ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 14 February 2012, 07:30:33
Processing time: 12 min 18 sec
Submitted sample:

File MD5: 0x0B3E04A0A7885004E98AAFF742843393
File SHA-1: 0xC2C0E7ADCA0F02D20B4C7143C9D1968421A2D2BC
Filesize: 75,434 bytes

Summary of the findings:

What's been found	Severity Level
Attempts to use BITS (Background Intelligent Transfer Service). Some threats are known to use BITS to evade firewall filtering and download files without firewall inspection.
Produces outbound traffic.
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\Google\Custom Buttons\toolbar.google.com_O8Y91YHB24Z6SR0SGYSK.XML	12,820 bytes	MD5: 0xA41B71A96BF9FD9D56C4410A380FCE69 SHA-1: 0x7F50CF77DFE753AD0A51D1472009A9C90BBE61C4	(not available)
2	%CommonAppData%\Microsoft\Network\Downloader\qmgr0.dat	5,442 bytes	MD5: 0x05E38FA079B8E5D856861C7DBEBAB8EC SHA-1: 0x0E20AE30F93784895B4F113E7CD2045069D8A8BF	(not available)
3	%CommonAppData%\Microsoft\Network\Downloader\qmgr1.dat	4,232 bytes	MD5: 0x136D6B1D98E45733F5744AF0C19A0037 SHA-1: 0x138F7E6EAC7FC7766929EC70E913576F85F95278	(not available)
4	%CommonDesktopDir%\CCleaner.lnk	682 bytes	MD5: 0x9A22A9EFB62B26C4347CE9A39E036E1F SHA-1: 0x04B032E0281B23B5B03C0F9334FF6011703A718E	(not available)
5	%CommonPrograms%\CCleaner\CCleaner Homepage.url	82 bytes	MD5: 0x20AAC90EEFD7FCF37027FDE1FCF35214 SHA-1: 0x5161CC36B8E0FBE826EF12F536308CC26E5727B6	(not available)
6	%CommonPrograms%\CCleaner\CCleaner.lnk	694 bytes	MD5: 0xE4AA5AA751726522B7CB5F364E020300 SHA-1: 0x46A7D61B71DA25EDCBB34068BF67742137163464	(not available)
7	%CommonPrograms%\CCleaner\Uninstall CCleaner.lnk	507 bytes	MD5: 0x7C8C5285422B865A5C90FB9BD08D6279 SHA-1: 0xC5421D91958DE7760A75CF8B58B64BE6B42F56D4	(not available)
8	%Temp%\Google Toolbar\GoogleToolbarWelcome.log	7,492 bytes	MD5: 0x8469D8ABE49F153E716B5273628B0BDD SHA-1: 0x60970AB60952002F52C1580770C6DFE37E28EF96	(not available)
9	%Temp%\Google Toolbar\gtb2D.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
10	%Temp%\Google Toolbar\gtb2D.tmp.exe	526,448 bytes	MD5: 0x5349C1396FF46C621B2F20B949D70DCF SHA-1: 0x78FFCADAD31FC39B5359003E6EBA98BE32E95EBB	(not available)
11	%Temp%\Google Toolbar\gtm29.tmp %ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbar.6.4.1321.1732.manifest.xml	19,771 bytes	MD5: 0xF0D6EB88EC79622D6C91979B6D429EC2 SHA-1: 0x49D17CEF26F7CFA83F938D3CF5FE74B1B5D1CA4A	(not available)
12	%Temp%\GoogleToolbarInstaller1.log	7,994 bytes	MD5: 0x694CA91114BB0023EF0EAFB66009CC91 SHA-1: 0xDA07553C4D4B31EC8740685FA61159E84DEFA13D	(not available)
13	%Temp%\GoogleToolbarInstaller2.log	3,773 bytes	MD5: 0xE2008EC77C69B0D6DC79742EBF6E7C32 SHA-1: 0xFEC0C53C682E7EE82FBC0D1C9CB4430FFAE17934	(not available)
14	%Temp%\googletoolbarinstaller_stub_signed.exe	201,328 bytes	MD5: 0xBC67002CC524050EAFDF18204C22C538 SHA-1: 0x9FDDDAA5FBE1EEAEC2B34938F0AFF33766224453	packed with PE_Patch.PECompact [Kaspersky Lab]
15	%Temp%\nsn5.tmp\ExecDos.dll	5,632 bytes	MD5: 0xA7CD6206240484C8436C66AFB12BDFBF SHA-1: 0x0BB3E24A7EB0A9E5A8EAE06B1C6E7551A7EC9919	(not available)
16	%Temp%\nsn5.tmp\g\PRFA-IEToolbar.exe	223,809 bytes	MD5: 0xBA294F93108CF238ECB91C394049F8B7 SHA-1: 0x486D16AEDDF402E1F3BE54CB6590EE1005FD92DB	(not available)
17	%ProgramFiles%\CCleaner\CCleaner.exe	2,301,752 bytes	MD5: 0xE701B8A239462A3A9098D407A6E53C47 SHA-1: 0x06624312A637447CBDADD185F1F2DFE5C1C1C4E9	(not available)
18	%ProgramFiles%\CCleaner\ccsetup307.exe	3,096,424 bytes	MD5: 0x337047BC466F8E7E3BD5219E0F72617D SHA-1: 0x5D63DAC30FCD20C544F33FD68EEA6E53B575BA71	(not available)
19	%ProgramFiles%\CCleaner\Lang\lang-1025.dll	26,624 bytes	MD5: 0x50C4DD494CD4651054F1A64B0D7B951C SHA-1: 0xEBDE8BF54AA327B1E82BAF4753E2B40200260A14	(not available)
20	%ProgramFiles%\CCleaner\Lang\lang-1026.dll	32,768 bytes	MD5: 0xD2FAB20F779D0CC5C0205777C49D788B SHA-1: 0xF4818A9AF2F668A3018C8DD26DBEC8E89AF12871	(not available)
21	%ProgramFiles%\CCleaner\Lang\lang-1027.dll	33,792 bytes	MD5: 0x38881D62701E442DFCD03BD43FBD8F72 SHA-1: 0xFADF16F857115E1F4FC532FB70EEB0B63E4AA4B7	(not available)
22	%ProgramFiles%\CCleaner\Lang\lang-1028.dll	16,384 bytes	MD5: 0x2E052E9D6405D7B214B705BD69394AFF SHA-1: 0x16C81EF8C2A53DF04AC63973360393FF2C139839	(not available)
23	%ProgramFiles%\CCleaner\Lang\lang-1029.dll	28,672 bytes	MD5: 0x0D114C06C262A543C2ABF38BF5FBE538 SHA-1: 0x72A546660031261B9CA235A68777A27CCC2C1D93	(not available)
24	%ProgramFiles%\CCleaner\Lang\lang-1030.dll	29,696 bytes	MD5: 0xADB8E9C3C9AA26C54E9DAA3594457B0B SHA-1: 0xEF4EB258C85537677ABEE214E11B34AC5EA0434D	(not available)
25	%ProgramFiles%\CCleaner\Lang\lang-1031.dll	30,208 bytes	MD5: 0x8E8F27BCA25C2BFD7B4ACF662E7C704C SHA-1: 0x45CDC139A123C0B6CC931B6A1B0CD89B8742567A	(not available)
26	%ProgramFiles%\CCleaner\Lang\lang-1032.dll	34,816 bytes	MD5: 0x55090EE05D26E1639600E6DBF9E1BE0F SHA-1: 0xAA903F52811D0E7A1402EA8082094502375119D6	(not available)
27	%ProgramFiles%\CCleaner\Lang\lang-1034.dll	33,792 bytes	MD5: 0x903273F2274CECE9AB3C010A5B631C3C SHA-1: 0xE0A88ADEB76E31C9C4D063C75B27A437CC26B3D0	(not available)
28	%ProgramFiles%\CCleaner\Lang\lang-1035.dll	31,232 bytes	MD5: 0x03A7C875ACF71623F9909DA1C76DCD10 SHA-1: 0x910BC79AA115B7F25116C8293B88FBC6BAAEB50D	(not available)
29	%ProgramFiles%\CCleaner\Lang\lang-1036.dll	34,816 bytes	MD5: 0xA53435B2C262AE7B35A5843610BEB7AE SHA-1: 0x2FADEF5100D8062DFB1AFFA0BDA7ABEFAD8D4F82	(not available)
30	%ProgramFiles%\CCleaner\Lang\lang-1037.dll	25,600 bytes	MD5: 0x73693FDE4158664F5698126061F3B286 SHA-1: 0xD847A28770FE54C2A9EB27F0AC18BFE399903418	(not available)
31	%ProgramFiles%\CCleaner\Lang\lang-1038.dll	31,744 bytes	MD5: 0xA2CE0E79CF65067CC876FCA4B4818FC1 SHA-1: 0xF886913046866D8E23531EF1DCDAA583B6DFCF21	(not available)
32	%ProgramFiles%\CCleaner\Lang\lang-1040.dll	31,744 bytes	MD5: 0x5B78A307F3AC4E3DBD59D94CE29E1817 SHA-1: 0x898E97EED48B7888886065F11211DE9D08B2D423	(not available)
33	%ProgramFiles%\CCleaner\Lang\lang-1041.dll	18,944 bytes	MD5: 0xC5C98F2ACC1BD90E93D5E12D63F6526C SHA-1: 0x09A67406D7B85CC6890F84BF73DFEC81470278B6	(not available)
34	%ProgramFiles%\CCleaner\Lang\lang-1042.dll	20,480 bytes	MD5: 0xFD015DC16BC8AE49D2A0E798E75024C2 SHA-1: 0xC4B49CD3862EFC327DA578DDF6001DB2176DBB03	(not available)
35	%ProgramFiles%\CCleaner\Lang\lang-1043.dll	33,792 bytes	MD5: 0x90644B314FB10FEF7B7D957162C76D7E SHA-1: 0xF826D4CA8672C1F7F6A20F28AD5C1F24273033C9	(not available)
36	%ProgramFiles%\CCleaner\Lang\lang-1044.dll	29,184 bytes	MD5: 0xEF3C22A2783A4194F5507FFABEF404D9 SHA-1: 0x8CE725638145B6478FD6DF9BCC391912082E3DBC	(not available)
37	%ProgramFiles%\CCleaner\Lang\lang-1045.dll	31,744 bytes	MD5: 0x84442567C752F71B8AE6C69081567005 SHA-1: 0xC0DB43B4AE9B9D907EEAB09C471726BABAB71985	(not available)
38	%ProgramFiles%\CCleaner\Lang\lang-1046.dll	33,280 bytes	MD5: 0x21BE0FDB71E76CCA2903CAEDF7668BD0 SHA-1: 0x2381C356646FEE39E336EB68B0BD131FB96AFBC4	(not available)
39	%ProgramFiles%\CCleaner\Lang\lang-1048.dll	30,208 bytes	MD5: 0x40544BE64FABDFF7E6F225211D95A0A3 SHA-1: 0x98BB97623DFF7B3D752829AC9221C644E005A66A	(not available)
40	%ProgramFiles%\CCleaner\Lang\lang-1049.dll	28,672 bytes	MD5: 0xC4617FB0A4F8C6DC9845428B6F67EB5F SHA-1: 0xCF03568D2FD94D9597B1672B8032B7B6C9B9C921	(not available)
41	%ProgramFiles%\CCleaner\Lang\lang-1050.dll	29,184 bytes	MD5: 0x4560F1D232D7281F7DCB00959B5EBA7A SHA-1: 0xEC9758487779F2E350C27FCB5DB439C30EA254A3	(not available)
42	%ProgramFiles%\CCleaner\Lang\lang-1051.dll	28,672 bytes	MD5: 0x7763097D16918582DFF7065132089102 SHA-1: 0x0E2D379635A191338C837470A8C20D0E5C1E5798	(not available)
43	%ProgramFiles%\CCleaner\Lang\lang-1052.dll	30,208 bytes	MD5: 0xA4480C3B1A52E17EB0785C096F12A630 SHA-1: 0x7AF081F1C9A54C947E11F737BA148091D4CDF4BA	(not available)
44	%ProgramFiles%\CCleaner\Lang\lang-1053.dll	30,208 bytes	MD5: 0x26E7C31E7E17938EDD2570B83CE74C19 SHA-1: 0x6D6EB5475BD89BBC40FDA68B2757F2C012E59705	(not available)
45	%ProgramFiles%\CCleaner\Lang\lang-1055.dll	29,184 bytes	MD5: 0x973A6C9F311EF4C53D32EF55E1A393F8 SHA-1: 0xD50D2431CC37BEC9C3C4836D6F89623E4FE36C26	(not available)
46	%ProgramFiles%\CCleaner\Lang\lang-1058.dll	29,696 bytes	MD5: 0x6CBE95FB90EE14D90528E07ABF4567DA SHA-1: 0x754CB34CA85E7009C04B2DEC734C2574DCB627B4	(not available)
47	%ProgramFiles%\CCleaner\Lang\lang-1059.dll	30,720 bytes	MD5: 0x280B85494E32977F9F881A56FB783F79 SHA-1: 0x05415662DFB3AC7AACDB395932E93A3BA821A037	(not available)
48	%ProgramFiles%\CCleaner\Lang\lang-1060.dll	31,232 bytes	MD5: 0x07CB43D437B57DE0E43F07C524806634 SHA-1: 0x295D105C2941370E5B8D6A211CED3C2F05B5C43C	(not available)
49	%ProgramFiles%\CCleaner\Lang\lang-1061.dll	29,184 bytes	MD5: 0x338210EC20C0C473CDCAFB99930C61B2 SHA-1: 0xE9A53DD8FECF69FFF8A1CE96CB2C2992FC9C5B22	(not available)
50	%ProgramFiles%\CCleaner\Lang\lang-1063.dll	29,184 bytes	MD5: 0xE417682896A13A4F3C2E746EDAABFFCC SHA-1: 0xABF9C826C5AEDF100C80AC8704231DCF41A20D55	(not available)
51	%ProgramFiles%\CCleaner\Lang\lang-1065.dll	30,208 bytes	MD5: 0x473ECF7B1EB564255896BEEF17223D5C SHA-1: 0x57451C42512069A418748CE401617B3C21A4925B	(not available)
52	%ProgramFiles%\CCleaner\Lang\lang-1066.dll	28,672 bytes	MD5: 0x961A68A0FA2CCC745975DAF46B3B9BA6 SHA-1: 0xDE674B9D76CDD63081EE42799C7EF4411C70EB58	(not available)
53	%ProgramFiles%\CCleaner\Lang\lang-1067.dll	27,648 bytes	MD5: 0xCA8AC83A493A9D59920C4B34596E0C45 SHA-1: 0x19EBB1870AA11E9DE3B927BCB107A803893F0542	(not available)
54	%ProgramFiles%\CCleaner\Lang\lang-1068.dll	29,184 bytes	MD5: 0x4E0609088FDC338DA96CDB0A532B2522 SHA-1: 0x351C7CF59831FD9538D1FB5BB0AC69B038D84460	(not available)
55	%ProgramFiles%\CCleaner\Lang\lang-1071.dll	30,208 bytes	MD5: 0x65BF04353798B9E65AB938D9417C7C5E SHA-1: 0x3379FEEA19A10216660B979D8830301266CEEB27	(not available)
56	%ProgramFiles%\CCleaner\Lang\lang-1079.dll	31,232 bytes	MD5: 0x9E9A6DBF3CD3F05EF7AA9B2421EFA24E SHA-1: 0xBEEA01B0B433EB4574DFFAA61CC9F0A8056908B3	(not available)
57	%ProgramFiles%\CCleaner\Lang\lang-1110.dll	29,184 bytes	MD5: 0xB5BC5768FA82718825DD269A668C4C68 SHA-1: 0xEE0BA7F3870F262F93CAA9B10F43E5E6D248C2E8	(not available)
58	%ProgramFiles%\CCleaner\Lang\lang-2052.dll	15,360 bytes	MD5: 0xDE132A55E2013D5FC75AE18502CB07F3 SHA-1: 0xE5440AA51F0964CA7C6A0F44967EB68B3635B606	(not available)
59	%ProgramFiles%\CCleaner\Lang\lang-2070.dll	33,792 bytes	MD5: 0x754FB6338DBFC1DCABB54EE9BF691780 SHA-1: 0xE141D17BF5E6BBBB433AFF45FB4C1799AE183EB1	(not available)
60	%ProgramFiles%\CCleaner\Lang\lang-2074.dll	29,184 bytes	MD5: 0x0512F14E7A6B914770B289AD869B349A SHA-1: 0x2A698961A03DC1F849E3297DCC0E6EF0FD08702A	(not available)
61	%ProgramFiles%\CCleaner\Lang\lang-3098.dll	29,184 bytes	MD5: 0x9C2DD47B98CA72B57E5C7C82A7BBE313 SHA-1: 0x049EC5BEDCA140932CB1997EF4E314820132C6AA	(not available)
62	%ProgramFiles%\CCleaner\Lang\lang-5146.dll	29,184 bytes	MD5: 0x2E2C087B9F0691F89B6072D9CA0087E1 SHA-1: 0xBED52910A2D1D037EE92614DF57175CF83667D6C	(not available)
63	%ProgramFiles%\CCleaner\Lang\lang-9999.dll	33,792 bytes	MD5: 0xAFA9F80E74A89884A48D3C85D8817976 SHA-1: 0x025721A244E41295F563215A9697DD7D26C32484	(not available)
64	%ProgramFiles%\CCleaner\uninst.exe	129,256 bytes	MD5: 0xA166843E2BA10A7EBC123FF255EC3CDF SHA-1: 0xB1DADBED494D67722F8298951FED3F9643F69B44	(not available)
65	%ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe	182,768 bytes	MD5: 0xCC839E8D766CC31A7710C9F38CF3E375 SHA-1: 0xA20FE767AE667638FC2ED43563BD436542CA7AD4	(not available)
66	%ProgramFiles%\Google\Google Toolbar\Component\GoogleCld_D9AEC8D4D1915047.dll	1,232,496 bytes	MD5: 0xB72206B97E3FD14D73EB81D086AA0B3B SHA-1: 0x12EC2761E5134A3032D289B5E27F1A8AF3D0445A	(not available)
67	%ProgramFiles%\Google\Google Toolbar\Component\GoogleCld_F383318595AD1D07.dll	1,206,896 bytes	MD5: 0xD41AEC4B522353ED17FCA7FFB2432978 SHA-1: 0xE2ECD7F66ACC255F0DA9C570C60B055B99253632	(not available)
68	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbar.7.2.2427.2330.manifest.xml	16,731 bytes	MD5: 0xDCFBFF3928A580BBB62B694E3589C172 SHA-1: 0xCD53FA6AA96F5FA9FD885773D9A1DE91C9C7031C	(not available)
69	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_248D3CEB7C787E4E.dll	3,047,536 bytes	MD5: 0x64C1481B867CC7B45E10A74CC9EB46E4 SHA-1: 0x6E48BBE314917BB5FDE23B3C8FEE7F435F29508A	(not available)
70	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_78F32466E61F1EEC.dll	2,908,272 bytes	MD5: 0x7DA764DA0C164E9CEDFE45847B2FA514 SHA-1: 0x903AA8CCD58750C61D7AC96D84DCC26BA0D27D91	(not available)
71	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarDynamic_ext_ja_32_0B613598DAECF22D.dll	58,992 bytes	MD5: 0xBD5888F44ECB38E3E00FA8BA933102C9 SHA-1: 0x2E6887AA44E527A3A534799EB0DD5D9DDCBEC996	(not available)
72	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarDynamic_ext_zh-CN_32_52173432FFDB9692.dll	234,608 bytes	MD5: 0x21CBDDD308C932725FA4BC54E5C17360 SHA-1: 0xEBD68F57982EE2B0BB9D26BF369D003AB7D37269	(not available)
73	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll	848,896 bytes	MD5: 0x9C626E135B52F704B9934774E37DDE4A SHA-1: 0x4F7691FDF7B2D175246B6179C6F59149C70EB8A8	(not available)
74	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_F5A70B61FC3A2BB0.dll	1,239,664 bytes	MD5: 0x3A913A99C665A6C3610241C09439F281 SHA-1: 0xB4292551BD8901D02C009EF0051895E66115C43B	(not available)
75	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarManager_A0AC09CE5247ECEF.exe	1,052,784 bytes	MD5: 0x72AA69F480CEB918D25B28EF0CABA60E SHA-1: 0x69085BE3B588CAF5A68280A43142DE7E1CBCE6BB	(not available)
76	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarManager_E85CDE7661A53A6A.exe	1,037,936 bytes	MD5: 0x19DF43A34C9BB7E790CB119AFCB7F66B SHA-1: 0xF1304E1D3EBEFD78CA4BA6B5118231ABBBDF311F	(not available)
77	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarUser_32_63846110C2FBA685.exe	307,312 bytes	MD5: 0xE168A426C2F711F39597292D878D5E50 SHA-1: 0x2A33E4F4C98249A44681733453412FB2E0A767C9	(not available)
78	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbarUser_32_7397BBD21492BAA9.exe %ProgramFiles%\Google\Google Toolbar\GoogleToolbarUser_32.exe	298,608 bytes	MD5: 0xDEA8E97225B79A52094459422FA9BE66 SHA-1: 0x379A0A0F08A8682B35476CF362AA42D7A5A44CAA	(not available)
79	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbar_32_2D29F0F746C2D723.dll	342,128 bytes	MD5: 0x61980095AE5D02B1E9D2ED604A90C1BF SHA-1: 0x53A6C23D4D30A0431776888A9BF5F7383A0BC4B1	(not available)
80	%ProgramFiles%\Google\Google Toolbar\Component\GoogleToolbar_32_788D2431A6FFBD5A.dll %ProgramFiles%\Google\Google Toolbar\GoogleToolbar_32.dll	279,664 bytes	MD5: 0xCE18BAFCF08340AC9A31044B86FA5FED SHA-1: 0xAEAB8D164B4F60AE7FD3166E953BA9BB60751957	(not available)
81	%ProgramFiles%\Google\Google Toolbar\Component\GoogleUpdaterService_5898FABCFA121C11.exe	182,768 bytes	MD5: 0x1C50AB911B3524356D0C58D8D669F09E SHA-1: 0x8196BF79D278F064FEAA77F3353410273F8611E6	(not available)
82	%ProgramFiles%\Google\Google Toolbar\Component\GoogleUpdateSetup_0002B5AEB6C5B612.exe	563,696 bytes	MD5: 0x5A81DAF322DFB89B925C1EE597302847 SHA-1: 0x6221A910EFCEB05583E82E25AF0CA8DF012D1278	(not available)
83	%ProgramFiles%\Google\Google Toolbar\Component\SearchWithGoogleUpdate_3CEFEC1F9BB6F303.exe	1,721,400 bytes	MD5: 0x47411684FC7E9A8F20E894D28FC66FEE SHA-1: 0x2F9D83A5A15970CEFCFC8959B32962D9702EA417	(not available)
84	%ProgramFiles%\Google\Google Toolbar\Component\SearchWithGoogleUpdate_60BF91FC421232D7.exe	1,487,344 bytes	MD5: 0xF0C64E8621073E5E6155A084D064C6FB SHA-1: 0xDFAB77008ED210FF0154BDBF27014F74CED69A0D	(not available)
85	%ProgramFiles%\Google\Google Toolbar\GoogleToolbarHelperPatch_signed.msp	119,808 bytes	MD5: 0x7C1F2F928AD72C15B6DDE410A0D9D43A SHA-1: 0x1E1E6CE38C2DE7FFEF611FC0D2A7A7DF13E8AAB3	(not available)
86	%ProgramFiles%\Google\Google Toolbar\GoogleToolbarHelper_signed.msi	28,160 bytes	MD5: 0xF7B15892385FE4B7F4A657B0619968D2 SHA-1: 0x935ADA5066CED268466EFBD5D18F777633928331	(not available)
87	%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\gth.dll	49,136 bytes	MD5: 0x15DC752B83DCB799D483BD715B855CF1 SHA-1: 0x8A0BE53000620F7141E07F3D4B41E72C6F6AAF2A	(not available)
88	%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\gtn.dll	148,976 bytes	MD5: 0xC31BBDCD066E35BE40DCF2C4EEF12F97 SHA-1: 0x69C41009431105CE0E9A4E7CFE4A6063C900C167	(not available)
89	%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\Readme.url	99 bytes	MD5: 0x5E0F60DDE2CE950E74EEE1E207800064 SHA-1: 0x4A360814B0E2B4DF4CA229A2A267EFA32C6E5DD6	(not available)
90	%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll	812,528 bytes	MD5: 0xA414F9F0E60B3AB385E56586D4EEAAF3 SHA-1: 0x28C4F210FBEA5C05EFF3FB66F171A49B33EBEDDC	(not available)
91	%ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe	39,408 bytes	MD5: 0x5D61BE7DB55B026A5D61A3EED09D0EAD SHA-1: 0x215950CE5D40907B041346F22B4E404EE591581D	(not available)
92	%ProgramFiles%\Google\Update\1.2.183.13\GoogleCrashHandler.exe	136,176 bytes	MD5: 0x975A3190EB50EAC7AA89488233E18294 SHA-1: 0x862F1AD96CB36E449FAE11E9C3276E5B12FEEECA	(not available)
93	%ProgramFiles%\Google\Update\1.2.183.13\GoogleUpdate.exe %ProgramFiles%\Google\Update\GoogleUpdate.exe	135,664 bytes	MD5: 0x8F0DE4FEF8201E306F9938B0905AC96A SHA-1: 0xD2E2915087427BE8EA88B4A174C334C578208E78	(not available)
94	%ProgramFiles%\Google\Update\1.2.183.13\GoogleUpdateHelper.msi	26,624 bytes	MD5: 0xFDA3E5076FADA18E867796219345ECE6 SHA-1: 0x598144E7D2467FA1865EAEAB9D95A20403156F46	(not available)
95	%ProgramFiles%\Google\Update\1.2.183.13\goopdate.dll	681,968 bytes	MD5: 0xEB24B0549C3F45594AF82A452CD4F822 SHA-1: 0x66528D7802891D129DEE7CF54B5A670012AC6F36	(not available)
96	%ProgramFiles%\Google\Update\1.2.183.13\GoopdateBho.dll	138,736 bytes	MD5: 0x626CA57682D15856B3BD87D6C5169DDE SHA-1: 0xA4D28A8E5042F2911282DE534ECD9C106CC6E9CD	(not available)
97	%ProgramFiles%\Google\Update\1.2.183.13\goopdateres_ar.dll	25,584 bytes	MD5: 0x2CF039038FDF0212511041BD7EB614E5 SHA-1: 0x604CC4517D13CE675BCE4A7A8A95988EEB50E833	(not available)
98	%ProgramFiles%\Google\Update\1.2.183.13\goopdateres_bg.dll	29,168 bytes	MD5: 0x915B9A095F53B8EF00C309FD17342362 SHA-1: 0x6DEEF71D075B9C05E23B2ACAB008FA598961283A	(not available)
99	%ProgramFiles%\Google\Update\1.2.183.13\goopdateres_bn.dll	27,632 bytes	MD5: 0x0596334BE2CAF19AE2F3C2365945F952 SHA-1: 0xC0D4D11CC4BAA154ECA122CA30D13F1DBCF8F0A2	(not available)
100	%ProgramFiles%\Google\Update\1.2.183.13\goopdateres_ca.dll	28,656 bytes	MD5: 0xABF850D51375F417A0FC705B824C7901 SHA-1: 0x7CA5CC857A64AB6C7E2F82EC0B62C45B4CB9FF80	(not available)

Notes:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
%CommonDesktopDir% is a variable that refers to the file system directory that contains files and folders that appear on the desktop for all users. A typical path is C:\Documents and Settings\All Users\Desktop (Windows NT/2000/XP).
%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%CommonAppData%\Microsoft\Network\Downloader
%CommonPrograms%\CCleaner
%AppData%\Google
%Temp%\nsj27.tmp
%Windir%\Temp\Google Toolbar
%CommonAppData%\Google
%CommonAppData%\Google\Custom Buttons
%CommonAppData%\Google\Google Toolbar
%CommonAppData%\Google\Google Toolbar\Component
%Profiles%\LocalService\Local Settings\Application Data\Google
%Profiles%\LocalService\Local Settings\Application Data\Google\Update
%Profiles%\LocalService\Local Settings\Application Data\Google\Update\Manifest
%Profiles%\LocalService\Local Settings\Application Data\Google\Update\Manifest\Initial
%AppData%\Google\CrashReports
%AppData%\Google\Custom Buttons
%AppData%\Google\Custom Buttons\Enterprise
%AppData%\Google\Toolbar Cache
%AppData%\Google\Toolbar Cache\6.4.1321.1732
%AppData%\Google\Toolbar Cache\6.4.1321.1732\en
%Temp%\Google Toolbar
%Temp%\nsn5.tmp
%Temp%\nsn5.tmp\g
%ProgramFiles%\CCleaner
%ProgramFiles%\CCleaner\Lang
%ProgramFiles%\Google
%ProgramFiles%\Google\Common
%ProgramFiles%\Google\Common\Google Updater
%ProgramFiles%\Google\CrashReports
%ProgramFiles%\Google\Google Toolbar
%ProgramFiles%\Google\Google Toolbar\Component
%ProgramFiles%\Google\GoogleToolbarNotifier
%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820
%ProgramFiles%\Google\Update
%ProgramFiles%\Google\Update\1.2.183.13

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%Profiles% is a variable that refers to the file system directory containing user profile folders. A typical path is C:\Documents and Settings.

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
googletoolbarinstaller_stub_signed.exe	%Temp%\googletoolbarinstaller_stub_signed.exe	524,288 bytes

There were new services created in the system:

Service Name	Display Name	Status	Service Filename
gusvc	Google Software Updater	"Stopped"	"%ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe"
gupdate	Google Update Service (gupdate)	"Stopped"	"%ProgramFiles%\Google\Update\GoogleUpdate.exe" /svc

The following system services were modified:

Service Name	Display Name	New Status	Service Filename
BITS	Background Intelligent Transfer Service	"Running"	%System%\svchost.exe -k netsvcs
MSIServer	Windows Installer	"Running"	%System%\msiexec.exe /V

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdaterService.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ProtectorExe.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\protector_dll.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A97CA128-6998-4F8E-807E-8ED05FADAFB0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Open CCleaner...
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Open CCleaner...\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Run CCleaner
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Run CCleaner\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32004B8A-44A9-43e7-84E9-808838809519}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32004B8A-44A9-43e7-84E9-808838809519}\Implemented Categories
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32004B8A-44A9-43e7-84E9-808838809519}\Implemented Categories\{00021493-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32004B8A-44A9-43e7-84E9-808838809519}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33B16641-F94B-4CD0-8D2B-0633B2C35790}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33B16641-F94B-4CD0-8D2B-0633B2C35790}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33B16641-F94B-4CD0-8D2B-0633B2C35790}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\18555481990E8AB4CBB63FB4F26006C0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\93BAD29AC2E44034A96BCB446EB8552E
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0\SourceList
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0\SourceList\Media
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0\SourceList\Net
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E\SourceList
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E\SourceList\Media
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E\SourceList\Net
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A9C08D73A738D4645A912F4E39ABB657
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DBFF5159BA0409649B38F48A1EE47E5F
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\ProxyStubClsid32

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe]

AppID = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdaterService.exe]

AppID = "{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ProtectorExe.EXE]

AppID = "{A97CA128-6998-4F8E-807E-8ED05FADAFB0}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\protector_dll.DLL]

AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}]

(Default) = "gusvc"
LocalService = "gusvc"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}]

(Default) = "protector_dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A97CA128-6998-4F8E-807E-8ED05FADAFB0}]

(Default) = "ProtectorExe"
RunAs = "Interactive User"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}]

(Default) = "Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itsel
LocalService = "gupdate"
ServiceParameters = "/comsvc"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Open CCleaner...\command]

(Default) = "%ProgramFiles%\CCleaner\ccleaner.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Run CCleaner\command]

(Default) = "%ProgramFiles%\CCleaner\ccleaner.exe /AUTO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}\InprocServer32]

(Default) = "%ProgramFiles%\Google\Google Toolbar\GoogleToolbar_32.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}]

(Default) = "Google Script Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]

(Default) = "%ProgramFiles%\Google\Google Toolbar\GoogleToolbar_32.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]

(Default) = "Google Toolbar"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InProcServer32]

(Default) = "%ProgramFiles%\Google\Update\1.2.183.13\goopdate.dll"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}]

(Default) = "PSFactoryBuffer"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32004B8A-44A9-43e7-84E9-808838809519}\InprocServer32]

(Default) = "%ProgramFiles%\Google\Google Toolbar\GoogleToolbar_32.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32004B8A-44A9-43e7-84E9-808838809519}]

(Default) = "Google Side Bar"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33B16641-F94B-4CD0-8D2B-0633B2C35790}\ProgID]

(Default) = "Google.OneClickCtrl.8"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33B16641-F94B-4CD0-8D2B-0633B2C35790}\InprocServer32]

(Default) = "%ProgramFiles%\Google\Update\1.2.183.13\npGoogleOneClick8.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33B16641-F94B-4CD0-8D2B-0633B2C35790}]

(Default) = "Google Update Plugin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\VersionIndependentProgID]

(Default) = "protector_dll.Protector"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\TypeLib]

(Default) = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\ProgID]

(Default) = "protector_dll.Protector.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\InprocServer32]

(Default) = "%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}]

(Default) = "Protector Class"
AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VersionIndependentProgID]

(Default) = "GoogleUpdate.OnDemandCOMClassMachine"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\TypeLib]

(Default) = "{7E6CD20B-8688-4960-96D9-B979471577B8}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID]

(Default) = "GoogleUpdate.OnDemandCOMClassMachine.1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalServer32]

(Default) = ""%ProgramFiles%\Google\Update\GoogleUpdate.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation]

Enabled = 0x00000001
IconReference = "@%ProgramFiles%\Google\Update\1.2.183.13\goopdate.dll,-1004"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}]

(Default) = "GoogleUpdate.OnDemandCOMClass"
LocalizedString = "@%ProgramFiles%\Google\Update\1.2.183.13\goopdate.dll,-3000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\VersionIndependentProgID]

(Default) = "protector_dll.ProtectorLib"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib]

(Default) = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\ProgID]

(Default) = "protector_dll.ProtectorLib.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32]

(Default) = "%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}]

(Default) = "ProtectorLib Class"
AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\VersionIndependentProgID]

(Default) = "GUServiceCtl.SilentUpdater"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\TypeLib]

(Default) = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\ProgID]

(Default) = "GUServiceCtl.SilentUpdater.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\LocalServer32]

(Default) = ""%ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}]

(Default) = "Google Silent Updater class"
AppID = "{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]

(Default) = "%ProgramFiles%\Google\Google Toolbar\GoogleToolbar_32.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

(Default) = "Google Toolbar Helper"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VersionIndependentProgID]

(Default) = "GoogleUpdateProcessLauncher"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\TypeLib]

(Default) = "{7E6CD20B-8688-4960-96D9-B979471577B8}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ProgID]

(Default) = "GoogleUpdateProcessLauncher.1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalServer32]

(Default) = ""%ProgramFiles%\Google\Update\GoogleUpdate.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}]

(Default) = "Google Update Process Launcher Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\VersionIndependentProgID]

(Default) = "protector_dll.ProtectorBho"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\TypeLib]

(Default) = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ProgID]

(Default) = "protector_dll.ProtectorBho.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32]

(Default) = "%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

(Default) = "Google Toolbar Notifier BHO"
AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\VersionIndependentProgID]

(Default) = "GUSchedulerCtl.UpdaterScheduler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\TypeLib]

(Default) = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\ProgID]

(Default) = "GUSchedulerCtl.UpdaterScheduler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\LocalServer32]

(Default) = ""%ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}]

(Default) = "Google Updater Scheduler class"
AppID = "{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID]

(Default) = "GoogleUpdate.CoreClass"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID]

(Default) = "GoogleUpdate.CoreClass.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}]

(Default) = "Google Update Core Class"
AppID = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID]

(Default) = "ProtectorExe.ProtectorHost"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\TypeLib]

(Default) = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\ProgID]

(Default) = "ProtectorExe.ProtectorHost.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32]

(Default) = ""%ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}]

(Default) = "ProtectorHost Class"
AppID = "{A97CA128-6998-4F8E-807E-8ED05FADAFB0}"
Depend = "%ProgramFiles%\Google\GoogleToolbarNotifier\5.5.4723.1820\gtn.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\18555481990E8AB4CBB63FB4F26006C0]

Complete = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\93BAD29AC2E44034A96BCB446EB8552E]

Complete = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0\SourceList\Net]

1 = "%ProgramFiles%\Google\Google Toolbar\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0\SourceList\Media]

1 = ";"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0\SourceList]

PackageName = "GoogleToolbarHelper_signed.msi"
LastUsedSource = "n;1;%ProgramFiles%\Google\Google Toolbar\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\18555481990E8AB4CBB63FB4F26006C0]

ProductName = "Google Toolbar for Internet Explorer"
PackageCode = "44CE195893A4F2C43956EA97F37E255D"
Language = 0x00000409
Version = 0x01000000

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]

Default_Search_URL =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]

SearchAssistant =

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies =
History =

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

Search Page =

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

provider =

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

{0E5CBF21-D15F-11D0-8301-00AA005B4383} =
ITBarLayout =

Other details

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
174.133.64.236	80
199.7.52.190	80
199.7.71.190	80
216.137.43.58	80
72.14.204.132	80
72.14.204.95	80
74.125.226.161	80
74.125.226.163	80
74.125.226.167	80
74.125.226.168	80
74.125.226.169	443
74.125.226.175	443
74.125.226.186	443

The data identified by the following URLs was then requested from the remote web server:

http://service.piriform.com/installcheck.aspx?p=1&v=3.07.1457&vx=&l=1033&b=1&o=5.1W3&g=1
http://crl.verisign.com/pca3.crl
http://CSC3-2004-crl.verisign.com/CSC3-2004.crl
http://crl.verisign.com/ThawteTimestampingCA.crl
http://crl.verisign.com/tss-ca.crl
http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer
http://download.piriform.com/ccsetup307.exe
http://themes.googleusercontent.com/static/fonts/opensans/v6/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot
http://fonts.googleapis.com/css?family=Open+Sans:r&subset=latin
http://dl.google.com/toolbar/components/Toolbar.manifest.xml.lz?zx=j-Ehs
http://dl.google.com/toolbar/components/toolbar.manifest.legacy.xml.lz
http://tools.google.com/service/update2
http://clients4.google.com/toolbar/ie8/accelerators/intl/en/manifest.txt
http://dl.google.com/toolbar/components/GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll.lz?zx=ezSNI
http://dl.google.com/toolbar/components/GoogleToolbarManager_E85CDE7661A53A6A.exe.lz?zx=D7Lmf
http://dl.google.com/toolbar/components/GoogleToolbarUser_32_7397BBD21492BAA9.exe.lz?zx=Da9J4
http://dl.google.com/toolbar/components/GoogleUpdaterService_5898FABCFA121C11.exe.lz?zx=lfdUL
http://dl.google.com/toolbar/components/GoogleUpdateSetup_0002B5AEB6C5B612.exe.lz?zx=8W1F7
http://dl.google.com/toolbar/components/SearchWithGoogleUpdate_60BF91FC421232D7.exe.lz?zx=TNJKc
http://dl.google.com/toolbar/components/GoogleCld_D9AEC8D4D1915047.dll.lz?zx=WuSQJ
http://dl.google.com/toolbar/components/GoogleToolbar_32_788D2431A6FFBD5A.dll.lz?zx=xx7pr
http://dl.google.com/toolbar/components/GoogleToolbarDynamic_32_78F32466E61F1EEC.dll.lz?zx=zmb8H
http://dl.google.com/toolbar/components/GoogleToolbarDynamic_ext_ja_32_0B613598DAECF22D.dll.lz?zx=M-Zke
http://dl.google.com/toolbar/components/GoogleToolbarDynamic_ext_zh-CN_32_52173432FFDB9692.dll.lz?zx=NcG3H
http://toolbar.google.com/tbredir?r=di&l=en&v=6.4&tbbrand=
http://toolbar.google.com/T6/done.html
http://toolbar.google.com/buttons/feeds/topbuttons/?hl=en&sd=com
http://toolbar.google.com/tbredir?r=ie8am&l=en&sd=com&v=6.4
http://tools.google.com/toolbar/js-utils.js
http://www.google-analytics.com/ga.js
http://clients1.google.com/tools/pso/ping?as=tbie&brand=PRFA&hl=en&events=T4I,R7I&rep=1&rlz=I7:,W1:,T4:1T4PRFA_enUS471,R7:&dcc=T4:1T4PRFA_enUS471,R2:1R2PRFA_enUS471&id=E9993CB565B981334C123992D239A04C217DB29A00CD1A40D3
http://www.google.com/toolbar/ie/done.html
http://www.google.com/toolbar/css/tbmain.css
http://www.google.com/js/gweb/analytics/autotrack.js
http://www.google.com/css/goog.css
http://www.google.com/css/modules/temp/notification/gcs.css
http://www.google.com/js/gweb/core.js
http://www.google.com/url?sa=p&pref=tb&pval=5&q=http%3A%2F%2Fwww.google.com%2Ftools%2Ftoolbar%2Fservice%2Fnoupdate%3F
http://www.google.com/tools/toolbar/service/noupdate?
http://www.google.com/js/gweb/ui/gtabs.js
http://www.google.com/js/gweb/analytics/doubletrack.js
http://www.google.com/intl/en/images/logos/toolbar_logo.gif
http://www.google.com/toolbar/ie/images/tour-plus-th.png
http://www.google.com/toolbar/ie/images/tour-instant-th.png
http://www.google.com/toolbar/ie/images/tour-search-th.png
http://www.google.com/toolbar/ie/images/tour-tools-th.png
http://www.google.com/toolbar/ie/images/tour-translate-th.png
http://www.google.com/toolbar/ie/images/tour-personalize-th.png
http://www.google.com/toolbar/ie/images/tour-plus.jpg
http://www.google.com/toolbar/ie/images/tour-instant.jpg
http://www.googleadservices.com/pagead/conversion.js
http://fls.doubleclick.net/activityi;src=2542116;type=searc340;cat=tbx;ord=7000711056947.263?
http://fls.doubleclick.net/activityi;src=2542116;type=searc340;cat=tbx;ord=7000711056947.263;~oref=http%3A%2F%2Fwww.google.com%2Ftoolbar%2Fie%2Fdone.html?&_dc_ck=try

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 443:

00000000 | 804C 0103 0000 3300 0000 1000 0004 0000 | .L....3.........
00000010 | 0500 000A 0100 8007 00C0 0300 8000 0009 | ................
00000020 | 0600 4000 0064 0000 6200 0003 0000 0602 | ..@..d..b.......
00000030 | 0080 0400 8000 0013 0000 1200 0063 F129 | .............c.)
00000040 | DB50 D238 0C5F 4CB1 EFDE 26B4 832B 1603 | .P.8._L...&..+..
00000050 | 0000 8410 0000 80AB 7E59 06A4 2537 534D | ........~Y..%7SM
00000060 | A121 AA35 EF43 FC0B A106 4C50 E842 FD40 | .!.5.C....LP.B.@
00000070 | 0166 A0C7 6C73 C8BA 4619 3FD3 FF47 37A0 | .f..ls..F.?..G7.
00000080 | BEF7 6207 A07C B102 9D0F 3F2F C832 3656 | ..b..|....?/.26V
00000090 | 55BF CA19 55A2 DF4A 9C2E 24A9 6A10 AA87 | U...U..J..$.j...
000000A0 | 4A3A 2698 237A 6784 1798 EC8C 7FDD 56B8 | J:&.#zg.......V.
000000B0 | AC9C 0AB2 4C22 9D55 6FF1 1157 2795 5BF3 | ....L".Uo..W'.[.
000000C0 | 6B9E 800C 4BC2 CFE5 FAF5 ED74 E97C 51D3 | k...K......t.|Q.
000000D0 | BD5C 4413 B192 E414 0300 0001 0116 0300 | .\D.............
000000E0 | 003C 1C94 EC94 1993 F1AA 12D3 1CD8 45C2 | .<............E.
000000F0 | D8E2 926F C81B 0B76 728D F125 8A3A 003A | ...o...vr..%.:.:
00000100 | 802E 9D31 F6B3 6ECA 836E C7F2 B666 ECC6 | ...1..n..n...f..
00000110 | 5402 0692 823D BB82 8351 183C F29F 1703 | T....=...Q.<....
00000120 | 0002 83A1 FFF7 5126 2E07 2BC0 4AA5 FB79 | ......Q&..+.J..y
00000130 | D6DC A6DB D10B 05F4 B335 5D77 88CB 7CD4 | .........5]w..|.
00000140 | 3D55 3F9E 8F02 0A85 4905 E7D4 FF8F E8A2 | =U?.....I.......
00000150 | 248E B31C 25EE 1CBF B112 EDA8 6D4A 45CE | $...%.......mJE.
00000160 | DDB6 D52E 3B47 0222 86B3 8EC1 68E9 233E | ....;G."....h.#>
00000170 | 204D 760F 8874 BDF6 BB1D 9EDA F1C8 2661 |  Mv..t........&a
00000180 | 9923 FA54 2866 ACB7 F0CF F683 9BC6 CA51 | .#.T(f.........Q
00000190 | 7535 A2D7 F2F1 310E 5157 7EB1 7CAB B4B9 | u5....1.QW~.|...
000001A0 | F3ED E249 4986 43F2 750D 9D87 ADA8 0412 | ...II.C.u.......
000001B0 | B2F4 4E8E 43D1 59B1 9D97 5CD0 FA91 CD08 | ..N.C.Y...\.....
000001C0 | 8498 D2B4 C864 EDA8 67FD 2801 7DA5 FEB9 | .....d..g.(.}...
000001D0 | 3E8C 95CB 1647 CD09 A616 0CFE DCF7 5D7C | >....G........]|
000001E0 | EF1B 6285 285C A88C D54C EDF6 F543 3373 | ..b.(\...L...C3s
000001F0 | A851 82AD B9D7 6B6C DC67 7835 7914 D528 | .Q....kl.gx5y..(
00000200 | 7E31 6570 C18C D9EB 6571 BF7C 7617 8C91 | ~1ep....eq.|v...
00000210 | 97F3 B146 0CA6 81E9 CD8E 1F5F 87B7 ACBC | ...F......._....
00000220 | 9A1F 7A84 C5C0 674E 430E 0F56 2CE6 06C3 | ..z...gNC..V,...
00000230 | D6C8 0DF7 7800 83C3 ED99 3580 F20E 67C3 | ....x.....5...g.
00000240 | 1F62 F1F1 5F28 1D70 CB5D E99F A48A 8A7C | .b.._(.p.].....|
00000250 | 2DAD DF3D DC6A DFB3 2FE1 473C C46C 2ED8 | -..=.j../.G<.l..
00000260 | EDB2 B00A 2B71 852F 6781 F8D5 228F 0658 | ....+q./g..."..X
00000270 | 4BA8 012F B2FE DB86 BDB3 839A AD6B 6322 | K../.........kc"
00000280 | 81A1 363E 4154 DFA8 8FE9 5C80 536A 77B7 | ..6>AT....\.Sjw.
00000290 | BE12 CDC9 CC7F F88C 16FD 76CC D2DC 72EE | ..........v...r.
000002A0 | B11E 908C DCE6 2236 55A1 7420 94B2 84E2 | ......"6U.t ....
000002B0 | 7498 C58E C317 B78F 8551 E5E1 0BB7 CFC9 | t........Q......
000002C0 | 6276 B376 36F9 C9FE 2FD2 9C85 4FEA EA79 | bv.v6.../...O..y
000002D0 | 1E68 AC1B CCF3 5BE1 4829 704C 23EA F433 | .h....[.H)pL#..3
000002E0 | 9FD2 AF1C D3B6 9AC8 8650 18EB CF23 D855 | .........P...#.U
000002F0 | FED1 AEC7 2141 7FA3 D10B 0B6B 07DB F8C7 | ....!A.....k....
00000300 | 51B9 2EAB C0EB D874 DAEE 2B85 8C7E 1C0E | Q......t..+..~..
00000310 | 1975 C9B5 4D90 7064 4206 0CE8 1554 5495 | .u..M.pdB....TT.
00000320 | 1025 D2BC E1A3 61AE CF9D B115 1E5D 0BD1 | .%....a......]..
00000330 | EEC8 26FB 237F 69F9 AC45 6A39 A7A8 2E4B | ..&.#.i..Ej9...K
00000340 | 20F6 A3AA E68C ABBA 8DB9 388F 53C6 FFB5 |  .........8.S...
00000350 | C0CD E616 7D4D 050F 304A 7BF9 18CA 8822 | ....}M..0J{...."
00000360 | BF42 D0B9 FA73 DE07 4AE8 1F8D 6570 B655 | .B...s..J...ep.U
00000370 | CE44 D1D0 4AC3 8121 C51D 73B6 7E25 ED36 | .D..J..!..s.~%.6
00000380 | BD4A 7D1A DA60 6406 E03B AE57 395F CDC9 | .J}..`d..;.W9_..
00000390 | 19B8 A2E2 6D60 E810 7AD0 024F 2888 0F83 | ....m`..z..O(...
000003A0 | 0247 927B 34DC                          | .G.{4.
00000030 | 0080 0400 8000 0013 0000 1200 0063 F8DF | .............c..
00000040 | F64A FEAE 1624 0D10 5EF7 7B00 B3EE 1603 | .J...$..^.{.....
00000050 | 0000 8410 0000 8003 83F8 79C1 5318 24C5 | ..........y.S.$.
00000060 | 6876 E4E0 9CDE B04C 696D 7E9D 67C9 CB3E | hv.....Lim~.g..>
00000070 | 2E58 9E44 C5B0 F6E3 123A 137A 6083 B1CB | .X.D.....:.z`...
00000080 | 8B07 F926 E505 4747 C09F 8AA5 63FD 1079 | ...&..GG....c..y
00000090 | EDED 272D 1654 972B D1FE 9E5E 0DC0 3141 | ..'-.T.+...^..1A
000000A0 | 42DB 759E 0618 1BE4 693F 400E BEA7 540B | B.u.....i?@...T.
000000B0 | 7045 F2E6 0B6A 991D 600E D9E3 3F54 31A2 | pE...j..`...?T1.
000000C0 | 6122 53F6 4012 5AFB BA99 AAEE CBDD 0D09 | a"S.@.Z.........
000000D0 | 0F28 7D01 D72C 3114 0300 0001 0116 0300 | .(}..,1.........
000000E0 | 003C E9A6 D180 41B9 088A A9E4 B585 4D52 | .<....A.......MR
000000F0 | 629A 294D D648 7461 14B7 2258 546C A549 | b.)M.Hta.."XTl.I
00000100 | 232D 2D6E AB7E A2A4 426B 5A8C 4037 8EA6 | #--n.~..BkZ.@7..
00000110 | D641 98EF 1EF8 555A 490B 3BE3 45E4 1703 | .A....UZI.;.E...
00000120 | 0001 0FE1 D76D ED5D 1417 50B8 C4D2 32F7 | .....m.]..P...2.
00000130 | B8A9 C9BB 6B10 4CB0 153A 5FB9 8A1B 576B | ....k.L..:_...Wk
00000140 | D3FA 8B3F D40E 9E3D 7D3F 61B0 3D69 215E | ...?...=}?a.=i!^
00000150 | 0304 C489 96AF F1F1 07E0 5585 7725 3587 | ..........U.w%5.
00000160 | 37C0 9848 656C F461 D918 5DE7 BFB9 8E4E | 7..Hel.a..]....N
00000170 | 5C44 56FC A119 AE21 D534 8763 8D27 07E0 | \DV....!.4.c.'..
00000180 | 4CB8 899E 8458 49A3 AA21 5251 8A15 52E5 | L....XI..!RQ..R.
00000190 | AB78 C531 72D4 307C AC21 0047 0B53 8717 | .x.1r.0|.!.G.S..
000001A0 | 919C 8806 84F1 79FB 1974 8EE0 F99C 8134 | ......y..t.....4
000001B0 | 354D 5C4F F300 4116 EE42 44D8 1E84 B661 | 5M\O..A..BD....a
000001C0 | 4DA8 7968 D7E3 7108 24BF D83D D251 1D61 | M.yh..q.$..=.Q.a
000001D0 | C91B 84C8 B7FF 686D 41D2 A0D6 0648 C898 | ......hmA....H..
000001E0 | 73FE 52E9 B9F6 878F B1E4 900B 3B42 BD7A | s.R.........;B.z
000001F0 | 9401 22F2 1594 91DB A8C8 BA70 14DB F4CE | .."........p....
00000200 | C624 1694 B974 A6F5 326A 0E31 EAF4 985E | .$...t..2j.1...^
00000210 | 6E42 2035 7082 E28A DBC6 1392 5774 794A | nB 5p.......WtyJ
00000220 | 4380 A6A9 FE55 6306 2F21 A49A DF7C 18C0 | C....Uc./!...|..
00000230 | DC4D                                    | .M
00000030 | 0080 0400 8000 0013 0000 1200 0063 6A17 | .............cj.
00000040 | 8755 F609 863C F299 74A7 79D3 7172 1603 | .U...<..t.y.qr..
00000050 | 0000 8410 0000 8021 E327 0924 4148 2454 | .......!.'.$AH$T
00000060 | 10FC 4485 434F 17A2 56B3 C6DE 0122 1BD2 | ..D.CO..V...."..
00000070 | A23D 508B DF53 DE3C 8EE8 2CE0 1CA1 B225 | .=P..S.<..,....%
00000080 | BC4C CBA9 5F04 6FC0 6F61 052E 169D 1324 | .L.._.o.oa.....$
00000090 | 5493 945C 46E9 9B9E 17D3 40AD A07A AF1D | T..\F.....@..z..
000000A0 | CCF0 274B ED78 6559 77E6 C4F5 EC15 EF5A | ..'K.xeYw......Z
000000B0 | 9F9E 7461 5822 0EF5 41EE 3DC6 0596 7478 | ..taX"..A.=...tx
000000C0 | 246F 424A 36D8 5691 A75F A90E BE1D B10C | $oBJ6.V.._......
000000D0 | A402 A9CA 83B3 D414 0300 0001 0116 0300 | ................
000000E0 | 003C BC9F 4C00 35FF 6640 8757 D1EC ABDC | .<..L.5.f@.W....
000000F0 | F014 B61C F463 5214 8253 C101 5F13 2EA9 | .....cR..S.._...
00000100 | B1C2 569F 2161 65EE C168 09C7 C074 3ECF | ..V.!ae..h...t>.
00000110 | 46B5 223A 8AA6 D8E4 9FDC 836F 7E5D 1703 | F.":.......o~]..
00000120 | 0001 C8B9 21DB 37C5 BB25 CC1F AF8C E36E | ....!.7..%.....n
00000130 | 859C 66B4 5162 8715 7124 A1C0 9CC8 E06C | ..f.Qb..q$.....l
00000140 | 31AF F71F B528 CF2D 6CEE A443 B115 7C57 | 1....(.-l..C..|W
00000150 | E290 A73A C1C7 DD0E 28E9 3636 AD9C 19F3 | ...:....(.66....
00000160 | DCF3 6924 A144 A025 FB23 4DC0 0C5B DE71 | ..i$.D.%.#M..[.q
00000170 | 58D7 80DA D212 85E7 4A6D A47A 952F F825 | X.......Jm.z./.%
00000180 | A490 7F57 D97D 2247 9679 9E11 DBF7 91CE | ...W.}"G.y......
00000190 | 78FF 7D60 C16D 83F9 C763 0A14 E8BF 4AB5 | x.}`.m...c....J.
000001A0 | 8607 DA89 AA1B B25C C668 CADF 539C 129A | .......\.h..S...
000001B0 | 37F4 C3D5 0DE1 E394 63C2 2623 4DA7 32D7 | 7.......c.&#M.2.
000001C0 | FBE0 97A3 709D 7DA4 B155 8BF8 314E 3803 | ....p.}..U..1N8.
000001D0 | DC57 3E14 E5DD BF1F 0C1A 12AE 4156 B661 | .W>.........AV.a
000001E0 | EEB1 003B B37C D19A 9A6E 4DDD 83D6 8146 | ...;.|...nM....F
000001F0 | 6297 FE3F 6372 25F6 01F0 C52A 225B 1370 | b..?cr%....*"[.p
00000200 | A56C C215 8E60 9019 DF10 9CAA 6632 4D8D | .l...`......f2M.
00000210 | DCCD EAAE 4984 6D55 E143 3C3D 4F76 95CE | ....I.mU.C<=Ov..
00000220 | 6DBD 9A73 36EA 0B5E B037 D087 6415 183F | m..s6..^.7..d..?
00000230 | 2A2B 6B0F B574 5CE2 693F 899A E6D7 7F8B | *+k..t\.i?......
00000240 | 785B F7AD 3305 367B 233B 47BD F466 7B74 | x[..3.6{#;G..f{t
00000250 | 1025 95A6 92B2 FC70 9DC2 FE23 4837 E893 | .%.....p...#H7..
00000260 | EF9C FF09 5E16 040E 0CB1 5123 C9DC 246B | ....^.....Q#..$k
00000270 | F476 517B FFD7 5B6D 4309 0FD9 64CB 56AD | .vQ{..[mC...d.V.
00000280 | 4506 506D 602E CCE3 D33E B26A 77CD D6B3 | E.Pm`....>.jw...
00000290 | 3072 AAFA 624E 1237 4A00 223F 355B E1AD | 0r..bN.7J."?5[..
000002A0 | 6989 4B1B 1C68 67FD 6043 2529 06CF 6879 | i.K..hg.`C%)..hy
000002B0 | 2BDA 3F78 E807 4C19 A1DD 8FC2 71CD B55E | +.?x..L.....q..^
000002C0 | 966A 55AD E3E9 3ED7 C99D 4145 4EF5 6A36 | .jU...>...AEN.j6
000002D0 | 6CC9 7727 A776 EC43 2D0E F4A2 EC35 8267 | l.w'.v.C-....5.g
000002E0 | BC1E AB3E EA63 82A5 5A13 46             | ...>.c..Z.F

Heuristics Analysis

Heuristically identified capability to use BITS (Background Intelligent Transfer Service) to schedule the following download task:

http://cache.pack.google.com/edgedl/toolbar/components/searchwithgoogleupdate_3cefec1f9bb6f303.exe.lz

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.