefox add-ons via package...

installiq.xpi

Create install.rdf failed!

CCoreFirefoxXpiInstaller::InstallAsPackage

Running Firefox to install add-ons:

Error running Firefox!

xmlns:NC="hXXp://home.netscape.com/NC-rdf#"

xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">

multi@installiq.com

{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

*.*.*

Error creating install.rdf!

CCoreFirefoxXpiInstaller::CreateInstallRDF

Installed Firefox extension:

CCoreFirefoxXpiInstaller::SetResult

Can't get Firefox default profiles folder!

CCoreFirefoxXpiInstaller::GetExtensionsFolder

c:\tfs.vs2012\admin\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h

keepmysettingsx.exe

hXXps://installer.freeze.com/LogError.aspx

Restoring V1 toolbar uninstall key...

Error replacing toolbar uninstall key!

Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion

Software\Microsoft\Windows\CurrentVersion\Uninstall\KeepMySettingsX

Renaming V1 uninstall key...

Error opeing uninstall registry key in HKLM\

Error copying V1 registry key!

CoreSearchProtectorApp.cpp

Error removing V1 registry key from HKLM\

CCoreSearchProtectorApp.ShutDown: window not found

Software\Microsoft\Windows\CurrentVersion\Run

Error removing registry key from HKLM\

apiurl

dsotherurl

spotherurl

searchkeyword

hXXp://bing.com

%s/provider[%d]

hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=

hXXp://google.com

firefoxstartpage

firefoxsearch

chromestartpage

chromesearch

config.dat

Yahoo uninstall key not found

Error replacing Yahoo Toolbar uninstall key!

UninstallKey

Software\Microsoft\Windows\CurrentVersion\Uninstall\

UninstallKey=

ChromeStartPage

ChromePriorSearchUrl

FirefoxPriorSearchUrl

ChromePriorStartPage

FirefoxPriorStartPage

CoreBrowserOptionUninstaller.cpp

c:\tfs.vs2012\admin\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h

safari.exe,safariurl,safari

%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies

Loading Safari cookies for url:[

CoreSafari.cpp

%appdata%\Apple Computer\Safari\Cookies\Cookies.plist

Failed to get Safari version key!

safari.exe

-url "%s"

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

Can't find shell associations or shell command reg keys!

CoreBrowser.cpp

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

CREATE TABLE sqlite_master(

sql text

0123456789ABCDEF3.7.5

CREATE TEMP TABLE sqlite_temp_master(

1.2.7

Detect.cpp

Dll %s failed, resultcode = %x

SymCCIS.dll

SymCCIS2.zip

RunDLL productlist="%s" resultcodes="%s"

/execute/text()

Missing ExecuteResult in requirement config!

/executeresult/text()

%programfiles%\iTunes\iTunes.exe

SOFTWARE\Microsoft\Windows Live\Messenger

ydetect.ytb

msnmsgr.exe

ydetect.yhp

ydetect.yas

Rules.cpp

RegKeyExists

regkey

chromeprefs

firefoxprefs

CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf

CDetectionYahooToolbar::IsInstalledFirefox

KeyExists

SourceKey

hkey_local_machine

hkey_current_user

hkey_current_config

hkey_classes_root

multireg: key found:

multireg%d

multireg: unable to parse key:

1.1.0.6

//flag[%d]/text()

Cannot evaluate .NET Version, .NET may not be installed!

DetectionFile.cpp

wajam_validate.zip

wajamexemissing

extracted wajam exe file not found!

Timed out waiting for wajam_validate.exe!

Unable to get returncode from wajam_validate.exe!

wajam_validate.exe detection process result = %d

yahoo.com

live.com

google.com

ask.com

msn.com

aol.com

DetectionFirefoxPrefs.cpp

CDetectionFirefoxPrefs::OnEvaluate

CDetectionChromePrefs::OnEvaluate

DetectionChromePrefs.cpp

)] disabled because of minimum windows version.

minwindowsversion

DetectionRule.cpp

Disabled; Firefox is not installed

Disabled; rule target is not Firefox

Disabled; Chrome is not installed

Disabled; rule target is not Chrome

asktbdet.zip

Ask detection process result = %d

CoreWininet.cpp

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

wininet: connecting to %s:%d

CCoreWininet::HTTPSendRequest

HTTPSendRequest:

httpopenrequest

wininet: HttpOpenRequest failed!

httpreqerr

wininet: Request handle is NULL after HttpSendRequest!

unable to set wininet http decoding

wininet: HttpAddRequestHeaders (post flag) failed!

Content-Type: application/x-www-form-urlencoded

Range: bytes=%u-

httpaddheaders

wininet: HttpAddRequestHeaders (range specification) failed!

Range: bytes=%u-%u

httpaddheader

httpsendreq

wininet: HttpSendRequest failed! (verb=

httptimeout

wininet: HttpQueryInfo failed!

wininet: HttpSendRequest failed!

httpqueryinfo

httpproxy

wininet: Server responded with error: %d, %s. %s %s

wininet: HttpSendRequest: status OK received

httpstatus

wininet: HttpQueryInfo for content range failed!

wininet: HttpQueryInfo for file size failed!

wininet: Operation cancelled by caller.

Software\Microsoft\Windows\CurrentVersion\Internet Settings

HTTP Status %d: %s

API url is invalid!

apiUrl is null!

%m/%d/%Y

Url is null!

%s, %s, l=0xx

[0x%X]

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps