124 Rule Fired 125 Custom Rule Fired 126 File Created 127 File Deleted 128 File Executed 129 File Modified 130 File Renamed 131 Net Connect 132 Net Listen 133 Registry Key Deleted 134 Registry Key Created 135 Registry Value Deleted 136 Registry Value Set 137 Description 138 Details 139 Count 140 Time 141 You are about to restore a potentially malicious program. Are you sure you wish to proceed? 142 You are about to permanently delete a potentially malicious program. Are you sure you wish to proceed? 143 Alias 144 ThreatFire updates are now available. Click here to run Smart Update. 146 Windows Hook Set 147 Program Launched 148 File Downloaded 149 Executable Modified 150 Information Scanned 151 Program Terminated 152 Browser Launched 153 Process Stopped 154 File Quarantined 155 Registry Key Quarantined 156 Registry Value Quarantined 157 ThreatFire protection is now running. Your computer is now protected from viruses, spyware, and other malicious programs. 158 ThreatFire protection has been suspended. Your computer may now be vulnerable to viruses, spyware, and other malicious programs. 159 Unknown 160 or 161 Automatic Updates have been disabled. You may not be running the most recent version of ThreatFire. Use the ThreatFire control panel to enable automatic updates. 164 ThreatFire - Initiating 166 ThreatFire has just prevented a trojan from infecting your system. 167 ThreatFire has just prevented a worm from infecting your system. 168 ThreatFire has just prevented spyware from infecting your system. 169 ThreatFire has detected that adware is attempting to run on your machine. 170 ThreatFire has just prevented a virus from infecting your system. 171 ThreatFire has just prevented a key logger from infecting your system. 172 ThreatFire has just prevented a rootkit from infecting your system. 173 A seemingly harmless program that in reality performs or allows an external agent to perform malicious and dangerous actions on your computer. 174 A program that can spread copies of itself to other computers using email or some other network transport mechanism. 175 A program that installs on, gathers information from and may take partial control of a computer without a user's informed consent. 176 Adware is software whose sole purpose is delivering ads on your computer. Often, it is bundled and integrated with additional software that provides other functionality. 177 A malicious program that can infect other files and rapidly replicate itself. 178 Key Logger 179 Rootkit 180 This trojan is also known as %s. 181 This worm is also known as %s. 182 This spyware is also known as %s. 183 This adware is also known as %s. 184 This virus is also known as %s. 185 This key logger is also known as %s. 186 This rootkit is also known as %s. 187 This application is also known as %s. 188 The last scheduled scan detected one or more threats and your immediate attention is required. Please click here to launch ThreatFire and run a full scan. 190 Automatic update completed 191 Reboot required 192 The latest ThreatFire update has been successfully installed, but a reboot is necessary to complete the process. Please reboot your computer now. 193 ThreatFire has detected that a reboot is required in order to update certain program drivers. Please reboot your machine now to ensure you are fully protected. 194 UNKNOWN 195 MODERATE 196 HIGH 197 VERY HIGH 198 UNKNOWN. The risk level of this type of malware is unknown at this time. 199 MODERATE. This action might represent a threat to your system security However, it is not uncommon for legitimate and trustworthy programs to perform this action as well. 200 HIGH. This action might represent a threat to your system security. Some legitimate and trustworthy programs perform this action, but it is not common. 201 VERY HIGH. This is a highly suspicious action which represents a threat to your system security. Most legitimate and trustworthy programs do not perform this action. 202 This attack typically appears in malware. 203 This attack typically appears in viruses, spyware, adware, worms and trojans. 204 This attack typically appears in adware and trojans. 205 This attack typically appears in adware. 206 This attack typically appears in spyware and adware. 207 This attack typically appears in viruses, spyware and adware. 208 This attack typically appears in trojans, viruses and some types of adware. 209 This attack typically appears in adware, trojans and worms. 210 This attack typically appears in worms, trojans and viruses. 211 This attack typically appears in trojans and worms. 212 This attack typically appears in trojans. 213 This attack typically appears in worms. 214 This attack typically appears in spyware, adware and trojans. 215 This attack typically appears in worms and buffer overflow exploits. 216 This attack typically appears in trojans, viruses and spyware. 217 This attack typically appears in trojans and rootkits. 218 This attack typically appears in rootkits. 219 This attack typically appears in viruses and trojans. 220 This attack typically appears in worms, trojans and spyware. 221 This program is behaving in a malware type manner. 222 This program is attempting to register itself in your "Windows System Startup" list. A program in this list will automatically load and operate every time you start up your computer. 223 This program is attempting to manipulate, modify or tamper with another program currently running on your computer. 224 This program is attempting to modify the way your computer communicates with the internet. 225 This program is attempting to launch another program hidden in the background, different from the initial program you clicked on. 226 This program is attempting to change your security settings, privacy levels or personal options on Internet Explorer. 227 This program is attempting to modify the way your computer communicates with the internet or monitor the information your computer is transmitting. 228 This program is attempting to copy itself to multiple locations on your computer. 229 This program is attempting to change your Internet Explorer Home Page. 230 This program is attempting to change your Search settings for Internet Explorer. 231 This program is attempting to change your security settings and privacy levels by modifying which websites are "trusted" by Internet Explorer. 232 This program is attempting to connect to the Internet in a suspicious manner to send out emails. 233 This program is attempting to connect to the Internet in a suspicious or unexpected manner. 234 This program is an "executable" file attempting to misrepresent itself as a ".PIF" file. This file will perform an action or set of actions on your computer if you permit it to proceed. 235 This program is attempting to copy an "executable" file to a sensitive area of your system. This file will perform an action or set of actions on your computer if the copy completes. 236 This program is attempting to alter the "user privileges" on your computer. This will change your ability to add/remove programs or otherwise manage your system. 237 This program is attempting to shut down your firewall, antivirus or anti-spyware protection. 238 This program is attempting to modify your computer so that another computer can access it. 239 This program is attempting to copy another program to an area of your computer that shares files with other computers. 240 This program is attempting to change the location from which you share files with other computers. 241 This program is attempting to change your security settings, privacy levels or personal options on Internet Explorer. 242 This program is attempting to modify your computer so that a file will run without your consent. 243 This program is attempting to remove an icon and its associated functionality from the Windows Control Panel. 244 This program is attempting to disable Windows File Protection. 245 This program is attempting to restrict your access to other programs. 246 This program is attempting to disable the Registry editing tools that manage your Windows and program settings. 247 This program is attempting to disable your Control-Alt-Delete function. 248 This program is attempting to disguise itself as a protected application. 249 This program is attempting to install a component that can monitor or manipulate your system activity. 250 This program is attempting to execute instructions from an unauthorized area of your computer. 251 This program is attempting to manipulate, modify or tamper with another program on your computer. 252 This program is attempting to hide a certain process from the Windows Task Manager. 253 This program is attempting to hide a certain file from your view. 254 This program is attempting to launch a web browser. 255 This program is unexpectedly attempting to send information off your system. 256 This program is logging keystrokes. 257 This program is attempting to access protected historical browsing information on your computer. 258 This program is attempting to take control of your web browser. 259 This program is attempting to take an unauthorized snapshot of your current active window. 260 This program is attempting to launch a malicious program. 261 This program is an "executable" file attempting to misrepresent itself as a ".CMD" file. This file will perform an action or set of actions on your computer if you permit it to proceed. 262 Your web browser is attempting to launch a program in an unusual way. 263 The program is attempting to load a device driver into the operating system 264 An executable program is being created in an alternate data stream. 265 This program has an unusual autorun entry on a removable drive. 266 This program is changing the firewall exception list. 267 This program is accessing raw disk sectors. 268 The web page is being altered in a suspicious way. 269 ThreatFire is scanning for threats now 270 Quarantine in progress... please wait 271 The latest updates have been installed and your ThreatFire protection is up-to-date. 273 Select this option if you trust the process and want to allow it to continue running. 274 Select this option to immediately terminate the process and quarantine all its files so they cannot be activated again. 275 Select this option to immediately terminate the process, but not quarantine it. 276 Check this option to remember your selection and automatically take the same action the next time this process attempts to run. 277 Quarantine Details 278 Pending Quarantine Actions 279 Suspicious Activities Detected 280 Registry Key Delete Disallowed 281 Registry Value Delete Disallowed 284 A threat-specific behavior pattern has been detected. 285 A system driver has been modified. 286 A program is deleting itself. 287 A system service has been modified. 288 A program is disabling System Restore 289 A System DLL has been copied and modified. 291 Alerts only when a known threat is detected. This level will display the fewest alerts. 292 Alerts when a known threat is detected and for most unknown threats. 293 Alerts for known threats, known PUAs* and for any unknown threats. 294 Alerts on most suspicious actions, for all but the most trusted processes. 295 Alerts on any suspicious action. This level will display the most alerts. 296 This program is creating a Windows System Service 297 This program is altering Safe Mode boot settings 301 A program is attempting to copy and rename windows system libraries 307 is not running. 701 Potentially unwanted applications (PUAs) are programs like adware or spyware that may exhibit some malware characteristics. They are often bundled or integrated with other software with desirable functionality. PUAs may also be system tools that have possible malicious uses or that have been observed in malware bundles. 702 The following technical data shows the recent activity performed by the executable that triggered this alert and may be helpful in understanding why ThreatFire alerted. The categories of data presented in the right-hand pane may include any of the following based on the particular process: Process Data, Properties, Program Windows, Network Actions, File Actions, Registry Actions, Program Actions and Modules. 1061 Potentially unwanted applications (PUAs) are programs like adware or spyware that may exhibit some malware characteristics. They are often bundled or integrated with other software with desirable functionality. PUAs may also be system tools that have possible malicious uses or that have been observed in malware bundles. 1074 The following file(s) and/or registry entries will be quarantined if you elect to quarantine this threat. Right-clicking on an item will display additional information, if available. Please note that this list may not be comprehensive since further details may be uncovered during the cleaning process. A full list of all actions performed is always available in the ThreatFire's Quarantine area after quarantining, and this is also where you may Restore any quarantined item. 1078 Modules 1079 Vista Audio Driver 1080 System Idle Process 1081 System Process 1082 System 1083 Services 1084 Autoruns 1085 Applications 1086 Protected 1087 Other 1088 Program Windows 1089 Network Actions 1090 Network Connection 1091 Network Listen 1092 File Actions 1093 Registry Actions 1094 Value Deleted 1095 Value Set 1096 Key Deleted 1097 Key Created 1098 Program Actions 1099 Window Hook Set 1100 File Downloaded 1101 Executable Modified 1102 Private Information Scanned 1103 Process Terminated 1104 Browser Launched 1105 Program Launched 1106 Path 1107 Process Data 1108 Process ID 1109 Parent PID 1110 Certificate 1111 File Description 1112 File Company 1113 Command Line 1114 Properties 1115 Global startup group 1116 Local startup group 1117 Run key in HKEY_LOCAL_MACHINE 1118 Run key in HKEY_CURRENT_USER 1119 RunOnce key in HKEY_LOCAL_MACHINE 1120 RunOnce key in HKEY_CURRENT_USER 1121 RunOnceEx key in HKEY_LOCAL_MACHINE 1122 RunOnceEx key in HKEY_CURRENT_USER 1123 RunServices key in HKEY_LOCAL_MACHINE 1124 RunServices key in HKEY_CURRENT_USER 1125 RunServicesOnce key in HKEY_LOCAL_MACHINE 1126 RunServicesOnce key in HKEY_CURRENT_USER 1127 Autorun 1128 Program runs at startup from 1129 Item is hosted by Rundll32.exe 1130 Program is on a removable drive 1131 Program is running from the drive root 1132 Program is running from the internat cache 1133 Program is running from the temp directory 1134 Program appears to be installed properly 1135 Program is packed 1136 Program is available in the start menu 1137 Program appears to be uninstallable 1138 Program is made by a trusted vendor 1139 Version %s © 2009 PC Tools, All Rights Reserved 1140 Your ThreatFire software has been successfully updated to version %d.%d. Click here to view the current ThreatFire EULA. 1141 Your recent update to the latest version of ThreatFire requires that you complete the new PC Security Check. Click here to run this short scan now.