program.Win32.Alureon.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: PUP
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 7a500c46d62f6f39e4bb2716a323bc34
SHA1: cf8def60e9fb0bfea31279286b425171fad8ae84
SHA256: 5ae70cb414bfde75c30df269d8ea3ff97e41f54475a7f014ae1bc87c1acb7ace
SSDeep: 196608:qJjPePN54ROHhwU1e6VZ6ls82/vd8Cz8nXaDGJJe2chXA0e/EI3547BgfWc:qJjPcN6RqKEDf6l92/vd8C8XhJJe2chw
Size: 11227192 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-04-10 15:19:31
Analyzed on: WindowsAda SP3 32-bit
Summary: PUP. Potentially Unwanted Program. An application that does not display malicious behavior yet is installed without having first sought affirmative user consent for installation. Users may not realize, due to the nature of the installation procedure, that an application they have not explicitly agreed to has been installed. This category can also be used to classify other applications which in a certain context can be wanted e.g. remote administration tools or IRC clients.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The program creates the following process(es):
%original file name%.exe:2104
BrowserExtensionsSetup.exe:3144
install.exe:820
BackupSetup.exe:4068
msfeedssync.exe:3180
CouponsHelper.exe:3544
vcredist_x86.exe:348
MsiExec.exe:2516
taskkill.exe:3616
taskkill.exe:368
~sp2E.tmp:3176
BrowserExtensionsSetupUAC.exe:3536
SearchProtectionStub.exe:2548
IEXPLORE.EXE:2676
Cloud_Backup_Setup.exe:2332
exthelper.exe:1888
The program injects its code into the following process(es):
SearchProtection.EXE:3452
IEXPLORE.EXE:2880
MyPC Backup.exe:1212
File activity
The process %original file name%.exe:2104 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\prop-base\libfilesystem_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\eula.rtf (6629 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\COPYING.Apachev2 (11 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\entries (424 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\libdirectsound_plugin.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\inst_finish (1 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libdirect3d_plugin.dll.svn-base (2392 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\manual.bat (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\MPB_EULA.txt (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\prop-base\libdirectsound_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libdirect3d_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\UserInfo.dll (4 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libwingdi_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1060.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\all-wcprops (315 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\ytd.exe (49631 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1055.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1053.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\libswscale_plugin.dll (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\System.dll (11 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Uninstall.exe (7446 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\librtmp.dll (60186 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1036.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1029.ini (13 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\YTD Video Downloader\Uninstall.lnk (1 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\text-base\libfloat_mixer_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\prop-base\libfloat_mixer_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\YTD Video Downloader\Web site.url (55 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\LICENSE (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\pixel (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\YTD Video Downloader\YTD Video Downloader.lnk (1 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1033.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1051.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1026.ini (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\scripts.yds (6360 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\entries (797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso27.tmp (772223 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1059.ini (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\NSISHelper.dll (8560 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\entries (428 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\all-wcprops (711 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res2052.ini (12 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\entries (431 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv2 (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv3 (7 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libwingdi_plugin.dll.svn-base (1856 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libugly_resampler_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1049.ini (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\entries (941 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res2070.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1035.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1040.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\text-base\libswscale_plugin.dll.svn-base (19096 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libwingdi_plugin.dll (1856 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1031.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libdrawable_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1034.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1048.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libvmem_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\prop-base\libtrivial_channel_mixer_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\nsDialogs.dll (9 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\prop-base\libaudio_format_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res2074.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdirect3d_plugin.dll (2392 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\prop-base\libswscale_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\tb-header.bmp (3312 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1044.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\libavcodec_plugin.dll (326900 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\text-base\libfilesystem_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libugly_resampler_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\libvlc.dll (3616 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\all-wcprops (293 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\libfilesystem_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1025.ini (15 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libvmem_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libvmem_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\entries (422 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libaudio_format_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1030.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res9999.ini (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\all-wcprops (831 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\all-wcprops (301 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\modern-header.bmp (6624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\Cloud_Backup_Setup.exe (6360 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\all-wcprops (307 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\prop-base\libinteger_mixer_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1061.ini (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\SearchProtectionStub.exe (13368 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libinteger_mixer_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\libvlccore.dll (69435 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libtrivial_channel_mixer_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1032.ini (784 bytes)
%Documents and Settings%\All Users\Desktop\YTD Video Downloader.lnk (942 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\FFMPEG.EXE (395158 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdrawable_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1052.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1045.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libdrawable_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\text-base\libinteger_mixer_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\entries (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\inst_start (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\getCountry (2 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\prop-base\libugly_resampler_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\text-base\libdirectsound_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libaudio_format_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libfloat_mixer_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\all-wcprops (500 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1050.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1038.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\text-base\libavcodec_plugin.dll.svn-base (326900 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\prop-base\libavcodec_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\exthelper.exe (49441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\NSISdl.dll (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1043.ini (13 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\inst_start (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\getCountry (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\pixel (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\eula.rtf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\MPB_EULA.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\NSISHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\modern-header.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\exthelper.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\nsDialogs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\tb-header.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso26.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\inst_finish (0 bytes)
The process BrowserExtensionsSetup.exe:3144 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Browser Extensions\nta_1.0.crx (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Coupons64.dll (23936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\NSISCouponsPlugin.dll (17848 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\CouponsHelper.exe (32128 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\ButtonWrap.dll (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss33.tmp (97299 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\deh_1.0.crx (16 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\sh_1.0.crx (14 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Button.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\BrowserExtensionsSetupUAC.exe (16288 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\startpage_2.2.xpi (10 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\saamazon_1.6.xpi (7 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Button64.exe (1856 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\amazonsh_1.0.crx (9 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\coupons_3.1.xpi (10 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Uninstall.exe (14510 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Coupons.dll (20416 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\saebay_1.6.xpi (6 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\ButtonWrap64.dll (8560 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm32.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\NSISCouponsPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\BrowserExtensionsSetupUAC.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\System.dll (0 bytes)
The process install.exe:820 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\dd_vcredistMSI736A.txt (542765 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWL42.tmp (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dd_vcredistUI736A.txt (130962 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\VWL42.tmp (0 bytes)
The process SearchProtection.EXE:3452 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{40DCF3A0-1630-482F-A96D-61C44FD2F2B3}.ico (1107 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (13210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yahoo_ie.xml (459 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data (6968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\favicon[1].ico (1340 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yahoo_ff.xml (803 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\searchplugins\yahoo_ff.xml (1606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Local State (58 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (72 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yahoo_ff.xml (0 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\search.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yahoo_ie.xml (0 bytes)
The process BackupSetup.exe:4068 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Program Files%\MyPC Backup\UnRegisterExtensions.exe (15 bytes)
%Program Files%\MyPC Backup\Database\mpcb_file_cache.db (7 bytes)
%Program Files%\MyPC Backup\AWSSDK.dll (71948 bytes)
%Program Files%\MyPC Backup\Database\mpcb_sig_cache.db (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\System.dll (11 bytes)
%Program Files%\MyPC Backup\mypcbackup.ico (7146 bytes)
%Program Files%\MyPC Backup\Crypto32.dll (2716 bytes)
%Program Files%\MyPC Backup\syncicon.ico (3454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vcredist_x86.exe (382688 bytes)
%Program Files%\MyPC Backup\diffstack.dll (2980 bytes)
%Program Files%\MyPC Backup\AlphaVSS.60.x86.dll (5823 bytes)
%Program Files%\MyPC Backup\Crypto64.dll (2300 bytes)
%Program Files%\MyPC Backup\AlphaVSS.Common.dll (3296 bytes)
%Program Files%\MyPC Backup\Database\mpcb_backup_conf.db (16 bytes)
%Program Files%\MyPC Backup\Service Start.exe (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\ns3B.tmp (6 bytes)
%Program Files%\MyPC Backup\x86\System.Data.SQLite.dll (20659 bytes)
%Program Files%\MyPC Backup\AlphaVSS.52.x64.dll (4240 bytes)
%Program Files%\MyPC Backup\BackupStack.exe (1938 bytes)
%Program Files%\MyPC Backup\uninst.exe (1797 bytes)
%Program Files%\MyPC Backup\AlphaVSS.51.x86.dll (4106 bytes)
%Program Files%\MyPC Backup\RegisterExtensionDotNet20_x86.exe (20 bytes)
%Program Files%\MyPC Backup\es_ES.mo (1831 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsRandom.dll (479 bytes)
%Documents and Settings%\%current user%\Desktop\MyPC Backup.lnk (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\NSISdl.dll (14 bytes)
%Program Files%\MyPC Backup\GetText.dll (12 bytes)
%Program Files%\MyPC Backup\Shared Stack.dll (62611 bytes)
%Program Files%\MyPC Backup\MPCBContextMenu.dll (149087 bytes)
%Program Files%\MyPC Backup\LogicNP.EZShellExtensions.dll (6579 bytes)
%Program Files%\MyPC Backup\Updater.exe (30085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mpbtrk.log (8 bytes)
%Program Files%\MyPC Backup\tick.ico (8864 bytes)
%Program Files%\MyPC Backup\Signup Wizard.exe (24414 bytes)
%Program Files%\MyPC Backup\de_DE.mo (1702 bytes)
%Program Files%\MyPC Backup\AlphaVSS.60.x64.dll (6324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\ns3A.tmp (6 bytes)
%Program Files%\MyPC Backup\MyPC Backup.exe (64373 bytes)
%Program Files%\MyPC Backup\syncing.ico (7445 bytes)
%Program Files%\MyPC Backup\MPCBIconOverlays.dll (85918 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\MyPC Backup.lnk (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\AccessControl.dll (8 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\MyPC Backup\MyPC Backup.lnk (774 bytes)
%Program Files%\MyPC Backup\Database\mpcb_queues.db (13 bytes)
%Program Files%\MyPC Backup\AlphaVSS.52.x86.dll (5025 bytes)
%Program Files%\MyPC Backup\RegisterExtensionDotNet20_x64.exe (16 bytes)
%Program Files%\MyPC Backup\it_IT.mo (1925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsSCM.dll (5 bytes)
%Program Files%\MyPC Backup\pt_PT.mo (1605 bytes)
%Program Files%\MyPC Backup\MPCBClient.dll (28694 bytes)
%Program Files%\MyPC Backup\ObjectListView.dll (13129 bytes)
%Program Files%\MyPC Backup\fr_FR.mo (1621 bytes)
%Program Files%\MyPC Backup\Database\mpcb_settings.db (9 bytes)
%Program Files%\MyPC Backup\RestartExplorer.exe (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\DotNetChecker.dll (1123 bytes)
%Program Files%\MyPC Backup\Configuration Updater.exe (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsExec.dll (6 bytes)
%Program Files%\MyPC Backup\x64\System.Data.SQLite.dll (20635 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\MyPC Backup\Uninstall.lnk (545 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg38.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsSCM.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\ns3A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsRandom.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\DotNetChecker.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\ns3B.tmp (0 bytes)
The process msfeedssync.exe:3180 makes changes in the file system.
The program creates and/or writes to the following file(s):
%WinDir%\Tasks\User_Feed_Synchronization-{414D0F7C-B684-437B-B53E-8AB5AE32E070}.job (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\SuggestedSites.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms (2176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\ie8[1].txt (644 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms (14084 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms (3314 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\rss[1].xml (6141 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms (3314 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\Internet Explorer Suggested Sites~.feed-ms (2184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\rss[1].xml (5486 bytes)
The process CouponsHelper.exe:3544 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\main.xul (681 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\config.json (225 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\amazon.xul (583 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\main.js (367 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\spigot.js (3 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\saebay.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\prefs.txt (171 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions.json (31 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\newtab.xul (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\config.json (292 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\icon.png (196 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\redirects.js (196 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome.manifest (148 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\prefs.txt (14 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\spigot.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\main.js (397 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\main.js (359 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome.manifest (192 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\config.json (295 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\main.js (386 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\amazon.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\spigot.js (3 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\startpage.js (392 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\icon.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}\chrome\content\config.json (278 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\icon.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\prefs.txt (110 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\ebay.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\savingsslider.xul (606 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\savingsslider.js (392 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome.manifest (125 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\saamazon.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\spigot.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\icon.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome.manifest (131 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\ebay.xul (569 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\prefs.txt (12 bytes)
The process vcredist_x86.exe:348 makes changes in the file system.
The program creates and/or writes to the following file(s):
C:\e22922a92f95b9889678f2\eula.1040.txt (13 bytes)
C:\e22922a92f95b9889678f2\install.res.1042.dll (1851 bytes)
C:\e22922a92f95b9889678f2\install.res.1028.dll (693 bytes)
C:\e22922a92f95b9889678f2\install.res.1036.dll (1925 bytes)
C:\e22922a92f95b9889678f2\$shtdwn$.req (788 bytes)
C:\e22922a92f95b9889678f2\install.res.1033.dll (1390 bytes)
C:\e22922a92f95b9889678f2\eula.1033.txt (10 bytes)
C:\e22922a92f95b9889678f2\install.ini (844 bytes)
C:\e22922a92f95b9889678f2\install.res.1040.dll (1754 bytes)
C:\e22922a92f95b9889678f2\globdata.ini (1 bytes)
C:\e22922a92f95b9889678f2\eula.2052.txt (405 bytes)
C:\e22922a92f95b9889678f2\install.res.1041.dll (983 bytes)
C:\e22922a92f95b9889678f2\vc_red.msi (3475 bytes)
C:\e22922a92f95b9889678f2 (8 bytes)
C:\e22922a92f95b9889678f2\eula.1036.txt (224 bytes)
C:\e22922a92f95b9889678f2\eula.1041.txt (5 bytes)
C:\e22922a92f95b9889678f2\eula.1028.txt (3 bytes)
C:\e22922a92f95b9889678f2\install.exe (8790 bytes)
C:\e22922a92f95b9889678f2\vcredist.bmp (5 bytes)
C:\e22922a92f95b9889678f2\eula.3082.txt (12 bytes)
C:\e22922a92f95b9889678f2\eula.1042.txt (5 bytes)
C:\e22922a92f95b9889678f2\eula.1049.txt (387 bytes)
C:\e22922a92f95b9889678f2\vc_red.cab (56236 bytes)
C:\e22922a92f95b9889678f2\install.res.3082.dll (1487 bytes)
C:\e22922a92f95b9889678f2\install.res.2052.dll (1368 bytes)
C:\e22922a92f95b9889678f2\install.res.1049.dll (1437 bytes)
C:\e22922a92f95b9889678f2\install.res.1031.dll (1585 bytes)
C:\e22922a92f95b9889678f2\eula.1031.txt (15 bytes)
The program deletes the following file(s):
C:\e22922a92f95b9889678f2\eula.1040.txt (0 bytes)
C:\_678953_ (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1042.dll (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1028.dll (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1036.dll (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1033.dll (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1049.dll (0 bytes)
C:\e22922a92f95b9889678f2\install.ini (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1040.dll (0 bytes)
C:\e22922a92f95b9889678f2\globdata.ini (0 bytes)
C:\e22922a92f95b9889678f2\eula.2052.txt (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1041.dll (0 bytes)
C:\e22922a92f95b9889678f2\vc_red.msi (0 bytes)
C:\e22922a92f95b9889678f2 (0 bytes)
C:\e22922a92f95b9889678f2\eula.1036.txt (0 bytes)
C:\e22922a92f95b9889678f2\eula.1041.txt (0 bytes)
C:\e22922a92f95b9889678f2\eula.1042.txt (0 bytes)
C:\e22922a92f95b9889678f2\install.exe (0 bytes)
C:\e22922a92f95b9889678f2\vcredist.bmp (0 bytes)
C:\e22922a92f95b9889678f2\eula.3082.txt (0 bytes)
C:\e22922a92f95b9889678f2\eula.1028.txt (0 bytes)
C:\e22922a92f95b9889678f2\eula.1049.txt (0 bytes)
C:\e22922a92f95b9889678f2\vc_red.cab (0 bytes)
C:\e22922a92f95b9889678f2\install.res.3082.dll (0 bytes)
C:\e22922a92f95b9889678f2\install.res.2052.dll (0 bytes)
C:\e22922a92f95b9889678f2\eula.1033.txt (0 bytes)
C:\e22922a92f95b9889678f2\install.res.1031.dll (0 bytes)
C:\e22922a92f95b9889678f2\eula.1031.txt (0 bytes)
The process ~sp2E.tmp:3176 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Search Protection\SearchProtection.exe (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz30.tmp (107044 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\BrowserExtensionsSetup.exe (60186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\SDSPlugin.dll (22552 bytes)
%Documents and Settings%\%current user%\Application Data\Search Protection\Uninstall.exe (12076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\System.dll (11 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\BrowserExtensionsSetup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\SDSPlugin.dll (0 bytes)
The process BrowserExtensionsSetupUAC.exe:3536 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst36.tmp (14354 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\NSISCouponsPlugin.dll (17848 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\NSISCouponsPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse35.tmp (0 bytes)
The process SearchProtectionStub.exe:2548 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2D.tmp\SDSPlugin.dll (22552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2D.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2C.tmp (19153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~sp2E.tmp (321984 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2D.tmp\SDSPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2D.tmp\System.dll (0 bytes)
The process IEXPLORE.EXE:2880 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Cookies\7KKWMT6B.txt (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\thankyou[1].htm (413 bytes)
%Documents and Settings%\%current user%\Cookies\A8WL5QB4.txt (919 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\7R8AXHHW\www.ytddownloader[1].xml (411 bytes)
%Documents and Settings%\%current user%\Cookies\3K5PFZ4L.txt (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\favicon[1].ico (9513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\dgdTycPTSRj[1].js (1186 bytes)
%Documents and Settings%\%current user%\Cookies\Y3E99XUS.txt (613 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\jquery.min[1].js (61363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\top-header-bg[1].jpg (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\ytd-logo[1].png (14728 bytes)
%Documents and Settings%\%current user%\Cookies\56E8VQFU.txt (87 bytes)
%Documents and Settings%\%current user%\Cookies\IO95CMW0.txt (385 bytes)
%Documents and Settings%\%current user%\Cookies\PJAYQ3JJ.txt (285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\header-bg[1].jpg (43912 bytes)
%Documents and Settings%\%current user%\Cookies\DEJ3GPCM.txt (327 bytes)
%Documents and Settings%\%current user%\Cookies\TW0Y1UD8.txt (613 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\styles[1].css (4529 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\core131[1].js (121395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\sh158[1].html (9923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\counter017[1].js (5915 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\widget120[1].css (45783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\all[1].js (87362 bytes)
%Documents and Settings%\%current user%\Cookies\4JILEPXF.txt (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\upgrade-pro-btn[1].png (6454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\header-bg-repeat[1].jpg (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\counter014[1].css (2977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\300lo[1].json (91 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\shares[1].json (55 bytes)
%Documents and Settings%\%current user%\Cookies\V9ILT370.txt (129 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\dgdTycPTSRj[1].htm (1970 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\YYGJFIDB\s7.addthis[1].xml (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\dgdTycPTSRj[2].htm (1094 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\main[1].js (25 bytes)
%Documents and Settings%\%current user%\Cookies\NBF8N5AK.txt (297 bytes)
%Documents and Settings%\%current user%\Cookies\O468AV3W.txt (697 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\ga[1].js (28634 bytes)
%Documents and Settings%\%current user%\Cookies\0KPRCZS7.txt (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\addthis_widget[1].js (3069 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\7KKWMT6B.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\56E8VQFU.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\IO95CMW0.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\O468AV3W.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\3K5PFZ4L.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\PJAYQ3JJ.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Y3E99XUS.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\widget120[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\0KPRCZS7.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\counter014[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\DEJ3GPCM.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\V9ILT370.txt (0 bytes)
The process IEXPLORE.EXE:2676 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~DFF65E.tmp (4605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DFDEEC.tmp (3263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{B5B36C2E-DAAE-11E3-81D1-0050563EC483}.dat (15783 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B5B36C2F-DAAE-11E3-81D1-0050563EC483}.dat (18695 bytes)
The process MyPC Backup.exe:1212 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D236B74794790D9923905972356B8BEC (448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3D.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar3E.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (126 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D236B74794790D9923905972356B8BEC (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Program Files%\MyPC Backup\Database\mpcb_settings.db (2260 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
%Documents and Settings%\%current user%\Desktop\Sync Folder.lnk (1 bytes)
%Program Files%\MyPC Backup\log\WAIT_HANDLES.log (540 bytes)
%Program Files%\MyPC Backup\Database\mpcb_settings.db-journal (27036 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Tar3E.tmp (0 bytes)
%Program Files%\MyPC Backup\Database\mpcb_settings.db-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3D.tmp (0 bytes)
The process Cloud_Backup_Setup.exe:2332 makes changes in the file system.
The program creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aff.conf (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2A.tmp\LogEx.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\log.txt (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2A.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BackupSetup.exe (1052338 bytes)
The program deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2A.tmp\LogEx.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2A.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss29.tmp (0 bytes)
Registry activity
The process %original file name%.exe:2104 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"DisplayVersion" = "4.8.1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"NoModify" = "1"
[HKLM\SOFTWARE\{DAF8B7E5-449D-4180-8281-10E536E597F2}]
"it" = "20140513175552"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"VersionMajor" = "4"
"UninstallString" = "%Program Files%\GreenTree Applications\YTD Video Downloader\uninstall.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"VersionMinor" = "8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"NoRepair" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKCU\Software\GreenTree Applications\YTD]
"ISN" = "2A0E0F74E87C41248D17D84CDB01E7BE"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"MainApp" = "%Program Files%\GreenTree Applications\YTD Video Downloader\ytd.exe"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse28.tmp\Cloud_Backup_Setup.exe,"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"InstallLocation" = "%Program Files%\GreenTree Applications\YTD Video Downloader\"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"Publisher" = "GreenTree Applications SRL"
[HKLM\SOFTWARE\{DAF8B7E5-449D-4180-8281-10E536E597F2}]
"(Default)" = "4.8.1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"InstallDir" = "%Program Files%\GreenTree Applications\YTD Video Downloader\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"DisplayIcon" = "%Program Files%\GreenTree Applications\YTD Video Downloader\ytd.exe,0"
[HKCU\Software\GreenTree Applications\YTD]
"Language" = "1033"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 8E 0A 56 5A 78 9D 38 B9 14 37 7E 94 9A 6E 73"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\GreenTree Applications\YTD]
"(Default)" = "%Program Files%\GreenTree Applications\YTD Video Downloader"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}]
"DisplayName" = "YTD Video Downloader 4.8.1"
"URLInfoAbout" = "http://www.ytddownloader.com"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\GreenTree Applications\YTD]
"kitType" = "cnet"
The process BrowserExtensionsSetup.exe:3144 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"InstallLocation" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}]
"AppName" = "Button.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"VersionMinor" = "4"
"URLInfoAbout" = "http://www.spigot.com"
"NoRepair" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\AppDataLow\Software\Browser Extensions\firefox]
"savingsslider@mybrowserbar.com" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\coupons_3.1.xpi|1|{cnid : 407453, cnid_overwrite : true}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}]
"AppPath" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions"
[HKCU\Software\AppDataLow\Software\Browser Extensions\firefox]
"saebay@mybrowserbar.com" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\saebay_1.6.xpi|1|{cnid : 407453, cnid_overwrite : true}"
[HKCU\Software\AppDataLow\Software\Browser Extensions\iexplorer]
"cnid" = "407453"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse28.tmp\Cloud_Backup_Setup.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse28.tmp\SearchProtectionStub.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse28.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh34.tmp\BrowserExtensionsSetupUAC.exe,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\AppDataLow\Software\Browser Extensions]
"cnid" = "407453"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\AppDataLow\Software\Browser Extensions\iexplorer]
"iedns" = "1"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61db39d5-034c-45c0-8bb2-daf857edcf3b}]
"AppName" = "Button64.exe"
"Policy" = "3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\CouponsHelper.exe,0"
[HKCU\Software\AppDataLow\Software\Browser Extensions\iexplorer]
"ieam" = "1"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61db39d5-034c-45c0-8bb2-daf857edcf3b}]
"AppPath" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions"
[HKCU\Software\AppDataLow\Software\Browser Extensions\firefox]
"saamazon@mybrowserbar.com" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\saamazon_1.6.xpi|1|{cnid : 407453, cnid_overwrite : true}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\AppDataLow\Software\Browser Extensions]
"SS_Ver" = "1.5"
[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}" = "51 66 7A 6C 4C 1D 3B 1B 5B C7 BA 29 EF 9C A8 04"
[HKCU\Software\AppDataLow\Software\Browser Extensions\firefox]
"{58d2a791-6199-482f-a9aa-9b725ec61362}" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\startpage_2.2.xpi|1|{dns : true, ntp :true, cnid : 407453, cnid_overwrite : true, dummy : true}"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"VersionMajor" = "1"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"AppPath" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"NoModify" = "1"
[HKCU\Software\AppDataLow\Software\Browser Extensions\iexplorer]
"iecp" = "1"
"ieeb" = "1"
[HKCU\Software\AppDataLow\Software\Browser Extensions]
"ISN" = "4E827B34725D438C88043AFFC3DC9C0E"
[HKCU\Software\AppDataLow\Software\Browser Extensions\chrome]
"nlcphjankhppgohedpkjonpadimhaoof" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\sh_1.0.crx|1|{cps :true, cps_overwrite : true, cnid : 407453, cnid_overwrite : true, dummy : true}"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"Publisher" = "Spigot, Inc."
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 28 18 57 F9 DD 35 46 4E DA F0 3A 5C 11 D9 A4"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"AppName" = "CouponsHelper.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"DisplayVersion" = "1.5"
[HKCU\Software\AppDataLow\Software\Browser Extensions\chrome]
"gpiifgmgnfdiblgpaepbmfdkcheicgof" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\nta_1.0.crx|1|{ntp :true, ntp_overwrite : true, custom_dea_ntp_disabled : false, cnid : 407453, cnid_overwrite : true, dummy : true}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\uninstall.exe"
[HKCU\Software\AppDataLow\Software\Browser Extensions]
"(Default)" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\AppDataLow\Software\Browser Extensions\iexplorer]
"ISN" = "4E827B34725D438C88043AFFC3DC9C0E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"DisplayName" = "Browser Extensions"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\Coupons64.dll"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"Policy" = "3"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh34.tmp]
"BrowserExtensionsSetupUAC.exe" = "Browser Extensions setup launcher UAC"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\Implemented Categories]
"(Default)" = ""
[HKCU\Software\AppDataLow\Software\Browser Extensions\chrome]
"cikkkfooompgefbcjlgdjejfdknkheaj" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\deh_1.0.crx|1|{dns : true, dns_overwrite : true, cnid : 407453, cnid_overwrite : true, dummy : true}"
"bbecdmcnlcoebdcidcfdkoimbjkcegbc" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\amazonsh_1.0.crx|1|{cnid : 407453, cnid_overwrite : true}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}]
"Policy" = "3"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
"(Default)" = "Browser Extensions"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
"NoExplorer" = "1"
"(Default)" = "Browser Extensions"
To automatically run itself each time Windows is booted, the program adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Browser Extensions" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\CouponsHelper.exe"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}"
The process install.exe:820 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B A6 33 AC C0 03 9C FD CA 5B 04 D3 25 DC FD A5"
The process SearchProtection.EXE:3452 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{40DCF3A0-1630-482F-A96D-61C44FD2F2B3}"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{40DCF3A0-1630-482F-A96D-61C44FD2F2B3}]
"FaviconURL" = "http://www.yahoo.com/favicon.ico"
"FaviconPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{40DCF3A0-1630-482F-A96D-61C44FD2F2B3}.ico"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\AppDataLow\Software\Search Protection]
"ping_ts" = "1399992989"
"GCFailed" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{40DCF3A0-1630-482F-A96D-61C44FD2F2B3}]
"URL" = "http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=407453&p={searchTerms}"
"OSDFileURL" = "file:///C:/DOCUME~1/adm/LOCALS~1/Temp/yahoo_ie.xml"
[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"
[HKCU\Software\Microsoft\Internet Explorer\User Preferences]
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977" = "01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 15 F0 62 DD 63 C9 97 B0 A5 79 F8 4A F6 A1 23"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://ca.search.yahoo.com/?type=407453&fr=spigot-yhp-ie"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"ShowSearchSuggestionsInAddressGlobal" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\AppDataLow\Software\Search Protection]
"FFFailed" = "0"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{40DCF3A0-1630-482F-A96D-61C44FD2F2B3}]
"DisplayName" = "Yahoo"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process BackupSetup.exe:4068 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MyPC Backup]
"(Default)" = "%Program Files%\MyPC Backup\BackupStack.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse28.tmp\Cloud_Backup_Setup.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse28.tmp\SearchProtectionStub.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse28.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh34.tmp\BrowserExtensionsSetupUAC.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh34.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg39.tmp\nsSCM.dll,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"DisplayName" = "MyPC Backup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"URLInfoAbout" = "http://www.mypcbackup.com"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"Publisher" = "JDi Backup Ltd"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"DisplayIcon" = "%Program Files%\MyPC Backup\MyPC Backup.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"UninstallString" = "%Program Files%\MyPC Backup\uninst.exe"
"HelpLink" = "http://support.mypcbackup.com"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 DE 3F 50 3F 75 5F BD DF AA 06 54 1B 9F E5 6C"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\MyPC Backup]
"MyPC Backup.exe" = "MyPC Backup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"DisplayVersion" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process msfeedssync.exe:3180 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 DB 2E 18 EE 8B 81 33 82 43 ED DA 08 6C 95 61"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Internet Explorer\Suggested Sites]
"DeletePending" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Internet Explorer\Suggested Sites]
"UploadDiagInfo" = "1C 5C 00 00 71 17 00 08 00 00 00 00 00 00 00 0C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process CouponsHelper.exe:3544 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 88 7F 08 72 50 11 65 8A 39 03 5C F7 06 69 16"
[HKCU\Software\AppDataLow\Software\Browser Extensions\firefox]
"{58d2a791-6199-482f-a9aa-9b725ec61362}" = ""
"saamazon@mybrowserbar.com" = ""
[HKLM\SOFTWARE\Google\Chrome\Extensions\bbecdmcnlcoebdcidcfdkoimbjkcegbc]
"Path" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\amazonsh_1.0.crx"
"Version" = "1.0"
[HKLM\SOFTWARE\Google\Chrome\Extensions\gpiifgmgnfdiblgpaepbmfdkcheicgof]
"Version" = "1.0"
"Path" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\nta_1.0.crx"
[HKLM\SOFTWARE\Google\Chrome\Extensions\cikkkfooompgefbcjlgdjejfdknkheaj]
"Path" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\deh_1.0.crx"
[HKLM\SOFTWARE\Google\Chrome\Extensions\nlcphjankhppgohedpkjonpadimhaoof]
"Version" = "1.0"
[HKCU\Software\AppDataLow\Software\Browser Extensions\firefox]
"savingsslider@mybrowserbar.com" = ""
[HKLM\SOFTWARE\Google\Chrome\Extensions\nlcphjankhppgohedpkjonpadimhaoof]
"Path" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\sh_1.0.crx"
[HKCU\Software\AppDataLow\Software\Browser Extensions\firefox]
"saebay@mybrowserbar.com" = ""
[HKLM\SOFTWARE\Google\Chrome\Extensions\cikkkfooompgefbcjlgdjejfdknkheaj]
"Version" = "1.0"
The process vcredist_x86.exe:348 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 71 48 07 79 86 D5 DB 63 6B A7 68 43 1B D7 C1"
The process MsiExec.exe:2516 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 8D 22 0A EB 76 3B 24 D6 67 D0 EF 30 45 D6 B2"
The process taskkill.exe:3616 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E C0 2D F8 F9 15 19 06 2A EA D4 C5 4A F7 C9 A6"
The process taskkill.exe:368 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 A9 CC 54 C0 96 DB CE 39 A6 51 A2 3E 0F 7F FF"
The process ~sp2E.tmp:3176 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"VersionMajor" = "1"
[HKCU\Software\AppDataLow\Software\Search Protection]
"CCV" = "179"
"WS_FF_AB" = "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=407453&p="
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"NoRepair" = "1"
[HKCU\Software\AppDataLow\Software\Search Protection]
"WS_GC_IB" = "http://search.yahoo.com/search?fr=chr-greentree_gc&ei=utf-8&ilc=12&type=407453&p={searchTerms}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\AppDataLow\Software\Search Protection]
"HP_IE" = "http://ca.search.yahoo.com/?type=407453&fr=spigot-yhp-ie"
"WS_FF_IB" = "http://search.yahoo.com/search?fr=chr-greentree_ff&ei=utf-8&ilc=12&type=407453&p={searchTerms}"
"ISN" = "E2DA97D8A12A4D02B7A3A58A402F38B0"
"ChannelID" = "407453"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\AppDataLow\Software\Search Protection]
"HP_GC" = "http://ca.search.yahoo.com/?type=407453&fr=spigot-yhp-ch"
"407453" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\Search Protection\uninstall.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\AppDataLow\Software\Search Protection]
"sdsprotection" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"NoModify" = "1"
[HKCU\Software\AppDataLow\Software\Search Protection]
"app_ver" = "8.9.0.2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"DisplayName" = "Search Protection"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"URLInfoAbout" = "http://www.spigot.com"
"VersionMinor" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 CB 0C 90 F6 7B 67 2C 75 9C 5D 2D 00 8B 53 E4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"Publisher" = "Spigot, Inc."
[HKCU\Software\AppDataLow\Software\Search Protection]
"SPID" = "249"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"DisplayVersion" = "8.9.0.2"
[HKCU\Software\AppDataLow\Software\Search Protection]
"WS_IE_IB" = "http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=407453&p={searchTerms}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"InstallDir" = "%Documents and Settings%\%current user%\Application Data\Search Protection\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\AppDataLow\Software\Search Protection]
"HP_FF" = "http://ca.search.yahoo.com/?type=407453&fr=spigot-yhp-ff"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Protection]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\Search Protection\SearchProtection.EXE,0"
"InstallLocation" = "%Documents and Settings%\%current user%\Application Data\Search Protection\"
[HKCU\Software\AppDataLow\Software\Search Protection]
"WS_IE_AB" = "http://search.yahoo.com/search?fr=greentree_ie1&ei=utf-8&ilc=12&type=407453&p={searchTerms}"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
To automatically run itself each time Windows is booted, the program adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SearchProtection" = "%Documents and Settings%\%current user%\Application Data\Search Protection\SearchProtection.EXE /autostart"
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process BrowserExtensionsSetupUAC.exe:3536 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}]
"AppName" = "Button.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}]
"(Default)" = ""
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}]
"AppPath" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61db39d5-034c-45c0-8bb2-daf857edcf3b}]
"AppName" = "Button64.exe"
"Policy" = "3"
"AppPath" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"AppPath" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 21 94 12 67 0A 50 F6 B5 F8 2F 18 89 B1 4F 08"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"AppName" = "CouponsHelper.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\Coupons64.dll"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}]
"Policy" = "3"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}\Implemented Categories]
"(Default)" = ""
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}]
"Policy" = "3"
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
"(Default)" = "Browser Extensions"
It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
"NoExplorer" = "1"
"(Default)" = "Browser Extensions"
The process SearchProtectionStub.exe:2548 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 A4 0F 08 F9 87 AC 86 69 DA 4F 9D 33 F4 60 3A"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 01 00 00 00 00 00 00 00"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process IEXPLORE.EXE:2880 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_20"
[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_21"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_27"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_22"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Type" = "1"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Internet Explorer\DOMStorage\addthis.com]
"(Default)" = "13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_27"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Type" = "3"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_21"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_21"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_27"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_27"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Type" = "3"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_22"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_29"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Count" = "28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_22"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_04"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
"(Default)" = "Java Plug-in 1.3.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_18"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Time" = "DE 07 05 00 02 00 0D 00 0E 00 38 00 07 00 D8 02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_17"
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
"(Default)" = "{5852F5ED-8BF4-11D4-A245-0080C6F74284}"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_24"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"LoadTime" = "550"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_26"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_20"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_29"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_21"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_22"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"LoadTime" = "7"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_23"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_18"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA8A9780-280D-11CF-A24D-444553540000}\iexplore]
"Flags" = "0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Internet Explorer\DOMStorage\Total]
"(Default)" = "56"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_24"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Count" = "28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_19"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_26"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_23"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_22"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_23"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Count" = "25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_23"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_26"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_20"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_29"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA8A9780-280D-11CF-A24D-444553540000}\iexplore]
"Type" = "1"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_24"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_26"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_20"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_24"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_26"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_26"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
"(Default)" = "Java Plug-in 1.6.0_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_27"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_29"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Count" = "16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_19"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Time" = "DE 07 05 00 02 00 0D 00 0E 00 38 00 08 00 74 03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_20"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_23"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_22"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_29"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Type" = "3"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_19"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_21"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_26"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_29"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA8A9780-280D-11CF-A24D-444553540000}\iexplore]
"Time" = "DE 07 05 00 02 00 0D 00 0E 00 38 00 0B 00 B3 03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_20"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_21"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_19"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_21"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_06"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_10"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_08"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Time" = "DE 07 05 00 02 00 0D 00 0E 00 38 00 07 00 07 03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_23"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_18"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_23"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_16"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA8A9780-280D-11CF-A24D-444553540000}\iexplore]
"Count" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_29"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_04"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_11"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_24"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_24"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 23 DD 48 BE 03 13 DB F0 95 A9 0F A1 E3 0D E8"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_19"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_20"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_05"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_09"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_17"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_19"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"LoadTime" = "30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_07"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_19"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_27"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_25"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_30"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_22"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_01"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_27"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_03"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_06"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_24"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_14"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_08"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Time" = "DE 07 05 00 02 00 0D 00 0E 00 38 00 0B 00 5B 02"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_28"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_12"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_15"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_06"
[HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ytddownloader.com]
"(Default)" = "13"
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_09"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The program deletes the following registry key(s):
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\JavaPlugin.160_18]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process IEXPLORE.EXE:2676 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Count" = "29"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Type" = "4"
"Count" = "29"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"CompatibilityFlags" = "0"
"FullScreen" = "no"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links]
"Order" = "08 00 00 00 02 00 00 00 42 01 00 00 01 00 00 00"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"DisplayName" = ""
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Path" = "%Documents and Settings%\%current user%\Favorites\Links\Web Slice Gallery.url"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"FeedUrl" = "https://ieonline.microsoft.com/#ieslice"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Type" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"ErrorState" = "0"
"FeedUrl" = "http://go.microsoft.com/fwlink/?LinkId=121315"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Time" = "DE 07 05 00 02 00 0D 00 0E 00 38 00 07 00 CE 01"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"DisplayMask" = "0"
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}]
"Enable" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"DisplayName" = ""
[HKCU\Software\Microsoft\Internet Explorer\Recovery\Active]
"{B5B36C2E-DAAE-11E3-81D1-0050563EC483}" = "0"
[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Handler" = "{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"ErrorState" = "0"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Window_Placement" = "2C 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Expiration" = "0"
"DisplayMask" = "0"
[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
"SecuritySafe" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Time" = "DE 07 05 00 02 00 0D 00 0E 00 38 00 07 00 CE 01"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C 55 AD 13 6B 22 EF C4 AA CD AE 1B EE D1 A7 06"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"Handler" = "{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}"
"Path" = "%Documents and Settings%\%current user%\Favorites\Links\Suggested Sites.url"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"Expiration" = "0"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The program deletes the following registry key(s):
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}]
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}]
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000]
[HKCU\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile]
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0]
"Expiration"
[HKCU\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1]
"Expiration"
The process MyPC Backup.exe:1212 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D C4 64 85 DF 2D 2B 5E 38 F2 BD 56 0D 27 EB 89"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
The process Cloud_Backup_Setup.exe:2332 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 37 0B 82 51 BD D6 48 F5 18 A9 82 05 FD 94 F2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process exthelper.exe:1888 makes changes in the system registry.
The program creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 8E E5 2A E6 1C 9F 7A 09 85 49 E7 E7 BF 44 86"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3A 00 00 00 01 00 00 00 00 00 00 00"
The program modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The program modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The program modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The program deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| 0bb90d714e37d22f1efc72f6e6d2615d | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\Button.exe |
| 053ad409e146bd049178c822b44577ce | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\Button64.exe |
| 99aeed1ab4d3728a97c9bd650c4db405 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\ButtonWrap.dll |
| f8009e326366c85e842509f875ed1b1b | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\ButtonWrap64.dll |
| 1f3950302ba2cd77491146081b427c07 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\Coupons.dll |
| 39d87fae8b93c0294602679647754543 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\Coupons64.dll |
| 719f6d7047c2744e21756a336f86ab90 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\CouponsHelper.exe |
| 3f8f68190c205ed52b5c75e9619e1030 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Browser Extensions\Uninstall.exe |
| 4cc2f1c0a729f6be8598db5cfd3e6d3c | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Search Protection\SearchProtection.exe |
| b40ccd65725eb1cf64c3b6ff0af046be | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Search Protection\Uninstall.exe |
| 45922155c9628e11441aa869c6287bb7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\BackupSetup.exe |
| 6994c3fa70378b0ac77486cee8077ed5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse28.tmp\Cloud_Backup_Setup.exe |
| 82d0c4c66511a51ab1c462de73b02aea | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse28.tmp\SearchProtectionStub.exe |
| 62efa7b730eb0523a026ea4325403b77 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg39.tmp\nsSCM.dll |
| 3c18ce9d12a6c9864a45aa74ffc949f2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsh34.tmp\BrowserExtensionsSetupUAC.exe |
| 5689d43c3b201dd3810fa3bba4a6476a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\vcredist_x86.exe |
| f8cf17314c5e065611dfc05b49e485a8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\~sp2E.tmp |
| 39d11c773b46d3084ef4aac1f9863146 | c:\Program Files\GreenTree Applications\YTD Video Downloader\FFMPEG.EXE |
| 62910599d15480d33cd176f7a7b74420 | c:\Program Files\GreenTree Applications\YTD Video Downloader\Uninstall.exe |
| 921b64a7dace4c93161b942b80b6b41b | c:\Program Files\GreenTree Applications\YTD Video Downloader\librtmp.dll |
| ded3aa6b7920334e6b334eaed3db96c5 | c:\Program Files\GreenTree Applications\YTD Video Downloader\libvlc.dll |
| 3c07164ceba1068ee3eff672d8e11eb6 | c:\Program Files\GreenTree Applications\YTD Video Downloader\libvlccore.dll |
| ab0a22194181d6d6ff01123dc9a376ce | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\text-base\libfilesystem_plugin.dll.svn-base |
| ab0a22194181d6d6ff01123dc9a376ce | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\access\libfilesystem_plugin.dll |
| 91074f5c7288c67eaed2c2c657e373d3 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libaudio_format_plugin.dll.svn-base |
| 43f19a5d4d42e3cd6514348ba5fbdd96 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libtrivial_channel_mixer_plugin.dll.svn-base |
| a3297b187aba1024501007bce77eeec4 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libugly_resampler_plugin.dll.svn-base |
| 91074f5c7288c67eaed2c2c657e373d3 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libaudio_format_plugin.dll |
| 43f19a5d4d42e3cd6514348ba5fbdd96 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll |
| a3297b187aba1024501007bce77eeec4 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libugly_resampler_plugin.dll |
| 04a21f5ee0a9c27ca5e5dae050f3d275 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\text-base\libfloat_mixer_plugin.dll.svn-base |
| d4f826e68b616cccc1de1e5ef07738b8 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\text-base\libinteger_mixer_plugin.dll.svn-base |
| 04a21f5ee0a9c27ca5e5dae050f3d275 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libfloat_mixer_plugin.dll |
| d4f826e68b616cccc1de1e5ef07738b8 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libinteger_mixer_plugin.dll |
| 46672363f47a25d69a5324045f4e8d63 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\text-base\libdirectsound_plugin.dll.svn-base |
| 46672363f47a25d69a5324045f4e8d63 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\audio_output\libdirectsound_plugin.dll |
| 4088b4e4ea76db97544c76ef7f2af08c | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\text-base\libavcodec_plugin.dll.svn-base |
| 4088b4e4ea76db97544c76ef7f2af08c | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\codec\libavcodec_plugin.dll |
| 416108272cc56d4036d5796fbb1b8f3c | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\text-base\libswscale_plugin.dll.svn-base |
| 416108272cc56d4036d5796fbb1b8f3c | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_filter\libswscale_plugin.dll |
| 350983ab596397b2d2703d658baeea8c | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libdirect3d_plugin.dll.svn-base |
| 6d9fa70a05698e9b6aa1c6074def16e8 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libdrawable_plugin.dll.svn-base |
| 3dee8d41db28133b3d00bfdf0fd16eaf | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libvmem_plugin.dll.svn-base |
| ccc67f588880568bfd46c4b8140f41aa | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libwingdi_plugin.dll.svn-base |
| 350983ab596397b2d2703d658baeea8c | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdirect3d_plugin.dll |
| 6d9fa70a05698e9b6aa1c6074def16e8 | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdrawable_plugin.dll |
| 3dee8d41db28133b3d00bfdf0fd16eaf | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\libvmem_plugin.dll |
| ccc67f588880568bfd46c4b8140f41aa | c:\Program Files\GreenTree Applications\YTD Video Downloader\plugins\video_output\libwingdi_plugin.dll |
| 547970950271112436efafb4632122a8 | c:\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe |
| e2c80c6c8ba5d2847601c5f8d426b63a | c:\Program Files\MyPC Backup\AWSSDK.dll |
| 5bfc53c0daee82e70ef02b9cf7ae3042 | c:\Program Files\MyPC Backup\AlphaVSS.51.x86.dll |
| ba1d420f7fa1b4eef8cc127bee74a023 | c:\Program Files\MyPC Backup\AlphaVSS.52.x64.dll |
| 568754948b2aa5fcc41217fb28425cc5 | c:\Program Files\MyPC Backup\AlphaVSS.52.x86.dll |
| a3ef02398e089dcd9708cbc4e427d0f7 | c:\Program Files\MyPC Backup\AlphaVSS.60.x64.dll |
| 057cf7fd20135899d616714534d0b7a8 | c:\Program Files\MyPC Backup\AlphaVSS.60.x86.dll |
| 3116e40a8b9709917e1dc1db4e068152 | c:\Program Files\MyPC Backup\AlphaVSS.Common.dll |
| e465525e1cbb92780aac5ad7d3f1cbbf | c:\Program Files\MyPC Backup\BackupStack.exe |
| 3392c789ab50d40131ff8f75df91265b | c:\Program Files\MyPC Backup\Configuration Updater.exe |
| 753da5b59f0fc465ccd60a598d9b5780 | c:\Program Files\MyPC Backup\Crypto32.dll |
| 199b0a1373fc914a9b756b1f9f882899 | c:\Program Files\MyPC Backup\Crypto64.dll |
| 538faef85616bc8d7edc33732be85b5d | c:\Program Files\MyPC Backup\GetText.dll |
| 9b2ac62a9aab3369b253411c14b92fcb | c:\Program Files\MyPC Backup\LogicNP.EZShellExtensions.dll |
| 4eb4e9dd980a3e19754c93b92bc57623 | c:\Program Files\MyPC Backup\MPCBClient.dll |
| 74ad2167e1247dd404e58fdab634d490 | c:\Program Files\MyPC Backup\MPCBContextMenu.dll |
| bb3b81fd209597a178ea239ce39c6fc6 | c:\Program Files\MyPC Backup\MPCBIconOverlays.dll |
| 4bc02235ad1e85455e6ab8c1cc912c64 | c:\Program Files\MyPC Backup\MyPC Backup.exe |
| 5a5498e2176e0f40a8fddd53da88920e | c:\Program Files\MyPC Backup\ObjectListView.dll |
| 4bb211393828d585cb5396a273008d94 | c:\Program Files\MyPC Backup\RegisterExtensionDotNet20_x64.exe |
| 74a8c01b69adedd7f1330245cd994821 | c:\Program Files\MyPC Backup\RegisterExtensionDotNet20_x86.exe |
| 158c16d067a3e27c1234b03aa69120b2 | c:\Program Files\MyPC Backup\RestartExplorer.exe |
| c5d24dd048304856c60a868f896507e4 | c:\Program Files\MyPC Backup\Service Start.exe |
| c48ccef729d6c4539ea57afb179adb38 | c:\Program Files\MyPC Backup\Shared Stack.dll |
| fe2c85a4cf13b37bad7ae065f807dc20 | c:\Program Files\MyPC Backup\Signup Wizard.exe |
| c1b78e5bb7297b4b46f16873d0073123 | c:\Program Files\MyPC Backup\UnRegisterExtensions.exe |
| a1c3cfb658f4546c5b2dbc92e85e88e0 | c:\Program Files\MyPC Backup\Updater.exe |
| 1946bde7c1276752a747bf987bd0ccbf | c:\Program Files\MyPC Backup\diffstack.dll |
| b3f12e4c4aafb56e945ed48d8647b563 | c:\Program Files\MyPC Backup\uninst.exe |
| 9f71303bddecf888cc77c2a486769c9d | c:\Program Files\MyPC Backup\x64\System.Data.SQLite.dll |
| 80725a732aba27911402f9ca09fede23 | c:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll |
| 47857df83c1bd9755afd1c7f0ae65465 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll |
| 7b37f8ec25c9ad853e8126c1d0992201 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll |
| 871f979d70414c900b35e56222932daf | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll |
| 4d03ca609e68f4c90cf66515218017f8 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll |
| b02f2fc742d87f54a94fcd5f4ce71d52 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll |
| 3460a87d70e659c44b9fec195345ac2e | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll |
| d727f282a20ebff629f26e13ce8fcac9 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll |
| 2229324ce0374811ca64a19ee62f130b | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll |
| 154b11cc93fc5a4a03e21d3dedfb5879 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll |
| 0f70ab283544f8dd3e5c7b2c27c34bbf | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll |
| 3c26a63c73eb4d6bda72815fcad79ef2 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll |
| 25b61d43310128c1467c1d51397b5342 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll |
| be48c834229e153ab89bcca1f8309315 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll |
| 6574e30c091c2ac5c99db460094f19a0 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll |
| c1e0a8ab46902ee0e15e02931efcb885 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll |
| 361a47591fd31ec99a9794b6541360a6 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll |
| a76104d8d9aba3670fd3cea603d70ada | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll |
| c38774421c7b64d2c23129a200c60f47 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll |
| db59cce916665d8c9a8a87198daede34 | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll |
| f6a85f3b0e30c96c993c69da6da6079e | c:\WINDOWS\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2104
BrowserExtensionsSetup.exe:3144
install.exe:820
BackupSetup.exe:4068
msfeedssync.exe:3180
CouponsHelper.exe:3544
vcredist_x86.exe:348
MsiExec.exe:2516
taskkill.exe:3616
taskkill.exe:368
~sp2E.tmp:3176
BrowserExtensionsSetupUAC.exe:3536
SearchProtectionStub.exe:2548
IEXPLORE.EXE:2676
Cloud_Backup_Setup.exe:2332
exthelper.exe:1888 - Delete the original program file.
- Delete or disinfect the following files created/modified by the program:
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\prop-base\libfilesystem_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\eula.rtf (6629 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\COPYING.Apachev2 (11 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\entries (424 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\libdirectsound_plugin.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\inst_finish (1 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libdirect3d_plugin.dll.svn-base (2392 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\manual.bat (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\MPB_EULA.txt (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\prop-base\libdirectsound_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libdirect3d_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\UserInfo.dll (4 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libwingdi_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1060.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\all-wcprops (315 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\ytd.exe (49631 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1055.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1053.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\libswscale_plugin.dll (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\System.dll (11 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Uninstall.exe (7446 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\librtmp.dll (60186 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1036.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1029.ini (13 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\YTD Video Downloader\Uninstall.lnk (1 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\text-base\libfloat_mixer_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\prop-base\libfloat_mixer_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\YTD Video Downloader\Web site.url (55 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\LICENSE (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\pixel (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\YTD Video Downloader\YTD Video Downloader.lnk (1 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1033.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1051.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1026.ini (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\scripts.yds (6360 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\entries (797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso27.tmp (772223 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1059.ini (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\NSISHelper.dll (8560 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\entries (428 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\all-wcprops (711 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res2052.ini (12 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\entries (431 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv2 (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv3 (7 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libwingdi_plugin.dll.svn-base (1856 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libugly_resampler_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1049.ini (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\entries (941 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res2070.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1035.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1040.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\text-base\libswscale_plugin.dll.svn-base (19096 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libwingdi_plugin.dll (1856 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1031.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libdrawable_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1034.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1048.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libvmem_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\prop-base\libtrivial_channel_mixer_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\nsDialogs.dll (9 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\prop-base\libaudio_format_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res2074.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdirect3d_plugin.dll (2392 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\prop-base\libswscale_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\tb-header.bmp (3312 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1044.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\libavcodec_plugin.dll (326900 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\text-base\libfilesystem_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libugly_resampler_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\libvlc.dll (3616 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\all-wcprops (293 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\libfilesystem_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1025.ini (15 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\text-base\libvmem_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libvmem_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\entries (422 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libaudio_format_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1030.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res9999.ini (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\all-wcprops (831 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\access\.svn\all-wcprops (301 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\modern-header.bmp (6624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\Cloud_Backup_Setup.exe (6360 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\.svn\all-wcprops (307 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\prop-base\libinteger_mixer_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1061.ini (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\SearchProtectionStub.exe (13368 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libinteger_mixer_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\libvlccore.dll (69435 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libtrivial_channel_mixer_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1032.ini (784 bytes)
%Documents and Settings%\All Users\Desktop\YTD Video Downloader.lnk (942 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\FFMPEG.EXE (395158 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdrawable_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1052.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1045.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\video_output\.svn\prop-base\libdrawable_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\text-base\libinteger_mixer_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\entries (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\inst_start (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\getCountry (2 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\prop-base\libugly_resampler_plugin.dll.svn-base (53 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\.svn\text-base\libdirectsound_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\.svn\text-base\libaudio_format_plugin.dll.svn-base (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libfloat_mixer_plugin.dll (1552 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\.svn\all-wcprops (500 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1050.ini (14 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1038.ini (13 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\text-base\libavcodec_plugin.dll.svn-base (326900 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\plugins\codec\.svn\prop-base\libavcodec_plugin.dll.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\exthelper.exe (49441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse28.tmp\NSISdl.dll (784 bytes)
%Program Files%\GreenTree Applications\YTD Video Downloader\Lang\res1043.ini (13 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\nta_1.0.crx (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Coupons64.dll (23936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\NSISCouponsPlugin.dll (17848 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\CouponsHelper.exe (32128 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\ButtonWrap.dll (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss33.tmp (97299 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\deh_1.0.crx (16 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\sh_1.0.crx (14 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Button.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh34.tmp\BrowserExtensionsSetupUAC.exe (16288 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\startpage_2.2.xpi (10 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\saamazon_1.6.xpi (7 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Button64.exe (1856 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\amazonsh_1.0.crx (9 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\coupons_3.1.xpi (10 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Uninstall.exe (14510 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\Coupons.dll (20416 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\saebay_1.6.xpi (6 bytes)
%Documents and Settings%\%current user%\Application Data\Browser Extensions\ButtonWrap64.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dd_vcredistMSI736A.txt (542765 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWL42.tmp (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dd_vcredistUI736A.txt (130962 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{40DCF3A0-1630-482F-A96D-61C44FD2F2B3}.ico (1107 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (13210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yahoo_ie.xml (459 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\favicon[1].ico (1340 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yahoo_ff.xml (803 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\searchplugins\yahoo_ff.xml (1606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Local State (58 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (72 bytes)
%Program Files%\MyPC Backup\UnRegisterExtensions.exe (15 bytes)
%Program Files%\MyPC Backup\Database\mpcb_file_cache.db (7 bytes)
%Program Files%\MyPC Backup\AWSSDK.dll (71948 bytes)
%Program Files%\MyPC Backup\Database\mpcb_sig_cache.db (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\System.dll (11 bytes)
%Program Files%\MyPC Backup\mypcbackup.ico (7146 bytes)
%Program Files%\MyPC Backup\Crypto32.dll (2716 bytes)
%Program Files%\MyPC Backup\syncicon.ico (3454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vcredist_x86.exe (382688 bytes)
%Program Files%\MyPC Backup\diffstack.dll (2980 bytes)
%Program Files%\MyPC Backup\AlphaVSS.60.x86.dll (5823 bytes)
%Program Files%\MyPC Backup\Crypto64.dll (2300 bytes)
%Program Files%\MyPC Backup\AlphaVSS.Common.dll (3296 bytes)
%Program Files%\MyPC Backup\Database\mpcb_backup_conf.db (16 bytes)
%Program Files%\MyPC Backup\Service Start.exe (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\ns3B.tmp (6 bytes)
%Program Files%\MyPC Backup\x86\System.Data.SQLite.dll (20659 bytes)
%Program Files%\MyPC Backup\AlphaVSS.52.x64.dll (4240 bytes)
%Program Files%\MyPC Backup\BackupStack.exe (1938 bytes)
%Program Files%\MyPC Backup\uninst.exe (1797 bytes)
%Program Files%\MyPC Backup\AlphaVSS.51.x86.dll (4106 bytes)
%Program Files%\MyPC Backup\RegisterExtensionDotNet20_x86.exe (20 bytes)
%Program Files%\MyPC Backup\es_ES.mo (1831 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsRandom.dll (479 bytes)
%Documents and Settings%\%current user%\Desktop\MyPC Backup.lnk (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\NSISdl.dll (14 bytes)
%Program Files%\MyPC Backup\GetText.dll (12 bytes)
%Program Files%\MyPC Backup\Shared Stack.dll (62611 bytes)
%Program Files%\MyPC Backup\MPCBContextMenu.dll (149087 bytes)
%Program Files%\MyPC Backup\LogicNP.EZShellExtensions.dll (6579 bytes)
%Program Files%\MyPC Backup\Updater.exe (30085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mpbtrk.log (8 bytes)
%Program Files%\MyPC Backup\tick.ico (8864 bytes)
%Program Files%\MyPC Backup\Signup Wizard.exe (24414 bytes)
%Program Files%\MyPC Backup\de_DE.mo (1702 bytes)
%Program Files%\MyPC Backup\AlphaVSS.60.x64.dll (6324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\ns3A.tmp (6 bytes)
%Program Files%\MyPC Backup\MyPC Backup.exe (64373 bytes)
%Program Files%\MyPC Backup\syncing.ico (7445 bytes)
%Program Files%\MyPC Backup\MPCBIconOverlays.dll (85918 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\MyPC Backup.lnk (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\AccessControl.dll (8 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\MyPC Backup\MyPC Backup.lnk (774 bytes)
%Program Files%\MyPC Backup\Database\mpcb_queues.db (13 bytes)
%Program Files%\MyPC Backup\AlphaVSS.52.x86.dll (5025 bytes)
%Program Files%\MyPC Backup\RegisterExtensionDotNet20_x64.exe (16 bytes)
%Program Files%\MyPC Backup\it_IT.mo (1925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsSCM.dll (5 bytes)
%Program Files%\MyPC Backup\pt_PT.mo (1605 bytes)
%Program Files%\MyPC Backup\MPCBClient.dll (28694 bytes)
%Program Files%\MyPC Backup\ObjectListView.dll (13129 bytes)
%Program Files%\MyPC Backup\fr_FR.mo (1621 bytes)
%Program Files%\MyPC Backup\Database\mpcb_settings.db (9 bytes)
%Program Files%\MyPC Backup\RestartExplorer.exe (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\DotNetChecker.dll (1123 bytes)
%Program Files%\MyPC Backup\Configuration Updater.exe (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg39.tmp\nsExec.dll (6 bytes)
%Program Files%\MyPC Backup\x64\System.Data.SQLite.dll (20635 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\MyPC Backup\Uninstall.lnk (545 bytes)
%WinDir%\Tasks\User_Feed_Synchronization-{414D0F7C-B684-437B-B53E-8AB5AE32E070}.job (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\SuggestedSites.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms (2176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\ie8[1].txt (644 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms (14084 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms (3314 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\rss[1].xml (6141 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms (3314 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\Internet Explorer Suggested Sites~.feed-ms (2184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\rss[1].xml (5486 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\main.xul (681 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\config.json (225 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\amazon.xul (583 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\main.js (367 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\spigot.js (3 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\saebay.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\prefs.txt (171 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions.json (31 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\newtab.xul (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\config.json (292 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\icon.png (196 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\redirects.js (196 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome.manifest (148 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\prefs.txt (14 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\spigot.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\main.js (397 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\main.js (359 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome.manifest (192 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com\chrome\content\config.json (295 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\main.js (386 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\amazon.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\spigot.js (3 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\chrome\content\startpage.js (392 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\icon.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}\chrome\content\config.json (278 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\icon.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\prefs.txt (110 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\ebay.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\{58d2a791-6199-482f-a9aa-9b725ec61362}_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\savingsslider.xul (606 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\chrome\content\savingsslider.js (392 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome.manifest (125 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome\content\saamazon.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\spigot.js (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\icon.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\savingsslider@mybrowserbar.com_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saamazon@mybrowserbar.com_tmp\chrome.manifest (131 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\ebay.xul (569 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\extensions\saebay@mybrowserbar.com_tmp\chrome\content\prefs.txt (12 bytes)
C:\e22922a92f95b9889678f2\eula.1040.txt (13 bytes)
C:\e22922a92f95b9889678f2\install.res.1042.dll (1851 bytes)
C:\e22922a92f95b9889678f2\install.res.1028.dll (693 bytes)
C:\e22922a92f95b9889678f2\install.res.1036.dll (1925 bytes)
C:\e22922a92f95b9889678f2\$shtdwn$.req (788 bytes)
C:\e22922a92f95b9889678f2\install.res.1033.dll (1390 bytes)
C:\e22922a92f95b9889678f2\eula.1033.txt (10 bytes)
C:\e22922a92f95b9889678f2\install.ini (844 bytes)
C:\e22922a92f95b9889678f2\install.res.1040.dll (1754 bytes)
C:\e22922a92f95b9889678f2\globdata.ini (1 bytes)
C:\e22922a92f95b9889678f2\eula.2052.txt (405 bytes)
C:\e22922a92f95b9889678f2\install.res.1041.dll (983 bytes)
C:\e22922a92f95b9889678f2\vc_red.msi (3475 bytes)
C:\e22922a92f95b9889678f2\eula.1036.txt (224 bytes)
C:\e22922a92f95b9889678f2\eula.1041.txt (5 bytes)
C:\e22922a92f95b9889678f2\eula.1028.txt (3 bytes)
C:\e22922a92f95b9889678f2\install.exe (8790 bytes)
C:\e22922a92f95b9889678f2\vcredist.bmp (5 bytes)
C:\e22922a92f95b9889678f2\eula.3082.txt (12 bytes)
C:\e22922a92f95b9889678f2\eula.1042.txt (5 bytes)
C:\e22922a92f95b9889678f2\eula.1049.txt (387 bytes)
C:\e22922a92f95b9889678f2\vc_red.cab (56236 bytes)
C:\e22922a92f95b9889678f2\install.res.3082.dll (1487 bytes)
C:\e22922a92f95b9889678f2\install.res.2052.dll (1368 bytes)
C:\e22922a92f95b9889678f2\install.res.1049.dll (1437 bytes)
C:\e22922a92f95b9889678f2\install.res.1031.dll (1585 bytes)
C:\e22922a92f95b9889678f2\eula.1031.txt (15 bytes)
%Documents and Settings%\%current user%\Application Data\Search Protection\SearchProtection.exe (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz30.tmp (107044 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\BrowserExtensionsSetup.exe (60186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\SDSPlugin.dll (22552 bytes)
%Documents and Settings%\%current user%\Application Data\Search Protection\Uninstall.exe (12076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz31.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst36.tmp (14354 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj37.tmp\NSISCouponsPlugin.dll (17848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2D.tmp\SDSPlugin.dll (22552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2D.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2C.tmp (19153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~sp2E.tmp (321984 bytes)
%Documents and Settings%\%current user%\Cookies\7KKWMT6B.txt (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\thankyou[1].htm (413 bytes)
%Documents and Settings%\%current user%\Cookies\A8WL5QB4.txt (919 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\7R8AXHHW\www.ytddownloader[1].xml (411 bytes)
%Documents and Settings%\%current user%\Cookies\3K5PFZ4L.txt (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\favicon[1].ico (9513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\dgdTycPTSRj[1].js (1186 bytes)
%Documents and Settings%\%current user%\Cookies\Y3E99XUS.txt (613 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\jquery.min[1].js (61363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\top-header-bg[1].jpg (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\ytd-logo[1].png (14728 bytes)
%Documents and Settings%\%current user%\Cookies\56E8VQFU.txt (87 bytes)
%Documents and Settings%\%current user%\Cookies\IO95CMW0.txt (385 bytes)
%Documents and Settings%\%current user%\Cookies\PJAYQ3JJ.txt (285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\header-bg[1].jpg (43912 bytes)
%Documents and Settings%\%current user%\Cookies\DEJ3GPCM.txt (327 bytes)
%Documents and Settings%\%current user%\Cookies\TW0Y1UD8.txt (613 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\styles[1].css (4529 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\core131[1].js (121395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\sh158[1].html (9923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\counter017[1].js (5915 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\widget120[1].css (45783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\all[1].js (87362 bytes)
%Documents and Settings%\%current user%\Cookies\4JILEPXF.txt (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\upgrade-pro-btn[1].png (6454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\header-bg-repeat[1].jpg (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\counter014[1].css (2977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\300lo[1].json (91 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\shares[1].json (55 bytes)
%Documents and Settings%\%current user%\Cookies\V9ILT370.txt (129 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\dgdTycPTSRj[1].htm (1970 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\YYGJFIDB\s7.addthis[1].xml (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\dgdTycPTSRj[2].htm (1094 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\main[1].js (25 bytes)
%Documents and Settings%\%current user%\Cookies\NBF8N5AK.txt (297 bytes)
%Documents and Settings%\%current user%\Cookies\O468AV3W.txt (697 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\ga[1].js (28634 bytes)
%Documents and Settings%\%current user%\Cookies\0KPRCZS7.txt (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\addthis_widget[1].js (3069 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DFF65E.tmp (4605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DFDEEC.tmp (3263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{B5B36C2E-DAAE-11E3-81D1-0050563EC483}.dat (15783 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B5B36C2F-DAAE-11E3-81D1-0050563EC483}.dat (18695 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D236B74794790D9923905972356B8BEC (448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3D.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar3E.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (126 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D236B74794790D9923905972356B8BEC (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
%Documents and Settings%\%current user%\Desktop\Sync Folder.lnk (1 bytes)
%Program Files%\MyPC Backup\log\WAIT_HANDLES.log (540 bytes)
%Program Files%\MyPC Backup\Database\mpcb_settings.db-journal (27036 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aff.conf (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2A.tmp\LogEx.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\log.txt (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2A.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BackupSetup.exe (1052338 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Browser Extensions" = "%Documents and Settings%\%current user%\Application Data\Browser Extensions\CouponsHelper.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SearchProtection" = "%Documents and Settings%\%current user%\Application Data\Search Protection\SearchProtection.EXE /autostart" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: YTD Video Downloader
Product Version: 4.8.1.0.3
Legal Copyright: Copyright (c) 2007-2014 GreenTree Applications SRL
Legal Trademarks:
Original Filename: Uninstall.exe
Internal Name:
File Version: 4.8.1
File Description: YTD Video Downloader
Comments:
Language: English (United States)
Company Name: Product Name: YTD Video DownloaderProduct Version: 4.8.1.0.3Legal Copyright: Copyright (c) 2007-2014 GreenTree Applications SRLLegal Trademarks: Original Filename: Uninstall.exeInternal Name: File Version: 4.8.1File Description: YTD Video DownloaderComments: Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 25506 | 25600 | 4.49191 | 3291075913c14a1799655a261fb21cca |
| .rdata | 32768 | 6386 | 6656 | 3.3883 | 170563e94de7ebfd6e622a164ce38c8a |
| .data | 40960 | 419484 | 512 | 0.991115 | 23d69b1e3a55dee07701198b7650a06b |
| .ndata | 462848 | 3035136 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 3497984 | 52184 | 52224 | 4.67389 | 51c0cfa6e9235ef676e3b5201d9dd439 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://ytd2.greentreeapps.ro/images/pixel.gif?action=install&point=start&cid=31fbc1ce06e12d56d19c32273fd38c79&isn=2A0E0F74E87C41248D17D84CDB01E7BE&kt=cnet | |
| hxxp://ytd2.greentreeapps.ro/getcountry.html | |
| hxxp://www.mybrowserbar.com/terms_extensions.rtf | 174.36.215.20 |
| hxxp://www.mybrowserbar.com/kits/hlp/exthelper.exe | 174.36.215.20 |
| hxxp://track.mypcbackup.com/4631cdb5/D0wnloads-mpb-cpl-new/MyPCBackup_Setup.exe | 184.154.150.131 |
| hxxp://mypcbackup.jdibackup.netdna-cdn.com/MyPCBackup_Setup.exe | |
| hxxp://www.mybrowserbar.com/cgi/extconfig.cgi?cnid=407453&ver=1.0&kt=cnet&ot=YTD1&bver=34.0.1847.131 | 174.36.215.20 |
| hxxp://update.mybrowserbar.com/kits/sds/update.xml | 108.59.13.15 |
| hxxp://www.mybrowserbar.com/kits/sds/update.xml | 174.36.215.20 |
| hxxp://update.mybrowserbar.com/kits/sds/SearchProtectionSetup.exe | 108.59.13.15 |
| hxxp://www.mybrowserbar.com/images/pixel.gif?sds=1&shp=1&sbe=1&cnid=407453&tov=19&kt=cnet | 174.36.215.20 |
| hxxp://ytd2.greentreeapps.ro/images/pixel.gif?action=install&point=finish&cid=31fbc1ce06e12d56d19c32273fd38c79&isn=2A0E0F74E87C41248D17D84CDB01E7BE&kt=cnet | |
| hxxp://ytd4.greentreeapps.ro/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1 | |
| hxxp://ytd4.greentreeapps.ro/styles.css | |
| hxxp://ytd4.greentreeapps.ro/js/main.js | |
| hxxp://fallback.global-ssl.fastly.net/js/250/addthis_widget.js | |
| hxxp://googleapis.l.google.com/ajax/libs/jquery/1.9.1/jquery.min.js | |
| hxxp://ytd4.greentreeapps.ro/images/ytd-logo.png | |
| hxxp://ytd4.greentreeapps.ro/images/top-header-bg.jpg | |
| hxxp://fallback.global-ssl.fastly.net/static/r07/core131.js | |
| hxxp://www-google-analytics.l.google.com/ga.js | |
| hxxp://ytd4.greentreeapps.ro/images/upgrade-pro-btn.png | |
| hxxp://ytd4.greentreeapps.ro/images/header-bg-repeat.jpg | |
| hxxp://ytd4.greentreeapps.ro/images/header-bg.jpg | |
| hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js | |
| hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.5.0&utms=1&utmn=211728539&utmhn=www.ytddownloader.com&utmcs=windows-1252&utmsr=1716x901&utmvp=1712x716&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=YTD Video Converter&utmhid=2112539694&utmr=-&utmp=/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1&utmht=1399992971790&utmac=UA-25210420-2&utmcc=__utma=135583929.1101086425.1399992972.1399992972.1399992972.1;+__utmz=135583929.1399992972.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~ | |
| hxxp://fallback.global-ssl.fastly.net/static/r07/widget120.css | |
| hxxp://fallback.global-ssl.fastly.net/static/r07/sh158.html | |
| hxxp://fallback.global-ssl.fastly.net/static/r07/counter017.js | |
| hxxp://fallback.global-ssl.fastly.net/static/r07/counter014.css | |
| hxxp://fallback.global-ssl.fastly.net/static/r07/widget016_32x32_top.gif | |
| hxxp://a749.dsw4.akamai.net/connect/xd_arbiter/dgdTycPTSRj.js?version=41 | |
| hxxp://m.addthisedge.com/live/red_lojson/300lo.json?19rgc5c&colc=1399992973025&si=5372328b6586c44f&uid=5372328cfdb7168d&pub=ytdcs&rev=1399981304&jsl=33&ln=en&pc=men&vpc=&dp=www.ytddownloader.com&aa=0&fcu1=667ae1ee&undefined&of=0&uf=1&pd=0&irt=0&md=0&ct=1&tct=0&abt=0<=782&cdn=0&lnlc=us&whcs=1&tl=c=1312,m=1312,i=1312,xm=2094,xp=2094&pi=1&fp=thankyou.html&&rb=0&gen=1000&gen=100&callback=_ate.track.hsr&chr=windows-1252 | |
| hxxp://a.ssl.fastly.net/url/shares.json?url=http://www.ytddownloader.com/&callback=_ate.cbs.sc_httpwwwytddownloadercom0 | |
| hxxp://ytd4.greentreeapps.ro/favicon.ico | |
| hxxp://m.addthisedge.com/live/t00/mu.gif?a=sc&r=1&err=1 | |
| hxxp://a1294.w20.akamai.net/b?c1=7&c2=2000001&c3=1&rn=ymtqsy&c7=http://www.ytddownloader.com/thankyou.html&c8=YTD Video Converter&cv=1.7 | |
| hxxp://ds-any-fp3-real.wa1.b.yahoo.com/favicon.ico | |
| hxxp://update.mybrowserbar.com/update/wt/ie/coupons/update.xml | 108.59.13.15 |
| hxxp://track.mypcbackup.com/aadebc4830c51c2794a960fe5a9e11df.php | 184.154.150.131 |
| hxxp://a767.dscms.akamai.net/download/d/d/9/dd9a82d0-52ef-40db-8dab-795376989c03/vcredist_x86.exe | |
| hxxp://e6845.ce.akamaiedge.net/CSC3-2010.crl | |
| hxxp://e6845.ce.akamaiedge.net/CSC3-2010.cer | |
| hxxp://e6845.ce.akamaiedge.net/pca3-g5.crl | |
| hxxp://s7.addthis.com/static/r07/core131.js | 199.27.73.184 |
| hxxp://s7.addthis.com/static/r07/counter014.css | 199.27.73.184 |
| hxxp://www.youtubedownloadersite.com/images/pixel.gif?action=install&point=start&cid=31fbc1ce06e12d56d19c32273fd38c79&isn=2A0E0F74E87C41248D17D84CDB01E7BE&kt=cnet | 95.211.187.90 |
| hxxp://crl.verisign.com/pca3-g5.crl | 23.50.69.163 |
| hxxp://www.ytddownloader.com/images/ytd-logo.png | 5.79.67.100 |
| hxxp://www.google-analytics.com/ga.js | 173.194.43.105 |
| hxxp://www.youtubedownloadersite.com/images/pixel.gif?action=install&point=finish&cid=31fbc1ce06e12d56d19c32273fd38c79&isn=2A0E0F74E87C41248D17D84CDB01E7BE&kt=cnet | 95.211.187.90 |
| hxxp://webupdate.mybrowserbar.com/kits/sds/SearchProtectionSetup.exe | 108.59.13.12 |
| hxxp://csc3-2010-aia.verisign.com/CSC3-2010.cer | 23.50.69.163 |
| hxxp://www.ytddownloader.com/images/upgrade-pro-btn.png | 5.79.67.100 |
| hxxp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js | 74.125.70.95 |
| hxxp://api-public.addthis.com/url/shares.json?url=http://www.ytddownloader.com/&callback=_ate.cbs.sc_httpwwwytddownloadercom0 | 199.27.72.196 |
| hxxp://b.scorecardresearch.com/b?c1=7&c2=2000001&c3=1&rn=ymtqsy&c7=http://www.ytddownloader.com/thankyou.html&c8=YTD Video Converter&cv=1.7 | 72.247.9.129 |
| hxxp://s7.addthis.com/js/250/addthis_widget.js | 199.27.73.184 |
| hxxp://www.google-analytics.com/__utm.gif?utmwv=5.5.0&utms=1&utmn=211728539&utmhn=www.ytddownloader.com&utmcs=windows-1252&utmsr=1716x901&utmvp=1712x716&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=YTD Video Converter&utmhid=2112539694&utmr=-&utmp=/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1&utmht=1399992971790&utmac=UA-25210420-2&utmcc=__utma=135583929.1101086425.1399992972.1399992972.1399992972.1;+__utmz=135583929.1399992972.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~ | 173.194.43.105 |
| hxxp://s7.addthis.com/static/r07/widget120.css | 199.27.73.184 |
| hxxp://api.mybrowserbar.com/cgi/api.cgi/407453/E2DA97D8A12A4D02B7A3A58A402F38B0/vrst/20 | 174.36.215.20 |
| hxxp://s7.addthis.com/static/r07/widget016_32x32_top.gif | 199.27.73.184 |
| hxxp://www.ytddownloader.com/styles.css | 5.79.67.100 |
| hxxp://www.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1 | 5.79.67.100 |
| hxxp://connect.facebook.net/en_US/all.js | 23.32.175.139 |
| hxxp://download.microsoft.com/download/d/d/9/dd9a82d0-52ef-40db-8dab-795376989c03/vcredist_x86.exe | 72.247.8.72 |
| hxxp://www.ytddownloader.com/images/header-bg.jpg | 5.79.67.100 |
| hxxp://www.ytddownloader.com/images/header-bg-repeat.jpg | 5.79.67.100 |
| hxxp://download.mybrowserbar.com/kits/hlp/exthelper.exe | 174.36.215.20 |
| hxxp://csc3-2010-crl.verisign.com/CSC3-2010.crl | 23.50.69.163 |
| hxxp://m.addthis.com/live/red_lojson/300lo.json?19rgc5c&colc=1399992973025&si=5372328b6586c44f&uid=5372328cfdb7168d&pub=ytdcs&rev=1399981304&jsl=33&ln=en&pc=men&vpc=&dp=www.ytddownloader.com&aa=0&fcu1=667ae1ee&undefined&of=0&uf=1&pd=0&irt=0&md=0&ct=1&tct=0&abt=0<=782&cdn=0&lnlc=us&whcs=1&tl=c=1312,m=1312,i=1312,xm=2094,xp=2094&pi=1&fp=thankyou.html&&rb=0&gen=1000&gen=100&callback=_ate.track.hsr&chr=windows-1252 | 8.37.70.20 |
| hxxp://www.yahoo.com/favicon.ico | 98.139.180.149 |
| hxxp://cdn.mypcbackup.com/MyPCBackup_Setup.exe | 108.161.187.46 |
| hxxp://www.youtubedownloadersite.com/getcountry.html | 95.211.187.90 |
| hxxp://www.ytddownloader.com/favicon.ico | 5.79.67.100 |
| hxxp://www.ytddownloader.com/images/top-header-bg.jpg | 5.79.67.100 |
| hxxp://static.ak.facebook.com/connect/xd_arbiter/dgdTycPTSRj.js?version=41 | 72.247.9.32 |
| hxxp://s7.addthis.com/static/r07/sh158.html | 199.27.73.184 |
| hxxp://s7.addthis.com/static/r07/counter017.js | 199.27.73.184 |
| hxxp://www.ytddownloader.com/js/main.js | 5.79.67.100 |
| hxxp://api.mybrowserbar.com/cgi/api.cgi/407453/E2DA97D8A12A4D02B7A3A58A402F38B0/vloc/20 | 174.36.215.20 |
| s-static.ak.facebook.com | 23.32.162.110 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /images/pixel.gif?action=install&point=start&cid=31fbc1ce06e12d56d19c32273fd38c79&isn=2A0E0F74E87C41248D17D84CDB01E7BE&kt=cnet HTTP/1.0
Host: VVV.youtubedownloadersite.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 May 2014 14:55:44 GMT
Content-Type: image/gif
Content-Length: 1093
Last-Modified: Wed, 20 Feb 2013 14:38:31 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:68AF816F211411E187C8D4C48A462294" xmpMM:DocumentID="xmp.did:68AF8170211411E187C8D4C48A462294"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:68AF816D211411E187C8D4C48A462294" stRef:documentID="xmp.did:68AF816E211411E187C8D4C48A462294"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,...........D..;..
GET /images/pixel.gif?sds=1&shp=1&sbe=1&cnid=407453&tov=19&kt=cnet HTTP/1.0
Host: VVV.mybrowserbar.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:08 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 1093
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: image/gif
GIF89a.............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:68AF816F211411E187C8D4C48A462294" xmpMM:DocumentID="xmp.did:68AF8170211411E187C8D4C48A462294"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:68AF816D211411E187C8D4C48A462294" stRef:documentID="xmp.did:68AF816E211411E187C8D4C48A462294"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,...........D..;..
GET /cgi/extconfig.cgi?cnid=407453&ver=1.0&kt=cnet&ot=YTD1&bver=34.0.1847.131 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: VVV.mybrowserbar.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:06 GMT
Server: Apache
Vary: Host
Content-Length: 0
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/xml; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 13 May 2014 14:56:06 GMT..Server: Apache..Vary: Host..Content-Length: 0..Keep-Alive: timeout=30, max=100..Connection: Keep-Alive..Content-Type: text/xml; charset=utf-8..
GET /static/r07/widget016_32x32_top.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 04 Apr 2014 15:06:53 GMT
Cache-Control: public, no-check, max-age=86313600
Content-Type: image/gif
Content-Length: 4083
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:13 GMT
Via: 1.1 varnish
Age: 3011649
Connection: keep-alive
X-Served-By: cache-c31-CHI
X-Cache: HIT
X-Cache-Hits: 2259854
X-Timer: S1399992973.975486040,VS0,VE0
Vary: Host
.PNG........IHDR... ... .....uL.[....gAMA......a....}PLTE...............................(..JW.h...%.KIw.......i%(;Z|?G...n*9(%X.........9NS..d.V...w..H..L......h.......LXu...8..r......88a..._.e...I......@......&8G...o.......&.8E.}.X......i...G.......ma..e.XY.......(*888......XXX........}_r........x.r.....Tiv.......xZ.,..8(..~......nnn...HHH...5m7......@w......#....!..(),r.....T....x....=.((...,...M9D...h...Y0X..iM.R)...(((.../Pps......F.J....tRNS..@p.. .`.........IDATx...._........{....S.. ...-...-..--....Y&5...~u....;.....&W.D...6i.7.u.m.6!uf.t.....kk.N...?..Skkg......O..>I....d.tj-.H.N$.gRgU1(\.S.gS.T..y.'S.T...e..........I..so..Y.`.}.1.I.N.R.z.}.1.^;.'?<N..o.'..7.3....E!..x.%.........D.lJ.^/..x.Dy..6C@>.hxk!.I.C>x@#.$...@.XX..y. ....M&..@.G5. ...E.MI....T[>.............'.v..9.........`.....^....1p....- c............c00.@..,..X.....[.`@.S..A.-o...`...........E.d.zA.i.e.........0....2.H]...M............`[Q19.4..s.6...sVT;.e....6..L...B..6^.....8.I...d.l.........6...l..x...H&.U......s.). .}..o.............y. .../..B....H..[.Y..;..`^|.;......H......L......P2...f"...B".......&....,H..:.:........W......~!.C.{..h.....p.>Q.I30 ..(&..B4....M.|.....%Y..~.BS.@!H~.P......0..s".......G..d...0.#.............\...O......<......h~..s.............(. gs.C}V.^#.......J.h."..._...a.!.fY._.Q..Z%.<.V..@..$...d(.h.$.......e.. .9....I.......@..8J.Q....U.......8J.Q...p....,......n.u...}.0....J.m...Y.n.UX......j...b a..yj.L.I.!... ....IV.c.e....y.s..P\.......o.z...i!.......8X8..$.........`vo..U(....{... ....OJ.
<<
<<< skipped >>>
GET /CSC3-2010.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: csc3-2010-crl.verisign.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "2237f9e4cdee23e13ed43192ff19e040:1399972210"
Last-Modified: Tue, 13 May 2014 09:10:10 GMT
Accept-Ranges: bytes
Content-Length: 126346
Date: Tue, 13 May 2014 14:56:59 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0....0...l...0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA..140513090003Z..140527090003Z0...N0!....c..k....D.k.....120708062201Z0!... _...u.t.=.<.&...130218061114Z0!...&..].....P.k.:...120125130117Z0!...7P.x....8.Q...s..130227010252Z0!...J.....Q..Y.[.....110404153956Z0!...d...=..q!_...g9..130729145216Z0!...l.....h2<.H......120329152211Z0!...q.9...`H.*.Y.C...120525202212Z0!...s...TM.......0...121221080842Z0!...t..,.. ...eL.....130314222305Z0!...y..r.HW.v.....w..140423054643Z0!..../u.......A..5...101214165045Z0!.....0.Xc...%...iM..121102230226Z0!.......S.a&.X5t.E]..111206083350Z0!....c.(....B.[M83...140108164517Z0!....A.Sv.....f,.....110609003155Z0!.....z......!.ID{]..101228182208Z0!....b^......{d.J'...130102154110Z0!......0..........I..130912181631Z0!....6e...~..T.......130131012247Z0!.........bD#*u......130226223939Z0!.......@..'$.).;}\..130121172259Z0!....7.v..........n..120724160733Z0!....P;.Y..d...c.(...120209181451Z0!.....].bb[.....!....140328205453Z0!.....a...L`..IV.....130402103508Z0!......fFW.z.....@T..130117000242Z0!...........].{7.....120730000000Z0!...".......Z.V.,.e..121031192224Z0!...'....[.1......g..130318195659Z0!...,GI.jH.|...J.....120518121623Z0!...<%a.=.d.......O..120424164254Z0!...@........... .a..121109212441Z0!...L.&L..o.8..=6....110311141238Z0!...L...5...s $.=.=..130205142241Z0!...O.c.........t....130109132228Z0!...X.BS.G]T.l.w.i..
<<
<<< skipped >>>
GET /js/250/addthis_widget.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 13 May 2014 11:43:13 GMT
ETag: "4945ca8-1aab-4f946919f3640"
Content-Encoding: gzip
Content-Type: text/javascript
Content-Length: 2676
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:11 GMT
Via: 1.1 varnish
Age: 2923
Connection: keep-alive
X-Served-By: cache-c101-CHI
X-Cache: HIT
X-Cache-Hits: 1047736
X-Timer: S1399992971.420254230,VS0,VE0
Vary: Host,Accept-Encoding
...........Yms.8..~....d...%...W.i.v/3.....)....m).EU.........e[...I..A..A@.....3.y..7#.?.....I*..6.....J.. .^.y....*....:....S/h9.Z.Z....q,a....."@/C3.p~Dq..X...:..*.Y.......G>/x.rI~.@..1....x2.<R.l..g...o.3...%.A.`t...G0b9.,.,.-i*...#.:/...]..{>.."x...X...)4.'t.:.DL...'..2...%.d....4<A:....V.E'..............`)..(AB=..qN...mzj.Ie..K.j.p.s.M.<.....c.".P..r.@.8...8....{....%<.=o........ Y..d....K>.P..sZz....W7D.#..O..@......J.G...._.4...g..i.....P..]....P...`...a.....U...6..HI.......9..u...x.4{...........<.y..0C.[.Y.2.3....n..^!x...H=.Bm....*.Y.`......6L.3..!...}..V..2.gL..z.j.$.y....|...c....]..{A.....j..`...|.....skR..u...f.^g.."l>a..|EF..|j....5....DN.................{.-R.....i...$E.....sX.........v:.........H.d.gmE.F..s.W}..t..L_....$..........#.....}J~.7.|.c.U O..#.&I.'....(......J.,D`9.3............t ...3...A.?Z. ...d.G*...Eh..i..|5t%..~.8.....RK:9ye.y.J.C9...O........2.KM.|..o.,.g...-.g...l..F.(...DOz.T..j.. ..PM..&.9.R.G.$f.yI.!.j*-..R. ....R..)..'.MB;iO....)c........:g.%.2-........X>.....-..r..d\c..\.DBo.i.~........|_..U..N-.u......~wp._h>...m6;zfh.$l.<..."K.m...(xa...x..j"d.........fK...S............V_.J..o|...L.......Ok.c........@/w..>.^l6........@.>.i.........=..|..*Ot....nB..e.g.wB..'..W....po....h..}..s.}.pB......cv..5z.;.H.w....}G.<.;.e.....}..r`..V.L....(.?..4!h0...#1.N]2Y......A....C....V..)NO...1..._....l6..../.\..=9.....w.J$v..,...-g"..u...E.H$WA....w..l.ch..$BC.J.*.........2.......^.]....ZN.dj.4..n..........7....z....3~<=.}..(..]n6`...{X.X}..o..
<<
<<< skipped >>>
GET /static/r07/core131.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 13 May 2014 11:42:44 GMT
Content-Encoding: gzip
Cache-Control: public, no-check, max-age=86313600
Content-Type: text/javascript
Content-Length: 76809
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:12 GMT
Via: 1.1 varnish
Age: 11125
Connection: keep-alive
X-Served-By: cache-c101-CHI
X-Cache: HIT
X-Cache-Hits: 457766
X-Timer: S1399992972.036291122,VS0,VE0
Vary: Host,Accept-Encoding
............ic.8.0.~...f.h..,Kv.$T..;{w...6...")..%.$%y...~k.@...d.<.}..X$./.BU.P.....8[{.....v...q.~....z3..~....}{{.O.t.:.......IP...vn.~.u....S....`6.&E...n.].&2.......Pf..fi..i.....]...q.Y..y..r]|...,....h.C9....Y:..i.[.C.Y....V.?.w..a......%`k....mo.CY.......AO....q..........H..,.....A.H...({......S......?.......N.{.."L.P...y.......n...............[..N..,...=#R......[WFy.................m..e.n5../..Vt..T`k.N........%e.J..w.4....0...S.,.s.............1..O.......T.f<MC..0....<b#\,0...Z1P....f..;w.a...z.`@...t.e.Q@........^U..t....J.......).......c....Ggi?h._......q.G[..v%....X..$..........N[Ft.....[dq. .e.Z.d.0.l.p. .F.....6...'u....3...x.K.`....zI....$^.q22.b...N.N...m..]......G....K..<zb...Ip.9....s.D.&......w.6...4J.[.....y...V=A..0...k3..M......I^....?....... ..6J.t:.T0...4...).V..$wM.....r..$J.....y`.....*..{....xSDc..'...`P...y$C.n...l.u.l{.Y.t....4snel.O..P..s...S..&......V.3...=.=..o..@..Vs.:2\... .9.....UN|.E^.b.V.....jd.#............D<...vP?...v[....!....."7....E...m1.CN.Oc.v.x<.qO.....nm.ma.]7l...&A....".h..[.....B..'.......v...;...~ .'....P....;'>....h.'.....-.[..l....`C..%.....*r ..Y....O...".*...T....n.n.....W.q......V.M...V.\....................#.^z.>..O.....f|..B.^....$6.g.L.is...[O.R..w.B......SHr&..s....0..0.......>L......LOGg@...[z....yw.M.....du"F.r.1L'...x........;H..........-n....-.Yt....3.[RC.%jq.5mr.)......{.F...@.A.}...}{..>....h.}.`.......... .... !...Z.{}...[.Q.!K...G..%.....8h9|.$2.Vev.`...r....|...{@...O.O.....2.Af..M).w.j.f@.1.......z.Q..p.J`E...n.l
<<
<<< skipped >>>
GET /static/r07/widget120.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 29 Apr 2014 11:58:30 GMT
Content-Encoding: gzip
Cache-Control: public, no-check, max-age=86313600
Content-Type: text/css
Content-Length: 20793
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:13 GMT
Via: 1.1 varnish
Age: 1219550
Connection: keep-alive
X-Served-By: cache-c101-CHI
X-Cache: HIT
X-Cache-Hits: 25631345
X-Timer: S1399992973.216857672,VS0,VE0
Vary: Host,Accept-Encoding
............y....'..|..W......Z...k.l.../i.......Z,....C..(...o.{==}.U.... ..F..$..}.d....9...e....c{..../^.l#..?}....i...~...k.p.....d]......nI.!...S......%...a....<..vxQ...~F4.....f.?......F../9.p. ^..$...r.I.M.....^ ........~...|....[7...y..........k..6....Z...<....T.?...g..'...,.A.O.O.v%.../...i...[...K.n.p..?.$..b........7t..%../...]y......$......C.=b..j1[I.m...%..V_.F.K....@..Yv...\x..E..{...K'... _..2......}..^.[.e.R".E{.....o.....I$.(..*... ...._.....M6.2.|...k....bK....x.{.dWW.........'....?........*.G...."..:.d.........v...i.{.Q.Rz.M...YJR...?.Y|`~........3.UUc=.t.t.eJ.~.E..J0...>...W.....>.K7yU.:....'.....6..X.....7..5v.F...{uf.~...W.F.Z....=.......q=...........i..]c....h...@..N..\.8..US...2...2F....;.:.............Pw2.Yw.UU.?....!......t.........|.a4.........yi.7...o..[.....%..........i...l.x.]T.^..t.y.P.!..D.D.....CO...#..,_.WB..e..d.V "...nY@..o.CQ.?/..........Oo.t-...t.:.l....?!nD.s..0....... ......]......|.LG?.c~~.u....yE.V.uCr...]!R.8.;...Y_.f$.KvD.-.6....t.........I.*....Q...H.........."........&..q:...<<....o.*.v..#.h....U".o..9.%.N.$.g...D...<..u..Mo../....)6T..I<D.......|h.L...abNV....]D..nn.DC...5<.}...L.....((e...<..y.*.x.FB.\....%t.Do{0K8N=..T......B.........>.......O.e....x...E.Gs.`.2..........U....=.$...2=[....Jf.].;.H..?.#...J..k..Wo..?.......p...(8l].#Q0lq.0..&.LS.|...N<.y...I{../z._EQ|.v$If..p/$...b....s.w.=F..}.7....G......i..u...%0#n..|{..{.]T..<....y.=.E..r.w..'[Q.x......>..dE.........m:.....H....p..y..,..V.....;...............]..y.-n...p
<<
<<< skipped >>>
GET /static/r07/counter014.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 04 Apr 2014 15:05:38 GMT
Content-Encoding: gzip
Cache-Control: public, no-check, max-age=86313600
Content-Type: text/css
Content-Length: 2666
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:13 GMT
Via: 1.1 varnish
Age: 2731440
Connection: keep-alive
X-Served-By: cache-c101-CHI
X-Cache: HIT
X-Cache-Hits: 11790312
X-Timer: S1399992973.804350376,VS0,VE0
Vary: Host,Accept-Encoding
...........XY..... ....fz..::...... .^&8........F..i..>v.a3...*..2./.~.L3w.....0..w ..C.\..{z.......v..Ad..z.. .a.Q....=.A.h.i...8r.2..(h..nY...._l.E..Z.iCK.....RW..: ...5..........77..4.`...*.0...Z.F.....O........i-pm.......w-7.e_o.?..E.G...b.....k.o..*.W..?~3.\...f.4....e.n}u7.j]b...1...e....n0i...>.8>.i.....g..NA.....n...cKc4uU.R.>........nLvQ..Z...u.w...."i.m....>1.1..$J!<...*..4...]TG@@.....!... s.q..W._..8.h...>UH...:.G..RD.B..-|uLj2D.X.C..eO...DISA..Oj..v..E,.(e..,.].K.........d.F,..`K..h..7.....F7.yN.F&....W^.....)..#f.........Z....U..fKzr...t..e0.1..f..[..;M.-%.h..{=...Z-.....C..u!*@..wf.i.t..L.qg7..r........@e<a'k.......(L...:>....L6............/....G.Db....d4... }.5.1/WbL.=.......z'...d..4K..n....D\%Ss.-.P.V.r....-..oC._.iwH. .F..dG..]...0@.A.{...E.2)7s.@.....;..2 U..i..e....0g;.........j..hM.X..V.*.0.B.H.C.fQl.)'...|?.L8.D.M0D"...JB.)iR..f...cN2[..,...d...Z.....j.`..U..~...B.}.D...!...P..:#Ik..E.`.J.....N.O.1.)@u.J.....ye...q.]*.Jt......\Ys....S..L..........8.@r.N.d.v.T.dFe.Q.qC...Jfp...).#..X..h..l....w"rN.K..........s=m-6.........iY(T.W..:6.In..A..m.Z.].h.mE...Z(.D5U/n...y.2l.=4W...... a........dN<!"f.=`$Tm.......|~...sXf....A..c.i.*....g.y.`F...2s..3h..6#.9.e..FI.>.k{).........]y.l1.KKxb.t-S\.Om.........=. ....z.@u=..........Z?....F.A..6.3.........2....}.J....)........X...U.Qq.i.7.. .W..,y..M(_Sc&.....J~..<asH.&~.U[..`R......A.BZ..r...$..</CU......i....T.a..:;..j.\G...-...-II....#...*N...=.E.d(.1.....i...ag.......)5JD$.k...D.. ;_#{..GE..ej.VY}Tu.u....h..r,b]
<<
<<< skipped >>>
POST /cgi/api.cgi/407453/E2DA97D8A12A4D02B7A3A58A402F38B0/vrst/20 HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml
User-Agent: WidgiToolbar-179-407453
Host: api.mybrowserbar.com
Content-Length: 609
Connection: Keep-Alive
Cache-Control: no-cache
<drq><auth><ccv>179</ccv><cnid>407453</cnid><isn>E2DA97D8A12A4D02B7A3A58A402F38B0</isn><ct>20</ct><dlid>1033</dlid><lngid>1033</lngid><wv>5.1</wv><brw><ie>8.0.6001.18702</ie><ff>29.0.1</ff><gc>34.0.1847.131</gc><dbrw>Internet Explorer</dbrw></brw></auth>
<vrst><isn>E2DA97D8A12A4D02B7A3A58A402F38B0</isn><cnid>407453</cnid><code_ver>179</code_ver><type>install</type><ct>20</ct><src>12</src><cid>75ed9567aa584c8ea8ea3cad7c47ab03</cid><cmdline>"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\~sp2E.tmp" /cnid "407453" /hp /ntp_ie /dsie /dsff /dsgc /register /seprotect /runbe /ffbf=31 /iebf=31 /gcbf=31</cmdline></vrst></drq>
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:27 GMT
Server: Apache
Pragma: no-cache
Cache-control: no-cache
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Tue, 13 May 2014 14:56:27 GMT
2b..<drp><auth>. <scv>179</scv>.</auth>.</drp>..0..
GET /static/r07/sh158.html HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 13 May 2014 11:43:12 GMT
Content-Encoding: gzip
Cache-Control: public, no-check, max-age=86313600
P3P: CP="NON ADM OUR DEV IND COM STA"
Content-Type: text/html; charset=UTF-8
Content-Length: 26393
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:13 GMT
Via: 1.1 varnish
Age: 11127
Connection: keep-alive
X-Served-By: cache-c48-CHI
X-Cache: HIT
X-Cache-Hits: 380880
X-Timer: S1399992973.412092447,VS0,VE0
Vary: Host,Accept-Encoding
............is.8.(.......C.`J..c.......SSKw..q9.I...\...../3...,..f.D..1U.".%.Hd........_....;.2.v~......;.~.....n......}....w,...k.$EX.i.D......mR....],....L.q....K,....._*9M....3.o.GIao).:==..5L4..dlkA....("p...2,.........NU.QX.vF...g].y..I.._...*.l.u..8O.....(.........v.$J....*..!.Uxy..;.*..e.,.Sg..P..............;.v.W8.wu}.&~.0...[....s....4w...........p.K... <.E>.s...z.u...f.... .R?.....i........../..!.....=...|`....Y..C........z,J=..IZ..Mc.....Q..\'..=...<tY. (...Y..A#..xR.9.9.X1....J. .OQ..,6.Ez.|.......g...w4.......;.{( 1@..V.P.......g..iG J...n.;.....e..1.../.Rp...l).(.x.T...C............{.v.7.?1.....%.......4v.rK....?V.lm.....M..i..N....Wa> x.(.^...O.&.....[..*."{..:...T.....d{."..{'.J.m....>..9. /.%.1..S%...eB.g...7....z'jr?OC...._.........".f....H...(.^..:.)..KID}Y....@[...^O`O...Z..^.%.^..8(..[...n8.......IX*...R....{..8.k<.!o$.......&.Fn...p.$./rb_..HcA.....)....#..f.dr..p<).t...D.".TI.......d...P.`..Y..[h....w"....0.^....."..-&.6Z("..<e...-uSp./........n...I2.2A&..(..y.<...y....h...e.z.......)..(Df..e.L......H.Fa.h.m...z[|...<..6$..*M.J.M.4.6..O.jp.K..g.L...E........0X3v.}..z....>?CO....O......g...2......1.X.L.O.A~...n0..S...'Y........Y&vi..1?...d... ...S.]...R...-....w.r....Xc.... .,-..nZ.,....;.r.5.{{.#.....u..........5.e.Q.f.f.S.g.[.PR...]....,..Rm.7I.M..m...........7....d......P.f...Z ,........_`~...b.p..w...v.....nl....A..,.......<..`..[..:.k...I..]?0o...w...Sg...[c........x..a..96{....~...N....?.....VOD.......2.}@...v5.....)." n@.....:..5....d-Fr.....@.q.
<<
<<< skipped >>>
GET /images/header-bg-repeat.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:12 GMT
Content-Type: image/jpeg
Content-Length: 1497
Last-Modified: Fri, 05 Oct 2012 14:07:53 GMT
Connection: keep-alive
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:48617E8EC10BE2118B4BD91E24AB7A59" xmpMM:DocumentID="xmp.did:FC5012CA0BCB11E2AA79CB95D10CA426" xmpMM:InstanceID="xmp.iid:FC5012C90BCB11E2AA79CB95D10CA426" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:48617E8EC10BE2118B4BD91E24AB7A59" stRef:documentID="xmp.did:48617E8EC10BE2118B4BD91E24AB7A59"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................~...................................................................1.!A.."3Qaq....2........................!1A.Q.....2Bb...3............?..s.}..4v$...y ....a[.C................wZ%..Y..G.T.r...J."n...5.h.....G...qs...NH~._.....Wu....K.g...\.V1.r.f.n.`.. ..X8..o....s]..I.\[#..[..`.6..5..9.....r..&.F.....S2_...Ea.....U....c...GIo...............x&.T.B..l..E.......J.z.}im..>#.@...
<<
<<< skipped >>>
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: VVV.ytddownloader.com
Connection: Keep-Alive
Cookie: __utma=135583929.1101086425.1399992972.1399992972.1399992972.1; __utmb=135583929.1.10.1399992972; __utmc=135583929; __utmz=135583929.1399992972.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __atuvc=1|20
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:14 GMT
Content-Type: image/x-icon
Content-Length: 22486
Last-Modified: Thu, 24 Oct 2013 10:35:32 GMT
Connection: keep-alive
Accept-Ranges: bytes
......00..........f... ......................h.......00.... ..%...... .... ......B........ .h...nS..(...0...`...........................................'''.< .333.>01.?28.;;;.@.".D2$.H6%.K9&.E5*.K:*.Q=).G95.L<0.G9<.T@*.YE,.]H..RB5.RC:._I=.`K/.cN0.fP2.kU4.nX5.fP=.n[?.qZ6.v^9.ya9...N...N.'%K.#.`.,$w.B3D.E9O.F4P.E=P.M:[.DDD.LBJ.KKK.QCE.[LB.WCH.^PG.JCX.]HP.WWW.aQB.aSJ.u^H.hZQ.r`F.naY.rf^.LEd.FAh.YGi.FGy.XHv.TR}.\Y{.g\b.cMs.cPv.ccc.kkk.uia.{qi.mlx.sss.}rt.{{{..we..wd..tm..xi..{t..~w...x.4 ..7,..=0..-...; ..J9..O?..E8..L>..[I..UV..MO..]L..TK..OS..VY..aP..c^..pq..ed..wv..ZL..RL..YJ..UR..KF..WJ..\Q..a[..\f..eh..lk..sq..ko..z{..*...'...8*..>3..2%..2)..83..<2..%...*&..3...:6..:;..A5..D9..L?..A4..E:..I=..C:..@3..D9..C?..MB..L@..PD..SH..ZR..KG..NN..PE..YN..VV..ZQ..VX..^_..WZ..cY..c\..aW..[b..Wb..]a..ej..fq..mq..ka..`k..im..ce..i`..ri..ov..zq..JD..SN..UP..[V..WY..^[..KH..VT..a]..a]..]h..ff..tk..ps..lh..pn..vy...~.......{..|...|..............................................................................................................................................................................................................................................................................................................S111111S....................................1.......1.....1..................................................1..........................8.......... ........1.............................7Glq.....nG9"!..........................1....Bl.{{{{{{{{{{{{.nF9.....1.................1..4m}
<<
<<< skipped >>>
GET /thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1 HTTP/1.1
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:10 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.6-1ubuntu1.8
Content-Encoding: gzip
6fa.............Wms.6..,..5;SIs!i.......[r.I.4.{..d4..R.)..@K.6.....D.J.....b./.>..._........f.....wo.....?.Wax}.M....O.h....b..F..eaxs..77.8...j..N.....c.....p..... 6.79.Y!..Y.?#L.'.p./"...d....j.V[G.L..4W<.{.l2..Hk....c.......Y#0..x.B.;.v"..\D,.j]-.6&..*.$...".......Y..Z.......(.i...0d...R)...B.*..ka&f:\.Zr.......~.."......J.....s..%{&...<^.'V.@H..yb..)........./.v...E........".d.....>\..W......?.~.?.G....,.O....U.K.<.p...7..Ne@.p},.r.s.D.3.o2n.z...n..R.XO .u....u.Lo...F..&9.8..c...y.g]....d..AA......G...P..Kg.{..n..A.:w>..7FDU.q.Bw.{m\u.....%}..g.-[..s.O..........y r.8_.D*.K...U...{x.8X.......D<.....4. X.P:.T&...P...6.. .....,...Aku..Y.........m...>)nJ..b......\......V.N..$.y.#.$,.3)..........e....:.-.......o..v......k`.....Ss...:~.....J......f2.P.1........@.r..~.cd...\ms.....Y.cU..s..J...ga..snyo=.....2?..M;.i*..Y..{.H.rb.V.$.pB..2.*..<..e.:......G.`..]......-."....Y....Om..@F..3..<Q".C)..~6q.._m...)g|G.h6..)..@. ...;@....{......?3.7y.8..xk....!<..V...1-,..\h.%b.L......"...E..12...7ook....uL....A..........]=..O....T].V*..vd.5&.......9#..s..f~F.......z.....%3...@/.J.x:...b.....S..o...K.h.....?..u9...Ng.l..:...;zm..=X.Z.7.............3...ON.LD.3tL.....-.q.......".s....W.2.X0|u.6.W ..Y.34..|.?U8..B...u....Mu...^........4..5..g*.k..6..r{E?......_......!...Y.A.. ..w...#....:...\.....lP.nO.......%...j.y..H.x..tV|......Q9KQ..T.cb...I#} W[8nC{.<;.4...d...nl..9..........1..o..X...lgd....6d....._w....3...4\..e.&.....N0xp......q...e.N..ce...%.B.(.4...?../~..l k1....z..U.N.P.{>...
<<
<<< skipped >>>
GET /styles.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:11 GMT
Content-Type: text/css
Content-Length: 16461
Last-Modified: Tue, 01 Apr 2014 14:19:57 GMT
Connection: keep-alive
Accept-Ranges: bytes
/* hXXp://meyerweb.com/eric/tools/css/reset/ . v2.0 | 20110126. License: none (public domain).*/..html, body, div, span, applet, object, iframe,.h1, h2, h3, h4, h5, h6, p, blockquote, pre,.a, abbr, acronym, address, big, cite, code,.del, dfn, em, img, ins, kbd, q, s, samp,.small, strike, strong, sub, sup, tt, var,.b, u, i, center,.dl, dt, dd, ol, ul, li,.fieldset, form, label, legend,.table, caption, tbody, tfoot, thead, tr, th, td,.article, aside, canvas, details, embed, .figure, figcaption, footer, header, hgroup, .menu, nav, output, ruby, section, summary,.time, mark, audio, video {..margin: 0;..padding: 0;..border: 0;..font-size: 100%;..font: inherit;..font-size:13px;..line-height:18px;..vertical-align: baseline;..font-family:Tahoma, Arial, Helvetica, sans-serifl.}./* HTML5 display-role reset for older browsers */.article, aside, details, figcaption, figure, .footer, header, hgroup, menu, nav, section {..display: block;.}.body {..line-height: 1;.}.ol, ul {..list-style: none;.}.blockquote, q {..quotes: none;.}.blockquote:before, blockquote:after,.q:before, q:after {..content: '';..content: none;.}.table {..border-collapse: collapse;..border-spacing: 0;.}..clearfix:after {..content: ".";..display: block;..clear: both;..visibility: hidden;..line-height: 0;..height: 0;.}. ..clearfix {..display: inline-block;.}. .html[xmlns] .clearfix {..display: block;.}. .* html .clearfix {..height: 1%;.}.a:link, a:visited, a:hover, a:active {color:#2c4b00; text-decoration:underline;}.h1 {font-size:24px; margin-bottom:8px;
<<
<<< skipped >>>
GET /images/top-header-bg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:12 GMT
Content-Type: image/jpeg
Content-Length: 2458
Last-Modified: Fri, 05 Oct 2012 14:07:53 GMT
Connection: keep-alive
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:48617E8EC10BE2118B4BD91E24AB7A59" xmpMM:DocumentID="xmp.did:FC5012C60BCB11E2AA79CB95D10CA426" xmpMM:InstanceID="xmp.iid:FC5012C50BCB11E2AA79CB95D10CA426" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:48617E8EC10BE2118B4BD91E24AB7A59" stRef:documentID="xmp.did:48617E8EC10BE2118B4BD91E24AB7A59"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..............................................................................................................................................................................................................................................!1....Aa....Q"q...2.......#3$....B.Cd5E..........................!#.1A."..a2.C....B3$.%.q.D..4d5E.8............?..}.4.i....#v...jq.[Lj.....]Hzc.=12..........<.....w.....t.E=..K...U......vt...-.x.hY.].j...#..de.t....yf. .".`.n.....a....i"8.C. ......A..aFs~.By..d..|..V.k.h.;'-.p.}..W.d.IM...v'...Z_.Ak]m
<<
<<< skipped >>>
GET /images/upgrade-pro-btn.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:12 GMT
Content-Type: image/png
Content-Length: 13813
Last-Modified: Thu, 24 Oct 2013 10:30:42 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......T.............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:6223BDC2438711E199DFDADE185FF648" xmpMM:DocumentID="xmp.did:6223BDC3438711E199DFDADE185FF648"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6223BDC0438711E199DFDADE185FF648" stRef:documentID="xmp.did:6223BDC1438711E199DFDADE185FF648"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>7._...2iIDATx..}y.eGy....{.{o.E..4h..ZF...bDd.#BA...`'..."... .........O*.............. 1.lJ.-.,a./#....7..{.9.;.|_.w..........;.-......_..O(.`...|.!..?K..g.x..?....................Y....D..AB&2.....O..{..<..d1........O,~........z..?xl..q.-.......b..o..'?../pW..<..ms..}[....Wn...w...m...R?!3O.Z.^.t..{O...?......O....kx|......?...>..n...?^B...".V..<...7...u..M....5^...Qw..p.A..4 ..f.&...o~..Pfuy.vxt.qP/....yx.8.B......_>..?..w.g.m........5{....ZJ..yU.._.......{...r....@0.....3}o@..............7at7@u7....l...W...~~Z.2c.\.....?.3.n..u..3....r...2...w.F..U..S.=..^....y.*.\.y.u....)1
<<
<<< skipped >>>
GET /download/d/d/9/dd9a82d0-52ef-40db-8dab-795376989c03/vcredist_x86.exe HTTP/1.0
Host: download.microsoft.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.0 200 OK
Content-Type: application/octet-stream
Last-Modified: Fri, 08 Aug 2008 21:12:57 GMT
Accept-Ranges: bytes
ETag: "cde1e9879bf9c81:0"
Server: Microsoft-IIS/8.0
Content-Disposition: attachment
Content-Length: 4216840
Date: Tue, 13 May 2014 14:56:48 GMT
Connection: close
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K...K...K.......D...K... ......._.......J.......J...RichK...........PE..L...{..B.................z..........rY... ........... ...............................6A.......... ..........................@...........t............4@..$...........!............................................... ...............................text....x... ...z.................. ..`.data................~..............@....rsrc...t.........?.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................t...Z...................&...<...L............................................... ...:...J...V...^...x.......................................&...<...J...^...t.......................................(...:...R...b...p...................................&...N...b...|...............r.......\...L...:...,...........................................~...f.......................z...............................&...0...D...:...............:...........$...................{..B.............&..................Z.
<<
<<< skipped >>>
GET /images/header-bg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:12 GMT
Content-Type: image/jpeg
Content-Length: 123553
Last-Modified: Thu, 10 Oct 2013 14:08:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
......Exif..II*.................Ducky.......Z..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:02967DEC099B11E388E0A65379C2936F" xmpMM:DocumentID="xmp.did:02967DED099B11E388E0A65379C2936F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02967DEA099B11E388E0A65379C2936F" stRef:documentID="xmp.did:02967DEB099B11E388E0A65379C2936F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................j.......................................................................................!.1.AQ.aq".....2R...B#...r.3..b..c...S..C....$T.4Ds......................!1.AQ.......a.."2qR...B............?....\}6..1....D...au.lxW....~k.n^.....:q.a..HH.....&....Z.Ut...3.Y.i.3(\x......Qe$.Eg...'...x._R_?........xQ..J..?.]QQ8../...~./...e?........L]>..7.*|j.`71au.lxV.<.r...d. u.:t.1O.$$n...~.CMK.=z..|.....i.i.3b.......AQe$.$P.U.OE%.=W.......m..n.......[.....N..#.....
<<
<<< skipped >>>
GET /static/r07/counter017.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 04 Apr 2014 15:05:40 GMT
Content-Encoding: gzip
Cache-Control: public, no-check, max-age=86313600
Content-Type: application/javascript
Content-Length: 3744
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:13 GMT
Via: 1.1 varnish
Age: 2731439
Connection: keep-alive
X-Served-By: cache-c100-CHI
X-Cache: HIT
X-Cache-Hits: 3193440
X-Timer: S1399992973.423447132,VS0,VE0
Vary: Host,Accept-Encoding
...........Z.s.6..Wd...<.....).D.8.#...:.}p=...$....a.....b..$;q......X.... ."....B.......s.....^...W7,s..[...B..7...|......aZA.t.#..s/.$....v2. .a...S....(.=...p`...._.z..4..x..V........Kx.'a..1{WQ_.L2.Q].z.0.8.3]3.X....^...........E.h. ....^.Xu7.fFs..jJ.32...D;.ZS@..98...v8......_%].{.&K....|.y.....f...W..]....`..P...{4.~~.j.%~....m.U...5.I....,..aL7.n}n&...AG.rAL..Z....n7;....n....E."........H3*....YM....v...16..x.;...&..A.|.*dH.h..........L..m...%<....$k.f....)l.^.X....<3O..&..a."..e.P}.......A}.n.).a;Z..h...?..(.......O...FN.w....r....57.(...B.b?.n..!....xH...~;.3..8.t`..=b..O..d...9.R.......Q...%......E..K.l...F....sJ....._Gw..Z...&RMc..t..14i..T;.Y....g.....}..6..K...M.^.&.i.....)..2...;....k2...B;........Q.5{\ .j...<.........4.h......7..w31..1.=)...y..^..TDzT...._x.i..i..^7O"s...n.8...O..\eT{1..a....7.b...&.b.7............n.h:..d....6...\......]. u#.._..8.,. =.X.!.;..(....-..ZE.|.I._.....u.T!.o.e....7..!.....]..$0.v.._..pN...;Z.vd.F ........04.)O.|.[..jm..:.?..^..^t*..... ..p.Mk.)/o;|;.F..M..........B.........G...9.I.....{t..X.v..[`.p.<.......D.......k... ....3..I......V....m........E. ..............?.."...I.\%|A..h...BR@....."M.E&i..!.....tT..@ T."....M.$Q"JAmT2T.q....2G9F...|U@.y=...y...V8j-..I.\"..lT'.., &....'X|4..9.82.....AV....)[r.P...;.Sw..f.B0[...n'wO... .W.LFa.YQ...@..C~.<...L......$.=.E..,..2.<....y,K.yz.e.q...k....<[....'..^~1.<]. ).5q.........( ......l0..s....T*n7....~.........i..:.,.p.M..'h....;...tbW...1....)..'.!....L)......j:...D*o..(..,:....0(..^5..K..PK.S...,
<<
<<< skipped >>>
GET /kits/sds/SearchProtectionSetup.exe HTTP/1.1
Accept-Encoding: gzip,deflate
User-Agent: WidgiToolbar
Host: webupdate.mybrowserbar.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Tue, 13 May 2014 14:56:08 GMT
Content-Type: application/octet-stream
Content-Length: 2696352
Last-Modified: Mon, 28 Apr 2014 15:06:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.ydx..7x..7x..7_Hz7{..7_Hl7i..7x..7...7q..7s..7q..7y..7q..7y..7Richx..7........................PE..L....l.K.................d.......B..K5............@..........................p.......F)..............................................`..............8.).h............................................................................................text....c.......d.................. ..`.rdata...............h..............@..@.data....f..........................@....ndata...P...............................rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H......G..H.P.u..u..u...|.@..K...SV.5..G.W.E.P.u.....@..e...E..E.P.u.....@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h..F.W....@..u.W...u....E.P.u.....@._^3.[.....L$....G...i. @...T.....tUVW.q.3.;5..G.sD..i. @...D..S.....t.G.....t...O..t .....u...3....3...F. @..;5..G.r.[_^...U..QQ
<<
<<< skipped >>>
GET /en_US/all.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: connect.facebook.net
Connection: Keep-Alive
HTTP/1.1 200 OK
ETag: "33e930b01622ce3f779fd0621f830a4b"
Content-Type: application/x-javascript; charset=utf-8
Timing-Allow-Origin: *
Content-Encoding: gzip
Content-MD5: gppApdvV6sdQwWHKaA5j1w==
X-FB-Debug: NuJ9AmBsD oxdDmDUfd17FeGhj6Xrv4K99arsh PH/Y=
Content-Length: 52964
Cache-Control: public, max-age=1200
Expires: Tue, 13 May 2014 15:16:12 GMT
Date: Tue, 13 May 2014 14:56:12 GMT
Connection: keep-alive
Vary: Accept-Encoding
............i{...7...O!;.)...l.*5.w.IO....''....$Z..R.%.......W.. E..............B.PU8.......O........O.=?~....O.*..8....y.........O.O.0n..........~....Tl..E....1...$.U>..:e!.....i..,.^8...a..4.....U...R..rTo..`>.6.........'...XJ..?~z...........g...:.{.u....z].^,b..*.ne..W......._.D..K..I..MR]..T...h.&..D..!.S<.gW.8W@'z.q..6..S..f ....i....[.ME.........|.Q...y'...4.v..B..........,......].....T;..r..B....2.RAdv.....?=.....N0v<G..../.`.u.....%..$......i2...yK..`...w.]T..A..r...%.p6_VC.U.vO........A..]2^....`.\W....a6KfU.'......S..*q2.t.0....(.{....x.~....~.........8....7.F..y...C...h._E.q.....h..T...sw..R.J..9....,.F-I..@F]...PH.. ..qN...,[O...xv..cK....b<.....x\E.........tP..g.~.t..lI.w:^V.o..0K....d...^n...7.../.arA...... ...R=5......w....i.=.rsuw.......n......./.. wnu>.R...W.......,X.Y.......{.b.:^..yL.B&....I0..3."{(..{(.E~.l.J..=...h2..(..T.. .!.....U..].`X...C?>.....@#.I.@.*CS....*....l.\...G...R<..c........D.!..xsP .....T.n...N...9wj...9..g...d../.a...........?..O}..=.c..<.E....ab.......sC.:M&./....v.......6.........5..hM=R.......!C..^.[....Y...9..i..t...y....5......G..w........u.. ....@e.H..T.?..h..*Y=...Q..}^......B.....>.%.wHK^....f.....mH...4....{Q:....."5.....tj..N_..z.....K......|..}...8.H5C[jDs..G.L.....Du&.$...2}....E....6..A.J2cQUo............x...........9.........hn.W.G.K.j..=.g.?0.Y.f.."|}x..b..g.U....MY...........?......$.....T.^.."..AV..@U.p....}......?........&~..9~4.........f'%X..KC......0..jL..l. ...........b....y....w.^D.......x....K.;>..>.V.X...9Di...p.
<<
<<< skipped >>>
GET /kits/hlp/exthelper.exe HTTP/1.0
Host: download.mybrowserbar.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:02 GMT
Server: Apache
Last-Modified: Wed, 30 Apr 2014 14:55:31 GMT
Accept-Ranges: bytes
Content-Length: 419176
Connection: close
Content-Type: application/x-msdos-program
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................................l...........................................Rich............................PE..L.....`S.....................n......a.............@.................................:D....@.................................L........ ...............L..h....@...1.................................. e..@............................................text...^........................... ..`.rdata..............................@..@.data....<..........................@....rsrc........ ......................@..@.reloc...D...@...F..................@..B........................................................................................................................................................................................................................................................................................................................................V.D$.P....D......D...^.......D...E..V......D...E...D$..t.V.b<..Y..^....D$...D$..P...@..u. ..U...u..u..u..u...F...E....].U...u..u..u..u..qF...E....]....L$.......D$............t....3.....L$. .....@...3.9.....j....D../s.....u...C...e...u..N.....D..........s.....V..j.j..N.....D...#....^..D...y$.r..A...A..V........D$..t.V.^;..Y..^...V.t$....x.......D...^.......D......V......D.......D$..t.V..;..Y..^...j....D..nr.....u..2C...e...u..N....9E......... s.....V..j.j..N....9E..K"....^..C..V........D$..t.V..:..Y..^
<<
<<< skipped >>>
GET /pca3-g5.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.verisign.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "895f8ccd92dfec674c94f0d04d1b63bc:1396128308"
Last-Modified: Sat, 29 Mar 2014 21:25:08 GMT
Accept-Ranges: bytes
Content-Length: 533
Date: Tue, 13 May 2014 14:57:00 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0...0..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G5..140320000000Z..140630235959Z0...*.H.............}...a.D[..8..i.....g8..S..tt..a.e.B]..v.l9.m.....~.G(l...G..#z{...Za..F.q....2^X..w.i'.&..n...4v8. &|/Y.B..%..J..g0."k.0....A..7.)h...=5....'Z........y.Ye.......M.._5.9..B.*.. .4z@.7#...... UL.F......iDg..6...'z$.E.E..*..g...2.@D.....&v...o..>..k1N...P...iHTTP/1.1 200 OK..Server: Apache..ETag: "895f8ccd92dfec674c94f0d04d1b63bc:1396128308"..Last-Modified: Sat, 29 Mar 2014 21:25:08 GMT..Accept-Ranges: bytes..Content-Length: 533..Date: Tue, 13 May 2014 14:57:00 GMT..Connection: keep-alive..Content-Type: application/pkix-crl..0...0..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G5..140320000000Z..140630235959Z0...*.H.............}...a.D[..8..i.....g8..S..tt..a.e.B]..v.l9.m.....~.G(l...G..#z{...Za..F.q....2^X..w.i'.&..n...4v8. &|/Y.B..%..J..g0."k.0....A..7.)h...=5....'Z........y.Ye.......M.._5.9..B.*.. .4z@.7#...... UL.F...
<<
<<< skipped >>>
GET /kits/sds/update.xml HTTP/1.1
Accept-Encoding: gzip,deflate
User-Agent: WidgiToolbar
Connection: Keep-Alive
Cache-Control: no-cache
Host: VVV.mybrowserbar.com
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:07 GMT
Server: Apache
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/xml; charset=utf-8
b9..<?xml version='1.0' encoding='UTF-8'?>.<SearchProtection>. <updatecheck path='hXXp://webupdate.mybrowserbar.com/kits/sds/SearchProtectionSetup.exe' ccv='179' />. </SearchProtection>...0..HTTP/1.1 200 OK..Date: Tue, 13 May 2014 14:56:07 GMT..Server: Apache..Keep-Alive: timeout=30, max=100..Connection: Keep-Alive..Transfer-Encoding: chunked..Content-Type: text/xml; charset=utf-8..b9..<?xml version='1.0' encoding='UTF-8'?>.<SearchProtection>. <updatecheck path='hXXp://webupdate.mybrowserbar.com/kits/sds/SearchProtectionSetup.exe' ccv='179' />. </SearchProtection>...0..
GET /CSC3-2010.cer HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: csc3-2010-aia.verisign.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
ETag: "4df6e0fc400cae9c052fae98c66d379f:1367386211"
Last-Modified: Wed, 01 May 2013 05:30:11 GMT
Accept-Ranges: bytes
Content-Length: 1550
Content-Type: text/plain
Date: Tue, 13 May 2014 14:57:00 GMT
Connection: keep-alive
0...0..........R...%V.......K3.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...100208000000Z..200207235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0.."0...*.H.............0.........#K^....2..W....&~......}..6k..u.0..h.. u......i..7..{.....7M_.;......'5.%.8..c.........jb.L.!......;.*O.[..O..v..'.|..~}......H.i...<<A.>......q.U...&J@<..&...m...%{..?../....w..V.z;T0S..b4....Z.(..L.N~[.........u....G...r..4....L~..O.=W.0..6...v.....~4-..........0...0...U.......0.......0p..U. .i0g0e..`.H...E....0V0(.. .........hXXps://VVV.verisign.com/cps0*.. .......0...hXXps://VVV.verisign.com/rpa0...U...........0m.. ........a0_.].[0Y0W0U..image/gif0!0.0... ..............k...j.H.,{..0%.#hXXp://logo.verisign.com/vslogo.gif04..U...-0 0).'.%.#hXXp://crl.verisign.com/pca3-g5.crl04.. ........(0&0$.. .....0...hXXp://ocsp.verisign.com0...U.%..0... ......... .......0(..U...!0...0.1.0...U....VeriSignMPKI-2-80...U..........{&.K......&.....0...U.#..0.....e......0..C9...3130...*.H.............V".4..a.H...V.d..........z."..G8J-l..q.|.p...O...S..^.t.I$..&...G.Lc...4..E...&s....dm.q..E.`.YQ9.X.k....yk..Ar.7"...#.?D...a....\.=...B=e6..=@(....#&.K ...].L4.<..7.o. .4.&.........!.3o..X.%|t.X.u.c?.1|......Sv.[........].!
<<
<<< skipped >>>
GET /b?c1=7&c2=2000001&c3=1&rn=ymtqsy&c7=http://VVV.ytddownloader.com/thankyou.html&c8=YTD Video Converter&cv=1.7 HTTP/1.1
Accept: */*
Referer: hXXp://s7.addthis.com/static/r07/sh158.html
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: b.scorecardresearch.com
Connection: Keep-Alive
Cookie: UID=dc7262f-206.167.78.17-1360768137; UIDR=1360768137
HTTP/1.1 204 No Content
Content-Length: 0
Date: Tue, 13 May 2014 14:56:15 GMT
Connection: keep-alive
Set-Cookie: UID=dc7262f-206.167.78.17-1360768137; expires=Mon, 02-May-2016 14:56:15 GMT; path=/; domain=.scorecardresearch.com
Set-Cookie: UIDR=1399992975; expires=Mon, 02-May-2016 14:56:15 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
HTTP/1.1 204 No Content..Content-Length: 0..Date: Tue, 13 May 2014 14:56:15 GMT..Connection: keep-alive..Set-Cookie: UID=dc7262f-206.167.78.17-1360768137; expires=Mon, 02-May-2016 14:56:15 GMT; path=/; domain=.scorecardresearch.com..Set-Cookie: UIDR=1399992975; expires=Mon, 02-May-2016 14:56:15 GMT; path=/; domain=.scorecardresearch.com..P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"..Pragma: no-cache..Expires: Mon, 01 Jan 1990 00:00:00 GMT..Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate..
GET /live/red_lojson/300lo.json?19rgc5c&colc=1399992973025&si=5372328b6586c44f&uid=5372328cfdb7168d&pub=ytdcs&rev=1399981304&jsl=33&ln=en&pc=men&vpc=&dp=VVV.ytddownloader.com&aa=0&fcu1=667ae1ee&undefined&of=0&uf=1&pd=0&irt=0&md=0&ct=1&tct=0&abt=0<=782&cdn=0&lnlc=us&whcs=1&tl=c=1312,m=1312,i=1312,xm=2094,xp=2094&pi=1&fp=thankyou.html&&rb=0&gen=1000&gen=100&callback=_ate.track.hsr&chr=windows-1252 HTTP/1.1
Accept: */*
Referer: hXXp://s7.addthis.com/static/r07/sh158.html
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: m.addthis.com
Connection: Keep-Alive
Cookie: uid=5372328cfdb7168d; uvc=1|20; uit=1
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Set-Cookie: di2=N5IPHQ.UYM~KSU;Path=/;Domain=.addthis.com;Expires=Thu, 12-May-2016 14:56:14 GMT
Set-Cookie: bt=;Path=/;Domain=.addthis.com;Expires=Thu, 01-Jan-1970 00:00:00 GMT
Set-Cookie: dt=X;Path=/;Domain=.addthis.com;Expires=Thu, 12-Jun-2014 14:56:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Content-Type: application/javascript;charset=UTF-8
Content-Encoding: gzip
Connection: close
...........O,I. )JL...(...V*NM.M. )V....Q*-...r.....|]..}]...C..BC} }.B.}C........nk.T.i..#F.][.....
GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 10:54:59 GMT
Expires: Tue, 13 May 2014 22:54:59 GMT
Last-Modified: Mon, 28 Apr 2014 22:33:43 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15798
Cache-Control: public, max-age=43200
Age: 14473
Alternate-Protocol: 80:quic
...........}kw.:............Io@R...........,Y..4..N/......$[NR.s.Y.........h43v..@.....~...*....a$.|>>..G....,... ..:...<Hdz....$e..:........^1..H....BV...Y....t2..r.8..y...,...(r<...8W|....%DX.&..g4I.......$u.5..^GH...g,G=.....x.. .........W|.............. ...c.......2F.........%O.QO.....#.z.B..UtX;p....6...!V...9<K..A.awP'9hc.{H>....a...,..../:....Q.^.2H.}.pt:..x.c.A...CL...)4..........1.A.Y.od.}.....j,....f.&......Q...........w.8........~x'..<.*...`_.^r..>t!$ .j....q..N....V...M.).4` .r.......O..(.L..@. .>..v.C ......VJ._[[........~"..e...7-..C..y.*.K.I....Y.2!.R.a..i^R...-q..LG......:8.?.?.?R....>o....{<....[..!2o....V.....b..q7kE...'....n?.~...../..A4....vL3[.._....q.......].JG..\.......q....w.YV1..>..`..Q.cC.`..0...\u.:.'.....L.$.1.\O.7n..7.=.O.r'..d.,.y..Kh..,.J.<..na...$..b.X....T..y>OS.....Vxu...e......e.e.x ..[..K.d.D..*....1..Nm."x...I..e...........>....\c......J..&c..J.;@...Q.....j...<......y..J...#>.....>........t.....Y>..Yk..@e..v.Cf5....7.....(.......$\.R.......wz.I.......6..:A>..g..[..o../..M'.....y.6*..]H.5`i*...Q..O.%4T ...;.....#J.........xkk.&..^N../[......As.E....W....5.*MG....z......6.w......p..['Bg.~T..2....U..@@.`.u..T...Z.................Z....|.F.........M.&...k._v]T.M..,/....4.$.8..X.`...qm-\[.q..C..l...I|>>UJ.}.k.4."... e...v.......&.....jSm.....RH..m.9..si|kP .xVQ......-.V.v..j..z6.`\!.`.6`c73..2....y.......p...l..._..=o......k....<v ..'.bX7.e..R9.....Ym5..e.PE.zA.....y.. ...B"R...Qy.....g7..hp...fK./...O.c.,R....^3
<<
<<< skipped >>>
GET /__utm.gif?utmwv=5.5.0&utms=1&utmn=211728539&utmhn=VVV.ytddownloader.com&utmcs=windows-1252&utmsr=1716x901&utmvp=1712x716&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=YTD Video Converter&utmhid=2112539694&utmr=-&utmp=/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1&utmht=1399992971790&utmac=UA-25210420-2&utmcc=__utma=135583929.1101086425.1399992972.1399992972.1399992972.1;+__utmz=135583929.1399992972.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 08 May 2014 11:48:04 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 443288
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Thu, 08 May 2014 11:48:04 GMT..Server: Golfe2..Content-Length: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Age: 443288..Alternate-Protocol: 80:quic..GIF89a.............,...........D..;..
GET /connect/xd_arbiter/dgdTycPTSRj.js?version=41 HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: static.ak.facebook.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Content-Encoding: gzip
X-FB-Debug: 2hkGn4rW8ep5ogm3K8NQerpkNF4BcCL6MAYruQmbjFc=
Vary: Accept-Encoding
Content-Length: 8774
Cache-Control: public, max-age=31036242
Expires: Thu, 07 May 2015 20:06:56 GMT
Date: Tue, 13 May 2014 14:56:14 GMT
Connection: keep-alive
...........|i..F..w....]@..Q:.-..jdY.hF.H...$]O.H. A...W.....y..........".gdDd....^_.......xi..,..V.9.o..0... ..a.L..i.e.....c.-.26.....h....l}..}.......4..7..x...../{S...a.^2..V8r...).4.L|..7:Z.^.&...6.."........<M.$..y3O>.)...X.ACJ.^".Yb....w.s...v.R.....CU..X........._.z..w8.rZ.]X...T|mw.<.........\..D>6.3...7...qE~x...9..$u.#.f06......dRI.......a...-...dd.....I........../..&']d...h..Y3..8...b 1.......a....[...L0.@.......r)...EP...S....qjA0.K...L......^....a......g0..c.jB{..A.1.......5.S....4..,@F...&g...<......K.2W[@..J1V.. .V!.2.5..u\e.....(.6...7t..........y..gV.%3NN..O.....j*.<..0......)?X.$....h.....u...t,h....A.;..vy).m4.h.4i......#...%1...k.W...i......."_.j.C.bD..K&.'.NiM.iiv..[..l..`zk.S......nnn.....\.....'.a.X8.... .Pa]ga..._..]....4.....3n.FX....t.F... sG`....^0..._ek...w.......R.M.y.......bV.. Yn(.2..F..;..GHsH....X~.....1...b..e.W..4...._...Y..O.Rc.=]..b...8..........*]O-..(xd!Cf.|c1............E..E.n.~f.E9|..AN.P...DF.e...i4......)..E.3.y3NVD?P....8 V;.9...p.O..2...ww?....;j~...r.Wj,C.C0..Ly.j..Gv|...?...l....[h..o.H<..P.....o.B..>....2w.H.9..M...zy)....r.{H........h.\..b.......{,w.."`.........~...m.1...0Y.~..;C.|..6c.i;...\b...........C.i.x..}....O...=.......k.y{.....^n.|b...br}....v}...$..*T...8|usoO.)...$.^..s......$D.3.._?.x....s.8.n7.:s...I..Pqu.N*?T|>...d.f..s8\./r~.........v'....*.:Z...l......$.,.&.Ty..@..V..h.?......v.!>.....G..._.O......v.k....}.7.....c[|........FX...Ak...&..k.5N..............}......!....]......c....H<..1..)<..S.....>......y......
<<
<<< skipped >>>
GET /getcountry.html HTTP/1.0
Host: VVV.youtubedownloadersite.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 May 2014 14:55:45 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2
Connection: close
X-Powered-By: PHP/5.3.10-1ubuntu3.11
CA..
GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 08 Feb 2013 15:35:10 GMT
Date: Thu, 08 May 2014 22:29:52 GMT
Expires: Fri, 08 May 2015 22:29:52 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 32819
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 404779
Alternate-Protocol: 80:quic
............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V........V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g..Q...S_..Y.....G)..T.".......<......&...*..Z.t%..s@it5..y.c.....p.h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;.....3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE..,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q....v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_........j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*........H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v....n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f..........&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3......i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&
<<
<<< skipped >>>
GET /MyPCBackup_Setup.exe HTTP/1.0
Host: cdn.mypcbackup.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:03 GMT
Content-Type: application/octet-stream
Content-Length: 10372136
Connection: close
x-amz-id-2: vjvfhdOeVxSF9l9YzS4wi6bl pSErTlALS/vawNFGydNHWGR0LsBHpVN7xbbNMfH
x-amz-request-id: 2B7D0872DDF1FC56
Last-Modified: Mon, 17 Mar 2014 11:20:28 GMT
ETag: "45922155c9628e11441aa869c6287bb7"
Server: NetDNA-cache/2.2
X-Cache: HIT
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t..........(m...........1..@............................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc...(m.......n...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<
<<< skipped >>>
GET /images/pixel.gif?action=install&point=finish&cid=31fbc1ce06e12d56d19c32273fd38c79&isn=2A0E0F74E87C41248D17D84CDB01E7BE&kt=cnet HTTP/1.0
Host: VVV.youtubedownloadersite.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 May 2014 14:56:09 GMT
Content-Type: image/gif
Content-Length: 1093
Last-Modified: Wed, 20 Feb 2013 14:38:31 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:68AF816F211411E187C8D4C48A462294" xmpMM:DocumentID="xmp.did:68AF8170211411E187C8D4C48A462294"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:68AF816D211411E187C8D4C48A462294" stRef:documentID="xmp.did:68AF816E211411E187C8D4C48A462294"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,...........D..;..
GET /terms_extensions.rtf HTTP/1.0
Host: VVV.mybrowserbar.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:55:49 GMT
Server: Apache
Vary: Host
Last-Modified: Thu, 27 Mar 2014 12:09:30 GMT
Accept-Ranges: bytes
Content-Length: 43087
Connection: close
Content-Type: application/rtf
{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Microsoft Sans Serif;}{\f1\fswiss\fprq2\fcharset0 Arial;}}..{\colortbl ;\red0\green0\blue255;\red51\green51\blue51;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\sb100\sa100\lang9\f0\fs17 The Spigot Terms of Use applies to the Browser Extensions (which includes Browser Extensions in Google Chrome/Internet Explorer, Amazon Shopping Helper in Google Chrome and Mozilla Firefox, Slick Savings/Browser Error Assistant/eBay Shopping Assistant in Mozilla Firefox) and Search Protection ("Program"), which is built and maintained by Spigot, Inc. ("We," \ldblquote our,\rdblquote or \ldblquote us,\rdblquote whether in uppercase, lowercase, or a combination). The Program allows you a convenient way to help find search results online by collecting your requests for information and processing them through our search engine partners. Our partners may compensate us for making this information available to you. Use of the Program is free of charge to you. Use of the Program and its features as described below requires that you agree to the following Terms of Use (the \ldblquote Terms\rdblquote ). You agree to be legally bound by these Terms clicking the \ldblquote I Agree,\rdblquote "Next", "Run", "Install" or "Yes" button provided. These Terms are a legal contract between Us and You, an individual user of at least 18 years of age, or if You are using the Program on behalf of any entity -- including a company, organization
<<
<<< skipped >>>
GET /kits/sds/update.xml HTTP/1.1
Accept-Encoding: gzip,deflate
User-Agent: WidgiToolbar
Host: update.mybrowserbar.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx/0.7.65
Date: Tue, 13 May 2014 14:56:07 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Location: hXXp://VVV.mybrowserbar.com/kits/sds/update.xml
<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/0.7.65</center>..</body>..</html>..HTTP/1.1 301 Moved Permanently..Server: nginx/0.7.65..Date: Tue, 13 May 2014 14:56:07 GMT..Content-Type: text/html..Content-Length: 185..Connection: keep-alive..Location: hXXp://VVV.mybrowserbar.com/kits/sds/update.xml..<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/0.7.65</center>..</body>..</html>....
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: VVV.yahoo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private
Content-Length: 5430
Content-Type: image/x-icon
Date: Mon, 12 May 2014 22:01:05 GMT
ETag: "YM:1:f780dd7f-efc3-47de-80fa-55026f0e0c600004f93b1285b677"
Expires: Tue, 13 May 2014 23:00:01 GMT
Last-Modified: Mon, 12 May 2014 22:00:15 GMT
Server: ATS
x-ysws-request-id: f0a10362-e960-4192-8a18-8e68dc193574
x-ysws-visited-replicas: gops.usw26.mobstor.vip.gq1.yahoo.com
Age: 60923
X-Cache: HIT from logo7.global.media.ne1.yahoo.com
X-Cache-Lookup: HIT from logo7.global.media.ne1.yahoo.com:80
Via: HTTP/1.1 web3.usw26.mobstor.gq1.yahoo.com UserFiberFramework/1.0, 1.0 logo7.global.media.ne1.yahoo.com:80 (squid/2.7.STABLE9), http/1.0 l7.ycs.che.yahoo.com (ApacheTrafficServer/4.0.2), http/1.1 ir2.fp.bf1.yahoo.com (ApacheTrafficServer/4.0.2)
Connection: keep-alive
...... .... .....&......... .h.......(... ...@..... ...........................;.p.5.o.6.o.6Dd.0.........................................................................................d.0.o.6Do.6.o.4...;...;.p.3.o.3.n.3.q.3.n.3.r.7.n.5.o.6up.8Pn.7)i.2.................................m.3.n.6*q.8Po.7tn.5.n.4.n.3.q.3.n.3.n.3.p.3...;...;.q.3.s.4.s.4.v.5.q.4.r.4.q.4.q.4.q.5.q.5.q.5.q.4.p.4.r.5.p.4.q.4.q.4.q.5.q.4.r.5.q.5.q.5.q.5.q.4.q.3.r.4.u.5.s.4.r.3.p.3...;...;.t.5.w.5.v.5.y.6.u.5.w.6.x.7.x.7.w.7.x.8.y.8.y.9.z.9.z.9.v.7.w.9.y.9.z.9.v.8.v.7.v.8.v.7.v.6.v.6.v.6.z.7.x.6.v.5.t.5.r.3...;...;.u.5.x.6.{.7.y.6.y.7.z.8.|.8.}.9...;...<...<.~.<...<...<.{.:.|.;.}.;.z.:.{.:.|.:.z.:.{.:.{.9.{.9...:.{.8.|.8.w.6.t.5.t.5...;...;.v.5.z.7...9.}.8.}.9...9...;...;...<...=...=...>...>...?...=...>...>...>...>...>...>...<...<...;...<...<.|.8.~.8.y.6.t.5...;...;.w.5...9...;...;...;...;...<...>...>...?...@...A...A...................@...A...A...?...>...>...>...>...=...;...<.}.8.v.5...;...;.z.7...:...<...<...>...?...?...A...A...B...C...C...D...................D...C...B...C...C...B...B...?...>...>...<.}.8.z.7...;...;...9...<...?...>...?...@...A...B...C...D...E...F...F...................G...F...G...F...E...D...D...B...A...A...>...<.z.8...;...;...8...=...A...A...A...B...D...D...F...F...F...H...H...................H...H...H...G...G...F...E...D...B...A...A...<.z.8...;...;...;...?...C...D...C...D...F...G...H...I...J...J...K............
<<
<<< skipped >>>
GET /update/wt/ie/coupons/update.xml HTTP/1.1
User-Agent: MS IE Coupons addon
Host: update.mybrowserbar.com
Accept: */*
HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Tue, 13 May 2014 14:56:29 GMT
Content-Type: text/xml
Content-Length: 217
Last-Modified: Tue, 21 May 2013 11:38:18 GMT
Connection: keep-alive
Accept-Ranges: bytes
<?xml version='1.0' encoding='UTF-8'?>..<cpupdate>...<libid>{40C6AC97-5316-4D22-BA61-3BF0D585FB22}</libid>...<url>hXXp://update.mybrowserbar.com/update/wt/ie/coupons/coupons_1.0.zip</url>...<ver>1.0</ver>..</cpupdate>..
GET /url/shares.json?url=http://VVV.ytddownloader.com/&callback=_ate.cbs.sc_httpwwwytddownloadercom0 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: api-public.addthis.com
Connection: Keep-Alive
Cookie: uid=5372328cfdb7168d; uvc=1|20; uit=1
HTTP/1.1 200 OK
Cache-Control: no-transform, max-age=600
Content-Type: application/json
Content-Encoding: gzip
Content-Length: 75
Accept-Ranges: bytes
Date: Tue, 13 May 2014 14:56:14 GMT
Via: 1.1 varnish
Age: 340
Connection: keep-alive
X-Served-By: cache-v41-ASH
X-Cache: HIT
X-Cache-Hits: 13
X-Timer: S1399992974.681583166,VS0,VE0
...........O,I.KN*. N..())(//.,II./...OLI-J..5..V*.H,J-V.210.0.......}>7...HTTP/1.1 200 OK..Cache-Control: no-transform, max-age=600..Content-Type: application/json..Content-Encoding: gzip..Content-Length: 75..Accept-Ranges: bytes..Date: Tue, 13 May 2014 14:56:14 GMT..Via: 1.1 varnish..Age: 340..Connection: keep-alive..X-Served-By: cache-v41-ASH..X-Cache: HIT..X-Cache-Hits: 13..X-Timer: S1399992974.681583166,VS0,VE0.............O,I.KN*. N..())(//.,II./...OLI-J..5..V*.H,J-V.210.0.......}>7.....
GET /live/t00/mu.gif?a=sc&r=1&err=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: m.addthisedge.com
Connection: Keep-Alive
HTTP/1.1 204 No Content
Date: Tue, 13 May 2014 14:56:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: close
GET /js/main.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:11 GMT
Content-Type: application/x-javascript
Content-Length: 1272
Last-Modified: Fri, 08 Nov 2013 13:22:51 GMT
Connection: keep-alive
Accept-Ranges: bytes
$(document).ready(function() {. //setting os..$(".os-redirect").click(function(){...setCookie('user_os', $(this).attr("os"), 1,'/');..});....$(".dropdown img.flag").addClass("flagvisibility");.. $(".dropdown dt a").click(function() {. $(".dropdown dd div").toggle();. });. . $(".dropdown dd ul li a").click(function() {. var text = $(this).html();. $(".dropdown dt a span").html(text);. $(".dropdown dd div").hide();... });. . $(document).bind('click', function(e) {. var $clicked = $(e.target);. if (! $clicked.parents().hasClass("dropdown")). $(".dropdown dd div").hide();. });...//setting locale...$(".langselector, #language-bar a").click(function(){...setCookie('ytd_locale', $(this).attr("hreflang"), 1,'/');..});....change_auto_renew();.});..function setCookie(c_name,value,exdays, path).{..var exdate=new Date();..exdate.setDate(exdate.getDate() exdays);..var c_value=escape(value) ((exdays==null) ? "" : "; expires=" exdate.toUTCString()) ((path) ? "; path=" path : "") ;..document.cookie=c_name "=" c_value;..}.function change_auto_renew() {. $("input[name=src]").each(function() {. $(this).val($(this).val() == 0 ? 1 : 0 );. });.}....
GET /images/ytd-logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ytddownloader.com/thankyou.html?isn=2A0E0F74E87C41248D17D84CDB01E7BE&stb=1&sds=1&shp=1&lang=1033&cid=31fbc1ce06e12d56d19c32273fd38c79&oldVer=&newVer=4.8.1&tov=19&kt=cnet&pv=0&mpb=1
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: VVV.ytddownloader.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Tue, 13 May 2014 14:56:12 GMT
Content-Type: image/png
Content-Length: 34724
Last-Modified: Fri, 05 Oct 2012 14:07:53 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR.......x.....h.......tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:48617E8EC10BE2118B4BD91E24AB7A59" xmpMM:DocumentID="xmp.did:72065B650C8711E28A8AE4B10473ECB4" xmpMM:InstanceID="xmp.iid:72065B640C8711E28A8AE4B10473ECB4" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:48617E8EC10BE2118B4BD91E24AB7A59" stRef:documentID="xmp.did:48617E8EC10BE2118B4BD91E24AB7A59"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O.......IDATx.....eYY'..s.........EA.[.6... .....c.8.[.........n.i[.g..F...F..i...V....(j...5"c}...|.s.yq#2.2.*....|U/.-..{.9....#.Rt.q.q.......\{\{\c.k.k..S....!......~....F.K.v....h..d0"%=*Fk.n...7...5}.........RPv....*%9..&..~z........@..;.G.?...x.qz}.zj..E...c.Z@i.qhff..sc-...)....777G.~..4.F._.f.. .Q=....$..~ ...<........6....>C..w.q.......#...<..........A.......`.L}.m.-.i.....~.....?.LEY.x8..hi&....LW..0......#..&..og....K...}@I\.<]... .p\~*!.x!...KU.:4...x.;.=.3....{.S*.EB...ovaq.J...1.5f.....W.$.wG...N....
<<
<<< skipped >>>
GET /4631cdb5/D0wnloads-mpb-cpl-new/MyPCBackup_Setup.exe HTTP/1.0
Host: track.mypcbackup.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 301 Moved Permanently
Date: Tue, 13 May 2014 14:56:02 GMT
Server: Apache
Set-Cookie: SESSID=pdk90qpa5qaa2oakk3a1mikus6; path=/; domain=.mypcbackup.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: LC_CURRENCY=CA; expires=Fri, 23-May-2014 14:56:02 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=CA; expires=Fri, 23-May-2014 14:56:02 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: LC_CURRENCY=CA; expires=Fri, 23-May-2014 14:56:02 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=CA; expires=Fri, 23-May-2014 14:56:02 GMT; path=/; domain=.mypcbackup.com
P3P: CP="We do not have a P3P policy"
location: hXXp://cdn.mypcbackup.com/MyPCBackup_Setup.exe
Set-Cookie: aff_id=75335; expires=Sat, 14-Jun-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: hop_name=75335; expires=Sat, 14-Jun-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: hop_id=111329; expires=Sat, 14-Jun-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: hash=4fe28efd5ddebc791624273719a5317b; expires=Sat, 14-Jun-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: tid=D0wnloads-mpb-cpl-new; expires=Sat, 14-Jun-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: 4631cdb5unique=true; expires=Mon, 11-Aug-2014 14:56:02 GMT; path=/; domain=mypcbackup.com
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: MPBWWW=3898156614.1.1048206016.2620617152; path=/
<<
<<< skipped >>>
GET /aadebc4830c51c2794a960fe5a9e11df.php HTTP/1.0
Host: track.mypcbackup.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:46 GMT
Server: Apache
Set-Cookie: SESSID=5e50ct6rv1pjuu34ldqhjluu04; path=/; domain=.mypcbackup.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: LC_CURRENCY=CA; expires=Fri, 23-May-2014 14:56:46 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=CA; expires=Fri, 23-May-2014 14:56:46 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: LC_CURRENCY=CA; expires=Fri, 23-May-2014 14:56:46 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=CA; expires=Fri, 23-May-2014 14:56:46 GMT; path=/; domain=.mypcbackup.com
Content-Length: 8
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: MPBWWW=3898156614.1.1048206016.2620657216; path=/
Complete..
POST /cgi/api.cgi/407453/E2DA97D8A12A4D02B7A3A58A402F38B0/vloc/20 HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml
User-Agent: WidgiToolbar-179-407453
Host: api.mybrowserbar.com
Content-Length: 446
Connection: Keep-Alive
Cache-Control: no-cache
<drq><auth><ccv>179</ccv><cnid>407453</cnid><tbcnid></tbcnid><isn>E2DA97D8A12A4D02B7A3A58A402F38B0</isn><ct>20</ct><dlid>1033</dlid><lngid>1033</lngid><wv>5.1</wv><brw><ie>8.0.6001.18702</ie><ff>29.0.1</ff><gc>34.0.1847.131</gc><dbrw>Internet Explorer</dbrw></brw></auth>
<vloc><type>install</type><key>1</key><key>3</key><key>2</key><key>4</key><key>5</key><key>6</key><key>7</key><key>8</key><key>9</key><key>10</key><key>11</key></vloc></drq>
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 14:56:26 GMT
Server: Apache
Pragma: no-cache
Cache-control: no-cache
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Tue, 13 May 2014 14:56:26 GMT
54d..<drp><auth>. <scv>179</scv>.</auth>.<vloc>. <li>. <key>1</key>. <value>hXXp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=407453&p={searchTerms}</value>. </li>. <li>. <key>3</key>. <value>hXXp://search.yahoo.com/search?fr=greentree_ie1&ei=utf-8&ilc=12&type=407453&p={searchTerms}</value>. </li>. <li>. <key>2</key>. <value>hXXp://search.yahoo.com/search?fr=chr-greentree_ff&ei=utf-8&ilc=12&type=407453&p={searchTerms}</value>. </li>. <li>. <key>4</key>. <value>hXXp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=407453&p=</value>. </li>. <li>. <key>5</key>. <value>hXXp://search.yahoo.com/search?fr=chr-greentree_gc&ei=utf-8&ilc=12&type=407453&p={searchTerms}</value>. </li>. <li>. <key>6</key>. <value>http://ca.search.yahoo.com/?type=407453&fr=spigot-yhp-ie</value>. </li>. <li>. <key>7</key>. <value>hXXp://ca.search.yahoo.com/?type=407453&fr=spigot-yhp-ff</value>. </li>. <li>. <key>8</key>. <value>hXXp://ca.search.yahoo.com/?type=407453&fr=spigot-yhp-ch</value>. </li>. <li>. <key>9</ke
<<
<<< skipped >>>
Map
The program connects to the servers at the folowing location(s):
Strings from Dumps
IEXPLORE.EXE_2676:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
IEFRAME.dll
IEFRAME.dll
MLANG.dll
MLANG.dll
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
msvcrt.dll
msvcrt.dll
ntdll.dll
ntdll.dll
SHLWAPI.dll
SHLWAPI.dll
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
iertutil.dll
iertutil.dll
urlmon.dll
urlmon.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
GetWindowsDirectoryW
GetWindowsDirectoryW
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
UrlApplySchemeW
UrlApplySchemeW
UrlCreateFromPathW
UrlCreateFromPathW
UrlCanonicalizeW
UrlCanonicalizeW
PathIsURLW
PathIsURLW
iexplore.pdb
iexplore.pdb
KEYWD
KEYWD
KEYW
KEYW
.uuxz
.uuxz
_ %S4Dd
_ %S4Dd
RUBV%uJ
RUBV%uJ
bZ22b%ss
bZ22b%ss
%.FG[[[]]]]]Z11.('
%.FG[[[]]]]]Z11.('
N56.SK
N56.SK
9u%s:
9u%s:
.Ra1X
.Ra1X
Y8t/,?.J%F^y
Y8t/,?.J%F^y
Go.OBR"F
Go.OBR"F
Ri.tn
Ri.tn
>.IN }
>.IN }
1YYYY1YY9GEAA=77YRNNNW:.VT1
1YYYY1YY9GEAA=77YRNNNW:.VT1
Y.hilkRROMLK=C,
Y.hilkRROMLK=C,
..(((($$
..(((($$
3...((((%
3...((((%
3....(.''$
3....(.''$
3.2...((((%
3.2...((((%
33.2....(,'
33.2....(,'
55323222...
55323222...
(%&'00443445?
(%&'00443445?
00.,,,4(
00.,,,4(
000.,,9(
000.,,9(
0020..9(
0020..9(
003200;(
003200;(
(#'( (''''!'!
(#'( (''''!'!
<)<.<3<<<</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe</pre><pre>user32.dll</pre><pre>yKernel32.DLL</pre><pre>{28fb17e0-d393-439d-9a21-9474a070473a}</pre><pre>iexplore.exe</pre><pre>Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}</pre><pre>"%s" %s</pre><pre>kernel32.dll</pre><pre>-extoff go.microsoft.com/fwlink/?LinkId=106320</pre><pre>-extoff go.microsoft.com/fwlink/?LinkId=106322</pre><pre>-extoff go.microsoft.com/fwlink/?LinkId=106323</pre><pre>\AppPatch\sysmain.sdb</pre><pre>explorer.exe</pre><pre>ieuser.exe</pre><pre>Kernel32.dll</pre><pre>Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}</pre><pre>.\%s.mui</pre><pre>.\%s\%s.mui</pre><pre>%s\%s.mui</pre><pre>%s\%s\%s.mui</pre><pre>%s\%s</pre><pre>Software\Microsoft\Internet Explorer\URLSearchHooks</pre><pre>shell:%s</pre><pre>Imaging_CreateWebPagePreview_Perftrack</pre><pre>Frame_URLEntered</pre><pre>Imaging_CreateWebPagePreview</pre><pre>WS_ExecuteQuery</pre><pre>8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)</pre><pre>IEXPLORE.EXE</pre><pre>Windows</pre><pre>8.00.6001.18702</pre><b>IEXPLORE.EXE_2880:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>IEFRAME.dll</pre><pre>MLANG.dll</pre><pre>ADVAPI32.dll</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>msvcrt.dll</pre><pre>ntdll.dll</pre><pre>SHLWAPI.dll</pre><pre>SHELL32.dll</pre><pre>ole32.dll</pre><pre>iertutil.dll</pre><pre>urlmon.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExW</pre><pre>GetWindowsDirectoryW</pre><pre>_wcmdln</pre><pre>_amsg_exit</pre><pre>UrlApplySchemeW</pre><pre>UrlCreateFromPathW</pre><pre>UrlCanonicalizeW</pre><pre>PathIsURLW</pre><pre>iexplore.pdb</pre><pre>KEYWD</pre><pre>KEYW</pre><pre>.uuxz</pre><pre>_ %S4Dd</pre><pre>RUBV%uJ</pre><pre>bZ22b%ss</pre><pre>%.FG[[[]]]]]Z11.('</pre><pre>N56.SK</pre><pre>9u%s:</pre><pre>.Ra1X</pre><pre>Y8t/,?.J%F^y</pre><pre>Go.OBR"F</pre><pre>Ri.tn</pre><pre>>.IN }</pre><pre>1YYYY1YY9GEAA=77YRNNNW:.VT1</pre><pre>Y.hilkRROMLK=C,</pre><pre>..(((($$</pre><pre>3...((((%</pre><pre>3....(.''$</pre><pre>3.2...((((%</pre><pre>33.2....(,'</pre><pre>55323222...</pre><pre>(%&'00443445?</pre><pre>00.,,,4(</pre><pre>000.,,9(</pre><pre>0020..9(</pre><pre>003200;(</pre><pre>(#'( (''''!'!</pre><pre><)<.<3<<<</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe</pre><pre>user32.dll</pre><pre>yKernel32.DLL</pre><pre>{28fb17e0-d393-439d-9a21-9474a070473a}</pre><pre>iexplore.exe</pre><pre>Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}</pre><pre>"%s" %s</pre><pre>kernel32.dll</pre><pre>-extoff go.microsoft.com/fwlink/?LinkId=106320</pre><pre>-extoff go.microsoft.com/fwlink/?LinkId=106322</pre><pre>-extoff go.microsoft.com/fwlink/?LinkId=106323</pre><pre>\AppPatch\sysmain.sdb</pre><pre>explorer.exe</pre><pre>ieuser.exe</pre><pre>Kernel32.dll</pre><pre>Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}</pre><pre>.\%s.mui</pre><pre>.\%s\%s.mui</pre><pre>%s\%s.mui</pre><pre>%s\%s\%s.mui</pre><pre>%s\%s</pre><pre>Software\Microsoft\Internet Explorer\URLSearchHooks</pre><pre>shell:%s</pre><pre>Imaging_CreateWebPagePreview_Perftrack</pre><pre>Frame_URLEntered</pre><pre>Imaging_CreateWebPagePreview</pre><pre>WS_ExecuteQuery</pre><pre>8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)</pre><pre>IEXPLORE.EXE</pre><pre>Windows</pre><pre>8.00.6001.18702</pre><b>SearchProtection.EXE_3452:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>u(SSh</pre><pre>t?<%u8</pre><pre><9%u3</pre><pre>t8It.IIt#</pre><pre>.FGy"</pre><pre>SShtbI</pre><pre> 2 34 567</pre><pre>>.uBV</pre><pre>FTPWVh</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>kernel32.dll</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>portuguese-brazilian</pre><pre>operator</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>Kernel32.dll</pre><pre>Unicows.dll</pre><pre>3.7.7.1</pre><pre>SQLite format 3</pre><pre>CREATE TABLE sqlite_master(</pre><pre>sql text</pre><pre>CREATE TEMP TABLE sqlite_temp_master(</pre><pre>REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY</pre><pre>urls_to_restore_on_startup</pre><pre>startup_urls</pre><pre>SELECT value FROM meta WHERE key="Default Search Provider ID"</pre><pre>INSERT INTO meta (key,value) VALUES ("Default Search Provider ID",</pre><pre>" WHERE key="Default Search Provider ID"</pre><pre>" WHERE key="Default Search Provider ID Backup"</pre><pre>UPDATE keywords SET logo_id ='0'</pre><pre>SELECT value FROM meta where key='version'</pre><pre>SELECT value FROM meta WHERE key='Default Search Provider ID Backup Signature'</pre><pre>SELECT m.value FROM meta m WHERE m.key="Default Search Provider ID"</pre><pre>' WHERE key="Default Search Provider ID Backup"</pre><pre>" WHERE key='Default Search Provider ID Backup Signature'</pre><pre>UPDATE meta SET value ='9999' WHERE key="Default Search Provider ID"</pre><pre>SELECT 1 FROM keywords WHERE id="</pre><pre>SELECT id FROM keywords WHERE keyword LIKE "</pre><pre>SELECT max(id) 1 FROM keywords</pre><pre>UPDATE keywords SET id = "</pre><pre>SELECT id FROM keywords where sync_guid="</pre><pre>SELECT id FROM keywords where url="</pre><pre>", keyword = "</pre><pre>", url="</pre><pre>UPDATE keywords SET prepopulate_id = 0, sync_guid="</pre><pre>UPDATE keywords SET suggest_url="</pre><pre>INSERT INTO keywords (id, short_name, keyword, favicon_url, url, safe_for_autoreplace, input_encodings, show_in_default_list, prepopulate_id) VALUES ("</pre><pre>UPDATE keywords SET sync_guid="</pre><pre>SELECT null FROM keywords</pre><pre>SELECT k.short_name FROM keywords k, meta m WHERE m.value=k.id AND m.key="Default Search Provider ID"</pre><pre>SELECT k.keyword FROM keywords k, meta m WHERE m.value=k.id AND m.key="Default Search Provider ID" AND k.keyword LIKE "</pre><pre>select k.sync_guid from keywords k, meta m WHERE m.value=k.id AND m.key="Default Search Provider ID"</pre><pre>select k.url from keywords k, meta m WHERE m.value=k.id AND m.key="Default Search Provider ID"</pre><pre>SELECT k.id FROM keywords k, meta m WHERE m.value=k.id AND m.key="Default Search Provider ID"</pre><pre>large file support is disabled</pre><pre>unknown operation</pre><pre>SQL logic error or missing database</pre><pre>foreign_keys</pre><pre>sqlite_compileoption_get</pre><pre>sqlite_compileoption_used</pre><pre>sqlite_log</pre><pre>sqlite_source_id</pre><pre>sqlite_version</pre><pre>sqlite_attach</pre><pre>sqlite_detach</pre><pre>sqlite_stat1</pre><pre>sqlite_rename_parent</pre><pre>sqlite_rename_trigger</pre><pre>sqlite_rename_table</pre><pre>RowKey</pre><pre>SQLITE_</pre><pre>d-d-d d:d:d</pre><pre>d:d:d</pre><pre>d-d-d</pre><pre>failed to allocate %u bytes of memory</pre><pre>failed memory resize %u to %u bytes</pre><pre>922337203685477580</pre><pre>API call with %s database connection pointer</pre><pre>OsError 0x%x (%u)</pre><pre>os_win.c:%d: (%d) %s(%s) - %s</pre><pre>%s-shm</pre><pre>%s\etilqs_</pre><pre>Recovered %d frames from WAL file %s</pre><pre>cannot limit WAL size: %s</pre><pre>invalid page number %d</pre><pre>2nd reference to page %d</pre><pre>Failed to read ptrmap key=%d</pre><pre>Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)</pre><pre>%d of %d pages missing from overflow list starting at %d</pre><pre>failed to get page %d</pre><pre>freelist leaf count too big on page %d</pre><pre>Page %d:</pre><pre>unable to get the page. error code=%d</pre><pre>btreeInitPage() returns error code %d</pre><pre>On tree page %d cell %d:</pre><pre>On page %d at right child:</pre><pre>Corruption detected in cell %d on page %d</pre><pre>Multiple uses for byte %d of page %d</pre><pre>Fragmentation of %d bytes reported as %d on page %d</pre><pre>Page %d is never used</pre><pre>Pointer map page %d is referenced</pre><pre>Outstanding page count goes from %d to %d during this analysis</pre><pre>unknown database %s</pre><pre>keyinfo(%d</pre><pre>%s(%d)</pre><pre>%s-mjX</pre><pre>foreign key constraint failed</pre><pre>unable to use function %s in the requested context</pre><pre>bind on a busy prepared statement: [%s]</pre><pre>zeroblob(%d)</pre><pre>abort at %d in [%s]: %s</pre><pre>constraint failed at %d in [%s]</pre><pre>cannot open savepoint - SQL statements in progress</pre><pre>no such savepoint: %s</pre><pre>cannot %s savepoint - SQL statements in progress</pre><pre>cannot rollback transaction - SQL statements in progress</pre><pre>cannot commit transaction - SQL statements in progress</pre><pre>sqlite_temp_master</pre><pre>sqlite_master</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid</pre><pre>cannot change %s wal mode from within a transaction</pre><pre>database table is locked: %s</pre><pre>statement aborts at %d: [%s] %s</pre><pre>cannot open value of type %s</pre><pre>cannot open virtual table: %s</pre><pre>cannot open view: %s</pre><pre>no such column: "%s"</pre><pre>foreign key</pre><pre>indexed</pre><pre>cannot open %s column for writing</pre><pre>misuse of aliased aggregate %s</pre><pre>%s: %s.%s.%s</pre><pre>%s: %s.%s</pre><pre>%s: %s</pre><pre>not authorized to use function: %s</pre><pre>%r %s BY term out of range - should be between 1 and %d</pre><pre>too many terms in %s BY clause</pre><pre>Expression tree is too large (maximum depth %d)</pre><pre>variable number must be between ?1 and ?%d</pre><pre>too many SQL variables</pre><pre>too many columns in %s</pre><pre>EXECUTE %s%s SUBQUERY %d</pre><pre>misuse of aggregate: %s()</pre><pre>%.*s"%w"%s</pre><pre>%s%.*s"%w"</pre><pre>%s OR name=%Q</pre><pre>type='trigger' AND (%s)</pre><pre>sqlite_</pre><pre>table %s may not be altered</pre><pre>there is already another table or index with this name: %s</pre><pre>view %s may not be altered</pre><pre>UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;</pre><pre>UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');</pre><pre>sqlite_sequence</pre><pre>UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q</pre><pre>UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;</pre><pre>Cannot add a PRIMARY KEY column</pre><pre>UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q</pre><pre>sqlite_altertab_%s</pre><pre>CREATE TABLE %Q.%s(%s)</pre><pre>DELETE FROM %Q.%s WHERE %s=%Q</pre><pre>SELECT tbl, idx, stat FROM %Q.sqlite_stat1</pre><pre>invalid name: "%s"</pre><pre>too many attached databases - max %d</pre><pre>database %s is already in use</pre><pre>unable to open database: %s</pre><pre>no such database: %s</pre><pre>cannot detach database %s</pre><pre>database %s is locked</pre><pre>%s %T cannot reference objects in database %s</pre><pre>access to %s.%s.%s is prohibited</pre><pre>access to %s.%s is prohibited</pre><pre>object name reserved for internal use: %s</pre><pre>there is already an index named %s</pre><pre>too many columns on %s</pre><pre>duplicate column name: %s</pre><pre>default value of column [%s] is not constant</pre><pre>table "%s" has more than one primary key</pre><pre>AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY</pre><pre>no such collation sequence: %s</pre><pre>CREATE %s %.*s</pre><pre>UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d</pre><pre>CREATE TABLE %Q.sqlite_sequence(name,seq)</pre><pre>view %s is circularly defined</pre><pre>UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d</pre><pre>table %s may not be dropped</pre><pre>use DROP TABLE to delete table %s</pre><pre>use DROP VIEW to delete view %s</pre><pre>DELETE FROM %s.sqlite_sequence WHERE name=%Q</pre><pre>DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q</pre><pre>foreign key on %s should reference only one column of table %T</pre><pre>number of columns in foreign key does not match the number of columns in the referenced table</pre><pre>unknown column "%s" in foreign key definition</pre><pre>indexed columns are not unique</pre><pre>table %s may not be indexed</pre><pre>views may not be indexed</pre><pre>virtual tables may not be indexed</pre><pre>there is already a table named %s</pre><pre>index %s already exists</pre><pre>sqlite_autoindex_%s_%d</pre><pre>table %s has no column named %s</pre><pre>CREATE%s INDEX %.*s</pre><pre>INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);</pre><pre>no such index: %S</pre><pre>index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped</pre><pre>DELETE FROM %Q.%s WHERE name=%Q AND type='index'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q</pre><pre>a JOIN clause is required before %s</pre><pre>unable to identify the object to be reindexed</pre><pre>table %s may not be modified</pre><pre>cannot modify %s because it is a view</pre><pre>foreign key mismatch</pre><pre>table %S has %d columns but %d values were supplied</pre><pre>%d values for %d columns</pre><pre>table %S has no column named %s</pre><pre>%s.%s may not be NULL</pre><pre>PRIMARY KEY must be unique</pre><pre>sqlite3_extension_init</pre><pre>unable to open shared library [%s]</pre><pre>no entry point [%s] in shared library [%s]</pre><pre>error during initialization: %s</pre><pre>automatic extension loading failed: %s</pre><pre>foreign_key_list</pre><pre>*** in database %s ***</pre><pre>unsupported encoding: %s</pre><pre>malformed database schema (%s)</pre><pre>%s - %s</pre><pre>unsupported file format</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid</pre><pre>database schema is locked: %s</pre><pre>unknown or unsupported join type: %T %T%s%T</pre><pre>RIGHT and FULL OUTER JOINs are not currently supported</pre><pre>a NATURAL join may not have an ON or USING clause</pre><pre>cannot have both ON and USING clauses in the same join</pre><pre>cannot join using column %s - column not present in both tables</pre><pre>USE TEMP B-TREE FOR %s</pre><pre>COMPOUND SUBQUERIES %d AND %d %s(%s)</pre><pre>%s.%s</pre><pre>%s:%d</pre><pre>ORDER BY clause should come after %s not before</pre><pre>LIMIT clause should come after %s not before</pre><pre>SELECTs to the left and right of %s do not have the same number of result columns</pre><pre>no such index: %s</pre><pre>sqlite_subquery_%p_</pre><pre>no such table: %s</pre><pre>SCAN TABLE %s %s%s(~%d rows)</pre><pre>sqlite3_get_table() called with two or more incompatible queries</pre><pre>cannot create %s trigger on view: %S</pre><pre>cannot create INSTEAD OF trigger on table: %S</pre><pre>INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')</pre><pre>no such trigger: %S</pre><pre>-- TRIGGER %s</pre><pre>no such column: %s</pre><pre>cannot VACUUM - SQL statements in progress</pre><pre>PRAGMA vacuum_db.synchronous=OFF</pre><pre>SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'</pre><pre>SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';</pre><pre>INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)</pre><pre>UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d</pre><pre>vtable constructor failed: %s</pre><pre>vtable constructor did not declare schema: %s</pre><pre>no such module: %s</pre><pre>table %s: xBestIndex returned an invalid plan</pre><pre>%s SUBQUERY %d</pre><pre>%s TABLE %s</pre><pre>%s AS %s</pre><pre>%s USING %s%sINDEX%s%s%s</pre><pre>%s USING INTEGER PRIMARY KEY</pre><pre>%s (rowid=?)</pre><pre>%s (rowid>? AND rowid<?)</pre><pre>%s (rowid>?)</pre><pre>%s (rowid<?)</pre><pre>%s VIRTUAL TABLE INDEX %d:%s</pre><pre>%s (~%lld rows)</pre><pre>at most %d tables in a join</pre><pre>cannot use index: %s</pre><pre>the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>unable to close due to unfinished backup operation</pre><pre>unknown database: %s</pre><pre>no such %s mode: %s</pre><pre>%s mode not allowed: %s</pre><pre>no such vfs: %s</pre><pre>database corruption at line %d of [%.10s]</pre><pre>misuse at line %d of [%.10s]</pre><pre>cannot open file at line %d of [%.10s]</pre><pre>OLEACC.dll</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExW</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegDeleteKeyW</pre><pre>RegCreateKeyExW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyExW</pre><pre>ADVAPI32.dll</pre><pre>SHELL32.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>UrlEscapeW</pre><pre>SHLWAPI.dll</pre><pre>COMCTL32.dll</pre><pre>USERENV.dll</pre><pre>HttpOpenRequestW</pre><pre>HttpSendRequestW</pre><pre>InternetCrackUrlW</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>PSAPI.DLL</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>.?AVFirefoxNotificationDlg@@</pre><pre>.?AV?$CDialogImpl@VFirefoxNotificationDlg@@VCWindow@ATL@@@ATL@@</pre><pre>.?AV?$CWinDataExchange@VFirefoxNotificationDlg@@@WTL@@</pre><pre>zcÁ</pre><pre>.?AVDUrlHelper@@</pre><pre><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/"></OpenSearchDescription></pre><pre><Image height="16" width="16" type="image/x-icon">http://www.yahoo.com/favicon.ico</Image></pre><pre><Url type="text/html" template="http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=10&ilc=12&p={searchTerms}" /></pre><pre><SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/"></SearchPlugin></pre><pre><Image width="16" height="16">http://www.yahoo.com/favicon.ico</Image></pre><pre><Url type="application/x-suggestions json" method="GET" template="http://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}" /></pre><pre><Url type="text/html" method="GET" template="http://search.yahoo.com/search"></Url></pre><pre></pre><pre><SearchForm>http://search.yahoo.com/</SearchForm></pre><pre><Image height="16" width="16" type="image/x-icon">http://www.yandex.com/favicon.ico</Image></pre><pre><Url type="text/html" template="http://yandex.ru/yandsearch?clid=42618&text={searchTerms}" /></pre><pre><Url type="application/x-suggestions json" method="GET" template="http://suggest.yandex.net/suggest-ff.cgi"></Url></pre><pre><Url type="text/html" method="GET" template="http://yandex.ru/yandsearch"></Url></pre><pre><Url type="application/x-moz-keywordsearch" method="GET" template="http://yandex.ru/yandsearch"></Url></pre><pre><SearchForm>http://www.yandex.ru/</SearchForm></pre><pre><Image height="16" width="16" type="image/x-icon">http://www.baidu.com/favicon.ico</Image></pre><pre><Url type="text/html" template="http://www.baidu.com/baidu?tn=dealio_dg&wd={searchTerms}" /></pre><pre><Url type="text/html" method="GET" template="http://www.baidu.com/baidu"></Url></pre><pre><SearchForm>http://www.baidu.com/</SearchForm></pre><pre><ShortName>Search.com</ShortName></pre><pre><Description>Search.com</Description></pre><pre><Image height="16" width="16" type="image/x-icon">http://www.search.com/favicon.ico</Image></pre><pre><Url type="text/html" template="http://t1.search.com/search?q={searchTerms}" /></pre><pre><ShortName>Search.com</ShortName></pre><pre><Description>Search.com</Description></pre><pre><Url type="text/html" method="GET" template="http://t1.search.com/search"></Url></pre><pre><SearchForm>http://t1.search.com/</SearchForm></pre><pre>"%""""$$</pre><pre>$'%%&%$##$</pre><pre>((&&&&%$#&</pre><pre>(('&'&&$%$</pre><pre>'(('&'&$&</pre><pre>$($%$%$$#</pre><pre>)&%%&&%%$##(</pre><pre>#)(&'''&&%$#'#</pre><pre>'))('('''&%#'$</pre><pre>'))('('('&%%'#</pre><pre>%)))(('(''%%'</pre><pre>>>>]]]111</pre><pre>#&$##$'&</pre><pre>$))('''(''&%$$'!</pre><pre>$)))('(('''&%%'</pre><pre>))))'''(''&%&%</pre><pre>{{{???___</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></pre><pre>3#4(4-4`4</pre><pre>4"4&4*4.42464</pre><pre>; ;$;(;,;0;</pre><pre>5!5%5)5-5155595</pre><pre>2i3}3L4</pre><pre>3#3'3 3/3</pre><pre>2 2$2(2,20242~2</pre><pre>4 4$4(4,4</pre><pre>3 4-424@4</pre><pre>1 1$1(1,10141</pre><pre>1 1$1(1,1014181<1</pre><pre>4,60687<7</pre><pre><4?8?<?@?</pre><pre>0(101<1\1|1</pre><pre>707<7`7|7</pre><pre>Fprefs.js</pre><pre>Global\{GCSDS_RESTORE_15B475F3-750C-4889-A091-41A9E28FC471}</pre><pre>SearchProtectionSetup.exe</pre><pre>cltmngui.exe</pre><pre>cltmng.exe</pre><pre>{chr_gc_SDS_changed_5A5011E0-B85A-4801-B002-8C669AD1BE12</pre><pre>{chr_ie_SDS_changed_5A5011E0-B85A-4801-B002-8C669AD1BE12</pre><pre>{chr_ff_SDS_changed_5A5011E0-B85A-4801-B002-8C669AD1BE12</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>HKEY_PERFORMANCE_DATA</pre><pre>HKEY_DYN_DATA</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>Global\{SS_EXE_RUNNING_15B475F3-750C-4889-A091-41A9E28FC471}</pre><pre>Global\{SDS_EXE_RUNNING_15B475F3-750C-4889-A091-41A9E28FC471}</pre><pre>KERNEL32.DLL</pre><pre>mscoree.dll</pre><pre>Comctl32.dll</pre><pre>@{chr_redo_se__sds_5A5011E0-B85A-4801-B002-8C669AD1BE12</pre><pre>777705555443332</pre><pre>5555443332</pre><pre>5555443332</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>\SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox\</pre><pre>Mozilla\Firefox\</pre><pre>profiles.ini</pre><pre>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>Firefox</pre><pre>Chrome</pre><pre>http\shell\open\command</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>chrome.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome</pre><pre>explorer.exe</pre><pre>SDS{FE4559D7-F7D6-4905-99B3-9BB1DDA607C5}</pre><pre>shell32.dll</pre><pre>Mozilla\Firefox\Profiles\*</pre><pre>\prefs.js</pre><pre>user_pref("browser.startup.page"</pre><pre>user_pref("browser.startup.homepage"</pre><pre>user_pref("browser.startup.homepage", "</pre><pre>Google\Chrome\User Data\</pre><pre>Web Data</pre><pre>HTTP/1.1</pre><pre>yahoo.com Search</pre><pre>%yahoo.co%</pre><pre>http://www.yahoo.com</pre><pre>/favicon.ico</pre><pre>yahoo_ie.xml</pre><pre>yahoo_ff.xml</pre><pre>E5E25692-5D50-4388-9C00-1FE806CFF550</pre><pre>http://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}</pre><pre>yandex.ru</pre><pre>http://www.yandex.com/favicon.ico</pre><pre>yandex_ie.xml</pre><pre>yandex_ff.xml</pre><pre>yandex.xml</pre><pre>B073B064-FDCA-4877-811F-0944183D9189</pre><pre>http://suggest.yandex.com/suggest-ff.cgi?part={searchTerms}</pre><pre>baidu.com</pre><pre>http://www.baidu.com/favicon.ico</pre><pre>baidu_ie.xml</pre><pre>baidu_ff.xml</pre><pre>baidu.xml</pre><pre>96DF6162-D0D6-4f40-A2D5-44E4F149C9F5</pre><pre>Search.com</pre><pre>search.com</pre><pre>%search.com%</pre><pre>http://www.search.com/favicon.ico</pre><pre>searchcom_ie.xml</pre><pre>searchcom_ff.xml</pre><pre>searchcom.xml</pre><pre>E82FF3F6-E7BF-4a7b-BBF9-40FD12A7FC45</pre><pre>browser.search.selectedEngine", "</pre><pre>browser.search.defaultenginename", "</pre><pre>browser.search.order.1", "</pre><pre>FaviconURLFallback</pre><pre>iertutil.dll</pre><pre>{5d337aed-05bc-4ee8-8785-0c113f072ebd}</pre><pre>cgi/api.cgi</pre><pre>\search.json</pre><pre>SELECT id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, autogenerate_keyword, logo_id, created_by_policy, instant_url, last_modified, sync_guid FROM keywords</pre><pre>SELECT id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, created_by_policy, instant_url, last_modified, sync_guid FROM keywords</pre><pre>SELECT value FROM meta WHERE key='Default Search Provider ID'</pre><pre>DROP TABLE keywords_backup</pre><pre>CREATE TABLE keywords_backup AS SELECT * FROM keywords ORDER BY id ASC</pre><pre>rGoogle\Chrome\User Data\Local State</pre><pre>browser.search.selectedEngine</pre><pre>user_pref("browser.search.defaultenginename", "</pre><pre>user_pref("browser.search.selectedEngine", "</pre><pre>user_pref("keyword.URL", "</pre><pre>\search.sqlite</pre><pre>\search-metadata.json</pre><pre>user_pref("browser.search.defaultenginename"</pre><pre>user_pref("browser.search.selectedEngine"</pre><pre>user_pref("keyword.URL"</pre><pre>user_pref("smartbar.addressBarOwnerCTID", "</pre><pre>.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"false\"}");</pre><pre>user_pref("browser.keywordURLPromptDeclined", 1);</pre><pre>user_pref("browser.keywordURLPromptDeclined"</pre><pre>Software\Microsoft\Internet Explorer\URLSearchHooks</pre><pre>{CFBFAE00-17A6-11D0-99CB-00C04FD64497}</pre><pre>{69293fa3-07e0-43ae-ABc9-b5759328e509}</pre><pre>\searchplugins\*.xml</pre><pre>AMicrosoft Windows NT</pre><pre>Microsoft Windows 2000</pre><pre>Microsoft Windows XP SP1</pre><pre>Microsoft Windows XP SP2</pre><pre>Microsoft Windows XP</pre><pre>Microsoft Windows Vista</pre><pre>Microsoft Windows Vista or higher</pre><pre>Microsoft Windows 95</pre><pre>Microsoft Windows 98</pre><pre>Microsoft Windows Me</pre><pre>operator[](std::wstring)</pre><pre>%H:%M:%S</pre><pre>%d/%m/%y</pre><pre>[%s %s] Level[%s] pid[0xX] tid[0xX] ct[%s] %s::%s() -</pre><pre>Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.</pre><pre>http://api.mybrowserbar.com</pre><pre>http://search.yahoo.com/search?ei=utf-8&fr=chr-greentree_ie&type=[CHANNEL_ID_SS]&ilc=12&p={searchTerms}</pre><pre>http://search.yahoo.com/search?ei=utf-8&fr=chr-greentree_ff&type=[CHANNEL_ID_SS]&ilc=12&p={searchTerms}</pre><pre>http://search.yahoo.com/search?ei=utf-8&fr=greentree_ie1&type=[CHANNEL_ID_SS]&ilc=12&p={searchTerms}</pre><pre>http://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=[CHANNEL_ID_SS]&ilc=12&p=</pre><pre>http://search.yahoo.com/search?ei=utf-8&fr=chr-greentree_gc&type=[CHANNEL_ID_SS]&ilc=12&p={searchTerms}</pre><pre>http://search.yahoo.com/search</pre><pre>http://www.baidu.com/baidu</pre><pre>http://yandex.ru/yandsearch</pre><pre>cmdline</pre><pre>http://update.mybrowserbar.com/kits/sds/update.xml</pre><pre>%Documents and Settings%\%current user%\Application Data\Search Protection\SearchProtection.EXE</pre><pre>This is your current setting%Search Protection Change Notification</pre><pre>Keep using %1.Change to %1 and disable the search protectionOSearch Protection has detected an attempt to change your default search settingHSearch Protection has detected a change to your browser search settings.</pre><pre>Replace%Select the entire document</pre><pre>Arrange Icons/Arrange windows so they overlap</pre><pre>Cascade Windows5Arrange windows as non-overlapping tiles</pre><pre>Tile Windows5Arrange windows as non-overlapping tiles</pre><pre>Tile Windows(Split the active window into panes</pre><pre>8, 9, 0, 2</pre><pre>SearchProtection.exe</pre><b>CouponsHelper.exe_3544:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre><9%u3</pre><pre>t8It.IIt#</pre><pre>.FGy"</pre><pre> 2 34 567</pre><pre>TT T!"TT#$TTTT%&'TTT(T)*T TTT,-.TT/0123TTTTTT4TTTTTTT5TTTTTT6789:;TTTTTTTT<TTT>?@ABCDTTTTETTTTFTTTTTTGTTHITTTTTJKTTTLLTTMTTTTTTTTTNTTOTPQRS</TTT></pre><pre>!"FFF#F$Fÿ&F'()FFFFFFFFFFFFF*FFFFFFFFFFFF FF,-FFFFFFFFFFF.F/FFFFFFFFFFFFFF01FF234FF56789FFFFFFFF:;FF<=>FF?FFFFF@ABFFFFFCFDFFFFFE</pre><pre>t.Gj:W</pre><pre>FL9D$(uÂ$</pre><pre>vSSSh</pre><pre>tGHt.Ht&</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>Could not resolve %s: %s; %s</pre><pre>getaddrinfo() failed for %s:%d; %s</pre><pre>init_resolve_thread() failed for %s; %s</pre><pre>Added %s:%d:%s to DNS cache</pre><pre>Resolve %s found illegal!</pre><pre>%5[^:]:%d:%5s</pre><pre>CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!</pre><pre>About to connect() to %s%s port %ld (#%ld)</pre><pre>Connected to %s (%s) port %ld (#%ld)</pre><pre>IDN support not present, can't parse Unicode domains</pre><pre>Protocol %s not supported or disabled in libcurl</pre><pre>http_proxy</pre><pre>%5[^:@]:%5[^@]</pre><pre>:%5[^@]</pre><pre>Port number too large: %lu</pre><pre>%s://%s%s%s:%hu%s%s%s</pre><pre>;type=%c</pre><pre>[%*45[0123456789abcdefABCDEF:.]%c</pre><pre>Couldn't find host %s in the _netrc file; using defaults</pre><pre>ftp@example.com</pre><pre>Couldn't resolve host '%s'</pre><pre>Couldn't resolve proxy '%s'</pre><pre>User-Agent: %s</pre><pre>Closing connection %d</pre><pre>Connection %d seems to be dead!</pre><pre>Found bundle for host %s: %p</pre><pre><url> malformed</url></pre><pre>:]://%[^</pre><pre>[^:]:%[^</pre><pre>Re-using existing connection! (#%ld) with host %s</pre><pre>%s://%s</pre><pre>Connection #%ld to host %s left intact</pre><pre>Internal error removing splay node = %d</pre><pre>Internal error clearing splay node = %d</pre><pre>Operation timed out after %ld milliseconds with %lld out of %lld bytes received</pre><pre>In state %d with no easy_conn, bail out!</pre><pre>Pipe broke: handle 0x%p, url = %s</pre><pre>[%s %s %s]</pre><pre>Send failure: %s</pre><pre>Recv failure: %s</pre><pre>%s cookie %s="%s" for domain %s, path %s, expire %lld</pre><pre>#HttpOnly_</pre><pre>skipped cookie with bad tailmatch domain: %s</pre><pre>skipped cookie with illegal dotcount domain: %s</pre><pre>httponly</pre><pre>23[^;</pre><pre>=]=I99[^;</pre><pre>%s%s%s</pre><pre># Fatal libcurl error</pre><pre># Netscape HTTP Cookie File</pre><pre># http://curl.haxx.se/docs/http-cookies.html</pre><pre># This file was generated by libcurl! Edit at your own risk.</pre><pre>WARNING: failed to save cookies in %s</pre><pre>Failed to set SO_KEEPALIVE on fd %d</pre><pre>bind failed with errno %d: %s</pre><pre>Local port: %hu</pre><pre>getsockname() failed with errno %d: %s</pre><pre>Bind to local port %hu failed, trying next</pre><pre>Couldn't bind to '%s'</pre><pre>Local Interface %s is ip %s using address family %i</pre><pre>Name '%s' family %i resolved to '%s' family %i</pre><pre>ssloc inet_ntop() failed with errno %d: %s</pre><pre>ssrem inet_ntop() failed with errno %d: %s</pre><pre>getpeername() failed with errno %d: %s</pre><pre>TCP_NODELAY set</pre><pre>Could not set TCP_NODELAY: %s</pre><pre>Failed to connect to %s: %s</pre><pre>sa_addr inet_ntop() failed with errno %d: %s</pre><pre>Trying %s...</pre><pre>couldn't connect to %s at %s:%d</pre><pre>Failed connect to %s:%ld; %s</pre><pre>Unable to parse FTP file list</pre><pre>Error in the SSH layer</pre><pre>Caller must register CURLOPT_CONV_ callback options</pre><pre>TFTP: No such user</pre><pre>TFTP: Unknown transfer ID</pre><pre>TFTP: Illegal operation</pre><pre>TFTP: Access Violation</pre><pre>TFTP: File Not Found</pre><pre>Login denied</pre><pre>Issuer check against peer certificate failed</pre><pre>Invalid LDAP URL</pre><pre>Unrecognized or bad HTTP Content or Transfer-Encoding</pre><pre>Problem with the SSL CA cert (path? access rights?)</pre><pre>Peer certificate cannot be authenticated with given CA certificates</pre><pre>Problem with the local SSL certificate</pre><pre>SSL peer certificate or SSH remote key was not OK</pre><pre>An unknown option was passed in to libcurl</pre><pre>A libcurl function was given a bad argument</pre><pre>Operation was aborted by an application callback</pre><pre>FTP: command REST failed</pre><pre>FTP: command PORT failed</pre><pre>HTTP response code said error</pre><pre>FTP: couldn't retrieve (RETR failed) the specified file</pre><pre>FTP: couldn't set file type</pre><pre>FTP: can't figure out the host in the PASV response</pre><pre>FTP: unknown 227 response format</pre><pre>FTP: unknown PASV reply</pre><pre>FTP: unknown PASS reply</pre><pre>FTP: The server did not accept the PRET command.</pre><pre>FTP: Accepting server connect has timed out</pre><pre>FTP: The server failed to connect to data port</pre><pre>FTP: weird server reply</pre><pre>A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.</pre><pre>URL using bad/illegal format or missing URL</pre><pre>Unsupported protocol</pre><pre>Winsock version not supported</pre><pre>Protocol family not supported</pre><pre>Address family not supported</pre><pre>Operation not supported</pre><pre>Socket is unsupported</pre><pre>Protocol is unsupported</pre><pre>Protocol option is unsupported</pre><pre>Unknown error %d (%#x)</pre><pre>%d.%d.%d.%d</pre><pre>%s%s%s%s%s%s</pre><pre>Session: %s</pre><pre>%s %s RTSP/1.0</pre><pre>Range: %s</pre><pre>Referer: %s</pre><pre>Accept-Encoding: %s</pre><pre>Refusing to issue an RTSP SETUP without a Transport: header.</pre><pre>Transport: %s</pre><pre>Transport:</pre><pre>Refusing to issue an RTSP request [%s] without a session ID.</pre><pre>Got RTSP Session ID Line [%s], but wanted ID [%s]</pre><pre>Unable to read the CSeq header: [%s]</pre><pre>SMTP</pre><pre>EHLO %s</pre><pre>HELO %s</pre><pre>No known authentication mechanisms supported!</pre><pre>AUTH %s %s</pre><pre>LOGIN</pre><pre>AUTH %s</pre><pre>Got unexpected smtp-server response: %d</pre><pre>Remote access denied: %d</pre><pre>Access denied: %d</pre><pre>smtp</pre><pre>Authentication failed: %d</pre><pre>MAIL FROM:%s SIZE=%s</pre><pre>MAIL FROM:%s AUTH=%s SIZE=%s</pre><pre>MAIL FROM:%s AUTH=%s</pre><pre>MAIL FROM:%s</pre><pre>RCPT TO:<%s></pre><pre>RCPT TO:%s</pre><pre>MAIL failed: %d</pre><pre>RCPT failed: %d</pre><pre>SMTPS not supported!</pre><pre>STARTTLS denied. %c</pre><pre>USER %s</pre><pre>APOP %s %s</pre><pre>Access denied. %c</pre><pre>PASS %s</pre><pre>%s %s</pre><pre>POP3S not supported!</pre><pre>LOGINDISABLED</pre><pre>%s CAPABILITY</pre><pre>%s LOGIN %s %s</pre><pre>%s AUTHENTICATE %s</pre><pre>%s STARTTLS</pre><pre>%s SELECT %s</pre><pre>%s FETCH 1 BODY[TEXT]</pre><pre>%s LOGOUT</pre><pre>IMAPS not supported!</pre><pre>TFTP</pre><pre>set timeouts for state %d; Total %ld, retry %d maxtry %d</pre><pre>invalid tsize -:%s:- value in OACK packet</pre><pre>%s (%ld)</pre><pre>blksize is smaller than min supported</pre><pre>%s (%d)</pre><pre>blksize is larger than max supported</pre><pre>%s (%d) %s (%d)</pre><pre>got option=(%s) value=(%s)</pre><pre>tftp_rx: internal error</pre><pre>Timeout waiting for block %d ACK. Retries = %d</pre><pre>Received unexpected DATA packet block %d, expecting block %d</pre><pre>Received last DATA packet block %d again.</pre><pre>tftp_tx: internal error, event: %i</pre><pre>tftp_tx: giving up waiting for block %d ack</pre><pre>Received ACK for block %d, expecting %d</pre><pre>bind() failed; %s</pre><pre>tftp_send_first: internal error</pre><pre>%s%c%s%c</pre><pre>TFTP finished</pre><pre>TFTP response timeout</pre><pre>Can't get the size of %s</pre><pre>Can't open %s for writing</pre><pre>Last-Modified: %s, d %s M d:d:d GMT</pre><pre>Couldn't open file %s</pre><pre>There are more than %d entries</pre><pre>LDAP remote: %s</pre><pre>LDAP local: ldap_simple_bind_s %s</pre><pre>LDAP local: Cannot connect to %s:%hu</pre><pre>LDAP local: trying to establish %s connection</pre><pre>LDAP local: %s</pre><pre>LDAP local: LDAP Vendor = %s ; LDAP Version = %d</pre><pre>CLIENT libcurl 7.29.0</pre><pre>MATCH %s %s %s</pre><pre>DEFINE %s %s</pre><pre>insufficient winsock version to support telnet</pre><pre>WSAStartup failed (%d)</pre><pre>%s %d %d</pre><pre>%s %s %d</pre><pre>%s %s %s</pre><pre>%s IAC %d</pre><pre>%s IAC %s</pre><pre>Sending data failed (%d)</pre><pre>%d (unknown)</pre><pre>%s (unsupported)</pre><pre>%s IAC SB</pre><pre>Syntax error in telnet option: %s</pre><pre>Unknown telnet option %s</pre><pre>7[^= ]%*[ =]%5s</pre><pre>USER,%s</pre><pre>%c%c%c%c%s%c%c</pre><pre>%c%s%c%s</pre><pre>7[^,],7s</pre><pre>%c%c%c%c</pre><pre>FreeLibrary(wsock2) failed (%d)</pre><pre>WSACloseEvent failed (%d)</pre><pre>WSAEnumNetworkEvents failed (%d)</pre><pre>WSACreateEvent failed (%d)</pre><pre>failed to find WSAEnumNetworkEvents function (%d)</pre><pre>failed to find WSAEventSelect function (%d)</pre><pre>failed to find WSACloseEvent function (%d)</pre><pre>failed to find WSACreateEvent function (%d)</pre><pre>failed to load WS2_32.DLL (%d)</pre><pre>WS2_32.DLL</pre><pre>PORT</pre><pre>Failure sending PORT command: %s</pre><pre>,%d,%d</pre><pre>Failure sending EPRT command: %s</pre><pre>%s |%d|%s|%hu|</pre><pre>bind() failed, we ran out of ports!</pre><pre>bind(port=%hu) failed: %s</pre><pre>bind(port=%hu) on non-local address failed: %s</pre><pre>socket failure: %s</pre><pre>failed to resolve the address provided to PORT: %s</pre><pre>getsockname() failed: %s</pre><pre>Connect data stream passively</pre><pre>STOR %s</pre><pre>APPE %s</pre><pre>SIZE %s</pre><pre>RETR %s</pre><pre>ftp server doesn't support SIZE</pre><pre>PBSZ %d</pre><pre>Access denied: d</pre><pre>ACCT %s</pre><pre>ACCT rejected by server: d</pre><pre>Connecting to %s (%s) port %d</pre><pre>Failure sending QUIT command: %s</pre><pre>Uploading to a URL without a file name!</pre><pre>FTPS not supported!</pre><pre>FTP response aborted due to select/poll error: %d</pre><pre>FTP response timeout</pre><pre>MDTM %s</pre><pre>Bad PASV/EPSV response: d</pre><pre>Can't resolve new host %s:%hu</pre><pre>Can't resolve proxy host %s:%hu</pre><pre>Skips %d.%d.%d.%d for data connection, uses %s instead</pre><pre>%d,%d,%d,%d,%d,%d</pre><pre>Illegal port number in EPSV reply</pre><pre>%c%c%c%u%c</pre><pre>ddd d:d:d GMT</pre><pre>dddddd</pre><pre>unsupported MDTM reply format</pre><pre>QUOT string not accepted: %s</pre><pre>Wildcard - "%s" skipped by user</pre><pre>Wildcard - START of "%s"</pre><pre>Preparing for accepting server on data port</pre><pre>CWD %s</pre><pre>Failed FTP upload: </pre><pre>RETR response: d</pre><pre>server did not report OK, got %d</pre><pre>Failure sending ABOR command: %s</pre><pre>Remembering we are in dir "%s"</pre><pre>PRET RETR %s</pre><pre>PRET STOR %s</pre><pre>PRET %s</pre><pre>REST %d</pre><pre>Got a d response code instead of the assumed 200</pre><pre>TYPE %c</pre><pre>Failed to do PORT</pre><pre>PRET command not accepted: d</pre><pre>Failed to MKD dir: d</pre><pre>MKD %s</pre><pre>QUOT command failed with d</pre><pre>Entry path is '%s'</pre><pre>PROT %c</pre><pre>unsupported parameter to CURLOPT_FTPSSLAUTH: %d</pre><pre>Got a d ftp-server response when 220 was expected</pre><pre>%sAuthorization: Basic %s</pre><pre>%s:%s</pre><pre>%s auth using %s with user '%s'</pre><pre>HTTP/</pre><pre>Avoided giant realloc for header (max is %d)!</pre><pre>The requested URL returned error: %d</pre><pre>The requested URL returned error: %s</pre><pre>If-Unmodified-Since: %s</pre><pre>Last-Modified: %s</pre><pre>If-Modified-Since: %s</pre><pre>%s, d %s M d:d:d GMT</pre><pre>Failed sending HTTP POST request</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>Internal HTTP POST error!</pre><pre>Failed sending HTTP request</pre><pre>%s%s=%s</pre><pre>%s HTTP/%s</pre><pre>%s%s%s%s%s%s%s%s%s%s%s</pre><pre>ftp://%s:%s@%s</pre><pre>Content-Range: bytes %s/%lld</pre><pre>Content-Range: bytes %s%lld/%lld</pre><pre>Range: bytes=%s</pre><pre>ftp://</pre><pre>Host: %s%s%s:%hu</pre><pre>Host: %s%s%s</pre><pre>Chunky upload is not supported by HTTP 1.0</pre><pre>HTTP error before end of send, stop sending</pre><pre>HTTP/1.0 connection set to keep alive!</pre><pre>HTTP/1.1 proxy connection set close!</pre><pre>HTTP/1.0 proxy connection set to keep alive!</pre><pre>HTTP 1.0, assume close after body</pre><pre>RTSP/%d.%d =</pre><pre>HTTP =</pre><pre>HTTP/%d.%d =</pre><pre>%s, algorithm="%s"</pre><pre>%s, opaque="%s"</pre><pre>%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"</pre><pre>%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop=%s, response="%s"</pre><pre>%s:%s:x:%s:%s:%s</pre><pre>%s:%.*s</pre><pre>%s:%s:%s</pre><pre>Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.</pre><pre>Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.</pre><pre>Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.</pre><pre>Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.</pre><pre>SOCKS4%s request granted.</pre><pre>Failed to resolve "%s" for SOCKS4 connect.</pre><pre>No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)</pre><pre>SOCKS5 GSSAPI per-message authentication is not supported.</pre><pre>Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)</pre><pre>Can't complete SOCKS5 connection to %s:%d. (%d)</pre><pre>Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)</pre><pre>Failed to resolve "%s" for SOCKS5 connect.</pre><pre>User was rejected by the SOCKS5 server (%d %d).</pre><pre>--:--:--</pre><pre>%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s</pre><pre>Received HTTP code %d from proxy after CONNECT</pre><pre>CONNECT %s HTTP/%s</pre><pre>%s%s%s%s</pre><pre>Host: %s</pre><pre>%s%s%s:%hu</pre><pre>%s:%hu</pre><pre>Establish HTTP proxy tunnel to %s:%hu</pre><pre>TUNNEL_STATE switched to: %d</pre><pre>HTTP/1.%d %d</pre><pre>password</pre><pre>login</pre><pre>Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds</pre><pre>operation aborted by callback</pre><pre>ioctl callback returned error %d</pre><pre>the ioctl callback returned %d</pre><pre>seek callback returned error %d</pre><pre>Problem (%d) in the Chunked-Encoded data</pre><pre>HTTP server doesn't seem to support byte ranges. Cannot resume.</pre><pre>Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)</pre><pre>Excess found in a non pipelined read: excess = %zu, size = %lld, maxdownload = %lld, bytecount = %lld</pre><pre>Rewinding stream by : %zu bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %zd)</pre><pre>Rewinding stream by : %zd bytes on url %s (zero-length body)</pre><pre>Operation timed out after %ld milliseconds with %lld bytes received</pre><pre>No URL set!</pre><pre>[^?&/:]://%c</pre><pre>Violate RFC 2616/10.3.2 and switch from POST to GET</pre><pre>Violate RFC 2616/10.3.3 and switch from POST to GET</pre><pre>Disables POST, goes with %s</pre><pre>Issue another request to this URL: '%s'</pre><pre>d:d</pre><pre>%s xxxxxxxxxxxxxxxx</pre><pre>username="%s",realm="%s",nonce="%s",cnonce="%s",nc="%s",digest-uri="%s",response=%s</pre><pre>%s/%s</pre><pre>12345678</pre><pre>00000001</pre><pre>%c%c==</pre><pre>%c%c%c=</pre><pre>0123456789-</pre><pre>.jpeg</pre><pre>.html</pre><pre>; filename="%s"</pre><pre>--%s--</pre><pre>couldn't open file "%s"</pre><pre>Content-Type: %s</pre><pre>Content-Type: multipart/mixed, boundary=%s</pre><pre>%s; boundary=%s</pre><pre>Visual C CRT: Not enough memory to complete call to strerror.</pre><pre>Broken pipe</pre><pre>Inappropriate I/O control operation</pre><pre>Operation not permitted</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>portuguese-brazilian</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>operator</pre><pre>updateURL</pre><pre>updateKey</pre><pre>optionsURL</pre><pre>aboutURL</pre><pre>iconURL</pre><pre>icon64URL</pre><pre>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</pre><pre>SELECT seq FROM sqlite_sequence WHERE name='locale'</pre><pre>SELECT seq FROM sqlite_sequence WHERE name='addon'</pre><pre>',strftime('%s059', 'now'),strftime('%s059', 'now'),'1','0','0','221102','','','0','0','1','0')</pre><pre>','1','1','0','0','0','</pre><pre>',strftime('%s059', 'now'),strftime('%s059', 'now'),'1','0','0','221102','','','0','0')</pre><pre>','{ec8030f7-c20a-464f-9b0e-13a3a9e97384}','</pre><pre>UPDATE sqlite_sequence SET seq='</pre><pre>inflate 1.2.7.f-hanba-win64 Copyright (C) 2012 Jonathan Hanba</pre><pre>unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll</pre><pre>3.7.7.1</pre><pre>SQLite format 3</pre><pre>CREATE TABLE sqlite_master(</pre><pre>sql text</pre><pre>CREATE TEMP TABLE sqlite_temp_master(</pre><pre>REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY</pre><pre>RegDeleteKeyExW</pre><pre>manifest.json</pre><pre>large file support is disabled</pre><pre>unknown operation</pre><pre>SQL logic error or missing database</pre><pre>foreign_keys</pre><pre>sqlite_compileoption_get</pre><pre>sqlite_compileoption_used</pre><pre>sqlite_log</pre><pre>sqlite_source_id</pre><pre>sqlite_version</pre><pre>sqlite_attach</pre><pre>sqlite_detach</pre><pre>sqlite_stat1</pre><pre>sqlite_rename_parent</pre><pre>sqlite_rename_trigger</pre><pre>sqlite_rename_table</pre><pre>RowKey</pre><pre>SQLITE_</pre><pre>d-d-d d:d:d</pre><pre>d:d:d</pre><pre>d-d-d</pre><pre>failed to allocate %u bytes of memory</pre><pre>failed memory resize %u to %u bytes</pre><pre>922337203685477580</pre><pre>API call with %s database connection pointer</pre><pre>OsError 0x%x (%u)</pre><pre>os_win.c:%d: (%d) %s(%s) - %s</pre><pre>%s-shm</pre><pre>%s\etilqs_</pre><pre>Recovered %d frames from WAL file %s</pre><pre>cannot limit WAL size: %s</pre><pre>invalid page number %d</pre><pre>2nd reference to page %d</pre><pre>Failed to read ptrmap key=%d</pre><pre>Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)</pre><pre>%d of %d pages missing from overflow list starting at %d</pre><pre>failed to get page %d</pre><pre>freelist leaf count too big on page %d</pre><pre>Page %d:</pre><pre>unable to get the page. error code=%d</pre><pre>btreeInitPage() returns error code %d</pre><pre>On tree page %d cell %d:</pre><pre>On page %d at right child:</pre><pre>Corruption detected in cell %d on page %d</pre><pre>Multiple uses for byte %d of page %d</pre><pre>Fragmentation of %d bytes reported as %d on page %d</pre><pre>Page %d is never used</pre><pre>Pointer map page %d is referenced</pre><pre>Outstanding page count goes from %d to %d during this analysis</pre><pre>unknown database %s</pre><pre>keyinfo(%d</pre><pre>%s(%d)</pre><pre>%s-mjX</pre><pre>foreign key constraint failed</pre><pre>unable to use function %s in the requested context</pre><pre>bind on a busy prepared statement: [%s]</pre><pre>zeroblob(%d)</pre><pre>abort at %d in [%s]: %s</pre><pre>constraint failed at %d in [%s]</pre><pre>cannot open savepoint - SQL statements in progress</pre><pre>no such savepoint: %s</pre><pre>cannot %s savepoint - SQL statements in progress</pre><pre>cannot rollback transaction - SQL statements in progress</pre><pre>cannot commit transaction - SQL statements in progress</pre><pre>sqlite_temp_master</pre><pre>sqlite_master</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid</pre><pre>cannot change %s wal mode from within a transaction</pre><pre>database table is locked: %s</pre><pre>statement aborts at %d: [%s] %s</pre><pre>cannot open value of type %s</pre><pre>cannot open virtual table: %s</pre><pre>cannot open view: %s</pre><pre>no such column: "%s"</pre><pre>foreign key</pre><pre>indexed</pre><pre>cannot open %s column for writing</pre><pre>misuse of aliased aggregate %s</pre><pre>%s: %s.%s.%s</pre><pre>%s: %s.%s</pre><pre>%s: %s</pre><pre>not authorized to use function: %s</pre><pre>%r %s BY term out of range - should be between 1 and %d</pre><pre>too many terms in %s BY clause</pre><pre>Expression tree is too large (maximum depth %d)</pre><pre>variable number must be between ?1 and ?%d</pre><pre>too many SQL variables</pre><pre>too many columns in %s</pre><pre>EXECUTE %s%s SUBQUERY %d</pre><pre>misuse of aggregate: %s()</pre><pre>%.*s"%w"%s</pre><pre>%s%.*s"%w"</pre><pre>%s OR name=%Q</pre><pre>type='trigger' AND (%s)</pre><pre>sqlite_</pre><pre>table %s may not be altered</pre><pre>there is already another table or index with this name: %s</pre><pre>view %s may not be altered</pre><pre>UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;</pre><pre>UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');</pre><pre>sqlite_sequence</pre><pre>UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q</pre><pre>UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;</pre><pre>Cannot add a PRIMARY KEY column</pre><pre>UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q</pre><pre>sqlite_altertab_%s</pre><pre>CREATE TABLE %Q.%s(%s)</pre><pre>DELETE FROM %Q.%s WHERE %s=%Q</pre><pre>SELECT tbl, idx, stat FROM %Q.sqlite_stat1</pre><pre>invalid name: "%s"</pre><pre>too many attached databases - max %d</pre><pre>database %s is already in use</pre><pre>unable to open database: %s</pre><pre>no such database: %s</pre><pre>cannot detach database %s</pre><pre>database %s is locked</pre><pre>%s %T cannot reference objects in database %s</pre><pre>access to %s.%s.%s is prohibited</pre><pre>access to %s.%s is prohibited</pre><pre>object name reserved for internal use: %s</pre><pre>there is already an index named %s</pre><pre>too many columns on %s</pre><pre>duplicate column name: %s</pre><pre>default value of column [%s] is not constant</pre><pre>table "%s" has more than one primary key</pre><pre>AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY</pre><pre>no such collation sequence: %s</pre><pre>CREATE %s %.*s</pre><pre>UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d</pre><pre>CREATE TABLE %Q.sqlite_sequence(name,seq)</pre><pre>view %s is circularly defined</pre><pre>UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d</pre><pre>table %s may not be dropped</pre><pre>use DROP TABLE to delete table %s</pre><pre>use DROP VIEW to delete view %s</pre><pre>DELETE FROM %s.sqlite_sequence WHERE name=%Q</pre><pre>DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q</pre><pre>foreign key on %s should reference only one column of table %T</pre><pre>number of columns in foreign key does not match the number of columns in the referenced table</pre><pre>unknown column "%s" in foreign key definition</pre><pre>indexed columns are not unique</pre><pre>table %s may not be indexed</pre><pre>views may not be indexed</pre><pre>virtual tables may not be indexed</pre><pre>there is already a table named %s</pre><pre>index %s already exists</pre><pre>sqlite_autoindex_%s_%d</pre><pre>table %s has no column named %s</pre><pre>CREATE%s INDEX %.*s</pre><pre>INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);</pre><pre>no such index: %S</pre><pre>index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped</pre><pre>DELETE FROM %Q.%s WHERE name=%Q AND type='index'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q</pre><pre>a JOIN clause is required before %s</pre><pre>unable to identify the object to be reindexed</pre><pre>table %s may not be modified</pre><pre>cannot modify %s because it is a view</pre><pre>foreign key mismatch</pre><pre>table %S has %d columns but %d values were supplied</pre><pre>%d values for %d columns</pre><pre>table %S has no column named %s</pre><pre>%s.%s may not be NULL</pre><pre>PRIMARY KEY must be unique</pre><pre>sqlite3_extension_init</pre><pre>unable to open shared library [%s]</pre><pre>no entry point [%s] in shared library [%s]</pre><pre>error during initialization: %s</pre><pre>automatic extension loading failed: %s</pre><pre>foreign_key_list</pre><pre>*** in database %s ***</pre><pre>unsupported encoding: %s</pre><pre>malformed database schema (%s)</pre><pre>%s - %s</pre><pre>unsupported file format</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid</pre><pre>database schema is locked: %s</pre><pre>unknown or unsupported join type: %T %T%s%T</pre><pre>RIGHT and FULL OUTER JOINs are not currently supported</pre><pre>a NATURAL join may not have an ON or USING clause</pre><pre>cannot have both ON and USING clauses in the same join</pre><pre>cannot join using column %s - column not present in both tables</pre><pre>USE TEMP B-TREE FOR %s</pre><pre>COMPOUND SUBQUERIES %d AND %d %s(%s)</pre><pre>%s.%s</pre><pre>%s:%d</pre><pre>ORDER BY clause should come after %s not before</pre><pre>LIMIT clause should come after %s not before</pre><pre>SELECTs to the left and right of %s do not have the same number of result columns</pre><pre>no such index: %s</pre><pre>sqlite_subquery_%p_</pre><pre>no such table: %s</pre><pre>SCAN TABLE %s %s%s(~%d rows)</pre><pre>sqlite3_get_table() called with two or more incompatible queries</pre><pre>cannot create %s trigger on view: %S</pre><pre>cannot create INSTEAD OF trigger on table: %S</pre><pre>INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')</pre><pre>no such trigger: %S</pre><pre>-- TRIGGER %s</pre><pre>no such column: %s</pre><pre>cannot VACUUM - SQL statements in progress</pre><pre>PRAGMA vacuum_db.synchronous=OFF</pre><pre>SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'</pre><pre>SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';</pre><pre>INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)</pre><pre>UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d</pre><pre>vtable constructor failed: %s</pre><pre>vtable constructor did not declare schema: %s</pre><pre>no such module: %s</pre><pre>table %s: xBestIndex returned an invalid plan</pre><pre>%s SUBQUERY %d</pre><pre>%s TABLE %s</pre><pre>%s AS %s</pre><pre>%s USING %s%sINDEX%s%s%s</pre><pre>%s USING INTEGER PRIMARY KEY</pre><pre>%s (rowid=?)</pre><pre>%s (rowid>? AND rowid<?)</pre><pre>%s (rowid>?)</pre><pre>%s (rowid<?)</pre><pre>%s VIRTUAL TABLE INDEX %d:%s</pre><pre>%s (~%lld rows)</pre><pre>at most %d tables in a join</pre><pre>cannot use index: %s</pre><pre>the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>unable to close due to unfinished backup operation</pre><pre>unknown database: %s</pre><pre>no such %s mode: %s</pre><pre>%s mode not allowed: %s</pre><pre>no such vfs: %s</pre><pre>database corruption at line %d of [%.10s]</pre><pre>misuse at line %d of [%.10s]</pre><pre>cannot open file at line %d of [%.10s]</pre><pre>d:\Autobuild\Work\BrowserExtensions\src\CouponsHelper\bin\Win32\Release\CouponsHelper.pdb</pre><pre>WS2_32.dll</pre><pre>WLDAP32.dll</pre><pre>PeekNamedPipe</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExW</pre><pre>RegDeleteKeyW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyExW</pre><pre>ADVAPI32.dll</pre><pre>ShellExecuteExW</pre><pre>SHELL32.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>SHLWAPI.dll</pre><pre>USERENV.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>zcÁ</pre><pre> )**,,,))))</pre><pre>, 2578;:9643.1</pre><pre>-(,0#&=<'&$/</pre><pre>%s~qa</pre><pre>z.geYJ (</pre><pre>.IMGd</pre><pre>B6'>2$@3¤Ôõ÷%H9%H:%H:%K:%K:%K;%I<%K<%L<%N<%K;%I9%H9%H9%H9%H8%H8%H8%H8%H8%H9%I:%J;%J<%J<%K<%N<%P<%O;%K<%J<%K<%L;%J;%H:%H9%G5ôÔ%@3%?2%=1$@5'</pre><pre>4c=.g?/mD-pE pF4uK5wL4uK*nD mC-lB.jA,g?2iC2gB3d@*a<<_5</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre>2-2l2}2P9</pre><pre>3 3$3(3,3</pre><pre>: :$:(:,:0:</pre><pre>< <$<(<,<0<4<8<<<</pre><pre>8 8$8@8^8</pre><pre>7 7@7\7`7</pre><pre>3 3$3(3,30343</pre><pre>mscoree.dll</pre><pre>KERNEL32.DLL</pre><pre>\manifest.json</pre><pre>\firefox</pre><pre>firefox.exe</pre><pre>\install.rdf</pre><pre>\chrome\content\config.json</pre><pre>\chrome</pre><pre>chrome.exe</pre><pre>\config.json</pre><pre>/cpupdate/setupurl</pre><pre>http://update.mybrowserbar.com/update/wt/ie/coupons/update.xml</pre><pre>tmp.exe</pre><pre>coupons_event_5D824970-61D6-4eee-860A-600A48AB5955</pre><pre></pre><pre><em:homepageURL></em:homepageURL></pre><pre></pre><pre><em:updateKey></em:updateKey></pre><pre></pre><pre><em:updateURL></em:updateURL></pre><pre>\extensions.ini</pre><pre>\extensions.json</pre><pre>\extensions.sqlite</pre><pre>shell32.dll</pre><pre>777705555443332</pre><pre>5555443332</pre><pre>5555443332</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>\SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>Mozilla\Firefox\</pre><pre>profiles.ini</pre><pre>kernel32.dll</pre><pre>explorer.exe</pre><pre>@Advapi32.dll</pre><pre>Google\Chrome\User Data\Default\</pre><pre>Google\Chrome\User Data\Local State</pre><pre>Software\Google\Chrome\Extensions</pre><pre>Microsoft Windows NT</pre><pre>Microsoft Windows 2000</pre><pre>Microsoft Windows XP SP1</pre><pre>Microsoft Windows XP SP2</pre><pre>Microsoft Windows XP</pre><pre>Microsoft Windows Vista</pre><pre>Microsoft Windows Vista or higher</pre><pre>Microsoft Windows 95</pre><pre>Microsoft Windows 98</pre><pre>Microsoft Windows Me</pre><pre>%s\%s</pre><pre>%Documents and Settings%\%current user%\Application Data\Browser Extensions\CouponsHelper.exe</pre><pre>1, 5, 0, 1</pre><pre>CouponsHelper.exe</pre><b>MyPC Backup.exe_1212_rwx_03980000_00010000:</b><pre>%x{8%x{</pre><b>MyPC Backup.exe_1212_rwx_03FF0000_00010000:</b><pre>%x{8%x{</pre><b>MyPC Backup.exe_1212_rwx_04F90000_00010000:</b><pre>].yEg</pre><b>MyPC Backup.exe_1212_rwx_04FA0000_00010000:</b><pre>)-y0}</pre></pre></pre>