home *** CD-ROM | disk | FTP | other *** search
/ PC Active 2009 June / PC Active NR.226.iso / Software / firewalls / zaZA_Setup_en.exe / PROTECTION_SWITCH.XML < prev    next >
Encoding:
Text File  |  2009-02-15  |  341.0 KB  |  3,507 lines
  1. <osfirewall>
  2.  
  3. <rulegroup name="protourfiles">
  4.     <ruleentry event="file" match="any" allow="false" notify="true" customtext="2002">
  5.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDIR\Internet Logs\BACKUP.RDB" />
  6.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDIR\Internet Logs\IAMDB.RDB" />
  7.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDIR\Internet Logs\ZALog.txt" />
  8.  
  9.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs" context="dircontent" />
  10.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\avsys" context="dircontent" />
  11.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\avsys\bases" context="dircontent" />
  12.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\lib" context="dircontent" />
  13.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\lib\pyd" context="dircontent" />
  14.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\plugins" context="dircontent" />
  15.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\plugins\rpc_server" context="dircontent" />
  16.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\plugins\vsmon_plugin" context="dircontent" />
  17.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\streamapi" context="dircontent" />
  18.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\streamapi\httpblocker" context="dircontent" />
  19.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\streamapi\imslsp" context="dircontent" />
  20.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\Updates" />
  21.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\Zonelabs\Updates\LocalCatalog.xml" />
  22.  
  23.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vswmi.dll" />
  24.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsconfig.xml" />
  25.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsdatant.sys" />
  26.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\vsconfig.xml" />
  27.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\vsdatant.sys" />
  28.         
  29.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsdata.dll" />
  30.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsinit.dll" />
  31.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsmonapi.dll" />
  32.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vspubapi.dll" />
  33.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsregexp.dll" />
  34.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsutil.dll" />
  35.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\vsxml.dll" />
  36.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\zlcomm.dll" />
  37.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\zlcommdb.dll" />
  38.         <itementry param="filename" operator="equalnocase" type="ansi" value="WINSYSDIR\zpeng25.dll" />
  39.  
  40.         <itementry param="filename" operator="equalnocase" type="ansi" value="ZLDIR" context="dirpath" />
  41.         <itementry param="filename" operator="equalnocase" type="ansi" value="ZLDIR" context="dircontent" />
  42.         <itementry param="filename" operator="equalnocase" type="ansi" value="ZLDIR\Help" context="dircontent" />
  43.         <itementry param="filename" operator="equalnocase" type="ansi" value="ZLDIR\Images" context="dircontent" />
  44.         <itementry param="filename" operator="equalnocase" type="ansi" value="ZLDIR\repair" context="dircontent" />
  45.  
  46.     </ruleentry>
  47. </rulegroup>
  48. <rulegroup name="protourreg">
  49.     <ruleentry event="registry" match="any" allow="false" notify="true" customtext="2003">
  50.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs" />
  51.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Zone Labs" />
  52.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Zone Labs\Monitor" />
  53.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Zone Labs\Monitor\DialogControl" />
  54.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\MiniLog" />
  55.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\TrueVector" />
  56.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\TrueVector\LocalStoreDir" />
  57.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\TrueVector\LogStoreDir" />
  58.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\TrueVector\Store" />
  59.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm" />
  60.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Zone Labs\ZoneAlarm" />
  61.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Zone Labs\ZoneAlarm\Plugin" />
  62.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Zone Labs\ZoneAlarm\Plugin\obj" />
  63.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\Registration" />
  64.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm" />
  65.  
  66.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions" />
  67.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.ADE" />
  68.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.ADP" />
  69.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.ASX" />
  70.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.BAS" />
  71.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.BAT" />
  72.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.CHM" />
  73.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.CMD" />
  74.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.COM" />
  75.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.CPL" />
  76.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.CRT" />
  77.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.DBX" />
  78.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.DLL" />
  79.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.EML" />
  80.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.EXE" />
  81.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.HLP" />
  82.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.HTA" />
  83.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.INF" />
  84.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.INS" />
  85.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.ISP" />
  86.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.JS" />
  87.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.JSE" />
  88.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.LNK" />
  89.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MDA" />
  90.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MDB" />
  91.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MDE" />
  92.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MDZ" />
  93.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MHT" />
  94.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MSC" />
  95.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MSI" />
  96.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MSP" />
  97.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.MST" />
  98.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.NCH" />
  99.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.OCX" />
  100.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.PCD" />
  101.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.PIF" />
  102.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.PRF" />
  103.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.RAR" />
  104.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.REG" />
  105.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.SCF" />
  106.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.SCR" />
  107.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.SCT" />
  108.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.SHB" />
  109.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.SHS" />
  110.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.SYS" />
  111.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.URL" />
  112.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.VB" />
  113.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.VBE" />
  114.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.VBS" />
  115.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.WMS" />
  116.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.WSC" />
  117.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.WSF" />
  118.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.WSH" />
  119.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm\MailSafe Extensions\.ZIP" />
  120.         
  121.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsdatant" />
  122.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsdatant\enum" />
  123.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsdatant\parameters" />
  124.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsdatant\security" />
  125.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsdatant\Instances" />
  126.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsdatant\Instances\Vsdatant - Instance" />
  127.  
  128.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsmon" />
  129.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsmon\enum" />
  130.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\Vsmon\security" />
  131.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\srescan" />
  132.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\srescan\enum" />
  133.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\srescan\parameters" />
  134.         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\srescan\security" />     
  135.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\CLASSES\ZAMailSafe" />
  136.     </ruleentry>                                                                            
  137. </rulegroup>
  138.  
  139. <rulegroup name="protourreg1">
  140.     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="2003">
  141.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm" />
  142.         <itementry param="value" operator="equalnocase" type="ansi" value="InstallDirectory" />
  143.     </ruleentry>
  144. </rulegroup>
  145.  
  146. <rulegroup name="protourreg2">
  147.     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="2003">
  148.         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm" />
  149.         <itementry param="value" operator="equalnocase" type="ansi" value="IntegrityMode" />
  150.     </ruleentry>
  151. </rulegroup>
  152.  
  153. <rulegroup name="protourreg3">
  154.   <ruleentry event="registry" match="all" allow="false" notify="true" customtext="2003">
  155.     <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm" />
  156.     <itementry param="value" operator="equalnocase" type="ansi" value="AltDirDebug" />
  157.   </ruleentry>
  158. </rulegroup>
  159.  
  160.  
  161.  
  162.                 <!-- Severity (and promotion/demotion) of customized OSFW Events -->
  163.                 <severity name="normal" rating="low" >
  164.                     <messages type="osfwSeverityDescription" value="normal behavior" locale="en-US" />
  165.                     <messages type="osfwSeverityDescription" value="normale Verhaltensweisen" locale="de-DE" />
  166.                     <messages type="osfwSeverityDescription" value="comportement normal" locale="fr-FR" />
  167.                     <messages type="osfwSeverityDescription" value="µ¡úσ╕╕πü¬σïòΣ╜£" locale="jp-JA" />
  168.                     <messages type="osfwSeverityDescription" value="actividad normal" locale="es-ES" />
  169.                     <messages type="osfwSeverityDescription" value="comportamento normale" locale="it-IT" />
  170.  
  171.                 </severity>
  172.  
  173.                 <severity name="suspicious" rating="medium" >
  174.                     <messages type="osfwSeverityDescription" value="suspicious behavior" locale="en-US" />
  175.                     <messages type="osfwSeverityDescription" value="verd├ñchtige Verhaltensweisen" locale="de-DE" />
  176.                     <messages type="osfwSeverityDescription" value="comportement normal" locale="fr-FR" />
  177.                     <messages type="osfwSeverityDescription" value="τûæπéÅπüùπüäσïòΣ╜£" locale="jp-JA" />
  178.                     <messages type="osfwSeverityDescription" value="actividad sospechosa" locale="es-ES" />
  179.                     <messages type="osfwSeverityDescription" value="comportamento sospetto" locale="it-IT" />
  180.                     <promotion    from="AskSDenyD"    to="AllowSDenyD" />
  181.                     <promotion    from="AskSD"        to="AllowSAskD" />
  182.                     <demotion    from="AskSDenyD"    to="DenySD" />
  183.                     <demotion    from="AskSD"        to="DenySD" />
  184.                     <demotion    from="DenySD"       to="DenySD" />
  185.                 </severity>
  186.  
  187.                 <severity name="dangerous" rating="high" >
  188.                     <messages type="osfwSeverityDescription" value="suspicious behavior" locale="en-US" />
  189.                     <messages type="osfwSeverityDescription" value="verd├ñchtige Verhaltensweisen" locale="de-DE" />
  190.                     <messages type="osfwSeverityDescription" value="comportement normal" locale="fr-FR" />
  191.                     <messages type="osfwSeverityDescription" value="τûæπéÅπüùπüäσïòΣ╜£" locale="jp-JA" />
  192.                     <messages type="osfwSeverityDescription" value="actividad sospechosa" locale="es-ES" />
  193.                     <messages type="osfwSeverityDescription" value="comportamento sospetto" locale="it-IT" />
  194.                     <promotion    from="AskSD"        to="AllowSD" />
  195.                     <promotion    from="AllowSAskD"    to="AllowSD" />
  196.                     <demotion    from="AskSD"        to="AskSDenyD" />
  197.                     <demotion    from="AllowSAskD"    to="AllowSDenyD" />
  198.                 </severity>
  199.  
  200.                 <severity name="malicious" rating="high" >
  201.                     <messages type="osfwSeverityDescription" value="malicious behavior" locale="en-US" />
  202.                     <messages type="osfwSeverityDescription" value="b├╢sartige Verhaltensweisen" locale="de-DE" />
  203.                     <messages type="osfwSeverityDescription" value="comportement malveillant" locale="fr-FR" />
  204.                     <messages type="osfwSeverityDescription" value="σì▒ΘÖ║πü¬σïòΣ╜£" locale="jp-JA" />
  205.                     <messages type="osfwSeverityDescription" value="actividad maligna" locale="es-ES" />
  206.                     <messages type="osfwSeverityDescription" value="comportamento dannoso" locale="it-IT" />
  207.                 </severity>
  208.  
  209.                 <severity name="crit_malicious" rating="critical" >
  210.                     <messages type="osfwSeverityDescription" value="malicious behavior" locale="en-US" />
  211.                     <messages type="osfwSeverityDescription" value="b├╢sartige Verhaltensweisen" locale="de-DE" />
  212.                     <messages type="osfwSeverityDescription" value="comportement malveillant" locale="fr-FR" />
  213.                     <messages type="osfwSeverityDescription" value="σì▒ΘÖ║πü¬σïòΣ╜£" locale="jp-JA" />
  214.                     <messages type="osfwSeverityDescription" value="actividad maligna" locale="es-ES" />
  215.                     <messages type="osfwSeverityDescription" value="comportamento dannoso" locale="it-IT" />
  216.                 </severity>
  217.  
  218.                 <!-- Customization of Raw OSFW Events 
  219.  
  220.                      Note that customevent id numbers are used by AA, so they must not be changed or
  221.                      reused.
  222.                 -->
  223.  
  224.                     <!-- "miscellaneous" events (1001-1999) -->
  225.  
  226.                 <customevent id="1001" severityref="malicious" >
  227.                     <messages type="osfwPresentText" value="Warning! %process_name% is a malicious program and is trying to run on your computer" locale="en-US" />
  228.                     <messages type="osfwPastText" value="%process_name% is a malicious program and was trying to run on your computer" locale="en-US" />
  229.                     <messages type="osfwBlockedText" value="%process_name% is a malicious program and was prevented from running on your computer" locale="en-US" />
  230.                     <messages type="osfwPresentText" value="Warnung! %process_name% ist ein b├╢sartiges Programm, das versucht, sich auf Ihrem Computer auszuf├╝hren." locale="de-DE" />
  231.                     <messages type="osfwPastText" value="%process_name% ist ein b├╢sartiges Programm, das versucht hat, sich auf Ihrem Computer auszuf├╝hren." locale="de-DE" />
  232.                     <messages type="osfwBlockedText" value="%process_name% ist ein b├╢sartiges Programm, das daran gehindert wurde, sich auf Ihrem Computer auszuf├╝hren." locale="de-DE" />
  233.                     <messages type="osfwPresentText" value="Avertissement ! %process_name% est un programme malveillant qui tente de s'ex├⌐cuter sur votre ordinateur" locale="fr-FR" />
  234.                     <messages type="osfwPastText" value="%process_name% est un programme malveillant et a tent├⌐ de s'ex├⌐cuter sur votre ordinateur" locale="fr-FR" />
  235.                     <messages type="osfwBlockedText" value="%process_name% est un programme malveillant et n'a pas r├⌐ussi ├á s'ex├⌐cuter sur votre ordinateur" locale="fr-FR" />
  236.                     <messages type="osfwPresentText" value="Φ¡ªσæè ! %process_name% πü¿πüäπüåµé¬µäÅπü«πüéπéïπâùπâ¡πé░πâ⌐πâáπüîπé│πâ│πâöπâÑπâ╝πé┐Σ╕èπüºσ«ƒΦíîπéÆΦ⌐ªπü┐πüªπüäπü╛πüÖ" locale="jp-JA" />
  237.                     <messages type="osfwPastText" value="%process_name% πü¿πüäπüåµé¬µäÅπü«πüéπéïπâùπâ¡πé░πâ⌐πâáπüîπé│πâ│πâöπâÑπâ╝πé┐Σ╕èπüºσ«ƒΦíîπéÆΦ⌐ªπü┐πüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  238.                     <messages type="osfwBlockedText" value="%process_name% πü¿πüäπüåµé¬µäÅπü«πüéπéïπâùπâ¡πé░πâ⌐πâáπü«πé│πâ│πâöπâÑπâ╝πé┐Σ╕èπüºπü«σ«ƒΦíîπüîΘÿ▓µ¡óπüòπéîπü╛πüùπüƒ" locale="jp-JA" />
  239.                     <messages type="osfwPresentText" value="Advertencia: %process_name% es un programa maligno y est├í intentando ejecutarse en el equipo" locale="es-ES" />
  240.                     <messages type="osfwPastText" value="%process_name% es un programa maligno y ha intentando ejecutarse en el equipo" locale="es-ES" />
  241.                     <messages type="osfwBlockedText" value="%process_name% es un programa maligno y se ha impedido su ejecuci├│n en el equipo" locale="es-ES" />
  242.                     <messages type="osfwPresentText" value="Avviso! %process_name% ├¿ un programma dannoso e sta cercando di essere eseguito sul computer" locale="it-IT" />
  243.                     <messages type="osfwPastText" value="%process_name% ├¿ un programma dannoso e ha cercato di essere eseguito sul computer" locale="it-IT" />
  244.                     <messages type="osfwBlockedText" value="%process_name% ├¿ un programma dannoso ed ├¿ stata impedita la sua esecuzione sul computer" locale="it-IT" />
  245.                 </customevent>
  246.  
  247.                     <!-- "malicious" behavior (2001-2999) -->
  248.  
  249.                 <customevent id="2001" severityref="malicious" >
  250.                     <messages type="osfwPresentText" value="Warning! %process_name% is a malicious program and is trying to run on your computer" locale="en-US" />
  251.                     <messages type="osfwPastText" value="%process_name% is a malicious program and was trying to run on your computer" locale="en-US" />
  252.                     <messages type="osfwBlockedText" value="%process_name% is a malicious program and was prevented from running on your computer" locale="en-US" />
  253.                     <messages type="osfwPresentText" value="Warnung! %process_name% ist ein b├╢sartiges Programm, das versucht, sich auf Ihrem Computer auszuf├╝hren." locale="de-DE" />
  254.                     <messages type="osfwPastText" value="%process_name% ist ein b├╢sartiges Programm, das versucht hat, sich auf Ihrem Computer auszuf├╝hren." locale="de-DE" />
  255.                     <messages type="osfwBlockedText" value="%process_name% ist ein b├╢sartiges Programm, das daran gehindert wurde, sich auf Ihrem Computer auszuf├╝hren." locale="de-DE" />
  256.                     <messages type="osfwPresentText" value="Avertissement ! %process_name% est un programme malveillant qui tente de s'ex├⌐cuter sur votre ordinateur" locale="fr-FR" />
  257.                     <messages type="osfwPastText" value="%process_name% est un programme malveillant et a tent├⌐ de s'ex├⌐cuter sur votre ordinateur" locale="fr-FR" />
  258.                     <messages type="osfwBlockedText" value="%process_name% est un programme malveillant et n'a pas r├⌐ussi ├á s'ex├⌐cuter sur votre ordinateur" locale="fr-FR" />
  259.                     <messages type="osfwPresentText" value="Φ¡ªσæè ! %process_name% πü¿πüäπüåµé¬µäÅπü«πüéπéïπâùπâ¡πé░πâ⌐πâáπüîπé│πâ│πâöπâÑπâ╝πé┐Σ╕èπüºσ«ƒΦíîπéÆΦ⌐ªπü┐πüªπüäπü╛πüÖ" locale="jp-JA" />
  260.                     <messages type="osfwPastText" value="%process_name% πü¿πüäπüåµé¬µäÅπü«πüéπéïπâùπâ¡πé░πâ⌐πâáπüîπé│πâ│πâöπâÑπâ╝πé┐Σ╕èπüºσ«ƒΦíîπéÆΦ⌐ªπü┐πüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  261.                     <messages type="osfwBlockedText" value="%process_name% πü¿πüäπüåµé¬µäÅπü«πüéπéïπâùπâ¡πé░πâ⌐πâáπü«πé│πâ│πâöπâÑπâ╝πé┐Σ╕èπüºπü«σ«ƒΦíîπüîΘÿ▓µ¡óπüòπéîπü╛πüùπüƒ" locale="jp-JA" />
  262.                     <messages type="osfwPresentText" value="Advertencia: %process_name% es un programa maligno y est├í intentando ejecutarse en el equipo" locale="es-ES" />
  263.                     <messages type="osfwPastText" value="%process_name% es un programa maligno y ha intentando ejecutarse en el equipo" locale="es-ES" />
  264.                     <messages type="osfwBlockedText" value="%process_name% es un programa maligno y se ha impedido su ejecuci├│n en el equipo" locale="es-ES" />
  265.                     <messages type="osfwPresentText" value="Avviso! %process_name% ├¿ un programma dannoso e sta cercando di essere eseguito sul computer" locale="it-IT" />
  266.                     <messages type="osfwPastText" value="%process_name% ├¿ un programma dannoso e ha cercato di essere eseguito sul computer" locale="it-IT" />
  267.                     <messages type="osfwBlockedText" value="%process_name% ├¿ un programma dannoso ed ├¿ stata impedita la sua esecuzione sul computer" locale="it-IT" />
  268.                 </customevent>
  269.                 <customevent id="2002" severityref="malicious" >
  270.                     <messages type="osfwPresentText" value="%process_name% is trying to change the behavior of %product_name% by modifying the file: %file%" locale="en-US" />
  271.                     <messages type="osfwPastText" value="%process_name% was trying to change the behavior of %product_name% by modifying the file: %file%" locale="en-US" />
  272.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing the behavior of %product_name% by modifying the file: %file%" locale="en-US" />
  273.                     <messages type="osfwPresentText" value="%process_name% versucht, die Verhaltensweise von %product_name% durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  274.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Verhaltensweise von %product_name% durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  275.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Verhaltensweise von %product_name% durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  276.                     <messages type="osfwPresentText" value="%process_name% tente de modifier le comportement de %product_name% en modifiant le fichier suivant : %file%" locale="fr-FR" />
  277.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier le comportement de %product_name% en modifiant le fichier suivant : %file%" locale="fr-FR" />
  278.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier le comportement de %product_name% en modifiant le fichier suivant : %file%" locale="fr-FR" />
  279.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüª %product_name% πü«σïòΣ╜£πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ:%file%" locale="jp-JA" />
  280.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüª %product_name% πü«σïòΣ╜£πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ:%file%" locale="jp-JA" />
  281.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüª %product_name% πü«σïòΣ╜£πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ:%file%" locale="jp-JA" />
  282.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar el comportamiento de %product_name% mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  283.                     <messages type="osfwPastText" value="%process_name% ha intentado cambiar el comportamiento de %product_name% mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  284.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie el comportamiento de %product_name% mediante la modificaci├│n del archivo: %file%" locale="es-ES"/>
  285.                     <messages type="osfwPresentText" value="%process_name% sta cercando di cambiare il comportamento di %product_name% modificando il file seguente: %file%" locale="it-IT" />
  286.                     <messages type="osfwPastText" value="%process_name% ha cercato di cambiare il comportamento di %product_name% modificando il file seguente: %file%" locale="it-IT" />
  287.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di cambiare il comportamento di %product_name% modificando il file seguente: %file%" locale="it-IT" />
  288.                 </customevent>
  289.                 <customevent id="2003" severityref="malicious" >
  290.                     <messages type="osfwPresentText" value="%process_name% is trying to change the settings of %product_name% by modifying the registry key: %registry_key%" locale="en-US" />
  291.                     <messages type="osfwPastText" value="%process_name% was trying to change the settings of %product_name% by modifying the registry key: %registry_key%" locale="en-US" />
  292.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing the settings of %product_name% by modifying the registry key: %registry_key%" locale="en-US" />
  293.                     <messages type="osfwPresentText" value="%process_name% versucht, die Einstellungen von %product_name% durch Modifizierung des folgenden Registrierungsschl├╝ssels zu ├ñndern: %registry_key%" locale="de-DE" />
  294.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Einstellungen von %product_name% durch Modifizierung des folgenden Registrierungsschl├╝ssels zu ├ñndern: %registry_key%" locale="de-DE" />
  295.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Einstellungen von %product_name% durch Modifizierung des folgenden Registrierungsschl├╝ssels zu ├ñndern: %registry_key%" locale="de-DE" />
  296.                     <messages type="osfwPresentText" value="%process_name% tente de modifier les param├¿tres de %product_name% en modifiant la cl├⌐ de registre suivante : %registry_key%" locale="fr-FR" />
  297.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier les param├¿tres de %product_name% en modifiant la cl├⌐ de registre suivante : %registry_key%" locale="fr-FR" />
  298.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier les param├¿tres de %product_name% en modifiant la cl├⌐ de registre suivante : %registry_key%" locale="fr-FR" />
  299.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπüª %product_name% πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %registry_key%" locale="jp-JA" />
  300.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπüª %product_name% πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %registry_key%" locale="jp-JA" />
  301.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπüª %product_name% πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %registry_key%" locale="jp-JA" />
  302.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la configuraci├│n de %product_name% mediante la modificaci├│n de la clave de registro: %registry_key%" locale="es-ES" />
  303.                     <messages type="osfwPastText" value="%process_name% ha intentado cambiar la configuraci├│n de %product_name% mediante la modificaci├│n de la clave de registro: %registry_key%" locale="es-ES" />
  304.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la configuraci├│n de %product_name% mediante la modificaci├│n de la clave de registro: %registry_key%" locale="es-ES" />
  305.                     <messages type="osfwPresentText" value="%process_name% sta cercando di cambiare le impostazioni di %product_name% modificando la chiave di registro seguente: %registry_key%" locale="it-IT" />
  306.                     <messages type="osfwPastText" value="%process_name% ha cercato di cambiare le impostazioni di %product_name% modificando la chiave di registro seguente: %registry_key%" locale="it-IT" />
  307.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di cambiare le impostazioni di %product_name% modificando la chiave di registro seguente: %registry_key%" locale="it-IT" />
  308.                 </customevent>
  309.  
  310.                     <!-- "dangerous" behavior (3001-3999) -->
  311.  
  312.                 <customevent id="3001" severityref="dangerous" >
  313.                     <messages type="osfwPresentText" value="%process_name% is trying to change your network settings by modifying the file: %file%" locale="en-US" />
  314.                     <messages type="osfwPastText" value="%process_name% was trying to change your network settings by modifying the file: %file%" locale="en-US" />
  315.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing your network settings by modifying the file: %file%" locale="en-US" />
  316.                     <messages type="osfwPresentText" value="%process_name% versucht, Ihre Netzwerkeinstellungen durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  317.                     <messages type="osfwPastText" value="%process_name% hat versucht, Ihre Netzwerkeinstellungen durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  318.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, Ihre Netzwerkeinstellungen durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE"/>
  319.                     <messages type="osfwPresentText" value="%process_name% tente de modifier vos param├¿tres r├⌐seau en modifiant le fichier suivant : %file%" locale="fr-FR" />
  320.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier vos param├¿tres r├⌐seau en modifiant le fichier suivant : %file%" locale="fr-FR" />
  321.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier vos param├¿tres r├⌐seau en modifiant le fichier suivant : %file%" locale="fr-FR" />
  322.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüªπâìπââπâêπâ»πâ╝πé»Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ:%file%" locale="jp-JA" />
  323.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüªπâìπââπâêπâ»πâ╝πé»Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ:%file%" locale="jp-JA" />
  324.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüªπâìπââπâêπâ»πâ╝πé»Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ:%file%" locale="jp-JA" />
  325.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la configuraci├│n de red mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  326.                     <messages type="osfwPastText" value="%process_name% ha intentado cambiar la configuraci├│n de red mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  327.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la configuraci├│n de red mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  328.                     <messages type="osfwPresentText" value="%process_name% sta cercando di cambiare le impostazioni di rete modificando il file seguente: %file%" locale="it-IT" />
  329.                     <messages type="osfwPastText" value="%process_name% ha cercato di cambiare le impostazioni di rete modificando il file seguente: %file%" locale="it-IT" />
  330.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di cambiare le impostazioni di rete modificando il file seguente: %file%" locale="it-IT" />
  331.                 </customevent>
  332.                 <customevent id="3002" severityref="dangerous" >
  333.                     <messages type="osfwPresentText" value="%process_name% is trying to change Windows by modifying the file: %file%" locale="en-US" />
  334.                     <messages type="osfwPastText" value="%process_name% was trying to change the configuration of Windows by modifying the file: %file%" locale="en-US" />
  335.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing the configuration of Windows by modifying the file: %file%" locale="en-US" />
  336.                     <messages type="osfwPresentText" value="%process_name% versucht, Windows durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  337.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Konfiguration von Windows durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  338.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Konfiguration von Windows durch Modifizierung der folgenden Datei zu ├ñndern: %file%" locale="de-DE" />
  339.                     <messages type="osfwPresentText" value="%process_name% tente de modifier Windows en modifiant le fichier suivant : %file%" locale="fr-FR" />
  340.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier Windows en modifiant le fichier suivant : %file%" locale="fr-FR" />
  341.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier Windows en modifiant le fichier suivant : %file%" locale="fr-FR" />
  342.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüª Windows πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ:%file%" locale="jp-JA" />
  343.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüª Windows πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ:%file%" locale="jp-JA" />
  344.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâòπéíπéñπâ½πéƵ¢╕πüìµ¢┐πüêπüª Windows πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ:%file%" locale="jp-JA" />
  345.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la configuraci├│n de Windows mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  346.                     <messages type="osfwPastText" value="%process_name% ha intentado cambiar la configuraci├│n de Windows mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  347.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la configuraci├│n de Windows mediante la modificaci├│n del archivo: %file%" locale="es-ES" />
  348.                     <messages type="osfwPresentText" value="%process_name% sta cercando di cambiare Windows modificando il file seguente: %file%" locale="it-IT" />
  349.                     <messages type="osfwPastText" value="%process_name% ha cercato di cambiare la configurazione di Windows %product_name% modificando il file seguente: %file%" locale="it-IT" />
  350.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% cambiare la configurazione di Windows %product_name% modificando il file seguente: %file%" locale="it-IT" />
  351.                 </customevent>
  352.                 <customevent id="3003" severityref="dangerous" >
  353.                     <messages type="osfwPresentText" value="%process_name% is trying to reconfigure software by modifying the registry key: %registry_key%"    locale="en-US" />
  354.                     <messages type="osfwPastText" value="%process_name% was trying to reconfigure software by modifying the registry key: %registry_key%" locale="en-US" />
  355.                     <messages type="osfwBlockedText" value="%process_name% was prevented from reconfiguring software by modifying the registry key: %registry_key%" locale="en-US" />
  356.                     <messages type="osfwPresentText" value="%process_name% versucht, Software durch Modifizierung des folgenden Registrierungsschl├╝ssels zu ├ñndern: %registry_key%"    locale="de-DE" />
  357.                     <messages type="osfwPastText" value="%process_name% hat versucht, Software durch Modifizierung des folgenden Registrierungsschl├╝ssels zu ├ñndern: %registry_key%" locale="de-DE" />
  358.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, Software durch Modifizierung des folgenden Registrierungsschl├╝ssels zu ├ñndern: %registry_key%" locale="de-DE" />
  359.                     <messages type="osfwPresentText" value="%process_name% tente de modifier reconfigurer des logiciels en modifiant la cl├⌐ de registre suivante : %registry_key%"    locale="fr-FR" />
  360.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier reconfigurer des logiciels en modifiant la cl├⌐ de registre suivante : %registry_key%" locale="fr-FR" />
  361.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á reconfigurer des logiciels en modifiant la cl├⌐ de registre suivante : %registry_key%" locale="fr-FR" />
  362.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπüªπé╜πâòπâêπéªπéºπéóπéÆσåìΦ¿¡σ«Üπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %registry_key%"    locale="jp-JA" />
  363.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπüªπé╜πâòπâêπéªπéºπéóπéÆσåìΦ¿¡σ«Üπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %registry_key%" locale="jp-JA" />
  364.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπüªπé╜πâòπâêπéªπéºπéóπéÆσåìΦ¿¡σ«Üπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %registry_key%" locale="jp-JA" />
  365.                     <messages type="osfwPresentText" value="%process_name% est├í intentando volver a configurar el software mediante la modificaci├│n de la clave de registro: %registry_key%"    locale="es-ES" />
  366.                     <messages type="osfwPastText" value="%process_name% ha intentado volver a configurar el software mediante la modificaci├│n de la clave de registro: %registry_key%" locale="es-ES" />
  367.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% vuelva a configurar el software mediante la modificaci├│n de la clave de registro: %registry_key%" locale="es-ES" />
  368.                     <messages type="osfwPresentText" value="%process_name% sta cercando di riconfigurare il software modificando la chiave di registro seguente: %registry_key%"    locale="it-IT" />
  369.                     <messages type="osfwPastText" value="%process_name% ha cercato di riconfigurare il software modificando la chiave di registro seguente: %registry_key%" locale="it-IT" />
  370.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di riconfigurare il software modificando la chiave di registro seguente: %registry_key%" locale="it-IT" />
  371.                 </customevent>
  372.                 <customevent id="3004" severityref="dangerous" >
  373.                     <messages type="osfwPresentText" value="%process_name% is trying to read and modify physical memory" locale="en-US" />
  374.                     <messages type="osfwPastText" value="%process_name% was trying to read and modify physical memory" locale="en-US" />
  375.                     <messages type="osfwBlockedText" value="%process_name% was prevented from reading and modifying physical memory" locale="en-US" />
  376.                     <messages type="osfwPresentText" value="%process_name% versucht, den physischen Speicher zu lesen und zu ├ñndern." locale="de-DE" />
  377.                     <messages type="osfwPastText" value="%process_name% versucht, den physischen Speicher zu lesen und zu ├ñndern." locale="de-DE" />
  378.                     <messages type="osfwBlockedText" value="%process_name% hat versucht, den physischen Speicher zu lesen und zu ├ñndern." locale="de-DE" />
  379.                     <messages type="osfwPresentText" value="%process_name% tente de lire et de modifier la m├⌐moire physique" locale="fr-FR" />
  380.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de lire et de modifier la m├⌐moire physique" locale="fr-FR" />
  381.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á lire et ├á modifier la m├⌐moire physique" locale="fr-FR" />
  382.                     <messages type="osfwPresentText" value="%process_name% πüîτë⌐τÉåπâíπâóπâ¬πéÆΦ¬¡πü┐σÅûπüúπüªσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  383.                     <messages type="osfwPastText" value="%process_name% πüîτë⌐τÉåπâíπâóπâ¬πéÆΦ¬¡πü┐σÅûπüúπüªσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  384.                     <messages type="osfwBlockedText" value="%process_name% πüîτë⌐τÉåπâíπâóπâ¬πéÆΦ¬¡πü┐σÅûπüúπüªσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  385.                     <messages type="osfwPresentText" value="%process_name% est├í intentando leer y modificar la memoria f├¡sica" locale="es-ES" />
  386.                     <messages type="osfwPastText" value="%process_name% ha intentado leer y modificar la memoria f├¡sica" locale="es-ES" />
  387.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% lea y modifique la memoria f├¡sica" locale="es-ES" />
  388.                     <messages type="osfwPresentText" value="%process_name% sta cercando di leggere e modificare la memoria fisica" locale="it-IT" />
  389.                     <messages type="osfwPastText" value="%process_name% ha cercato di leggere e modificare la memoria fisica" locale="it-IT" />
  390.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di leggere e modificare la memoria fisica" locale="it-IT" />
  391.                 </customevent>
  392.                 <customevent id="3005" severityref="dangerous" >
  393.                     <messages type="osfwPresentText" value="%process_name% is attempting to monitor user activities on this computer. If allowed it may try to track or log keystrokes (user input), mouse movements/clicks, web sites visited, and other user behaviors" locale="en-US" />
  394.                     <messages type="osfwPastText" value="%process_name% was attempting to monitor user activity" locale="en-US" />
  395.                     <messages type="osfwBlockedText" value="%process_name% was prevented from monitoring user activity" locale="en-US" />
  396.                     <messages type="osfwPresentText" value="%process_name% versucht, Benutzeraktivit├ñten auf diesem Computer zu ├╝berwachen. Wenn dies gestattet wird, versucht das Programm m├╢glicherweise, Tastatureingaben (Benutzereingaben), Mausbewegungen/-klicks, besuchte Websites und andere Aktivit├ñten des Benutzers nachzuverfolgen bzw. zu protokollieren." locale="de-DE" />
  397.                     <messages type="osfwPastText" value="%process_name% hat versucht, Benutzeraktivit├ñten zu ├╝berwachen." locale="de-DE" />
  398.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, Benutzeraktivit├ñten zu ├╝berwachen." locale="de-DE" />
  399.                     <messages type="osfwPresentText" value="%process_name% tente de surveiller les activit├⌐s des utilisateurs sur cet ordinateur. Si vous l'autorisez, il pourra pister et enregistrer les saisies des utilisateurs, les mouvements et les clics de la souris, ainsi que les sites Web visit├⌐s et autres comportements des utilisateurs." locale="fr-FR" />
  400.                     <messages type="osfwPastText" value="%process_name% tente de surveiller les activit├⌐s des utilisateurs" locale="fr-FR" />
  401.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á surveiller les activit├⌐s des utilisateurs" locale="fr-FR" />
  402.                     <messages type="osfwPresentText" value="%process_name% πü»πÇüπüôπü«πé│πâ│πâöπâÑπâ╝πé┐Σ╕èπü«πâªπâ╝πé╢ πéóπé»πâåπéúπâôπâåπéúπéÆτ¢úΦªûπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖπÇéπü¥πéîπéÆΦ¿▒σÅ»πüùπüƒσá┤σÉêπÇüπé¡πâ╝πé╣πâêπâ¡πâ╝πé» (πâªπâ╝πé╢σàÑσè¢)πÇüπâ₧πéªπé╣πü«σïòπüì/πé»πâ¬πââπé»πÇüπéóπé»πé╗πé╣πüùπüƒ Web πé╡πéñπâêπÇüπüèπéêπü│πü¥πü«Σ╗ûπü«πâªπâ╝πé╢Φíîτé║πéÆΦ┐╜Φ╖íπü╛πüƒπü»Φ¿ÿΘî▓πüùπéêπüåπü¿πüÖπéïσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  403.                     <messages type="osfwPastText" value="%process_name% πüîπâªπâ╝πé╢ πéóπé»πâåπéúπâôπâåπéúπéÆτ¢úΦªûπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒπÇé" locale="jp-JA" />
  404.                     <messages type="osfwBlockedText" value="%process_name% πüîπÇüπâªπâ╝πé╢ πéóπé»πâåπéúπâôπâåπéúπü«τ¢úΦªûπéÆτªüµ¡óπüòπéîπü╛πüùπüƒπÇé" locale="jp-JA" />
  405.                     <messages type="osfwPresentText" value="%process_name% est├í intentando controlar las actividades del usuario en este equipo. Si se permite esto, es posible que intente realizar un seguimiento o registrar las pulsaciones de teclas, los clics/movimientos del rat├│n, los sitios Web visitados y otras acciones del usuario." locale="es-ES" />
  406.                     <messages type="osfwPastText" value="%process_name% estaba intentando supervisar la actividad del usuario" locale="es-ES" />
  407.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% supervise la actividad del usuario" locale="es-ES" />
  408.                     <messages type="osfwPresentText" value="%process_name% sta tentando di monitorare le attivit├á dell'utente su questo computer. Se autorizzato, potrebbe cercare di registrare o tenere traccia dei tasti premuti (input dell'utente), dei movimenti/clic del mouse, dei siti Web visitati e altri comportamenti dell'utente." locale="it-IT" />
  409.                     <messages type="osfwPastText" value="%process_name% ha cercato di monitorare l'attivit├á dell'utente" locale="it-IT" />
  410.                     <messages type="osfwBlockedText" value="A %process_name% ├¿ stato impedito il monitoraggio dell'attivit├á dell'utente" locale="it-IT" />
  411.                 </customevent>
  412.                 <customevent id="3006" severityref="dangerous" >
  413.                     <messages type="osfwPresentText" value="%process_name% is trying to load the driver: %driver%" locale="en-US" />
  414.                     <messages type="osfwPastText" value="%process_name% was trying to load the driver: %driver%" locale="en-US" />
  415.                     <messages type="osfwBlockedText" value="%process_name% was prevented from loading the driver: %driver%" locale="en-US" />
  416.                     <messages type="osfwPresentText" value="%process_name% versucht, den folgenden Treiber zu laden: %driver%" locale="de-DE" />
  417.                     <messages type="osfwPastText" value="%process_name% hat versucht, den folgenden Treiber zu laden: %driver%" locale="de-DE" />
  418.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, den folgenden Treiber zu laden: %driver%" locale="de-DE" />
  419.                     <messages type="osfwPresentText" value="%process_name% tente de charger le pilote : %driver%" locale="fr-FR" />
  420.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de charger le pilote : %driver%" locale="fr-FR" />
  421.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á charger le pilote : %driver%" locale="fr-FR" />
  422.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπéÆπâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %driver%" locale="jp-JA" />
  423.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπéÆπâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  424.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπéÆπâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  425.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cargar el controlador: %driver%" locale="es-ES" />
  426.                     <messages type="osfwPastText" value="%process_name% ha intentado cargar el controlador: %driver%" locale="es-ES" />
  427.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cargue el controlador: %driver%" locale="es-ES" />
  428.                     <messages type="osfwPresentText" value="%process_name% sta cercando di caricare il driver seguente: %driver%" locale="it-IT" />
  429.                     <messages type="osfwPastText" value="%process_name% ha cercato di caricare il driver seguente: %driver%" locale="it-IT" />
  430.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di caricare il driver seguente: %driver%" locale="it-IT" />
  431.                 </customevent>
  432.  
  433.                 <customevent id="3007" severityref="dangerous" >
  434.                     <messages type="osfwPresentText" value="%process_name% is trying to install a new driver or service: %driver%" locale="en-US" />
  435.                     <messages type="osfwPastText" value="%process_name% was trying to install a new driver or service: %driver%" locale="en-US" />
  436.                     <messages type="osfwBlockedText" value="%process_name% was prevented from installing a new driver or service: %driver%" locale="en-US" />
  437.                     <messages type="osfwPresentText" value="%process_name% versucht, einen neuen Treiber oder Dienst zu installieren: %driver%" locale="de-DE" />
  438.                     <messages type="osfwPastText" value="%process_name% hat versucht, einen neuen Treiber oder Dienst zu installieren: %driver%" locale="de-DE" />
  439.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, einen neuen Treiber oder Dienst zu installieren: %driver%" locale="de-DE" />
  440.                     <messages type="osfwPresentText" value="%process_name% tente d'installer un nouveau pilote ou service : %driver%" locale="fr-FR" />
  441.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ d'installer un nouveau pilote ou service : %driver%" locale="fr-FR" />
  442.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á installer un nouveau pilote ou service : %driver%" locale="fr-FR" />
  443.                     <messages type="osfwPresentText" value="%process_name% πü»µ¼íπü«µû░πüùπüäπâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %driver%" locale="jp-JA" />
  444.                     <messages type="osfwPastText" value="%process_name% πü»µ¼íπü«µû░πüùπüäπâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  445.                     <messages type="osfwBlockedText" value="%process_name% πü»µ¼íπü«µû░πüùπüäπâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆπéñπâ│πé╣πâêπâ╝πâ½πüºπüìπü╛πü¢πéôπüºπüùπüƒ: %driver%" locale="jp-JA" />
  446.                     <messages type="osfwPresentText" value="%process_name% est├í intentando instalar un nuevo controlador o servicio: %driver%" locale="es-ES" />
  447.                     <messages type="osfwPastText" value="%process_name% estaba intentando instalar un nuevo controlador o servicio: %driver%" locale="es-ES" />
  448.                     <messages type="osfwBlockedText" value="Se ha empedido que %process_name% instale un nuevo controlador o servicio: %driver%" locale="es-ES" />
  449.                     <messages type="osfwPresentText" value="%process_name% is trying to install a new driver or service: %driver%" locale="it-IT" />
  450.                     <messages type="osfwPresentText" value="%process_name% sta cercando di installare un nuovo driver o servizio: %driver%" locale="it-IT" />
  451.                     <messages type="osfwPastText" value="%process_name% ha cercato di installare un nuovo driver o servizio: %driver%" locale="it-IT" />
  452.                 </customevent>
  453.  
  454.                 <customevent id="3008" severityref="dangerous" >
  455.                     <messages type="osfwPresentText" value="%process_name% is trying to modify an existing driver or service: %driver%" locale="en-US" />
  456.                     <messages type="osfwPastText" value="%process_name% was trying to modify an existing driver or service: %driver%" locale="en-US" />
  457.                     <messages type="osfwBlockedText" value="%process_name% was prevented from modifying an existing driver or service: %driver%" locale="en-US" />
  458.                     <messages type="osfwPresentText" value="%process_name% versucht, einen vorhandenen Treiber oder Dienst zu ├ñndern: %driver%" locale="de-DE" />
  459.                     <messages type="osfwPastText" value="%process_name% hat versucht, einen vorhandenen Treiber oder Dienst zu ├ñndern: %driver%" locale="de-DE" />
  460.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, einen vorhandenen Treiber oder Dienst zu ├ñndern: %driver%" locale="de-DE" />
  461.                     <messages type="osfwPresentText" value="%process_name% tente de modifier un pilote ou un service existant : %driver%" locale="fr-FR" />
  462.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier un pilote ou un service existant : %driver%" locale="fr-FR" />
  463.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier un pilote ou un service existant : %driver%" locale="fr-FR" />
  464.                     <messages type="osfwPresentText" value="%process_name% πü»µ¼íπü«µùóσ¡ÿπü«πâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %driver%" locale="jp-JA" />
  465.                     <messages type="osfwPastText" value="%process_name% πü»µ¼íπü«µùóσ¡ÿπü«πâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  466.                     <messages type="osfwBlockedText" value="%process_name% πü»µ¼íπü«µùóσ¡ÿπü«πâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆσñëµ¢┤πüºπüìπü╛πü¢πéôπüºπüùπüƒ: %driver%" locale="jp-JA" />
  467.                     <messages type="osfwPresentText" value="%process_name% est├í intentando modificar un controlador o servicio existente: %driver%" locale="es-ES" />
  468.                     <messages type="osfwPastText" value="%process_name% estaba intentando modificar un controlador o servicio existente: %driver%" locale="es-ES" />
  469.                     <messages type="osfwBlockedText" value="Se ha impedido que%process_name% modifique un controlador o servicio existente: %driver%" locale="es-ES" />
  470.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare un driver o un servizio esistente: %driver%" locale="it-IT" />
  471.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare un driver o un servizio esistente: %driver%" locale="it-IT" />
  472.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di installare un nuovo driver o servizio: %driver%" locale="it-IT" />
  473.                 </customevent>
  474.  
  475.                 <customevent id="3009" severityref="dangerous" >
  476.                     <messages type="osfwPresentText" value="%process_name% is trying to remove a driver or service: %driver%" locale="en-US" />
  477.                     <messages type="osfwPastText" value="%process_name% was trying to remove a driver or service: %driver%" locale="en-US" />
  478.                     <messages type="osfwBlockedText" value="%process_name% was prevented from removing a driver or service: %driver%" locale="en-US" />
  479.                     <messages type="osfwPresentText" value="%process_name% versucht, einen Treiber oder Dienst zu entfernen: %driver%" locale="de-DE" />
  480.                     <messages type="osfwPastText" value="%process_name% hat versucht, einen Treiber oder Dienst zu entfernen: %driver%" locale="de-DE" />
  481.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, einen Treiber oder Dienst zu entfernen: %driver%" locale="de-DE" />
  482.                     <messages type="osfwPresentText" value="%process_name% tente de supprimer un pilote ou un service : %driver%" locale="fr-FR" />
  483.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de supprimer un pilote ou un service : %driver%" locale="fr-FR" />
  484.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á supprimer un pilote ou un service : %driver%" locale="fr-FR" />
  485.                     <messages type="osfwPresentText" value="%process_name% πü»µ¼íπü«πâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆσëèΘÖñπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %driver%" locale="jp-JA" />
  486.                     <messages type="osfwPastText" value="%process_name% πü»µ¼íπü«πâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆσëèΘÖñπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  487.                     <messages type="osfwBlockedText" value="%process_name% πü»µ¼íπü«πâëπâ⌐πéñπâÉπü╛πüƒπü»πé╡πâ╝πâôπé╣πéÆσëèΘÖñπüºπüìπü╛πü¢πéôπüºπüùπüƒ: %driver%" locale="jp-JA" />
  488.                     <messages type="osfwPresentText" value="%process_name% est├í intentando eliminar un controlador o servicio: %driver%" locale="es-ES" />
  489.                     <messages type="osfwPastText" value="%process_name% estaba intentando eliminar un controlador o servicio: %driver%" locale="es-ES" />
  490.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% elimine un controlador o servicio: %driver%" locale="es-ES" />
  491.                     <messages type="osfwPresentText" value="%process_name% sta cercando di rimuovere un driver o servizio: %driver%" locale="it-IT" />
  492.                     <messages type="osfwPastText" value="%process_name% ha cercato di rimuovere un driver o servizio: %driver%" locale="it-IT" />
  493.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di rimuovere un driver o servizio: %driver%" locale="it-IT" />
  494.                 </customevent>
  495.  
  496.  
  497.                     <!-- "suspicious" behavoir (4001-4999) -->
  498.                 <customevent id="4001" severityref="suspicious" >
  499.                     <messages type="osfwPresentText" value="%process_name% is trying to set '%registry_value%' to run each time your computer is started" locale="en-US" />
  500.                     <messages type="osfwPastText" value="%process_name% was trying to set '%registry_value%' to run each time your computer is started" locale="en-US" />
  501.                     <messages type="osfwBlockedText" value="%process_name% was prevented from setting '%registry_value%' to run each time your computer is started" locale="en-US" />
  502.                     <messages type="osfwPresentText" value="%process_name% nimmt Einstellungen an '%registry_value%' vor, die bewirken, dass es bei jedem Computerstart ausgef├╝hrt wird." locale="de-DE" />
  503.                     <messages type="osfwPastText" value="%process_name% hat Einstellungen an '%registry_value%' vorgenommen, die bewirken, dass es bei jedem Computerstart ausgef├╝hrt wird." locale="de-DE" />
  504.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, Einstellungen an '%registry_value%' vorzunehmen, die bewirken, dass es bei jedem Computerstart ausgef├╝hrt wird." locale="de-DE" />
  505.                     <messages type="osfwPresentText" value="%process_name% tente de d├⌐finir '%registry_value%' pour ├¬tre ex├⌐cut├⌐ ├á chaque d├⌐marrage de l'ordinateur" locale="fr-FR" />
  506.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de d├⌐finir '%registry_value%' pour ├¬tre ex├⌐cut├⌐ ├á chaque d├⌐marrage de l'ordinateur" locale="fr-FR" />
  507.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á d├⌐finir '%registry_value%' pour ├¬tre ex├⌐cut├⌐ ├á chaque d├⌐marrage de l'ordinateur" locale="fr-FR" />
  508.                     <messages type="osfwPresentText" value="%process_name% πüîπÇüπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½ '%registry_value%' πéÆσ«ƒΦíîπüÖπéïπéêπüåπü½Φ¿¡σ«Üπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  509.                     <messages type="osfwPastText" value="%process_name% πüîπÇüπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½ '%registry_value%' πéÆσ«ƒΦíîπüÖπéïπéêπüåπü½Φ¿¡σ«Üπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  510.                     <messages type="osfwBlockedText" value="%process_name% πüîπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½ '%registry_value%' πéÆσ«ƒΦíîπüÖπéïπéêπüåπü½Φ¿¡σ«ÜπüÖπéïπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  511.                     <messages type="osfwPresentText" value="%process_name% est├í intentando configurar el valor '%registry_value%' para que se ejecute cada vez que se inicie el equipo" locale="es-ES" />
  512.                     <messages type="osfwPastText" value="%process_name% ha intentado configurar el valor '%registry_value%' para que se ejecute cada vez que se inicie el equipo" locale="es-ES" />
  513.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% configure el valor '%registry_value%' para que se ejecute cada vez que se inicie el equipo" locale="es-ES" />
  514.                     <messages type="osfwPresentText" value="%process_name% sta cercando di impostare '%registry_value%' in modo che venga eseguito all'avvio del computer" locale="it-IT" />
  515.                     <messages type="osfwPastText" value="%process_name% ha cercato di impostare '%registry_value%' in modo che venga eseguito all'avvio del computer" locale="it-IT" />
  516.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di impostare '%registry_value%' in modo che venga eseguito all'avvio del computer" locale="it-IT" />
  517.                 </customevent>
  518.                 <customevent id="4002" severityref="suspicious" >
  519.                     <messages type="osfwPresentText" value="%process_name% is trying to unload the driver: %driver%" locale="en-US" />
  520.                     <messages type="osfwPastText" value="%process_name% was trying to unload the driver: %driver%" locale="en-US" />
  521.                     <messages type="osfwBlockedText" value="%process_name% was prevented from unloading the driver: %driver%" locale="en-US" />
  522.                     <messages type="osfwPresentText" value="%process_name% versucht, den folgenden Treiber zu entladen: %driver%" locale="de-DE" />
  523.                     <messages type="osfwPastText" value="%process_name% hat versucht, den folgenden Treiber zu entladen: %driver%" locale="de-DE" />
  524.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, den folgenden Treiber zu entladen: %driver%" locale="de-DE" />
  525.                     <messages type="osfwPresentText" value="%process_name% tente de d├⌐charger le pilote : %driver%" locale="fr-FR" />
  526.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de d├⌐charger le pilote : %driver%" locale="fr-FR" />
  527.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á d├⌐charger le pilote : %driver%" locale="fr-FR" />
  528.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπéÆπéóπâ│πâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %driver%" locale="jp-JA" />
  529.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπéÆπéóπâ│πâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  530.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπéÆπéóπâ│πâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  531.                     <messages type="osfwPresentText" value="%process_name% est├í intentando descargar el controlador: %driver%" locale="es-ES" />
  532.                     <messages type="osfwPastText" value="%process_name% ha intentado descargar el controlador: %driver%" locale="es-ES" />
  533.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% descargue el controlador: %driver%" locale="es-ES" />
  534.                     <messages type="osfwPresentText" value="%process_name% sta cercando di scaricare il driver seguente: %driver%" locale="it-IT" />
  535.                     <messages type="osfwPastText" value="%process_name% ha cercato di scaricare il driver seguente: %driver%" locale="it-IT" />
  536.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di scaricare il driver seguente: %driver%" locale="it-IT" />
  537.                 </customevent>
  538.                 <customevent id="4003" severityref="suspicious" >
  539.                     <messages type="osfwPresentText" value="%process_name% is trying to connect to the driver: %driver%" locale="en-US" />
  540.                     <messages type="osfwPastText" value="%process_name% was trying to connect to the driver: %driver%" locale="en-US" />
  541.                     <messages type="osfwBlockedText" value="%process_name% was prevented from connecting to the driver: %driver%" locale="en-US" />
  542.                     <messages type="osfwPresentText" value="%process_name% versucht, eine Verbindung zu dem folgenden Treiber herzustellen: %driver%" locale="de-DE" />
  543.                     <messages type="osfwPastText" value="%process_name% hat versucht, eine Verbindung zu dem folgenden Treiber herzustellen: %driver%" locale="de-DE" />
  544.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, eine Verbindung zu dem folgenden Treiber herzustellen: %driver%" locale="de-DE" />
  545.                     <messages type="osfwPresentText" value="%process_name% tente de se connecter au pilote : %driver%" locale="fr-FR" />
  546.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de se connecter au pilote : %driver%" locale="fr-FR" />
  547.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á se connecter au pilote : %driver%" locale="fr-FR" />
  548.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπü½µÄÑτ╢Üπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %driver%" locale="jp-JA" />
  549.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπü½µÄÑτ╢Üπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  550.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâëπâ⌐πéñπâÉπü½µÄÑτ╢Üπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %driver%" locale="jp-JA" />
  551.                     <messages type="osfwPresentText" value="%process_name% est├í intentando conectarse al controlador: %driver%" locale="es-ES" />
  552.                     <messages type="osfwPastText" value="%process_name% ha intentado conectarse al controlador: %driver%" locale="es-ES" />
  553.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% se conecte al controlador: %driver%" locale="es-ES" />
  554.                     <messages type="osfwPresentText" value="%process_name% sta cercando di connettersi al driver seguente: %driver%" locale="it-IT" />
  555.                     <messages type="osfwPastText" value="%process_name% ha cercato di connettersi al driver seguente: %driver%" locale="it-IT" />
  556.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di connettersi al driver seguente: %driver%" locale="it-IT" />
  557.                 </customevent>
  558.                 <customevent id="4004" severityref="suspicious" >
  559.                     <messages type="osfwPresentText" value="%process_name% may be trying to prevent '%registry_value%' from running each time your computer is started by modifying the registry key: %registry_key%" locale="en-US" />
  560.                     <messages type="osfwPastText" value="%process_name% may have been trying to prevent '%registry_value%' from running each time your computer is started by modifying the registry key: %registry_key%" locale="en-US" />
  561.                     <messages type="osfwBlockedText" value="%process_name% was prevented from modifying registry key: %registry_key%" locale="en-US" />
  562.                     <messages type="osfwPresentText" value="%process_name% versucht m├╢glicherweise, '%registry_value%' durch Modifizierung des folgenden Registrierungsschl├╝ssels daran zu hindern, dass es bei jedem Computerstart ausgef├╝hrt wird: %registry_key%" locale="de-DE" />
  563.                     <messages type="osfwPastText" value="%process_name% hat m├╢glicherweise versucht, '%registry_value%' durch Modifizierung des folgenden Registrierungsschl├╝ssels daran zu hindern, dass es bei jedem Computerstart ausgef├╝hrt: %registry_key%" locale="de-DE" />
  564.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, den folgenden Registrierungsschl├╝ssel zu ├ñndern: %registry_key%" locale="de-DE" />
  565.                     <messages type="osfwPresentText" value="%process_name% tente d'emp├¬cher '%registry_value%' de s'ex├⌐cuter ├á chaque d├⌐marrage de l'ordinateur en modifiant la cl├⌐ de registre : %registry_key%" locale="fr-FR" />
  566.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ d'emp├¬cher '%registry_value%' de s'ex├⌐cuter ├á chaque d├⌐marrage de l'ordinateur en modifiant la cl├⌐ de registre : %registry_key%" locale="fr-FR" />
  567.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifi├⌐ la cl├⌐ de registre suivante : %registry_key%" locale="fr-FR" />
  568.                     <messages type="osfwPresentText" value="%process_name% πüîπÇüπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½ '%registry_value%' πüîσ«ƒΦíîπüòπéîπü¬πüäπéêπüåπü½πüÖπéïπüƒπéüπü½πÇüµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπéêπüåπü¿πüùπüªπüäπéïσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖ: %registry_key%" locale="jp-JA" />
  569.                     <messages type="osfwPastText" value="%process_name% πüîπÇüπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½ '%registry_value%' πüîσ«ƒΦíîπüòπéîπü¬πüäπéêπüåπü½πüÖπéïπüƒπéüπü½πÇüµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπéêπüåπü¿πüùπüªπüäπüƒσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖ: %registry_key%" locale="jp-JA" />
  570.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπ⬠πé¡πâ╝πéƵ¢╕πüìµ¢┐πüêπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %registry_key%" locale="jp-JA" />
  571.                     <messages type="osfwPresentText" value="%process_name% est├í intentando impedir que el valor '%registry_value%' se ejecute cada vez que se inicie el equipo mediante la modificaci├│n de la clave de registro: %registry_key%" locale="es-ES" />
  572.                     <messages type="osfwPastText" value="%process_name% ha intentado impedir que el valor '%registry_value%' se ejecute cada vez que se inicie el equipo mediante la modificaci├│n de la clave de registro: %registry_key%" locale="es-ES" />
  573.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% modifique la clave de registro: %registry_key%" locale="es-ES" />
  574.                     <messages type="osfwPresentText" value="Probabile tentativo da parte di %process_name% di bloccare l'esecuzione di '%registry_value%' all'avvio del computer modificando la chiave di registro seguente: %registry_key%" locale="it-IT" />
  575.                     <messages type="osfwPastText" value="Probabile tentativo da parte di %process_name% di bloccare l'esecuzione di '%registry_value%' all'avvio del computer modificando la chiave di registro seguente: %registry_key%" locale="it-IT" />
  576.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di modificare la chiave di registro seguente: %registry_key%" locale="it-IT" />
  577.                 </customevent>
  578.                 <customevent id="4005" severityref="suspicious" >
  579.                     <messages type="osfwPresentText" value="%process_name% is trying to modify the registry value:  %registry_key%\%registry_value%" locale="en-US" />
  580.                     <messages type="osfwPastText" value="%process_name% was trying to modify the registry value:  %registry_key%\%registry_value%" locale="en-US" />
  581.                     <messages type="osfwBlockedText" value="%process_name% was prevented from modifying the registry value:  %registry_key%\%registry_value%" locale="en-US" />
  582.                     <messages type="osfwPresentText" value="%process_name% versucht, den folgenden Registrierungswert zu ├ñndern:  %registry_key%\%registry_value%" locale="de-DE" />
  583.                     <messages type="osfwPastText" value="%process_name% hat versucht, den folgenden Registrierungswert zu ├ñndern:  %registry_key%\%registry_value%" locale="de-DE" />
  584.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, den folgenden Registrierungswert zu ├ñndern:  %registry_key%\%registry_value%" locale="de-DE" />
  585.                     <messages type="osfwPresentText" value="%process_name% tente de modifier la valeur de registre :  %registry_key%\%registry_value%" locale="fr-FR" />
  586.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier la valeur de registre :  %registry_key%\%registry_value%" locale="fr-FR" />
  587.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifi├⌐ la valeur de registre suivante :  %registry_key%\%registry_value%" locale="fr-FR" />
  588.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπâ¬σÇñπéƵ¢╕πüìµ¢┐πüêπéêπüåπü¿πüùπüªπüäπü╛πüÖ:  %registry_key%\%registry_value%" locale="jp-JA" />
  589.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπâ¬σÇñπéƵ¢╕πüìµ¢┐πüêπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ:  %registry_key%\%registry_value%" locale="jp-JA" />
  590.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâ¼πé╕πé╣πâêπâ¬σÇñπéƵ¢╕πüìµ¢┐πüêπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ:  %registry_key%\%registry_value%" locale="jp-JA" />
  591.                     <messages type="osfwPresentText" value="%process_name% est├í intentando modificar el valor de registro:  %registry_key%\%registry_value%" locale="es-ES" />
  592.                     <messages type="osfwPastText" value="%process_name% ha intentado modificar el valor de registro:  %registry_key%\%registry_value%" locale="es-ES" />
  593.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% modifique el valor de registro:  %registry_key%\%registry_value%" locale="es-ES" />
  594.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare il valore di registro seguente:  %registry_key%\%registry_value%" locale="it-IT" />
  595.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare il valore di registro seguente:  %registry_key%\%registry_value%" locale="it-IT" />
  596.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di modificare il valore registro seguente:  %registry_key%\%registry_value%" locale="it-IT" />
  597.                 </customevent>
  598.                 <customevent id="4006" severityref="suspicious" >
  599.                     <messages type="osfwPresentText" value="%process_name% is trying to change your browser search settings" locale="en-US" />
  600.                     <messages type="osfwPastText" value="%process_name% was trying to change your browser search settings" locale="en-US" />
  601.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing your browser search settings" locale="en-US" />
  602.                     <messages type="osfwPresentText" value="%process_name% versucht, die Sucheinstellungen Ihres Browsers zu ├ñndern." locale="de-DE" />
  603.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Sucheinstellungen Ihres Browsers zu ├ñndern." locale="de-DE" />
  604.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Sucheinstellungen Ihres Browsers zu ├ñndern." locale="de-DE" />
  605.                     <messages type="osfwPresentText" value="%process_name% tente de modifier les param├¿tres de recherche de votre navigateur" locale="fr-FR" />
  606.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier les param├¿tres de recherche de votre navigateur" locale="fr-FR" />
  607.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier les param├¿tres de recherche de votre navigateur" locale="fr-FR" />
  608.                     <messages type="osfwPresentText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«µñ£τ┤óΦ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  609.                     <messages type="osfwPastText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«µñ£τ┤óΦ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  610.                     <messages type="osfwBlockedText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«µñ£τ┤óΦ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  611.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la configuraci├│n de b├║squeda del navegador" locale="es-ES" />
  612.                     <messages type="osfwPastText" value="%process_name% ha intentado cambiar la configuraci├│n de b├║squeda del navegador" locale="es-ES" />
  613.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la configuraci├│n de b├║squeda del navegador" locale="es-ES" />
  614.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare le impostazioni di ricerca del browser" locale="it-IT" />
  615.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare le impostazioni di ricerca del browser" locale="it-IT" />
  616.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di modificare le impostazioni di ricerca del browser" locale="it-IT" />
  617.                 </customevent>
  618.                 <customevent id="4007" severityref="suspicious" >
  619.                     <messages type="osfwPresentText" value="%process_name% is trying to change your browser home page" locale="en-US" />
  620.                     <messages type="osfwPastText" value="%process_name% was trying to change your browser home page" locale="en-US" />
  621.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing your browser home page" locale="en-US" />
  622.                     <messages type="osfwPresentText" value="%process_name% versucht, die Startseite Ihres Browsers zu ├ñndern." locale="de-DE" />
  623.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Startseite Ihres Browsers zu ├ñndern." locale="de-DE" />
  624.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Startseite Ihres Browsers zu ├ñndern." locale="de-DE" />
  625.                     <messages type="osfwPresentText" value="%process_name% tente de modifier la page d'accueil de votre navigateur" locale="fr-FR" />
  626.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier la page d'accueil de votre navigateur" locale="fr-FR" />
  627.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier la page d'accueil de votre navigateur" locale="fr-FR" />
  628.                     <messages type="osfwPresentText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«πâ¢πâ╝πâá πâÜπâ╝πé╕πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  629.                     <messages type="osfwPastText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«πâ¢πâ╝πâá πâÜπâ╝πé╕πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  630.                     <messages type="osfwBlockedText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«πâ¢πâ╝πâá πâÜπâ╝πé╕πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  631.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la p├ígina de inicio del navegador" locale="es-ES" />
  632.                     <messages type="osfwPastText" value="%process_name% ha intentado cambiar la p├ígina de inicio del navegador" locale="es-ES" />
  633.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la p├ígina de inicio del navegador" locale="es-ES" />
  634.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare la pagina iniziale del browser" locale="it-IT" />
  635.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare la pagina iniziale del browser" locale="it-IT" />
  636.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di modificare la pagina iniziale del browser" locale="it-IT" />
  637.                 </customevent>
  638.                 <customevent id="4008" severityref="suspicious">
  639.                     <messages type="osfwPresentText" value="%process_name% is trying to change your browser main settings" locale="en-US"/>
  640.                     <messages type="osfwPastText" value="%process_name% was trying to change your browser main settings" locale="en-US"/>
  641.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing your browser main settings" locale="en-US"/>
  642.                     <messages type="osfwPresentText" value="%process_name% versucht, die Haupteinstellungen Ihres Browsers zu ├ñndern." locale="de-DE"/>
  643.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Haupteinstellungen Ihres Browsers zu ├ñndern." locale="de-DE"/>
  644.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Haupteinstellungen Ihres Browsers zu ├ñndern." locale="de-DE"/>
  645.                     <messages type="osfwPresentText" value="%process_name% tente de modifier vos principaux param├¿tres de navigateur" locale="fr-FR"/>
  646.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier vos principaux param├¿tres de navigateur" locale="fr-FR"/>
  647.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier vos principaux param├¿tres de navigateur" locale="fr-FR"/>
  648.                     <messages type="osfwPresentText" value="%process_name% πü»πâûπâ⌐πéªπé╢πü«πâíπéñπâ│Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA"/>
  649.                     <messages type="osfwPastText" value="%process_name% πü»πâûπâ⌐πéªπé╢πü«πâíπéñπâ│Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA"/>
  650.                     <messages type="osfwBlockedText" value="%process_name% πü»πâûπâ⌐πéªπé╢πü«πâíπéñπâ│Φ¿¡σ«ÜπéÆσñëµ¢┤πüºπüìπü╛πü¢πéôπüºπüùπüƒ" locale="jp-JA"/>
  651.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la configuraci├│n principal del navegador" locale="es-ES"/>
  652.                     <messages type="osfwPastText" value="%process_name% estaba intentado cambiar la configuraci├│n principal navegador" locale="es-ES"/>
  653.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la configuraci├│n principal del navegador" locale="es-ES"/>
  654.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare le impostazioni principali del browser" locale="it-IT"/>
  655.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare le impostazioni principali del browser" locale="it-IT"/>
  656.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di modificare le impostazioni principali del browser" locale="it-IT"/>
  657.                 </customevent>
  658.                 <customevent id="4009" severityref="suspicious">
  659.                     <messages type="osfwPresentText" value="%process_name% is trying to change the system behavior for executable files. This may allow a suspicous program to start every time you run any application." locale="en-US" />
  660.                     <messages type="osfwPastText" value="%process_name% was trying to change the system behavior for executable files. This may allow a suspicous program to start every time you run any application." locale="en-US" />
  661.                     <messages type="osfwBlockedText" value="%process_name% was prevented from the changing system behavior for executable files. It will not allow a suspicous program to start every time you run any application." locale="en-US" />
  662.                     <messages type="osfwPresentText" value="%process_name% versucht, das Systemverhalten f├╝r Programmdateien zu ├ñndern. So kann m├╢glicherweise ein verd├ñchtiges Programm bei jeder Ausf├╝hrung einer Anwendung gestartet werden." locale="de-DE" />
  663.                     <messages type="osfwPastText" value="%process_name% hat versucht, das Systemverhalten f├╝r Programmdateien zu ├ñndern. So kann m├╢glicherweise ein verd├ñchtiges Programm bei jeder Ausf├╝hrung einer Anwendung gestartet werden." locale="de-DE" />
  664.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, das Systemverhalten f├╝r Programmdateien zu ├ñndern. Es verhindert, dass ein verd├ñchtiges Programm bei jeder Ausf├╝hrung einer Anwendung gestartet ist." locale="de-DE" />
  665.                     <messages type="osfwPresentText" value="%process_name% tente de modifier le comportement du syst├¿me pour les fichiers ex├⌐cutables. Cette op├⌐ration permettra peut-├¬tre le lancement d'un programme suspect chaque fois que vous ex├⌐cutez une application." locale="fr-FR" />
  666.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier le comportement du syst├¿me pour les fichiers ex├⌐cutables. Cette op├⌐ration permettra peut-├¬tre le lancement d'un programme suspect chaque fois que vous ex├⌐cutez une application." locale="fr-FR" />
  667.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier le comportement du syst├¿me pour les fichiers ex├⌐cutables. Cette op├⌐ration emp├¬chera le lancement d'un programme suspect chaque fois que vous ex├⌐cutez une application." locale="fr-FR" />
  668.                     <messages type="osfwPresentText" value="%process_name% πü»σ«ƒΦíîσÅ»Φâ╜πâòπéíπéñπâ½πü½ΘûóπüÖπéïπé╖πé╣πâåπâáσïòΣ╜£πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖπÇéπüôπéîπü½πéêπéèπÇüπéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│σ«ƒΦíîµÖéπü½τûæπéÅπüùπüäπâùπâ¡πé░πâ⌐πâáπüîΦ╡╖σïòπüÖπéïσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  669.                     <messages type="osfwPastText" value="%process_name% πü»σ«ƒΦíîσÅ»Φâ╜πâòπéíπéñπâ½πü½ΘûóπüÖπéïπé╖πé╣πâåπâáσïòΣ╜£πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒπÇéπüôπéîπü½πéêπéèπÇüπéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│σ«ƒΦíîµÖéπü½τûæπéÅπüùπüäπâùπâ¡πé░πâ⌐πâáπüîΦ╡╖σïòπüÖπéïσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  670.                     <messages type="osfwBlockedText" value="%process_name% πü»σ«ƒΦíîσÅ»Φâ╜πâòπéíπéñπâ½πü½ΘûóπüÖπéïπé╖πé╣πâåπâáσïòΣ╜£πéÆσñëµ¢┤πüºπüìπü╛πü¢πéôπüºπüùπüƒπÇéπüùπüƒπüîπüúπüªπÇüπéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│σ«ƒΦíîµÖéπü½τûæπéÅπüùπüäπâùπâ¡πé░πâ⌐πâáπüîΦ╡╖σïòπüÖπéïπüôπü¿πü»πüéπéèπü╛πü¢πéôπÇé" locale="jp-JA" />
  671.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la actividad del sistema para los archivos ejecutables. Esto puede permitir a un programa sospechoso reiniciarse cada vez que ejecute una aplicaci├│n." locale="es-ES" />
  672.                     <messages type="osfwPastText" value="%process_name% estaba intentando cambiar la actividad del sistema para los archivos ejecutables. Esto puede permitir a un programa sospechoso reiniciarse cada vez que ejecute una aplicaci├│n." locale="es-ES" />
  673.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la actividad del sistema para los archivos ejecutables. Esto no permitir├í a ning├║n programa sospechoso reiniciarse cada vez que ejecute una aplicaci├│n." locale="es-ES" />
  674.                     <messages type="osfwPresentText" value="%process_name% sta cercando di cambiare il comportamento del sistema relativamente ai file eseguibili. Questo potrebbe consentire lΓÇÖavvio di un programma sospetto allΓÇÖavvio di unΓÇÖapplicazione." locale="it-IT" />
  675.                     <messages type="osfwPastText" value="%process_name% ha cercato di cambiare il comportamento del sistema relativamente ai file eseguibili. Questo potrebbe consentire lΓÇÖavvio di un programma sospetto allΓÇÖavvio di unΓÇÖapplicazione." locale="it-IT" />
  676.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di cambiare il comportamento del sistema relativamente ai file eseguibili. Questo impedir├á lΓÇÖavvio di un programma sospetto allΓÇÖavvio di unΓÇÖapplicazione." locale="it-IT" />
  677.                 </customevent>
  678.                 <customevent id="4010" severityref="suspicious" >
  679.                     <messages type="osfwPresentText" value="%process_name% is trying to install a library that will be loaded each time your system is started" locale="en-US" />
  680.                     <messages type="osfwPastText" value="%process_name% was trying to install a library that would be loaded each time your system is started" locale="en-US" />
  681.                     <messages type="osfwBlockedText" value="%process_name% was prevented from installing a library that would be loaded each time your system is started" locale="en-US" />
  682.                     <messages type="osfwPresentText" value="%process_name% versucht, eine Bibliothek zu installieren, die bei jedem Systemstart geladen wird." locale="de-DE" />
  683.                     <messages type="osfwPastText" value="%process_name% hat versucht, eine Bibliothek zu installieren, die bei jedem Systemstart geladen wird." locale="de-DE" />
  684.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, eine Bibliothek zu installieren, die bei jedem Systemstart geladen wird." locale="de-DE" />
  685.                     <messages type="osfwPresentText" value="%process_name% tente d'installer une biblioth├¿que qui devra ├¬tre charg├⌐e ├á chaque d├⌐marrage du syst├¿me" locale="fr-FR" />
  686.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ d'installer une biblioth├¿que devant ├¬tre charg├⌐e ├á chaque d├⌐marrage du syst├¿me" locale="fr-FR" />
  687.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á installer une biblioth├¿que devant ├¬tre charg├⌐e ├á chaque d├⌐marrage du syst├¿me" locale="fr-FR" />
  688.                     <messages type="osfwPresentText" value="%process_name% πü»πé╖πé╣πâåπâáΦ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπâ⌐πéñπâûπâ⌐πâ¬πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  689.                     <messages type="osfwPastText" value="%process_name% πü»πé╖πé╣πâåπâáΦ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπâ⌐πéñπâûπâ⌐πâ¬πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  690.                     <messages type="osfwBlockedText" value="%process_name% πü»πé╖πé╣πâåπâáΦ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπâ⌐πéñπâûπâ⌐πâ¬πéÆπéñπâ│πé╣πâêπâ╝πâ½πüºπüìπü╛πü¢πéôπüºπüùπüƒ" locale="jp-JA" />
  691.                     <messages type="osfwPresentText" value="%process_name% est├í intentando instalar una biblioteca que se cargar├í cada vez que se inicie el sistema" locale="es-ES" />
  692.                     <messages type="osfwPastText" value="%process_name% estaba intentando instalar una biblioteca que se cargara cada vez que se iniciara el sistema" locale="es-ES" />
  693.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% intente instalar una biblioteca que se cargara cada vez que se iniciara el sistema" locale="es-ES" />
  694.                     <messages type="osfwPresentText" value="%process_name% sta cercando di installare una libreria che sar├á caricata a ogni avvio del sistema" locale="it-IT" />
  695.                     <messages type="osfwPastText" value="%process_name% ha cercato di installare una libreria che sarebbe stata caricata a ogni avvio del sistema" locale="it-IT" />
  696.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di installare una libreria che sarebbe stata caricata a ogni avvio del sistema" locale="it-IT" />
  697.                 </customevent>
  698.                 <customevent id="4011" severityref="suspicious" >
  699.                     <messages type="osfwPresentText" value="%process_name% is trying to prevent a library from being loaded each time your system is started" locale="en-US" />
  700.                     <messages type="osfwPastText" value="%process_name% was trying to prevent a library from being each time your system is started" locale="en-US" />
  701.                     <messages type="osfwBlockedText" value="%process_name% was prevented from trying to prevent a library from being loaded each time your system is started" locale="en-US" />
  702.                     <messages type="osfwPresentText" value="%process_name% versucht zu verhindern, dass eine Bibliothek bei jedem Systemstart geladen wird." locale="de-DE" />
  703.                     <messages type="osfwPastText" value="%process_name% hat versucht zu verhindern, dass eine Bibliothek bei jedem Systemstart geladen wird." locale="de-DE" />
  704.                     <messages type="osfwBlockedText" value="%process_name% wurde am Versuch gehindert, zu verhindern, dass eine Bibliothek bei jedem Systemstart geladen wird." locale="de-DE" />
  705.                     <messages type="osfwPresentText" value="%process_name% tente d'emp├¬cher le chargement d'une biblioth├¿que ├á chaque d├⌐marrage du syst├¿me" locale="fr-FR" />
  706.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ d'emp├¬cher le chargement d'une biblioth├¿que ├á chaque d├⌐marrage du syst├¿me" locale="fr-FR" />
  707.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á emp├¬cher le chargement d'une biblioth├¿que ├á chaque d├⌐marrage du syst├¿me" locale="fr-FR" />
  708.                     <messages type="osfwPresentText" value="%process_name% πü»πé╖πé╣πâåπâáΦ╡╖σïòµÖéπü½πâ⌐πéñπâûπâ⌐πâ¬πüîπâ¡πâ╝πâëπüòπéîπéïπü«πéÆΘÿ▓µ¡óπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  709.                     <messages type="osfwPastText" value="%process_name% πü»πé╖πé╣πâåπâáΦ╡╖σïòµÖéπü½πâ⌐πéñπâûπâ⌐πâ¬πüîπâ¡πâ╝πâëπüòπéîπéïπü«πéÆΘÿ▓µ¡óπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  710.                     <messages type="osfwBlockedText" value="%process_name% πü»πé╖πé╣πâåπâáΦ╡╖σïòµÖéπü½πâ⌐πéñπâûπâ⌐πâ¬πüîπâ¡πâ╝πâëπüòπéîπéïπü«πéÆΘÿ▓µ¡óπüºπüìπü╛πü¢πéôπüºπüùπüƒ" locale="jp-JA" />
  711.                     <messages type="osfwPresentText" value="%process_name% est├í intentando evitar que se cargue ninguna biblioteca cada vez que se inicie el sistema" locale="es-ES" />
  712.                     <messages type="osfwPastText" value="%process_name% estaba intentando evitar que se cargara ninguna biblioteca cada vez que se iniciara el sistema" locale="es-ES" />
  713.                     <messages type="osfwBlockedText" value="Se ha evitado que %process_name% intente evitar que se cargue ninguna biblioteca cada vez que se inicie el sistema" locale="es-ES" />
  714.                     <messages type="osfwPresentText" value="%process_name% sta cercando di impedire il caricamento di una libreria a ogni avvio del sistema" locale="it-IT" />
  715.                     <messages type="osfwPastText" value="%process_name% ha cercato di impedire il caricamento di una libreria a ogni avvio del sistema" locale="it-IT" />
  716.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di bloccare il caricamento di una libreria a ogni avvio del sistema" locale="it-IT" />
  717.                 </customevent>
  718.                 <customevent id="4012" severityref="suspicious" >
  719.                     <messages type="osfwPresentText" value="%process_name% is trying to install a library that will be loaded any time an application is started" locale="en-US" />
  720.                     <messages type="osfwPastText" value="%process_name% was trying to install a library that would be loaded any time an application is started" locale="en-US" />
  721.                     <messages type="osfwBlockedText" value="%process_name% was prevented from installing a library that would be loaded any time an application is started" locale="en-US" />
  722.                     <messages type="osfwPresentText" value="%process_name% versucht, eine Bibliothek zu installieren, die bei jedem Start einer Anwendung geladen wird." locale="de-DE" />
  723.                     <messages type="osfwPastText" value="%process_name% hat versucht, eine Bibliothek zu installieren, die bei jedem Start einer Anwendung geladen wird." locale="de-DE" />
  724.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, eine Bibliothek zu installieren, die bei jedem Start einer Anwendung geladen wird." locale="de-DE" />
  725.                     <messages type="osfwPresentText" value="%process_name% tente d'installer une biblioth├¿que qui devra ├¬tre charg├⌐e ├á chaque lancement d'application" locale="fr-FR" />
  726.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ d'installer une biblioth├¿que devant ├¬tre charg├⌐e ├á chaque lancement d'application" locale="fr-FR" />
  727.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á installer une biblioth├¿que devant ├¬tre charg├⌐e ├á chaque lancement d'application" locale="fr-FR" />
  728.                     <messages type="osfwPresentText" value="%process_name% πü»πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│Φ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπâ⌐πéñπâûπâ⌐πâ¬πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  729.                     <messages type="osfwPastText" value="%process_name% πü»πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│Φ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπâ⌐πéñπâûπâ⌐πâ¬πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  730.                     <messages type="osfwBlockedText" value="%process_name% πü»πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│Φ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπâ⌐πéñπâûπâ⌐πâ¬πéÆπéñπâ│πé╣πâêπâ╝πâ½πüºπüìπü╛πü¢πéôπüºπüùπüƒ" locale="jp-JA" />
  731.                     <messages type="osfwPresentText" value="%process_name% est├í intentando instalar una biblioteca que se cargara cada vez que se iniciara una aplicaci├│n" locale="es-ES" />
  732.                     <messages type="osfwPastText" value="%process_name% estaba intentando instalar una biblioteca que se cargara cada vez que se iniciara una aplicaci├│n" locale="es-ES" />
  733.                     <messages type="osfwBlockedText" value="Se ha evitado que %process_name% instalara una biblioteca que se cargara cada vez que se iniciara una aplicaci├│n" locale="es-ES" />
  734.                     <messages type="osfwPresentText" value="%process_name% sta cercando di installare una libreria che sar├á caricata allΓÇÖavvio di unΓÇÖapplicazione" locale="it-IT" />
  735.                     <messages type="osfwPastText" value="%process_name% ha cercato di installare una libreria che sarebbe stata caricata allΓÇÖavvio di unΓÇÖapplicazione" locale="it-IT" />
  736.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di installare una libreria che sarebbe stata caricata allΓÇÖavvio di unΓÇÖapplicazione" locale="it-IT" />
  737.                 </customevent>
  738.                 <customevent id="4013" severityref="suspicious" >
  739.                     <messages type="osfwPresentText" value="%process_name% is trying to uninstall a library that should be loaded any time an application is started" locale="en-US" />
  740.                     <messages type="osfwPastText" value="%process_name% was trying to uninstall a library that should be loaded any time an application is started" locale="en-US" />
  741.                     <messages type="osfwBlockedText" value="%process_name% was prevented from uninstalling a library that should be loaded any time an application is started" locale="en-US" />
  742.                     <messages type="osfwPresentText" value="%process_name% versucht, eine Bibliothek zu deinstallieren, die bei jedem Start einer Anwendung geladen werden muss." locale="de-DE" />
  743.                     <messages type="osfwPastText" value="%process_name% hat versucht, eine Bibliothek zu deinstallieren, die bei jedem Start einer Anwendung geladen werden muss." locale="de-DE" />
  744.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, eine Bibliothek zu deinstallieren, die bei jedem Start einer Anwendung geladen werden muss." locale="de-DE" />
  745.                     <messages type="osfwPresentText" value="%process_name% tente de d├⌐sinstaller une biblioth├¿que devant ├¬tre charg├⌐e ├á chaque lancement d'application" locale="fr-FR" />
  746.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de d├⌐sinstaller une biblioth├¿que devant ├¬tre charg├⌐e ├á chaque lancement d'application" locale="fr-FR" />
  747.                     <messages type="osfwBlockedText" value="%process_name% n'as pas r├⌐ussi ├á d├⌐sinstaller une biblioth├¿que devant ├¬tre charg├⌐e ├á chaque lancement d'application" locale="fr-FR" />
  748.                     <messages type="osfwPresentText" value="%process_name% πü»πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│Φ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπü╣πüìπâ⌐πéñπâûπâ⌐πâ¬πéÆπéóπâ│πéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  749.                     <messages type="osfwPastText" value="%process_name% πü»πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│Φ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπü╣πüìπâ⌐πéñπâûπâ⌐πâ¬πéÆπéóπâ│πéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  750.                     <messages type="osfwBlockedText" value="%process_name% πü»πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│Φ╡╖σïòµÖéπü½πâ¡πâ╝πâëπüòπéîπéïπü╣πüìπâ⌐πéñπâûπâ⌐πâ¬πéÆπéóπâ│πéñπâ│πé╣πâêπâ╝πâ½πüºπüìπü╛πü¢πéôπüºπüùπüƒ" locale="jp-JA" />
  751.                     <messages type="osfwPresentText" value="%process_name% est├í intentando desinstalar una biblioteca que se deber├¡a cargar cada vez que se iniciara una aplicaci├│n" locale="es-ES" />
  752.                     <messages type="osfwPastText" value="%process_name% estaba intentando desinstalar una biblioteca que se deber├¡a cargar cada vez que se iniciara una aplicaci├│n" locale="es-ES" />
  753.                     <messages type="osfwBlockedText" value="Se ha evitado que %process_name% desinstalara una biblioteca que se deber├¡a cargar cada vez que se iniciara una aplicaci├│n" locale="es-ES" />
  754.                     <messages type="osfwPresentText" value="%process_name% sta cercando di disinstallare una libreria che deve essere caricata allΓÇÖavvio di unΓÇÖapplicazione" locale="it-IT" />
  755.                     <messages type="osfwPastText" value="%process_name% ha cercato di disinstallare una libreria che avrebbe dovuto essere caricata allΓÇÖavvio di unΓÇÖapplicazione" locale="it-IT" />
  756.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di disinstallare una libreria che avrebbe dovuto essere caricata allΓÇÖavvio di unΓÇÖapplicazione" locale="it-IT" />
  757.                 </customevent>
  758.                 <customevent id="4014" severityref="suspicious" >
  759.                     <messages type="osfwPresentText" value="%process_name% is trying to change the desktop background. The new background may contain a Web page with executable code." locale="en-US" />
  760.                     <messages type="osfwPastText" value="%process_name% was trying to change the desktop background. The new background may contain a Web page with executable code." locale="en-US" />
  761.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing the desktop background. The new background may contain a Web page with executable code." locale="en-US" />
  762.  
  763.                     <messages type="osfwPresentText" value="%process_name% versucht, den Hintergrund des Desktops zu ├ñndern. Der neue Hintergrund enth├ñlt m├╢glicherweise eine Webseite mit ausf├╝hrbarem Code." locale="de-DE" />
  764.                     <messages type="osfwPastText" value="%process_name% hat versucht, den Hintergrund des Desktops zu ├ñndern. Der neue Hintergrund enth├ñlt m├╢glicherweise eine Webseite mit ausf├╝hrbarem Code." locale="de-DE" />
  765.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, den Hintergrund des Desktops zu ├ñndern. Der neue Hintergrund enth├ñlt m├╢glicherweise eine Webseite mit ausf├╝hrbarem Code." locale="de-DE" />
  766.  
  767.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar el fondo de escritorio. El nuevo fondo puede contener una p├ígina Web con un c├│digo ejecutable." locale="es-ES" />
  768.                     <messages type="osfwPastText" value="%process_name% estaba intentando cambiar el fondo de escritorio. El nuevo fondo puede contener una p├ígina Web con un c├│digo ejecutable." locale="es-ES" />
  769.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambiara el fondo de escritorio. El nuevo fondo puede contener una p├ígina Web con un c├│digo ejecutable." locale="es-ES" />
  770.  
  771.                     <messages type="osfwPresentText" value="%process_name% tente de changer l'arri├¿re-plan du bureau. Le nouvel arri├¿re-plan peut contenir une page Web avec un code ex├⌐cutable." locale="fr-FR" />
  772.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de changer l'arri├¿re-plan du bureau. Le nouvel arri├¿re-plan peut contenir une page Web avec un code ex├⌐cutable." locale="fr-FR" />
  773.                     <messages type="osfwBlockedText" value="%process_name% n'a pas ├⌐t├⌐ autoris├⌐ ├á changer l'arri├¿re-plan du bureau. Le nouvel arri├¿re-plan peut contenir une page Web avec un code ex├⌐cutable." locale="fr-FR" />
  774.  
  775.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare lo sfondo del desktop. Il nuovo sfondo potrebbe contenere una pagina Web con codice eseguibile." locale="it-IT" />
  776.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare lo sfondo del desktop. Il nuovo sfondo potrebbe contenere una pagina Web con codice eseguibile." locale="it-IT" />
  777.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di modificare lo sfondo del desktop. Il nuovo sfondo potrebbe contenere una pagina Web con codice eseguibile." locale="it-IT" />
  778.  
  779.                     <messages type="osfwPresentText" value="%process_name% πü»πâçπé╣πé»πâêπââπâù πâÉπââπé»πé░πâ⌐πéªπâ│πâëπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖπÇéµû░πüùπüäπâÉπââπé»πé░πâ⌐πéªπâ│πâëπü»σ«ƒΦíîσÅ»Φâ╜πé│πâ╝πâëπéÆσɽπéÇ Web πâÜπâ╝πé╕πéÆσɽπéôπüºπüäπéïπüôπü¿πüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  780.                     <messages type="osfwPastText" value="%process_name% πü»πâçπé╣πé»πâêπââπâù πâÉπââπé»πé░πâ⌐πéªπâ│πâëπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒπÇéµû░πüùπüäπâÉπââπé»πé░πâ⌐πéªπâ│πâëπü»σ«ƒΦíîσÅ»Φâ╜πé│πâ╝πâëπéÆσɽπéÇ Web πâÜπâ╝πé╕πéÆσɽπéôπüºπüäπéïπüôπü¿πüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  781.                     <messages type="osfwBlockedText" value="%process_name% πüîπâçπé╣πé»πâêπââπâù πâÉπââπé»πé░πâ⌐πéªπâ│πâëπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ╗µ¡óπüùπü╛πüùπüƒπÇéµû░πüùπüäπâÉπââπé»πé░πâ⌐πéªπâ│πâëπü»σ«ƒΦíîσÅ»Φâ╜πé│πâ╝πâëπéÆσɽπéÇ Web πâÜπâ╝πé╕πéÆσɽπéôπüºπüäπéïπüôπü¿πüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  782.  
  783.                 </customevent>
  784.                 <customevent id="4015" severityref="suspicious" >
  785.                     <messages type="osfwPresentText" value="%process_name% is trying to change your browser settings or options." locale="en-US" />
  786.                     <messages type="osfwPastText" value="%process_name% was trying to change your browser settings or options." locale="en-US" />
  787.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing your browser settings or options." locale="en-US" />
  788.  
  789.                     <messages type="osfwPresentText" value="%process_name% versucht, die Einstellungen oder Optionen Ihres Browsers zu ├ñndern." locale="de-DE" />
  790.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Einstellungen oder Optionen Ihres Browsers zu ├ñndern." locale="de-DE" />
  791.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Einstellungen oder Optionen Ihres Browsers zu ├ñndern." locale="de-DE" />
  792.  
  793.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la configuraci├│n o las opciones del navegador" locale="es-ES" />
  794.                     <messages type="osfwPastText" value="%process_name% estaba intentando cambiar la configuraci├│n o las opciones del navegador" locale="es-ES" />
  795.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambie la configuraci├│n o las opciones del navegador" locale="es-ES" />
  796.  
  797.                     <messages type="osfwPresentText" value="%process_name% tente de modifier les param├¿tres ou les options de votre navigateur." locale="fr-FR" />
  798.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier les param├¿tres ou les options de votre navigateur." locale="fr-FR" />
  799.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier les param├¿tres ou les options de votre navigateur." locale="fr-FR" />
  800.  
  801.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare le impostazioni o le opzioni del browser." locale="it-IT" />
  802.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare le impostazioni o le opzioni del browser." locale="it-IT" />
  803.                     <messages type="osfwBlockedText" value="%process_name% ha impedito la modifica delle impostazioni o delle opzioni del browser." locale="it-IT" />
  804.  
  805.                     <messages type="osfwPresentText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«Φ¿¡σ«Üπüéπéïπüäπü»πé¬πâùπé╖πâºπâ│πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  806.                     <messages type="osfwPastText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«Φ¿¡σ«Üπüéπéïπüäπü»πé¬πâùπé╖πâºπâ│πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  807.                     <messages type="osfwBlockedText" value="%process_name% πüîπâûπâ⌐πéªπé╢πü«Φ¿¡σ«Üπüéπéïπüäπü»πé¬πâùπé╖πâºπâ│πéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  808.  
  809.                 </customevent>
  810.  
  811.                 <customevent id="4016" severityref="suspicious" >
  812.                     <messages type="osfwPresentText" value="%process_name% is trying to change your screen saver settings. This may allow a suspicous program to run every time the screen saver is activated." locale="en-US" />
  813.                     <messages type="osfwPastText" value="%process_name% was trying to change your screen saver settings. This may allow a suspicous program to run every time the screen saver is activated." locale="en-US" />
  814.                     <messages type="osfwBlockedText" value="%process_name% was prevented from changing your screen saver settings. This may allow a suspicous program to run every time the screen saver is activated." locale="en-US" />
  815.  
  816.                     <messages type="osfwPresentText" value="%process_name% tente de modifier les param├¿tres de votre ├⌐conomiseur d'├⌐cran. Cette op├⌐ration risque d'autoriser l'ex├⌐cution d'un programme suspect chaque fois que l'├⌐conomiseur d'├⌐cran est activ├⌐." locale="fr-FR" />
  817.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de modifier les param├¿tres de votre ├⌐conomiseur d'├⌐cran. Cette op├⌐ration risque d'autoriser l'ex├⌐cution d'un programme suspect chaque fois que l'├⌐conomiseur d'├⌐cran est activ├⌐." locale="fr-FR"/>
  818.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á modifier les param├¿tres de votre ├⌐conomiseur d'├⌐cran. Cette op├⌐ration risque d'autoriser l'ex├⌐cution d'un programme suspect chaque fois que l'├⌐conomiseur d'├⌐cran est activ├⌐." locale="fr-FR" />
  819.  
  820.                     <messages type="osfwPresentText" value="%process_name% versucht, Ihre Bildschirmschoner-Einstellungen zu ├ñndern. So kann m├╢glicherweise ein verd├ñchtiges Programm bei jeder Aktivierung des Bildschirmschoners ausgef├╝hrt werden." locale="de-DE" />
  821.                     <messages type="osfwPastText" value="%process_name% hat versucht, Ihre Bildschirmschoner-Einstellungen zu ├ñndern. So kann m├╢glicherweise ein verd├ñchtiges Programm bei jeder Aktivierung des Bildschirmschoners ausgef├╝hrt werden." locale="de-DE" />
  822.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, Ihre Bildschirmschoner-Einstellungen zu ├ñndern. So kann m├╢glicherweise ein verd├ñchtiges Programm bei jeder Aktivierung des Bildschirmschoners ausgef├╝hrt werden." locale="de-DE" />
  823.  
  824.                     <messages type="osfwPresentText" value="%process_name% sta cercando di modificare le impostazioni dello screensaver. Questo potrebbe consentire lΓÇÖavvio di un programma sospetto allΓÇÖattivazione dello screensaver." locale="it-IT" />
  825.                     <messages type="osfwPastText" value="%process_name% ha cercato di modificare le impostazioni dello screensaver. Questo potrebbe consentire lΓÇÖavvio di un programma sospetto allΓÇÖattivazione dello screensaver." locale="it-IT" />
  826.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di modificare le impostazioni dello screensaver. Questo potrebbe consentire lΓÇÖavvio di un programma sospetto allΓÇÖattivazione dello screensaver." locale="it-IT" />
  827.  
  828.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cambiar la configuraci├│n del protector de pantalla. Esto puede permitir a los programas sospechosos ejecutarse cada vez que el protector de pantalla se active." locale="es-ES" />
  829.                     <messages type="osfwPastText" value="%process_name% estaba intentando cambiar la configuraci├│n del protector de pantalla. Esto puede permitir a los programas sospechosos ejecutarse cada vez que el protector de pantalla se active." locale="es-ES" />
  830.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cambiara la configuraci├│n del protector de pantalla. Esto puede permitir a los programas sospechosos ejecutarse cada vez que el protector de pantalla se active." locale="es-ES" />
  831.  
  832.                     <messages type="osfwPresentText" value="%process_name% πüîπé╣πé»πâ¬πâ╝πâ│ πé╗πâ╝πâÉπâ╝πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖπÇéπüôπéîπü½πéêπéèπÇüπé╣πé»πâ¬πâ╝πâ│ πé╗πâ╝πâÉπâ╝πü«Φ╡╖σïòµÖéπü½τûæπéÅπüùπüäπâùπâ¡πé░πâ⌐πâáπüîσ«ƒΦíîπüòπéîπéïσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  833.                     <messages type="osfwPastText" value="%process_name% πüîπé╣πé»πâ¬πâ╝πâ│ πé╗πâ╝πâÉπâ╝πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒπÇéπüôπéîπü½πéêπéèπÇüπé╣πé»πâ¬πâ╝πâ│ πé╗πâ╝πâÉπâ╝πü«Φ╡╖σïòµÖéπü½τûæπéÅπüùπüäπâùπâ¡πé░πâ⌐πâáπüîσ«ƒΦíîπüòπéîπéïσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  834.                     <messages type="osfwBlockedText" value="%process_name% πüîπé╣πé»πâ¬πâ╝πâ│ πé╗πâ╝πâÉπâ╝πü«Φ¿¡σ«ÜπéÆσñëµ¢┤πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒπÇéπüôπéîπü½πéêπéèπÇüπé╣πé»πâ¬πâ╝πâ│ πé╗πâ╝πâÉπâ╝πü«Φ╡╖σïòµÖéπü½τûæπéÅπüùπüäπâùπâ¡πé░πâ⌐πâáπüîσ«ƒΦíîπüòπéîπéïσÅ»Φâ╜µÇºπüîπüéπéèπü╛πüÖπÇé" locale="jp-JA" />
  835.                 </customevent>
  836.  
  837.                 <customevent id="4017" severityref="suspicious" >
  838.                     <messages type="osfwPresentText" value="%process_name% is trying to install an application to run each time your computer is started." locale="en-US" />
  839.                     <messages type="osfwPastText" value="%process_name% was trying to install an application to run each time your computer is started." locale="en-US" />
  840.                     <messages type="osfwBlockedText" value="%process_name% was prevented from installing an application to run each time your computer is started." locale="en-US" />
  841.  
  842.                     <messages type="osfwPresentText" value="%process_name% tente d'installer une application qui sera ex├⌐cut├⌐e ├á chaque d├⌐marrage de l'ordinateur." locale="fr-FR" />
  843.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ d'installer une application dont le lancement s'effectue ├á chaque d├⌐marrage de l'ordinateur." locale="fr-FR" />
  844.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á installer une application dont le lancement s'effectue ├á chaque d├⌐marrage de l'ordinateur." locale="fr-FR" />
  845.  
  846.                     <messages type="osfwPresentText" value="%process_name% versucht, eine Anwendung zu installieren, die bei jedem Computerstart ausgef├╝hrt wird." locale="de-DE" />
  847.                     <messages type="osfwPastText" value="%process_name% hat versucht, eine Anwendung zu installieren, die bei jedem Computerstart ausgef├╝hrt wird." locale="de-DE" />
  848.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, eine Anwendung zu installieren, die bei jedem Computerstart ausgef├╝hrt wird." locale="de-DE" />
  849.  
  850.                     <messages type="osfwPresentText" value="%process_name% sta cercando di installare unΓÇÖapplicazione che verr├á eseguita a ogni avvio del computer." locale="it-IT" />
  851.                     <messages type="osfwPastText" value="%process_name% ha cercato di installare unΓÇÖapplicazione che verr├á eseguita a ogni avvio del computer." locale="it-IT" />
  852.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di installare unΓÇÖapplicazione che avrebbe dovuto essere eseguita a ogni avvio del computer." locale="it-IT" />
  853.  
  854.                     <messages type="osfwPresentText" value="%process_name% est├í intentando instalar una aplicaci├│n para ejecutar cada vez que el equipo se inicie." locale="es-ES" />
  855.                     <messages type="osfwPastText" value="%process_name% estaba intentando instalar una aplicaci├│n para ejecutar cada vez que el equipo se inicie." locale="es-ES" />
  856.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% instale una aplicaci├│n para ejecutar cada vez que el equipo se inicie." locale="es-ES" />
  857.  
  858.                     <messages type="osfwPresentText" value="%process_name% πüîπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖπÇé" locale="jp-JA" />
  859.                     <messages type="osfwPastText" value="%process_name% πüîπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒπÇé" locale="jp-JA" />
  860.                     <messages type="osfwBlockedText" value="%process_name% πüîπé│πâ│πâöπâÑπâ╝πé┐πü«Φ╡╖σïòπü«πüƒπü│πü½πéóπâùπâ¬πé▒πâ╝πé╖πâºπâ│πéÆπéñπâ│πé╣πâêπâ╝πâ½πüùπéêπüåπü¿πüùπüªπüäπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒπÇé" locale="jp-JA" />
  861.                 </customevent>
  862.  
  863.                 <!-- Normal behavior (5001-5999) -->
  864.  
  865.                 <customevent id="5001" severityref="normal" >
  866.                     <messages type="osfwPresentText" value="%process_name% is trying to load the module: %module%" locale="en-US" />
  867.                     <messages type="osfwPastText" value="%process_name% was trying to load the module: %module%" locale="en-US" />
  868.                     <messages type="osfwBlockedText" value="%process_name% was prevented from loading the module: %module%" locale="en-US" />
  869.                     <messages type="osfwPresentText" value="%process_name% versucht, das folgende Modul zu laden: %module%" locale="de-DE" />
  870.                     <messages type="osfwPastText" value="%process_name% hat versucht, das folgende Modul zu laden: %module%" locale="de-DE" />
  871.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, das folgende Modul zu laden: %module%" locale="de-DE" />
  872.                     <messages type="osfwPresentText" value="%process_name% tente de charger le module : %module%" locale="fr-FR" />
  873.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de charger le module : %module%" locale="fr-FR" />
  874.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á charger le module : %module%" locale="fr-FR" />
  875.                     <messages type="osfwPresentText" value="%process_name% πüîµ¼íπü«πâóπé╕πâÑπâ╝πâ½πéÆπâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ:%module%" locale="jp-JA" />
  876.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâóπé╕πâÑπâ╝πâ½πéÆπâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ:%module%" locale="jp-JA" />
  877.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâóπé╕πâÑπâ╝πâ½πéÆπâ¡πâ╝πâëπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ:%module%" locale="jp-JA" />
  878.                     <messages type="osfwPresentText" value="%process_name% est├í intentando cargar el m├│dulo: %module%" locale="es-ES" />
  879.                     <messages type="osfwPastText" value="%process_name% ha intentado cargar el m├│dulo: %module%" locale="es-ES" />
  880.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% cargue el m├│dulo: %module%" locale="es-ES" />
  881.                     <messages type="osfwPresentText" value="%process_name% sta cercando di caricare il modulo seguente: %module%" locale="it-IT" />
  882.                     <messages type="osfwPastText" value="%process_name% ha cercato di caricare il modulo seguente: %module%" locale="it-IT" />
  883.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di caricare il modulo seguente: %module%" locale="it-IT" />
  884.                 </customevent>
  885.  
  886.                 <!-- Severity depends upon the target process for the event (6001-6999) -->
  887.  
  888.                 <customevent id="6001" >
  889.                     <messages type="osfwPresentText"  value="%process_name% is trying to communicate with %target_process% by opening its process" locale="en-US" />
  890.                     <messages type="osfwPastText" value="%process_name% was trying to communicate with %target_process% by opening its process" locale="en-US" />
  891.                     <messages type="osfwBlockedText" value="%process_name% was prevented from to communicating with %target_process% by opening its process" locale="en-US" />
  892.                     <messages type="osfwPresentText"  value="%process_name% versucht, durch ├ûffnen des Prozesses mit %target_process% zu kommunizieren." locale="de-DE" />
  893.                     <messages type="osfwPastText" value="%process_name% hat versucht, durch ├ûffnen des Prozesses mit %target_process% zu kommunizieren." locale="de-DE" />
  894.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, durch ├ûffnen des Prozesses mit %target_process% zu kommunizieren." locale="de-DE" />
  895.                     <messages type="osfwPresentText"  value="%process_name% a tent├⌐ de communiquer avec %target_process% en ouvrant son processus" locale="fr-FR" />
  896.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de communiquer avec %target_process% en ouvrant son processus" locale="fr-FR" />
  897.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á communiquer avec %target_process% en ouvrant son processus" locale="fr-FR" />
  898.                     <messages type="osfwPresentText"  value="%process_name% πüî %target_process% πü«πâùπâ¡πé╗πé╣πéÆπé¬πâ╝πâùπâ│πüùπüªΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  899.                     <messages type="osfwPastText" value="%process_name% πüî %target_process% πü«πâùπâ¡πé╗πé╣πéÆπé¬πâ╝πâùπâ│πüùπüªΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  900.                     <messages type="osfwBlockedText" value="%process_name% πüî %target_process% πü«πâùπâ¡πé╗πé╣πéÆπé¬πâ╝πâùπâ│πüùπüªΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  901.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando comunicarse con %target_process% abriendo su proceso" locale="es-ES" />
  902.                     <messages type="osfwPastText" value="%process_name% ha intentado comunicarse con %target_process% abriendo su proceso" locale="es-ES" />
  903.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% se comunique con %target_process% abriendo su proceso" locale="es-ES" />
  904.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di comunicare con %target_process% aprendo il suo processo" locale="it-IT" />
  905.                     <messages type="osfwPastText" value="%process_name% ha cercato di comunicare con %target_process% aprendo il suo processo" locale="it-IT" />
  906.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di comunicare con %target_process% aprendo il suo processo" locale="it-IT" />
  907.                 </customevent>
  908.                 <customevent id="6002" >
  909.                     <messages type="osfwPresentText"  value="%process_name% is trying to communicate with %target_process% by opening a thread" locale="en-US" />
  910.                     <messages type="osfwPastText" value="%process_name% was trying to communicate with %target_process% by opening a thread" locale="en-US" />
  911.                     <messages type="osfwBlockedText" value="%process_name% was prevented from communicating with %target_process% by opening a thread" locale="en-US" />
  912.                     <messages type="osfwPresentText"  value="%process_name% versucht, durch ├ûffnen eines Threads mit %target_process% zu kommunizieren." locale="de-DE" />
  913.                     <messages type="osfwPastText" value="%process_name% hat versucht, durch ├ûffnen eines Threads mit %target_process% zu kommunizieren." locale="de-DE" />
  914.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, durch ├ûffnen eines Threads mit %target_process% zu kommunizieren." locale="de-DE" />
  915.                     <messages type="osfwPresentText"  value="%process_name% tente de communiquer avec %target_process% en ouvrant un thread" locale="fr-FR" />
  916.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de communiquer avec %target_process% en ouvrant un thread" locale="fr-FR" />
  917.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á communiquer avec %target_process% en ouvrant un thread" locale="fr-FR" />
  918.                     <messages type="osfwPresentText"  value="%process_name% πüîπé╣πâ¼πââπâëπéÆπé¬πâ╝πâùπâ│πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  919.                     <messages type="osfwPastText" value="%process_name% πüîπé╣πâ¼πââπâëπéÆπé¬πâ╝πâùπâ│πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  920.                     <messages type="osfwBlockedText" value="%process_name% πüîπé╣πâ¼πââπâëπéÆπé¬πâ╝πâùπâ│πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  921.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando comunicarse con %target_process% abriendo un subproceso" locale="es-ES" />
  922.                     <messages type="osfwPastText" value="%process_name% ha intentado comunicarse con %target_process% abriendo un subproceso" locale="es-ES" />
  923.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% se comunique con %target_process% abriendo un subproceso" locale="es-ES" />
  924.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di comunicare con %target_process% aprendo un thread" locale="it-IT" />
  925.                     <messages type="osfwPastText" value="%process_name% ha cercato di comunicare con %target_process% aprendo un thread" locale="it-IT" />
  926.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di comunicare con %target_process% aprendo un thread" locale="it-IT" />
  927.                 </customevent>
  928.                 <customevent id="6003" >
  929.                     <messages type="osfwPresentText"  value="%process_name% is trying to launch %target_process%, or use another program to gain access to privileged resources" locale="en-US" />
  930.                     <messages type="osfwPastText" value="%process_name% was trying to launch %target_process%, or use another program to gain access to privileged resources" locale="en-US" />
  931.                     <messages type="osfwBlockedText" value="%process_name% was prevented from launching %target_process%, or use another program to gain access to privileged resources" locale="en-US" />
  932.                     <messages type="osfwPresentText"  value="%process_name% versucht, %target_process% zu laden oder ein anderes Programm zu verwenden, um Zugriff auf berechtigte Ressourcen zu erhalten." locale="de-DE" />
  933.                     <messages type="osfwPastText" value="%process_name% hat versucht, %target_process% zu laden oder ein anderes Programm zu verwenden, um Zugriff auf berechtigte Ressourcen zu erhalten." locale="de-DE" />
  934.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, %target_process% zu laden oder ein anderes Programm zu verwenden, um Zugriff auf berechtigte Ressourcen zu erhalten." locale="de-DE" />
  935.                     <messages type="osfwPresentText"  value="%process_name% tente de lancer %target_process% ou d'utiliser un autre programme pour acc├⌐der aux ressources privil├⌐gi├⌐es" locale="fr-FR" />
  936.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de lancer %target_process% ou d'utiliser un autre programme pour acc├⌐der aux ressources privil├⌐gi├⌐es" locale="fr-FR" />
  937.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á lancer %target_process% ou utiliser un autre programme pour acc├⌐der aux ressources privil├⌐gi├⌐es" locale="fr-FR" />
  938.                     <messages type="osfwPresentText"  value="%process_name% πüîπÇüµ¿⌐ΘÖÉπü«σ┐àΦªüπü¬πâ¬πé╜πâ╝πé╣πü½πéóπé»πé╗πé╣πüÖπéïπüƒπéüπü½πÇü%target_process% πéÆΦ╡╖σïòπüùπÇüπü╛πüƒπü»σêÑπü«πâùπâ¡πé░πâ⌐πâáπéÆΣ╜┐τö¿πüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  939.                     <messages type="osfwPastText" value="%process_name% πüîπÇüµ¿⌐ΘÖÉπü«σ┐àΦªüπü¬πâ¬πé╜πâ╝πé╣πü½πéóπé»πé╗πé╣πüÖπéïπüƒπéüπü½πÇü%target_process% πéÆΦ╡╖σïòπüùπÇüπü╛πüƒπü»σêÑπü«πâùπâ¡πé░πâ⌐πâáπéÆΣ╜┐τö¿πüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  940.                     <messages type="osfwBlockedText" value="%process_name% πü⌐ΘÖÉπü«σ┐àΦªüπü¬πâ¬πé╜πâ╝πé╣πü½πéóπé»πé╗πé╣πüÖπéïπüƒπéüπü½ %target_process% πéÆΦ╡╖σïòπüùπÇüπü╛πüƒπü»σêÑπü«πâùπâ¡πé░πâ⌐πâáπéÆΣ╜┐τö¿πüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  941.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando ejecutar %target_process% o utilizar otro programa para acceder a recursos con privilegios" locale="es-ES" />
  942.                     <messages type="osfwPastText" value="%process_name% ha intentado ejecutar %target_process% o utilizar otro programa para acceder a recursos con privilegios" locale="es-ES" />
  943.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% ejecute %target_process% o utilice otro programa para acceder a recursos con privilegios" locale="es-ES" />
  944.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di avviare %target_process% o di usare un altro programma per ottenere accesso a risorse privilegiate" locale="it-IT" />
  945.                     <messages type="osfwPastText" value="%process_name% ha cercato di avviare %target_process% o di usare un altro programma per ottenere accesso a risorse privilegiate" locale="it-IT" />
  946.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di avviare %target_process% o di usare un altro programma per ottenere accesso a risorse privilegiate" locale="it-IT" />
  947.                 </customevent>
  948.                 <customevent id="6004" >
  949.                     <messages type="osfwPresentText"  value="%process_name% is trying to start" locale="en-US" />
  950.                     <messages type="osfwPastText" value="%process_name% was trying to start" locale="en-US" />
  951.                     <messages type="osfwBlockedText" value="%process_name% was prevented from starting" locale="en-US" />
  952.                     <messages type="osfwPresentText"  value="%process_name% versucht zu starten." locale="de-DE" />
  953.                     <messages type="osfwPastText" value="%process_name% hat versucht zu starten." locale="de-DE" />
  954.                     <messages type="osfwBlockedText" value="%process_name% wurde am Starten gehindert." locale="de-DE" />
  955.                     <messages type="osfwPresentText"  value="%process_name% tente de d├⌐marrer" locale="fr-FR" />
  956.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de d├⌐marrer" locale="fr-FR" />
  957.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á d├⌐marrer" locale="fr-FR" />
  958.                     <messages type="osfwPresentText"  value="%process_name% πü»Φ╡╖σïòπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  959.                     <messages type="osfwPastText" value="%process_name% πü»Φ╡╖σïòπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  960.                     <messages type="osfwBlockedText" value="%process_name% πü«Φ╡╖σïòπéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  961.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando iniciarse" locale="es-ES" />
  962.                     <messages type="osfwPastText" value="%process_name% ha intentado iniciarse" locale="es-ES" />
  963.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% se inicie" locale="es-ES" />
  964.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di effettuare l'avvio" locale="it-IT" />
  965.                     <messages type="osfwPastText" value="%process_name% ha cercato di effettuare l'avvio" locale="it-IT" />
  966.                     <messages type="osfwBlockedText" value="Avvio di %process_name% bloccato" locale="it-IT" />
  967.                 </customevent>
  968.                 <customevent id="6005" >
  969.                     <messages type="osfwPresentText"  value="%process_name% is trying to control the keyboard input of the process: %target_process%" locale="en-US" />
  970.                     <messages type="osfwPastText" value="%process_name% was trying to control the keyboard input of the process: %target_process%" locale="en-US" />
  971.                     <messages type="osfwBlockedText" value="%process_name% was prevented from controlling the keyboard input of the process: %target_process%" locale="en-US" />
  972.                     <messages type="osfwPresentText"  value="%process_name% versucht, die Tastatureingaben des folgenden Prozesses zu steuern: %target_process%" locale="de-DE" />
  973.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Tastatureingaben des folgenden Prozesses zu steuern: %target_process%" locale="de-DE" />
  974.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Tastatureingaben des folgenden Prozesses zu steuern: %target_process%" locale="de-DE" />
  975.                     <messages type="osfwPresentText"  value="%process_name% tente de contr├┤ler l'entr├⌐e clavier du processus : %target_process%" locale="fr-FR" />
  976.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de contr├┤ler l'entr├⌐e clavier du processus : %target_process%" locale="fr-FR" />
  977.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á contr├┤ler l'entr├⌐e clavier du processus : %target_process%" locale="fr-FR" />
  978.                     <messages type="osfwPresentText"  value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü«πé¡πâ╝πâ£πâ╝πâëσàÑσè¢πéÆσê╢σ╛íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %target_process%" locale="jp-JA" />
  979.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü«πé¡πâ╝πâ£πâ╝πâëσàÑσè¢πéÆσê╢σ╛íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  980.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü«πé¡πâ╝πâ£πâ╝πâëσàÑσè¢πéÆσê╢σ╛íπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  981.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando controlar las entradas del teclado del proceso: %target_process%" locale="es-ES" />
  982.                     <messages type="osfwPastText" value="%process_name% ha intentado controlar las entradas del teclado del proceso: %target_process%" locale="es-ES" />
  983.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% controle las entradas del teclado del proceso: %target_process%" locale="es-ES" />
  984.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di controllare l'input da tastiera per il processo seguente: %target_process%" locale="it-IT" />
  985.                     <messages type="osfwPastText" value="%process_name% ha cercato di controllare l'input da tastiera per il processo seguente: %target_process%" locale="it-IT" />
  986.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di controllare l'input da tastiera per il processo seguente: %target_process%" locale="it-IT" />
  987.                 </customevent>
  988.                 <customevent id="6006" >
  989.                     <messages type="osfwPresentText"  value="%process_name% is trying to control the mouse input of the process: %target_process%" locale="en-US" />
  990.                     <messages type="osfwPastText" value="%process_name% was trying to control the mouse input of the process: %target_process%" locale="en-US" />
  991.                     <messages type="osfwBlockedText" value="%process_name% was prevented from controlling the mouse input of the process: %target_process%" locale="en-US" />
  992.                     <messages type="osfwPresentText"  value="%process_name% versucht, die Mauseingaben des folgenden Prozesses zu steuern: %target_process%" locale="de-DE" />
  993.                     <messages type="osfwPastText" value="%process_name% hat versucht, die Mauseingaben des folgenden Prozesses zu steuern: %target_process%" locale="de-DE" />
  994.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, die Mauseingaben des folgenden Prozesses zu steuern: %target_process%" locale="de-DE" />
  995.                     <messages type="osfwPresentText"  value="%process_name% tente de contr├┤ler l'entr├⌐e souris du processus : %target_process%" locale="fr-FR" />
  996.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de contr├┤ler l'entr├⌐e souris du processus : %target_process%" locale="fr-FR" />
  997.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á contr├┤ler l'entr├⌐e souris du processus : %target_process%" locale="fr-FR" />
  998.                     <messages type="osfwPresentText"  value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü«πâ₧πéªπé╣σàÑσè¢πéÆσê╢σ╛íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %target_process%" locale="jp-JA" />
  999.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü«πâ₧πéªπé╣σàÑσè¢πéÆσê╢σ╛íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  1000.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü«πâ₧πéªπé╣σàÑσè¢πéÆσê╢σ╛íπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  1001.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando controlar las entradas del mouse del proceso: %target_process%" locale="es-ES" />
  1002.                     <messages type="osfwPastText" value="%process_name% ha intentado controlar las entradas del mouse del proceso: %target_process%" locale="es-ES" />
  1003.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% controle las entradas del mouse del proceso: %target_process%" locale="es-ES" />
  1004.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di controllare l'input tramite mouse per il processo seguente: %target_process%" locale="it-IT" />
  1005.                     <messages type="osfwPastText" value="%process_name% ha cercato di controllare l'input tramite mouse per il processo seguente: %target_process%" locale="it-IT" />
  1006.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di controllare l'input tramite mouse per il processo seguente: %target_process%" locale="it-IT" />
  1007.                 </customevent>
  1008.                 <customevent id="6007" >
  1009.                     <messages type="osfwPresentText"  value="%process_name% is trying to communicate with %target_process% by using DDE" locale="en-US" />
  1010.                     <messages type="osfwPastText" value="%process_name% was trying to communicate with %target_process% by using DDE" locale="en-US" />
  1011.                     <messages type="osfwBlockedText" value="%process_name% was prevented from communicating with %target_process% by using DDE" locale="en-US" />
  1012.                     <messages type="osfwPresentText"  value="%process_name% versucht, durch Verwenden von DDE mit %target_process% zu kommunizieren." locale="de-DE" />
  1013.                     <messages type="osfwPastText" value="%process_name% hat versucht, durch Verwenden von DDE mit %target_process% zu kommunizieren." locale="de-DE" />
  1014.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, durch Verwenden von DDE mit %target_process% zu kommunizieren." locale="de-DE" />
  1015.                     <messages type="osfwPresentText"  value="%process_name% tente de communiquer avec %target_process% en utilisant DDE" locale="fr-FR" />
  1016.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de communiquer avec %target_process% en utilisant DDE" locale="fr-FR" />
  1017.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á communiquer avec %target_process% en utilisant DDE" locale="fr-FR" />
  1018.                     <messages type="osfwPresentText"  value="%process_name% πüî DDE πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  1019.                     <messages type="osfwPastText" value="%process_name% πüî DDE πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  1020.                     <messages type="osfwBlockedText" value="%process_name% πüî DDE πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  1021.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando comunicarse con %target_process% mediante DDE" locale="es-ES" />
  1022.                     <messages type="osfwPastText" value="%process_name% ha intentado comunicarse con %target_process% mediante DDE" locale="es-ES" />
  1023.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% se comunique con %target_process% mediante DDE" locale="es-ES" />
  1024.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di comunicare con %target_process% utilizzando DDE" locale="it-IT" />
  1025.                     <messages type="osfwPastText" value="%process_name% ha cercato di comunicare con %target_process% utilizzando DDE" locale="it-IT" />
  1026.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di comunicare con %target_process% utilizzando DDE" locale="it-IT" />
  1027.                 </customevent> 
  1028.                 <customevent id="6008" >
  1029.                     <messages type="osfwPresentText"  value="%process_name% is trying to communicate with %target_process% using a programming technique called a callback" locale="en-US" />
  1030.                     <messages type="osfwPastText" value="%process_name% was trying to communicate with %target_process% using a programming technique called a callback" locale="en-US" />
  1031.                     <messages type="osfwBlockedText" value="%process_name% was prevented from to communicating with %target_process% using a programming technique called a callback" locale="en-US" />
  1032.                     <messages type="osfwPresentText"  value="%process_name% versucht, durch die als Callback (R├╝ckruf) bezeichnete Programmierungsmethode mit %target_process% zu kommunizieren." locale="de-DE" />
  1033.                     <messages type="osfwPastText" value="%process_name% hat versucht, durch die als Callback (R├╝ckruf) bezeichnete Programmierungsmethode mit %target_process% zu kommunizieren." locale="de-DE" />
  1034.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, durch die als Callback (R├╝ckruf) bezeichnete Programmierungsmethode mit %target_process% zu kommunizieren." locale="de-DE" />
  1035.                     <messages type="osfwPresentText"  value="%process_name% tente de communiquer avec %target_process% en utilisant une technique de programmation appel├⌐e le rappel" locale="fr-FR" />
  1036.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de communiquer avec %target_process% en utilisant une technique de programmation appel├⌐e le rappel" locale="fr-FR" />
  1037.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á communiquer avec %target_process% en utilisant une technique de programmation appel├⌐e le rappel" locale="fr-FR" />
  1038.                     <messages type="osfwPresentText"  value="%process_name% πüîπé│πâ╝πâ½πâÉπââπé»πü¿πüäπüåπâùπâ¡πé░πâ⌐πâƒπâ│πé░µèÇΦíôπéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  1039.                     <messages type="osfwPastText" value="%process_name% πüîπé│πâ╝πâ½πâÉπââπé»πü¿πüäπüåπâùπâ¡πé░πâ⌐πâƒπâ│πé░µèÇΦíôπéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  1040.                     <messages type="osfwBlockedText" value="%process_name% πüîπé│πâ╝πâ½πâÉπââπé»πü¿πüäπüåπâùπâ¡πé░πâ⌐πâƒπâ│πé░µèÇΦíôπéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  1041.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando comunicarse con %target_process% mediante una t├⌐cnica de programaci├│n denominada respuesta de llamada" locale="es-ES" />
  1042.                     <messages type="osfwPastText" value="%process_name% ha intentado comunicarse con %target_process% mediante una t├⌐cnica de programaci├│n denominada respuesta de llamada" locale="es-ES" />
  1043.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% se comunique con %target_process% mediante una t├⌐cnica de programaci├│n denominada respuesta de llamada" locale="es-ES" />
  1044.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di comunicare con %target_process% utilizzando una tecnica di programmazione denominata callback" locale="it-IT" />
  1045.                     <messages type="osfwPastText" value="%process_name% ha cercato di comunicare con %target_process% utilizzando una tecnica di programmazione denominata callback" locale="it-IT" />
  1046.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di comunicare con %target_process% utilizzando una tecnica di programmazione denominata callback" locale="it-IT" />
  1047.                 </customevent> 
  1048.                 <customevent id="6009" >
  1049.                     <messages type="osfwPresentText"  value="%process_name% is trying to inject code into: %target_process%" locale="en-US" />
  1050.                     <messages type="osfwPastText" value="%process_name% was trying to inject code into: %target_process%" locale="en-US" />
  1051.                     <messages type="osfwBlockedText" value="%process_name% was prevented from injecting code into: %target_process%" locale="en-US" />
  1052.                     <messages type="osfwPresentText"  value="%process_name% versucht, Code einzubringen in: %target_process%" locale="de-DE" />
  1053.                     <messages type="osfwPastText" value="%process_name% hat versucht, Code einzubringen in: %target_process%" locale="de-DE" />
  1054.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, Code einzubringen in: %target_process%" locale="de-DE" />
  1055.                     <messages type="osfwPresentText"  value="%process_name% tente d'ins├⌐rer un code dans : %target_process%" locale="fr-FR" />
  1056.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ d'ins├⌐rer un code dans : %target_process%" locale="fr-FR" />
  1057.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á ins├⌐rer un code dans : %target_process%" locale="fr-FR" />
  1058.                     <messages type="osfwPresentText"  value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü½πé│πâ╝πâëπéƵî┐σàÑπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %target_process%" locale="jp-JA" />
  1059.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü½πé│πâ╝πâëπéƵî┐σàÑπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  1060.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πü½πé│πâ╝πâëπéƵî┐σàÑπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  1061.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando insertar c├│ndigo en: %target_process%" locale="es-ES" />
  1062.                     <messages type="osfwPastText" value="%process_name% ha intentado insertar c├│ndigo en: %target_process%" locale="es-ES" />
  1063.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% inserte c├│ndigo en: %target_process%" locale="es-ES" />
  1064.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di inserire del codice in: %target_process%" locale="it-IT" />
  1065.                     <messages type="osfwPastText" value="%process_name% ha cercato di inserire del codice in: %target_process%" locale="it-IT" />
  1066.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di inserire del codice in: %target_process%" locale="it-IT" />
  1067.                 </customevent>
  1068.                 <customevent id="6010" >
  1069.                     <messages type="osfwPresentText"  value="%process_name% is trying to terminate: %target_process%" locale="en-US" />
  1070.                     <messages type="osfwPastText" value="%process_name% was trying to terminate: %target_process%" locale="en-US" />
  1071.                     <messages type="osfwBlockedText" value="%process_name% was prevented from terminating: %target_process%" locale="en-US" />
  1072.                     <messages type="osfwPresentText"  value="%process_name% versucht, Folgendes zu beenden: %target_process%" locale="de-DE" />
  1073.                     <messages type="osfwPastText" value="%process_name% hat versucht, Folgendes zu beenden: %target_process%" locale="de-DE" />
  1074.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, Folgendes zu beenden: %target_process%" locale="de-DE" />
  1075.                     <messages type="osfwPresentText"  value="%process_name% tente de terminer : %target_process%" locale="fr-FR" />
  1076.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de terminer : %target_process%" locale="fr-FR" />
  1077.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á terminer : %target_process%" locale="fr-FR" />
  1078.                     <messages type="osfwPresentText"  value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πéÆτ╡éΣ║åπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ: %target_process%" locale="jp-JA" />
  1079.                     <messages type="osfwPastText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πéÆτ╡éΣ║åπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  1080.                     <messages type="osfwBlockedText" value="%process_name% πüîµ¼íπü«πâùπâ¡πé╗πé╣πéÆτ╡éΣ║åπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ: %target_process%" locale="jp-JA" />
  1081.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando terminar: %target_process%" locale="es-ES" />
  1082.                     <messages type="osfwPastText" value="%process_name% ha intentado terminar: %target_process%" locale="es-ES" />
  1083.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% termine: %target_process%" locale="es-ES" />
  1084.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di terminare: %target_process%" locale="it-IT" />
  1085.                     <messages type="osfwPastText" value="%process_name% ha cercato di terminare: %target_process%" locale="it-IT" />
  1086.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di terminare: %target_process%" locale="it-IT" />
  1087.                 </customevent> 
  1088.                 <customevent id="6011" >
  1089.                     <messages type="osfwPresentText"  value="%process_name% is trying to communicate with %target_process% using Windows messages" locale="en-US" />
  1090.                     <messages type="osfwPastText" value="%process_name% was trying to communicate with %target_process% using Windows messages" locale="en-US" />
  1091.                     <messages type="osfwBlockedText" value="%process_name% was prevented from communicating with %target_process% using Windows messages" locale="en-US" />
  1092.                     <messages type="osfwPresentText"  value="%process_name% versucht, mit Hilfe von Windows-Meldungen mit %target_process% zu kommunizieren." locale="de-DE" />
  1093.                     <messages type="osfwPastText" value="%process_name% hat versucht, mit Hilfe von Windows-Meldungen mit %target_process% zu kommunizieren." locale="de-DE" />
  1094.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, mit Hilfe von Windows-Meldungen mit %target_process% zu kommunizieren." locale="de-DE" />
  1095.                     <messages type="osfwPresentText"  value="%process_name% tente de communiquer avec %target_process% en utilisant les messages Windows" locale="fr-FR" />
  1096.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de communiquer avec %target_process% en utilisant les messages Windows" locale="fr-FR" />
  1097.                     <messages type="osfwBlockedText" value="%process_name% n'a pas r├⌐ussi ├á communiquer avec %target_process% en utilisant les messages Windows" locale="fr-FR" />
  1098.                     <messages type="osfwPresentText"  value="%process_name% πüî Windows πâíπââπé╗πâ╝πé╕πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  1099.                     <messages type="osfwPastText" value="%process_name% πüî Windows πâíπââπé╗πâ╝πé╕πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  1100.                     <messages type="osfwBlockedText" value="%process_name% πüî Windows πâíπââπé╗πâ╝πé╕πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüƒπü«πéÆΘÿ▓µ¡óπüùπü╛πüùπüƒ" locale="jp-JA" />
  1101.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando comunicarse con %target_process% mediante mensajes de Windows" locale="es-ES" />
  1102.                     <messages type="osfwPastText" value="%process_name% ha intentado comunicarse con %target_process% mediante mensajes de Windows" locale="es-ES" />
  1103.                     <messages type="osfwBlockedText" value="Se ha impedido que %process_name% se comunique con %target_process% mediante mensajes de Windows" locale="es-ES" />
  1104.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di comunicare con %target_process% utilizzando messaggi di Windows" locale="it-IT" />
  1105.                     <messages type="osfwPastText" value="%process_name% ha cercato di comunicare con %target_process% utilizzando messaggi di Windows" locale="it-IT" />
  1106.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di comunicare con %target_process% utilizzando messaggi di Windows" locale="it-IT" />
  1107.                 </customevent>
  1108.                 <customevent id="6012" >
  1109.                     <messages type="osfwPresentText"  value="%process_name% is trying to communicate with %target_process% using OLE or COM" locale="en-US" />
  1110.                     <messages type="osfwPastText" value="%process_name% was trying to communicate with %target_process% using OLE or COM" locale="en-US" />
  1111.                     <messages type="osfwBlockedText" value="%process_name% was prevented from communicating with %target_process% using OLE or COM" locale="en-US" />
  1112.                     <messages type="osfwPresentText"  value="%process_name% versucht, mit Hilfe von OLE oder COM mit %target_process% zu kommunizieren." locale="de-DE" />
  1113.                     <messages type="osfwPastText" value="%process_name% hat versucht, mit Hilfe von OLE oder COM mit %target_process% zu kommunizieren." locale="de-DE" />
  1114.                     <messages type="osfwBlockedText" value="%process_name% wurde daran gehindert, mit Hilfe von OLE oder COM mit %target_process% zu kommunizieren." locale="de-DE" />
  1115.                     <messages type="osfwPresentText"  value="%process_name% tente de communiquer avec %target_process% via OLE ou COM" locale="fr-FR" />
  1116.                     <messages type="osfwPastText" value="%process_name% a tent├⌐ de communiquer avec %target_process% via OLE ou COM" locale="fr-FR" />
  1117.                     <messages type="osfwBlockedText" value="%process_name% n'as pas r├⌐ussi ├á communiquer avec %target_process% via OLE ou COM" locale="fr-FR" />
  1118.                     <messages type="osfwPresentText"  value="%process_name% πü» OLE πü╛πüƒπü» COM πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüÖ" locale="jp-JA" />
  1119.                     <messages type="osfwPastText" value="%process_name% πü» OLE πü╛πüƒπü» COM πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüùπéêπüåπü¿πüùπüªπüäπü╛πüùπüƒ" locale="jp-JA" />
  1120.                     <messages type="osfwBlockedText" value="%process_name% πü» OLE πü╛πüƒπü» COM πéÆΣ╜┐τö¿πüùπüª %target_process% πü¿ΘÇÜΣ┐íπüºπüìπü╛πü¢πéôπüºπüùπüƒ" locale="jp-JA" />
  1121.                     <messages type="osfwPresentText"  value="%process_name% est├í intentando comunicarse con %target_process% mediante OLE o COM" locale="es-ES" />
  1122.                     <messages type="osfwPastText" value="%process_name% estaba intentando comunicarse con %target_process% mediante OLE o COM" locale="es-ES" />
  1123.                     <messages type="osfwBlockedText" value="Se ha evitado que %process_name% se comunicara con %target_process% mediante OLE o COM" locale="es-ES" />
  1124.                     <messages type="osfwPresentText"  value="%process_name% sta cercando di comunicare con %target_process% utilizzando OLE o COM" locale="it-IT" />
  1125.                     <messages type="osfwPastText" value="%process_name% ha cercato di comunicare con %target_process% utilizzando OLE o COM" locale="it-IT" />
  1126.                     <messages type="osfwBlockedText" value="├ê stato impedito a %process_name% di comunicare con %target_process% utilizzando OLE o COM" locale="it-IT" />
  1127.                 </customevent>
  1128.  
  1129.                 <!-- 
  1130.                      Rulegroups used soley to map events to customevents.  We
  1131.                      can get rid of this if the evententry element is ever
  1132.                      extended to allow specification of customtext.
  1133.                 -->
  1134.                 <!-- ASKING -->
  1135.  
  1136.                 <!-- Malicious behavior -->
  1137.  
  1138.                 <rulegroup name="rg-malwr-ask" customtext="2001" ask="true" />
  1139.  
  1140.                 <!-- Dangerous behavior -->
  1141.  
  1142.                 <rulegroup name="rg-memmp-ask" customtext="3004" ask="true" />
  1143.                 <rulegroup name="rg-glbhook-ask" customtext="3005" ask="true" />
  1144.                 <rulegroup name="rg-drvld-ask" customtext="3006" ask="true" />
  1145.                 <rulegroup name="rg-drvcr-ask" customtext="3007" ask="true" />
  1146.                 <rulegroup name="rg-drvmd-ask" customtext="3008" ask="true" />
  1147.                 <rulegroup name="rg-drvdl-ask" customtext="3009" ask="true" />
  1148.  
  1149.                 <!-- Suspicious behavior -->
  1150.  
  1151.                 <rulegroup name="rg-drvud-ask" customtext="4002" ask="true" />
  1152.                 <rulegroup name="rg-drvct-ask" customtext="4003" ask="true" />
  1153.  
  1154.                 <!-- Normal behavior -->
  1155.  
  1156.                 <rulegroup name="rg-modld-ok" customtext="5001" allow="true" notify="true" />
  1157.  
  1158.                 <!-- Severity depends upon the target process -->
  1159.  
  1160.                 <rulegroup name="rg-openp-ask" customtext="6001" ask="true" />
  1161.                 <rulegroup name="rg-opent-ask" customtext="6002" ask="true" />
  1162.                 <rulegroup name="rg-spawn-ask" customtext="6003" ask="true" />
  1163.                 <rulegroup name="rg-start-ask" customtext="6004" ask="true" />
  1164.                 <rulegroup name="rg-keybd-ask" customtext="6005" ask="true" />
  1165.                 <rulegroup name="rg-mouse-ask" customtext="6006" ask="true" />
  1166.                 <rulegroup name="rg-ddein-ask" customtext="6007" ask="true" />
  1167.                 <rulegroup name="rg-callb-ask" customtext="6008" ask="true" />
  1168.                 <rulegroup name="rg-whook-ask" customtext="6009" ask="true" />
  1169.                 <rulegroup name="rg-termp-ask" customtext="6010" ask="true" />
  1170.                 <rulegroup name="rg-msg-ask" customtext="6011" ask="true" />
  1171.                 <rulegroup name="rg-olecn-ask" customtext="6012" ask="true" />
  1172.  
  1173.  
  1174.                 <!-- BLOCKING -->
  1175.                 <!-- Malicious behavior -->
  1176.  
  1177.                 <rulegroup name="rg-malwr-blk" customtext="2001" allow="false" notify="true" />
  1178.  
  1179.                 <!-- Dangerous behavior -->
  1180.  
  1181.                 <rulegroup name="rg-memmp-blk" customtext="3004" allow="false" notify="true" />
  1182.                 <rulegroup name="rg-glbhook-blk" customtext="3005" allow="false" notify="true" />
  1183.                 <rulegroup name="rg-drvld-blk" customtext="3006" allow="false" notify="true" />
  1184.                 <rulegroup name="rg-drvcr-blk" customtext="3007" allow="false" notify="true" />
  1185.                 <rulegroup name="rg-drvmd-blk" customtext="3008" allow="false" notify="true" />
  1186.                 <rulegroup name="rg-drvdl-blk" customtext="3009" allow="false" notify="true" />
  1187.  
  1188.  
  1189.                 <!-- Suspicious behavior -->
  1190.  
  1191.                 <rulegroup name="rg-drvud-blk" customtext="4002" allow="false" notify="true" />
  1192.                 <rulegroup name="rg-drvct-blk" customtext="4003" allow="false" notify="true" />
  1193.  
  1194.  
  1195.                 <rulegroup name="rg-regall-blk" customtext="4005" allow="false" notify="true" />
  1196.  
  1197.    
  1198.                                 <!-- Severity depends upon the target process -->
  1199.  
  1200.                 <rulegroup name="rg-openp-blk" customtext="6001" allow="false" notify="true" />
  1201.                 <rulegroup name="rg-opent-blk" customtext="6002" allow="false" notify="true" />
  1202.                 <rulegroup name="rg-spawn-blk" customtext="6003" allow="false" notify="true" />
  1203.                 <rulegroup name="rg-start-blk" customtext="6004" allow="false" notify="true" />
  1204.                 <rulegroup name="rg-keybd-blk" customtext="6005" allow="false" notify="true" />
  1205.                 <rulegroup name="rg-mouse-blk" customtext="6006" allow="false" notify="true" />
  1206.                 <rulegroup name="rg-ddein-blk" customtext="6007" allow="false" notify="true" />
  1207.                 <rulegroup name="rg-callb-blk" customtext="6008" allow="false" notify="true" />
  1208.                 <rulegroup name="rg-whook-blk" customtext="6009" allow="false" notify="true" />
  1209.                 <rulegroup name="rg-termp-blk" customtext="6010" allow="false" notify="true" />
  1210.                 <rulegroup name="rg-msg-blk" customtext="6011" allow="false" notify="true" />
  1211.                 <rulegroup name="rg-olecn-blk" customtext="6012" allow="false" notify="true" />
  1212.  
  1213.                 <!-- Protect IE Settings -->
  1214.  
  1215.                 <!-- Allow IE Settings -->
  1216.  
  1217.                 <!-- Default search page -->
  1218.                 <rulegroup name="a-ie-srchdef">
  1219.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1220.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1221.                         <itementry param="value" operator="equalnocase" type="ansi" value="Default_Search_URL"/>
  1222.                     </ruleentry>
  1223.                 </rulegroup>
  1224.  
  1225.                 <!-- Allow default search URL -->
  1226.                 <rulegroup name="a-ie-search1">
  1227.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1228.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1229.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomizeSearch" />
  1230.                     </ruleentry>
  1231.                 </rulegroup>
  1232.                 <rulegroup name="a-ie-search2">
  1233.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1234.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1235.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomSearch" />
  1236.                     </ruleentry>
  1237.                 </rulegroup>
  1238.                 <rulegroup name="a-ie-search3">
  1239.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1240.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1241.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchAssistant" />
  1242.                     </ruleentry>
  1243.                 </rulegroup>
  1244.                 <rulegroup name="a-ie-search4">
  1245.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1246.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1247.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomizeSearch" />
  1248.                     </ruleentry>
  1249.                 </rulegroup>
  1250.                 <rulegroup name="a-ie-search5">
  1251.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1252.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1253.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomSearch" />
  1254.                     </ruleentry>
  1255.                 </rulegroup>
  1256.                 <rulegroup name="a-ie-search6">
  1257.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1258.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1259.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchAssistant" />
  1260.                     </ruleentry>
  1261.                 </rulegroup>
  1262.                 <rulegroup name="a-ie-search7">
  1263.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1264.                         <!-- Defines Internet Search Engines -->
  1265.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer" />
  1266.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchUrl" />
  1267.                     </ruleentry>
  1268.                 </rulegroup>
  1269.                 <rulegroup name="a-ie-search8">
  1270.                     <ruleentry event="registry" match="any" allow="true" customtext="4006">
  1271.                         <!-- CLSID of App (URL Search Hook object) that defines a custom network protocol -->
  1272.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks" />
  1273.                     </ruleentry>
  1274.                 </rulegroup>
  1275.                 <rulegroup name="a-ie-search9">
  1276.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1277.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1278.                         <itementry param="value" operator="equalnocase" type="ansi" value="Search Page"/>
  1279.                     </ruleentry>
  1280.                 </rulegroup>
  1281.                 <rulegroup name="a-ie-search10">
  1282.                     <ruleentry event="registry" match="all" allow="true" customtext="4006">
  1283.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main"/>
  1284.                         <itementry param="value" operator="equalnocase" type="ansi" value="Search Page"/>
  1285.                     </ruleentry>
  1286.                 </rulegroup>
  1287.  
  1288.                 <!-- Allow IE Home Page -->
  1289.                 <rulegroup name="a-ie-home1">
  1290.                     <ruleentry event="registry" match="all" allow="true" customtext="4007">
  1291.                         <!-- Defines Internet Search Engines -->
  1292.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main" />
  1293.                         <itementry param="value" operator="equalnocase" type="ansi" value="Start Page" />
  1294.                     </ruleentry>
  1295.                 </rulegroup>
  1296.                 <rulegroup name="a-ie-home2">
  1297.                     <ruleentry event="registry" match="all" allow="true" customtext="4007">
  1298.                         <!-- Defines Internet Search Engines -->
  1299.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main" />
  1300.                         <itementry param="value" operator="equalnocase" type="ansi" value="Start Page" />
  1301.                     </ruleentry>
  1302.                 </rulegroup>
  1303.  
  1304.                 <!-- Allow ActiveX installation -->
  1305.                 <rulegroup name="allow-classes">
  1306.                     <ruleentry event="registry" match="any" allow="true" customtext="3003">
  1307.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes" />
  1308.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes\CLSID" />
  1309.                     </ruleentry>
  1310.                 </rulegroup>
  1311.  
  1312.                 <!-- Allow Startup -->
  1313.                 <rulegroup name="allow-run1">
  1314.                     <ruleentry event="registry" match="any" allow="true" customtext="4001">
  1315.                         <!-- Windows AutoRuns Registry Keys -->
  1316.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Run" />
  1317.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  1318.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  1319.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  1320.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  1321.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  1322.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  1323.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Run" />
  1324.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  1325.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  1326.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  1327.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  1328.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  1329.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  1330.                     </ruleentry>
  1331.                 </rulegroup>
  1332.                 <rulegroup name="allow-run2">
  1333.                     <ruleentry event="registry" match="all" allow="true" customtext="4001">
  1334.                         <!-- Windows AutoRuns Registry Values -->
  1335.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  1336.                         <itementry param="value" operator="equalnocase" type="ansi" value="Run" />
  1337.                     </ruleentry>
  1338.                 </rulegroup>
  1339.                 <rulegroup name="allow-run3">
  1340.                     <ruleentry event="registry" match="all" allow="true" customtext="4001">
  1341.                         <!-- Windows AutoRuns Registry Values -->
  1342.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  1343.                         <itementry param="value" operator="equalnocase" type="ansi" value="Load" />
  1344.                     </ruleentry>
  1345.                 </rulegroup>
  1346.                 <rulegroup name="allow-run4">
  1347.                     <ruleentry event="registry" match="all" allow="true" customtext="4001">
  1348.                         <!-- Windows AutoRuns Registry Values -->
  1349.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1350.                         <itementry param="value" operator="equalnocase" type="ansi" value="Userinit" />
  1351.                     </ruleentry>
  1352.                 </rulegroup>
  1353.                 <rulegroup name="allow-run5">
  1354.                     <ruleentry event="registry" match="all" allow="true" customtext="4001">
  1355.                         <!-- Windows AutoRuns Registry Values -->
  1356.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1357.                         <itementry param="value" operator="equalnocase" type="ansi" value="Shell" />
  1358.                     </ruleentry>
  1359.                 </rulegroup>
  1360.                 <rulegroup name="allow-run6">
  1361.                     <ruleentry event="registry" match="all" allow="true" customtext="4010">
  1362.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" />
  1363.                     </ruleentry>
  1364.                 </rulegroup>
  1365.  
  1366.                 <!-- Default local page -->
  1367.                 <rulegroup name="blk-ie-lcpage1">
  1368.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4008">
  1369.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1370.                         <itementry param="value" operator="equalnocase" type="ansi" value="Local Page"/>
  1371.                     </ruleentry>
  1372.                 </rulegroup>
  1373.  
  1374.                 <rulegroup name="blk-ie-lcpage2">
  1375.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4008">
  1376.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main"/>
  1377.                         <itementry param="value" operator="equalnocase" type="ansi" value="Local Page"/>
  1378.                     </ruleentry>
  1379.                 </rulegroup>
  1380.  
  1381.                 <!-- Default start page -->
  1382.                 <rulegroup name="blk-ie-stpgdef">
  1383.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4008">
  1384.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1385.                         <itementry param="value" operator="equalnocase" type="ansi" value="Default_Page_URL"/>
  1386.                     </ruleentry>
  1387.                 </rulegroup>
  1388.  
  1389.                 <!-- Default search page -->
  1390.                 <rulegroup name="blk-ie-srchdef">
  1391.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1392.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1393.                         <itementry param="value" operator="equalnocase" type="ansi" value="Default_Search_URL"/>
  1394.                     </ruleentry>
  1395.                 </rulegroup>
  1396.  
  1397.                 <!-- Block default search URL -->
  1398.                 <rulegroup name="blk-ie-search1">
  1399.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1400.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1401.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomizeSearch" />
  1402.                     </ruleentry>
  1403.                 </rulegroup>
  1404.                 <rulegroup name="blk-ie-search2">
  1405.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1406.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1407.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomSearch" />
  1408.                     </ruleentry>
  1409.                 </rulegroup>
  1410.                 <rulegroup name="blk-ie-search3">
  1411.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1412.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1413.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchAssistant" />
  1414.                     </ruleentry>
  1415.                 </rulegroup>
  1416.                 <rulegroup name="blk-ie-search4">
  1417.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1418.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1419.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomizeSearch" />
  1420.                     </ruleentry>
  1421.                 </rulegroup>
  1422.                 <rulegroup name="blk-ie-search5">
  1423.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1424.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1425.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomSearch" />
  1426.                     </ruleentry>
  1427.                 </rulegroup>
  1428.                 <rulegroup name="blk-ie-search6">
  1429.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1430.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1431.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchAssistant" />
  1432.                     </ruleentry>
  1433.                 </rulegroup>
  1434.                 <rulegroup name="blk-ie-search7">
  1435.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1436.                         <!-- Defines Internet Search Engines -->
  1437.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer" />
  1438.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchUrl" />
  1439.                     </ruleentry>
  1440.                 </rulegroup>
  1441.                 <rulegroup name="blk-ie-search8">
  1442.                     <ruleentry event="registry" match="any" allow="false" notify="true" customtext="4006">
  1443.                         <!-- CLSID of App (URL Search Hook object) that defines a custom network protocol -->
  1444.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks" />
  1445.                     </ruleentry>
  1446.                 </rulegroup>
  1447.                 <rulegroup name="blk-ie-search9">
  1448.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1449.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1450.                         <itementry param="value" operator="equalnocase" type="ansi" value="Search Page"/>
  1451.                     </ruleentry>
  1452.                 </rulegroup>
  1453.                 <rulegroup name="blk-ie-search10">
  1454.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4006">
  1455.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main"/>
  1456.                         <itementry param="value" operator="equalnocase" type="ansi" value="Search Page"/>
  1457.                     </ruleentry>
  1458.                 </rulegroup>
  1459.  
  1460.                 <!-- Block IE Home Page -->
  1461.                 <rulegroup name="blk-ie-home1">
  1462.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4007">
  1463.                         <!-- Defines Internet Search Engines -->
  1464.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main" />
  1465.                         <itementry param="value" operator="equalnocase" type="ansi" value="Start Page" />
  1466.                     </ruleentry>
  1467.                 </rulegroup>
  1468.                 <rulegroup name="blk-ie-home2">
  1469.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4007">
  1470.                         <!-- Defines Internet Search Engines -->
  1471.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main" />
  1472.                         <itementry param="value" operator="equalnocase" type="ansi" value="Start Page" />
  1473.                     </ruleentry>
  1474.                 </rulegroup>
  1475.  
  1476.                 <!-- Allow hosts -->
  1477.                 <rulegroup name="allow-hosts">
  1478.                     <ruleentry event="file" match="any" allow="true" customtext="3001">
  1479.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\etc\hosts" />
  1480.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\etc\lmhosts" />
  1481.                     </ruleentry>
  1482.                 </rulegroup>
  1483.  
  1484.                 <!-- Ask IE Settings -->
  1485.  
  1486.                 <!-- Default local page -->
  1487.                 <rulegroup name="ask-ie-lcpage1">
  1488.                     <ruleentry event="registry" match="all" ask="true" customtext="4008">
  1489.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1490.                         <itementry param="value" operator="equalnocase" type="ansi" value="Local Page"/>
  1491.                     </ruleentry>
  1492.                 </rulegroup>
  1493.  
  1494.                 <rulegroup name="ask-ie-lcpage2">
  1495.                     <ruleentry event="registry" match="all" ask="true" customtext="4008">
  1496.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main"/>
  1497.                         <itementry param="value" operator="equalnocase" type="ansi" value="Local Page"/>
  1498.                     </ruleentry>
  1499.                 </rulegroup>
  1500.  
  1501.                 <!-- Default start page -->
  1502.                 <rulegroup name="ask-ie-stpgdef">
  1503.                     <ruleentry event="registry" match="all" ask="true" customtext="4008">
  1504.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1505.                         <itementry param="value" operator="equalnocase" type="ansi" value="Default_Page_URL"/>
  1506.                     </ruleentry>
  1507.                 </rulegroup>
  1508.  
  1509.                 <!-- Default search page -->
  1510.                 <rulegroup name="ask-ie-srchdef">
  1511.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1512.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1513.                         <itementry param="value" operator="equalnocase" type="ansi" value="Default_Search_URL"/>
  1514.                     </ruleentry>
  1515.                 </rulegroup>
  1516.  
  1517.                 <!-- Ask default search URL -->
  1518.                 <rulegroup name="ask-ie-search1">
  1519.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1520.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1521.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomizeSearch" />
  1522.                     </ruleentry>
  1523.                 </rulegroup>
  1524.                 <rulegroup name="ask-ie-search2">
  1525.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1526.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1527.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomSearch" />
  1528.                     </ruleentry>
  1529.                 </rulegroup>
  1530.                 <rulegroup name="ask-ie-search3">
  1531.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1532.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Search" />
  1533.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchAssistant" />
  1534.                     </ruleentry>
  1535.                 </rulegroup>
  1536.                 <rulegroup name="ask-ie-search4">
  1537.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1538.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1539.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomizeSearch" />
  1540.                     </ruleentry>
  1541.                 </rulegroup>
  1542.                 <rulegroup name="ask-ie-search5">
  1543.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1544.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1545.                         <itementry param="value" operator="equalnocase" type="ansi" value="CustomSearch" />
  1546.                     </ruleentry>
  1547.                 </rulegroup>
  1548.                 <rulegroup name="ask-ie-search6">
  1549.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1550.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Search" />
  1551.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchAssistant" />
  1552.                     </ruleentry>
  1553.                 </rulegroup>
  1554.                 <rulegroup name="ask-ie-search7">
  1555.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1556.                         <!-- Defines Internet Search Engines -->
  1557.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer" />
  1558.                         <itementry param="value" operator="equalnocase" type="ansi" value="SearchUrl" />
  1559.                     </ruleentry>
  1560.                 </rulegroup>
  1561.                 <rulegroup name="ask-ie-search8">
  1562.                     <ruleentry event="registry" match="any" ask="true" customtext="4006">
  1563.                         <!-- CLSID of App (URL Search Hook object) that defines a custom network protocol -->
  1564.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks" />
  1565.                     </ruleentry>
  1566.                 </rulegroup>
  1567.                 <rulegroup name="ask-ie-search9">
  1568.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1569.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main"/>
  1570.                         <itementry param="value" operator="equalnocase" type="ansi" value="Search Page"/>
  1571.                     </ruleentry>
  1572.                 </rulegroup>
  1573.  
  1574.                 <rulegroup name="ask-ie-search10">
  1575.                     <ruleentry event="registry" match="all" ask="true" customtext="4006">
  1576.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main"/>
  1577.                         <itementry param="value" operator="equalnocase" type="ansi" value="Search Page"/>
  1578.                     </ruleentry>
  1579.                 </rulegroup>
  1580.  
  1581.                 <!-- Ask IE Home Page -->
  1582.                 <rulegroup name="ask-ie-home1">
  1583.                     <ruleentry event="registry" match="all" ask="true" customtext="4007">
  1584.                         <!-- Defines Internet Search Engines -->
  1585.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Main" />
  1586.                         <itementry param="value" operator="equalnocase" type="ansi" value="Start Page" />
  1587.                     </ruleentry>
  1588.                 </rulegroup>
  1589.                 <rulegroup name="ask-ie-home2">
  1590.                     <ruleentry event="registry" match="all" ask="true" customtext="4007">
  1591.                         <!-- Defines Internet Search Engines -->
  1592.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Internet Explorer\Main" />
  1593.                         <itementry param="value" operator="equalnocase" type="ansi" value="Start Page" />
  1594.                     </ruleentry>
  1595.                 </rulegroup>
  1596.  
  1597.                 <!-- Ask about Windows initialization -->
  1598.                 <rulegroup name="prot-winini">
  1599.                     <ruleentry event="file" match="any" ask="true" customtext="3002">
  1600.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDIR\win.ini" />
  1601.                         <itementry param="filename" operator="equalnocase" type="ansi" value="ROOT\autoexec.bat" />
  1602.                         <itementry param="filename" operator="equalnocase" type="ansi" value="ROOT\config.sys" />
  1603.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDIR\system.ini" />
  1604.                     </ruleentry>
  1605.                 </rulegroup>
  1606.                 <!-- Ask about hosts -->
  1607.                 <rulegroup name="prot-hosts">
  1608.                     <ruleentry event="file" match="any" ask="true" customtext="3001">
  1609.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\etc\hosts" />
  1610.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\etc\lmhosts" />
  1611.                     </ruleentry>
  1612.                 </rulegroup>
  1613.                 <rulegroup name="askStartupFolder">
  1614.                     <ruleentry event="file" match="any" ask="true" customtext="4017">
  1615.                         <itementry param="filename" operator="equalnocase" type="ansi" value="STARTUP" context="startupdir" />
  1616.                     </ruleentry>
  1617.                 </rulegroup>
  1618.                 <ruleset name="rs-files-ask" allow="true">
  1619.                     <rulerefentry rulegroupref="prot-hosts"/>
  1620.                     <rulerefentry rulegroupref="askStartupFolder"/>
  1621.                     <rulerefentry rulegroupref="protourfiles"/>
  1622.                 </ruleset>
  1623.  
  1624.                 <!-- Ask IE Desktop Wallpaper -->
  1625.                 <rulegroup name="ask-ie-desktop-wp">
  1626.                     <ruleentry event="registry" match="any" ask="true" customtext="4014">
  1627.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Desktop\General" />
  1628.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Internet Explorer\Desktop\Components" />
  1629.                     </ruleentry>
  1630.                 </rulegroup>
  1631.  
  1632.                 <!-- Ask deletion of Advanced Tab -->
  1633.                 <rulegroup name="prot-ie-advanced-tab">
  1634.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1635.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1636.                         <itementry param="value" operator="equalnocase" type="ansi" value="AdvancedTab" />
  1637.                     </ruleentry>
  1638.                 </rulegroup>
  1639.  
  1640.                 <!-- Ask deletion of Connections Tab -->
  1641.                 <rulegroup name="prot-ie-connections-tab">
  1642.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1643.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1644.                         <itementry param="value" operator="equalnocase" type="ansi" value="ConnectionsTab" />
  1645.                     </ruleentry>
  1646.                 </rulegroup>
  1647.  
  1648.                 <!-- Ask deletion of Content Tab -->
  1649.                 <rulegroup name="prot-ie-content-tab">
  1650.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1651.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1652.                         <itementry param="value" operator="equalnocase" type="ansi" value="ContentTab" />
  1653.                     </ruleentry>
  1654.                 </rulegroup>
  1655.  
  1656.                 <!-- Ask deletion of General Tab -->
  1657.                 <rulegroup name="prot-ie-general-tab">
  1658.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1659.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1660.                         <itementry param="value" operator="equalnocase" type="ansi" value="GeneralTab" />
  1661.                     </ruleentry>
  1662.                 </rulegroup>
  1663.  
  1664.                 <!-- Ask disable setting of IE HomePage -->
  1665.                 <rulegroup name="prot-ie-homepage">
  1666.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1667.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1668.                         <itementry param="value" operator="equalnocase" type="ansi" value="HomePage" />
  1669.                     </ruleentry>
  1670.                 </rulegroup>
  1671.  
  1672.                 <!-- Ask deletion of Privacy Tab -->
  1673.                 <rulegroup name="prot-ie-privacy-tab">
  1674.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1675.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1676.                         <itementry param="value" operator="equalnocase" type="ansi" value="PrivacyTab" />
  1677.                     </ruleentry>
  1678.                 </rulegroup>
  1679.  
  1680.                 <!-- Ask deletion of Programms Tab -->
  1681.                 <rulegroup name="prot-ie-programs-tab">
  1682.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1683.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1684.                         <itementry param="value" operator="equalnocase" type="ansi" value="ProgramsTab" />
  1685.                     </ruleentry>
  1686.                 </rulegroup>
  1687.  
  1688.                 <!-- Ask deletion of Security Tab -->
  1689.                 <rulegroup name="prot-ie-security-tab">
  1690.                     <ruleentry event="registry" match="all" ask="true" customtext="4015">
  1691.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" />
  1692.                         <itementry param="value" operator="equalnocase" type="ansi" value="SecurityTab" />
  1693.                     </ruleentry>
  1694.                 </rulegroup>
  1695.  
  1696.                 <rulegroup name="protsysStartup">
  1697.                     <ruleentry event="registry" match="any" ask="true" customtext="4017">
  1698.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup" />
  1699.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts" />
  1700.                     </ruleentry>
  1701.                 </rulegroup>
  1702.  
  1703.                 <rulegroup name="protScreenSaver">
  1704.                     <ruleentry event="registry" match="all" ask="true" customtext="4016">
  1705.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Control Panel\Desktop" />
  1706.                         <itementry param="value" operator="equalnocase" type="ansi" value="Scrnsave.exe" />
  1707.                     </ruleentry>
  1708.                 </rulegroup>
  1709.                 
  1710.                 <!-- Block Windows initialization -->
  1711.                 <rulegroup name="block-winini">
  1712.                     <ruleentry event="file" match="any" ask="true" customtext="3002">
  1713.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDIR\win.ini" />
  1714.                         <itementry param="filename" operator="equalnocase" type="ansi" value="ROOT\autoexec.bat" />
  1715.                         <itementry param="filename" operator="equalnocase" type="ansi" value="ROOT\config.sys" />
  1716.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDIR\system.ini" />
  1717.                     </ruleentry>
  1718.                 </rulegroup>
  1719.                 <!-- Block hosts -->
  1720.                 <rulegroup name="block-hosts">
  1721.                     <ruleentry event="file" match="any" allow="false" notify="true" customtext="3001">
  1722.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\etc\hosts" />
  1723.                         <itementry param="filename" operator="equalnocase" type="ansi" value="WINDRVDIR\etc\lmhosts" />
  1724.                     </ruleentry>
  1725.                 </rulegroup>
  1726.                 <rulegroup name="blockStartupFolder">
  1727.                     <ruleentry event="file" match="any" allow="false" notify="true" customtext="4017">
  1728.                         <itementry param="filename" operator="equalnocase" type="ansi" value="STARTUP" context="startupdir" />
  1729.                     </ruleentry>
  1730.                 </rulegroup>
  1731.  
  1732.                 <ruleset name="rs-files-block" allow="true">
  1733.                     <rulerefentry rulegroupref="block-hosts"/>
  1734.                     <rulerefentry rulegroupref="blockStartupFolder"/>
  1735.                     <rulerefentry rulegroupref="protourfiles"/>
  1736.                 </ruleset>
  1737.  
  1738.                 <!-- Protect our files -->
  1739.                 <ruleset name="rs-files-allow" allow="true">
  1740.                     <rulerefentry rulegroupref="protourfiles"/>
  1741.                 </ruleset>
  1742.  
  1743.                 <!-- Ask about ActiveX installation -->
  1744.                 <rulegroup name="protect-classes">
  1745.                     <ruleentry event="registry" match="any" ask="true" customtext="3003">
  1746.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes" />
  1747.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes\CLSID" />
  1748.                     </ruleentry>
  1749.                 </rulegroup>
  1750.  
  1751.                 <!-- Block ActiveX installation -->
  1752.                 <rulegroup name="block-classes">
  1753.                     <ruleentry event="registry" match="any" allow="false" notify="true" customtext="3003">
  1754.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes" />
  1755.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes\CLSID" />
  1756.                     </ruleentry>
  1757.                 </rulegroup>
  1758.  
  1759.                 <!-- Ask about Startup -->
  1760.                 <rulegroup name="protect-run1">
  1761.                     <ruleentry event="registry" match="any" ask="true" customtext="4001">
  1762.                         <!-- Windows AutoRuns Registry Keys -->
  1763.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Run" />
  1764.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  1765.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  1766.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  1767.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  1768.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  1769.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  1770.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Run" />
  1771.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  1772.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  1773.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  1774.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  1775.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  1776.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  1777.                     </ruleentry>
  1778.                 </rulegroup>
  1779.                 <rulegroup name="protect-run2">
  1780.                     <ruleentry event="registry" match="all" ask="true" customtext="4001">
  1781.                         <!-- Windows AutoRuns Registry Values -->
  1782.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  1783.                         <itementry param="value" operator="equalnocase" type="ansi" value="Run" />
  1784.                     </ruleentry>
  1785.                 </rulegroup>
  1786.                 <rulegroup name="protect-run3">
  1787.                     <ruleentry event="registry" match="all" ask="true" customtext="4001">
  1788.                         <!-- Windows AutoRuns Registry Values -->
  1789.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  1790.                         <itementry param="value" operator="equalnocase" type="ansi" value="Load" />
  1791.                     </ruleentry>
  1792.                 </rulegroup>
  1793.                 <rulegroup name="protect-run4">
  1794.                     <ruleentry event="registry" match="all" ask="true" customtext="4001">
  1795.                         <!-- Windows AutoRuns Registry Values -->
  1796.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1797.                         <itementry param="value" operator="equalnocase" type="ansi" value="Userinit" />
  1798.                     </ruleentry>
  1799.                 </rulegroup>
  1800.                 <rulegroup name="protect-run5">
  1801.                     <ruleentry event="registry" match="all" ask="true" customtext="4001">
  1802.                         <!-- Windows AutoRuns Registry Values -->
  1803.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1804.                         <itementry param="value" operator="equalnocase" type="ansi" value="Shell" />
  1805.                     </ruleentry>
  1806.                 </rulegroup>
  1807.                 <rulegroup name="protect-run5U">
  1808.                     <ruleentry event="registry" match="all" ask="true" customtext="4001">
  1809.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1810.                         <itementry param="value" operator="equalnocase" type="ansi" value="Shell" />
  1811.                     </ruleentry>
  1812.                 </rulegroup>
  1813.                 <rulegroup name="protlogonSys">
  1814.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1815.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1816.                         <itementry param="value" operator="equalnocase" type="ansi" value="System" />
  1817.                     </ruleentry>
  1818.                 </rulegroup>
  1819.                 <rulegroup name="protlogonSysU">
  1820.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1821.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1822.                         <itementry param="value" operator="equalnocase" type="ansi" value="System" />
  1823.                     </ruleentry>
  1824.                 </rulegroup>
  1825.                 <rulegroup name="protlogonGina">
  1826.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1827.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1828.                         <itementry param="value" operator="equalnocase" type="ansi" value="GinaDLL" />
  1829.                     </ruleentry>
  1830.                 </rulegroup>
  1831.                 <rulegroup name="protlogonTMan">
  1832.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1833.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  1834.                         <itementry param="value" operator="equalnocase" type="ansi" value="Taskman" />
  1835.                     </ruleentry>
  1836.                 </rulegroup>
  1837.                 <rulegroup name="protect-run6">
  1838.                     <ruleentry event="registry" match="all" ask="true" customtext="4010">
  1839.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" />
  1840.                     </ruleentry>
  1841.                 </rulegroup>
  1842.                 <rulegroup name="protImageFExec">
  1843.                     <ruleentry event="registry" match="all" ask="true" customtext="4009">
  1844.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" />
  1845.                     </ruleentry>
  1846.                 </rulegroup>
  1847.                 <rulegroup name="protourExecs">
  1848.                     <ruleentry event="registry" match="any" allow="false" notify="true" customtext="2003">
  1849.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe" />
  1850.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe" />
  1851.                     </ruleentry>
  1852.                 </rulegroup>
  1853.                 <rulegroup name="protAvDatVersion">
  1854.                   <ruleentry event="registry" match="all" allow="false" notify="true" customtext="2003">
  1855.                     <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm" />
  1856.                     <itementry param="value" operator="equalnocase" type="ansi" value="AVDatVersion" />
  1857.                   </ruleentry>
  1858.                 </rulegroup>
  1859.  
  1860.                 <rulegroup name="protAvEngVersion">
  1861.                   <ruleentry event="registry" match="all" allow="false" notify="true" customtext="2003">
  1862.                     <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm" />
  1863.                     <itementry param="value" operator="equalnocase" type="ansi" value="AVEngineVer" />
  1864.                   </ruleentry>
  1865.                 </rulegroup>
  1866.  
  1867.                 <rulegroup name="protAvSDKVersion">
  1868.                   <ruleentry event="registry" match="all" allow="false" notify="true" customtext="2003">
  1869.                     <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Zone Labs\ZoneAlarm" />
  1870.                     <itementry param="value" operator="equalnocase" type="ansi" value="AVSDKVersion" />
  1871.                   </ruleentry>
  1872.                 </rulegroup>
  1873.                 <rulegroup name="protZaRunReg">
  1874.                   <ruleentry event="registry" match="all" allow="false" notify="true" customtext="2003">
  1875.                     <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Run" />
  1876.                     <itementry param="value" operator="equalnocase" type="ansi" value="ZoneAlarm Client" />
  1877.                   </ruleentry>
  1878.                 </rulegroup>
  1879.                 <rulegroup name="proIFMapWLogon">
  1880.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1881.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini" />
  1882.                         <itementry param="value" operator="equalnocase" type="ansi" value="Winlogon" />
  1883.                     </ruleentry>
  1884.                 </rulegroup>
  1885.                 <rulegroup name="prot-shellex">
  1886.                     <ruleentry event="registry" match="any" ask="true" customtext="4009">
  1887.                         <!-- Executable behavior -->
  1888.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes\exefile\shell\open\command" />
  1889.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes\exefile\shell\runas\command" />
  1890.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Classes\exefile\shell\open\command" />
  1891.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Classes\exefile\shell\runas\command" />
  1892.                     </ruleentry>
  1893.                 </rulegroup>
  1894.                 <rulegroup name="prot-appinit">
  1895.                     <ruleentry event="registry" match="all" ask="true" customtext="4012">
  1896.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" />
  1897.                         <itementry param="value" operator="equalnocase" type="ansi" value="AppInit_DLLs" />
  1898.                     </ruleentry>
  1899.                 </rulegroup>
  1900.                 <rulegroup name="protcmdAutoRun">
  1901.                     <ruleentry event="registry" match="all" ask="true" customtext="4009">
  1902.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Command Processor" />
  1903.                         <itementry param="value" operator="equalnocase" type="ansi" value="AutoRun" />
  1904.                     </ruleentry>
  1905.                 </rulegroup>
  1906.                 <rulegroup name="protcmdAutoRunU">
  1907.                     <ruleentry event="registry" match="all" ask="true" customtext="4009">
  1908.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Microsoft\Command Processor" />
  1909.                         <itementry param="value" operator="equalnocase" type="ansi" value="AutoRun" />
  1910.                     </ruleentry>
  1911.                 </rulegroup>
  1912.                 <rulegroup name="protSecuPack">
  1913.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1914.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Control\Lsa" />
  1915.                         <itementry param="value" operator="equalnocase" type="ansi" value="Security Packages" />
  1916.                     </ruleentry>
  1917.                 </rulegroup>
  1918.                 <rulegroup name="protAuthPack">
  1919.                     <ruleentry event="registry" match="all" ask="true" customtext="4001">
  1920.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Control\Lsa" />
  1921.                         <itementry param="value" operator="equalnocase" type="ansi" value="Authentication Packages" />
  1922.                     </ruleentry>
  1923.                 </rulegroup>
  1924.                 <rulegroup name="protNotiPack">
  1925.                     <ruleentry event="registry" match="all" ask="true" customtext="4001">
  1926.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Control\Lsa" />
  1927.                         <itementry param="value" operator="equalnocase" type="ansi" value="Notification Packages" />
  1928.                     </ruleentry>
  1929.                 </rulegroup>
  1930.                 <rulegroup name="protSessManager">
  1931.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1932.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Control\Session Manager" />
  1933.                         <itementry param="value" operator="equalnocase" type="ansi" value="BootExecute" />
  1934.                     </ruleentry>
  1935.                 </rulegroup>
  1936.                 <rulegroup name="protBootImage">
  1937.                     <ruleentry event="registry" match="all" ask="true" customtext="4017">
  1938.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Control\BootVerificationProgram" />
  1939.                         <itementry param="value" operator="equalnocase" type="ansi" value="ImagePath" />
  1940.                     </ruleentry>
  1941.                 </rulegroup>
  1942.                 <rulegroup name="protDNSLibPath">
  1943.                     <ruleentry event="registry" match="all" ask="true" customtext="4012">
  1944.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCS\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002" />
  1945.                         <itementry param="value" operator="equalnocase" type="ansi" value="LibraryPath" />
  1946.                     </ruleentry>
  1947.                 </rulegroup>
  1948.                 <rulegroup name="protSTScheduler">
  1949.                     <ruleentry event="registry" match="any" ask="true" customtext="4009">
  1950.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler" />
  1951.                     </ruleentry>
  1952.                 </rulegroup>
  1953.                 <rulegroup name="protShExecHooks">
  1954.                     <ruleentry event="registry" match="any" ask="true" customtext="4009">
  1955.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks" />
  1956.                     </ruleentry>
  1957.                 </rulegroup>
  1958.  
  1959.                 <!-- AskSDenyD registry protection -->
  1960.                 <ruleset name="rs-rega-asdd" allow="true">
  1961.                     <rulerefentry rulegroupref="protect-run1"/>
  1962.                     <rulerefentry rulegroupref="protect-run2"/>
  1963.                     <rulerefentry rulegroupref="protect-run3"/>
  1964.                     <rulerefentry rulegroupref="protect-run4"/>
  1965.                     <rulerefentry rulegroupref="protect-run5"/>
  1966.                     <rulerefentry rulegroupref="prot-shellex"/>
  1967.                     <rulerefentry rulegroupref="prot-appinit"/>
  1968.                     <rulerefentry rulegroupref="ask-ie-srchdef"/>
  1969.                     <rulerefentry rulegroupref="ask-ie-search1"/>
  1970.                     <rulerefentry rulegroupref="ask-ie-search2"/>
  1971.                     <rulerefentry rulegroupref="ask-ie-search3"/>
  1972.                     <rulerefentry rulegroupref="ask-ie-search4"/>
  1973.                     <rulerefentry rulegroupref="ask-ie-search5"/>
  1974.                     <rulerefentry rulegroupref="ask-ie-search6"/>
  1975.                     <rulerefentry rulegroupref="ask-ie-search7"/>
  1976.                     <rulerefentry rulegroupref="ask-ie-search8"/>
  1977.                     <rulerefentry rulegroupref="ask-ie-search9"/>
  1978.                     <rulerefentry rulegroupref="ask-ie-search10"/>
  1979.                     <rulerefentry rulegroupref="ask-ie-home1"/>
  1980.                     <rulerefentry rulegroupref="ask-ie-home2"/>
  1981.                     <rulerefentry rulegroupref="ask-ie-lcpage1"/>
  1982.                     <rulerefentry rulegroupref="ask-ie-lcpage2"/>
  1983.                     <rulerefentry rulegroupref="ask-ie-stpgdef"/>
  1984.                     <rulerefentry rulegroupref="protourreg"/>
  1985.                     <rulerefentry rulegroupref="protourreg1"/>
  1986.                     <rulerefentry rulegroupref="protourreg2"/>
  1987.                     <rulerefentry rulegroupref="protourreg3"/>
  1988.                     <rulerefentry rulegroupref="protZaRunReg"/>
  1989.                     <rulerefentry rulegroupref="protourExecs"/>
  1990.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  1991.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  1992.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  1993.                     <rulerefentry rulegroupref="ask-ie-desktop-wp"/>
  1994.                     <rulerefentry rulegroupref="prot-ie-advanced-tab"/>
  1995.                     <rulerefentry rulegroupref="prot-ie-connections-tab"/>
  1996.                     <rulerefentry rulegroupref="prot-ie-content-tab"/>
  1997.                     <rulerefentry rulegroupref="prot-ie-general-tab"/>
  1998.                     <rulerefentry rulegroupref="prot-ie-homepage"/>
  1999.                     <rulerefentry rulegroupref="prot-ie-privacy-tab"/>
  2000.                     <rulerefentry rulegroupref="prot-ie-programs-tab"/>
  2001.                     <rulerefentry rulegroupref="prot-ie-security-tab"/>
  2002.                     <rulerefentry rulegroupref="protect-run5U"/>
  2003.                     <rulerefentry rulegroupref="protScreenSaver"/>
  2004.                     <rulerefentry rulegroupref="protlogonGina"/>
  2005.                     <rulerefentry rulegroupref="protlogonSys"/>
  2006.                     <rulerefentry rulegroupref="protlogonSysU"/>
  2007.                     <rulerefentry rulegroupref="protlogonTMan"/>
  2008.                     <rulerefentry rulegroupref="protsysStartup"/>
  2009.                     <rulerefentry rulegroupref="protcmdAutoRun"/>
  2010.                     <rulerefentry rulegroupref="protcmdAutoRunU"/>
  2011.                     <rulerefentry rulegroupref="protSecuPack"/>
  2012.                     <rulerefentry rulegroupref="protAuthPack"/>
  2013.                     <rulerefentry rulegroupref="protNotiPack"/>
  2014.                     <rulerefentry rulegroupref="protSessManager"/>
  2015.                     <rulerefentry rulegroupref="protBootImage"/>
  2016.                     <rulerefentry rulegroupref="protImageFExec"/>
  2017.                     <rulerefentry rulegroupref="proIFMapWLogon"/>
  2018.                     <rulerefentry rulegroupref="protDNSLibPath"/>
  2019.                     <rulerefentry rulegroupref="protSTScheduler"/>
  2020.                     <rulerefentry rulegroupref="protShExecHooks"/>
  2021.  
  2022.                 </ruleset>
  2023.  
  2024.                 <!-- AskSD registry protection -->
  2025.                 <ruleset name="rs-rega-asad" allow="true">
  2026.                     <rulerefentry rulegroupref="protect-run1"/>
  2027.                     <rulerefentry rulegroupref="protect-run2"/>
  2028.                     <rulerefentry rulegroupref="protect-run3"/>
  2029.                     <rulerefentry rulegroupref="protect-run4"/>
  2030.                     <rulerefentry rulegroupref="protect-run5"/>
  2031.                     <rulerefentry rulegroupref="protect-run6"/>
  2032.                     <rulerefentry rulegroupref="prot-shellex"/>
  2033.                     <rulerefentry rulegroupref="prot-appinit"/>
  2034.                     <rulerefentry rulegroupref="ask-ie-srchdef"/>
  2035.                     <rulerefentry rulegroupref="ask-ie-search1"/>
  2036.                     <rulerefentry rulegroupref="ask-ie-search2"/>
  2037.                     <rulerefentry rulegroupref="ask-ie-search3"/>
  2038.                     <rulerefentry rulegroupref="ask-ie-search4"/>
  2039.                     <rulerefentry rulegroupref="ask-ie-search5"/>
  2040.                     <rulerefentry rulegroupref="ask-ie-search6"/>
  2041.                     <rulerefentry rulegroupref="ask-ie-search7"/>
  2042.                     <rulerefentry rulegroupref="ask-ie-search8"/>
  2043.                     <rulerefentry rulegroupref="ask-ie-search9"/>
  2044.                     <rulerefentry rulegroupref="ask-ie-search10"/>
  2045.                     <rulerefentry rulegroupref="ask-ie-home1"/>
  2046.                     <rulerefentry rulegroupref="ask-ie-home2"/>
  2047.                     <rulerefentry rulegroupref="ask-ie-lcpage1"/>
  2048.                     <rulerefentry rulegroupref="ask-ie-lcpage2"/>
  2049.                     <rulerefentry rulegroupref="ask-ie-stpgdef"/>
  2050.                     <rulerefentry rulegroupref="protourreg"/>
  2051.                     <rulerefentry rulegroupref="protourreg1"/>
  2052.                     <rulerefentry rulegroupref="protourreg2"/>
  2053.                     <rulerefentry rulegroupref="protourreg3"/>
  2054.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2055.                     <rulerefentry rulegroupref="protourExecs"/>
  2056.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2057.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2058.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2059.                     <rulerefentry rulegroupref="ask-ie-desktop-wp"/>
  2060.                     <rulerefentry rulegroupref="prot-ie-advanced-tab"/>
  2061.                     <rulerefentry rulegroupref="prot-ie-connections-tab"/>
  2062.                     <rulerefentry rulegroupref="prot-ie-content-tab"/>
  2063.                     <rulerefentry rulegroupref="prot-ie-general-tab"/>
  2064.                     <rulerefentry rulegroupref="prot-ie-homepage"/>
  2065.                     <rulerefentry rulegroupref="prot-ie-privacy-tab"/>
  2066.                     <rulerefentry rulegroupref="prot-ie-programs-tab"/>
  2067.                     <rulerefentry rulegroupref="prot-ie-security-tab"/>
  2068.                     <rulerefentry rulegroupref="protect-run5U"/>
  2069.                     <rulerefentry rulegroupref="protScreenSaver"/>
  2070.                     <rulerefentry rulegroupref="protlogonGina"/>
  2071.                     <rulerefentry rulegroupref="protlogonSys"/>
  2072.                     <rulerefentry rulegroupref="protlogonSysU"/>
  2073.                     <rulerefentry rulegroupref="protlogonTMan"/>
  2074.                     <rulerefentry rulegroupref="protsysStartup"/>
  2075.                     <rulerefentry rulegroupref="protcmdAutoRun"/>
  2076.                     <rulerefentry rulegroupref="protcmdAutoRunU"/>
  2077.                     <rulerefentry rulegroupref="protSecuPack"/>
  2078.                     <rulerefentry rulegroupref="protAuthPack"/>
  2079.                     <rulerefentry rulegroupref="protNotiPack"/>
  2080.                     <rulerefentry rulegroupref="protSessManager"/>
  2081.                     <rulerefentry rulegroupref="protBootImage"/>
  2082.                     <rulerefentry rulegroupref="protImageFExec"/>
  2083.                     <rulerefentry rulegroupref="proIFMapWLogon"/>
  2084.                     <rulerefentry rulegroupref="protDNSLibPath"/>
  2085.                     <rulerefentry rulegroupref="protSTScheduler"/>
  2086.                     <rulerefentry rulegroupref="protShExecHooks"/>
  2087.  
  2088.                 </ruleset>
  2089.  
  2090.                 <!-- Ask about Deleting Startup -->
  2091.                 <rulegroup name="askdel-run1">
  2092.                     <ruleentry event="registry" match="any" ask="true" customtext="4004">
  2093.                         <!-- Windows AutoRuns Registry Keys -->
  2094.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Run" />
  2095.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  2096.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  2097.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  2098.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Run" />
  2099.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  2100.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  2101.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  2102.                     </ruleentry>
  2103.                 </rulegroup>
  2104.                 <rulegroup name="askdel-run2">
  2105.                     <ruleentry event="registry" match="all" ask="true" customtext="4004">
  2106.                         <!-- Windows AutoRuns Registry Values -->
  2107.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  2108.                         <itementry param="value" operator="equalnocase" type="ansi" value="Run" />
  2109.                     </ruleentry>
  2110.                 </rulegroup>
  2111.                 <rulegroup name="askdel-run3">
  2112.                     <ruleentry event="registry" match="all" ask="true" customtext="4004">
  2113.                         <!-- Windows AutoRuns Registry Values -->
  2114.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  2115.                         <itementry param="value" operator="equalnocase" type="ansi" value="Load" />
  2116.                     </ruleentry>
  2117.                 </rulegroup>
  2118.                 <rulegroup name="askdel-run4">
  2119.                     <ruleentry event="registry" match="all" ask="true" customtext="4004">
  2120.                         <!-- Windows AutoRuns Registry Values -->
  2121.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  2122.                         <itementry param="value" operator="equalnocase" type="ansi" value="Userinit" />
  2123.                     </ruleentry>
  2124.                 </rulegroup>
  2125.                 <rulegroup name="askdel-run5">
  2126.                     <ruleentry event="registry" match="all" ask="true" customtext="4004">
  2127.                         <!-- Windows AutoRuns Registry Values -->
  2128.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  2129.                         <itementry param="value" operator="equalnocase" type="ansi" value="Shell" />
  2130.                     </ruleentry>
  2131.                 </rulegroup>
  2132.                 <rulegroup name="askdel-run6">
  2133.                     <ruleentry event="registry" match="all" ask="true" customtext="4011">
  2134.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" />
  2135.                     </ruleentry>
  2136.                 </rulegroup>
  2137.                 <rulegroup name="askdel-appinit">
  2138.                     <ruleentry event="registry" match="all" ask="true" customtext="4013">
  2139.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" />
  2140.                         <itementry param="value" operator="equalnocase" type="ansi" value="AppInit_DLLs" />
  2141.                     </ruleentry>
  2142.                 </rulegroup>
  2143.                 
  2144.                 <!-- AskSDenyD delete registry protection -->
  2145.                 <ruleset name="rs-regd-asdd" allow="true">
  2146.                     <rulerefentry rulegroupref="askdel-run1"/>
  2147.                     <rulerefentry rulegroupref="askdel-run2"/>
  2148.                     <rulerefentry rulegroupref="askdel-run3"/>
  2149.                     <rulerefentry rulegroupref="askdel-run4"/>
  2150.                     <rulerefentry rulegroupref="askdel-run5"/>
  2151.                     <rulerefentry rulegroupref="askdel-run6"/>
  2152.                     <rulerefentry rulegroupref="askdel-appinit"/>
  2153.                     <rulerefentry rulegroupref="protourreg"/>
  2154.                     <rulerefentry rulegroupref="protourreg1"/>
  2155.                     <rulerefentry rulegroupref="protourreg2"/>
  2156.                     <rulerefentry rulegroupref="protourreg3"/>
  2157.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2158.                     <rulerefentry rulegroupref="protourExecs"/>
  2159.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2160.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2161.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2162.                 </ruleset>
  2163.  
  2164.                 <!-- AskSD delete registry protection -->
  2165.                 <ruleset name="rs-regd-asad" allow="true">
  2166.                     <rulerefentry rulegroupref="askdel-run1"/>
  2167.                     <rulerefentry rulegroupref="askdel-run2"/>
  2168.                     <rulerefentry rulegroupref="askdel-run3"/>
  2169.                     <rulerefentry rulegroupref="askdel-run4"/>
  2170.                     <rulerefentry rulegroupref="askdel-run5"/>
  2171.                     <rulerefentry rulegroupref="askdel-run6"/>
  2172.                     <rulerefentry rulegroupref="askdel-appinit"/>
  2173.                     <rulerefentry rulegroupref="protourreg"/>
  2174.                     <rulerefentry rulegroupref="protourreg1"/>
  2175.                     <rulerefentry rulegroupref="protourreg2"/>
  2176.                     <rulerefentry rulegroupref="protourreg3"/>
  2177.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2178.                     <rulerefentry rulegroupref="protourExecs"/>
  2179.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2180.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2181.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2182.                 </ruleset>
  2183.  
  2184.                 <!-- AllowSAskD delete registry protection -->
  2185.                 <ruleset name="rs-regd-sad" allow="true">
  2186.                     <rulerefentry rulegroupref="protourreg"/>
  2187.                     <rulerefentry rulegroupref="protourreg1"/>
  2188.                     <rulerefentry rulegroupref="protourreg2"/>
  2189.                     <rulerefentry rulegroupref="protourreg3"/>
  2190.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2191.                     <rulerefentry rulegroupref="protourExecs"/>
  2192.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2193.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2194.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2195.                 </ruleset>
  2196.  
  2197.                 <!-- AllowSDenyD delete registry protection -->
  2198.                 <ruleset name="rs-regd-sdd" allow="true">
  2199.                     <rulerefentry rulegroupref="protourreg"/>
  2200.                     <rulerefentry rulegroupref="protourreg1"/>
  2201.                     <rulerefentry rulegroupref="protourreg2"/>
  2202.                     <rulerefentry rulegroupref="protourreg3"/>
  2203.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2204.                     <rulerefentry rulegroupref="protourExecs"/>
  2205.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2206.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2207.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2208.                 </ruleset>
  2209.  
  2210.                 <!-- Block Adding Startup -->
  2211.                 <rulegroup name="block-run1">
  2212.                     <ruleentry event="registry" match="any" allow="false" notify="true" customtext="4001">
  2213.                         <!-- Windows AutoRuns Registry Keys -->
  2214.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Run" />
  2215.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  2216.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  2217.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  2218.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  2219.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  2220.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  2221.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Run" />
  2222.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  2223.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  2224.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  2225.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  2226.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  2227.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  2228.                     </ruleentry>
  2229.                 </rulegroup>
  2230.                 <rulegroup name="block-run2">
  2231.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4001">
  2232.                         <!-- Windows AutoRuns Registry Values -->
  2233.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  2234.                         <itementry param="value" operator="equalnocase" type="ansi" value="Run" />
  2235.                     </ruleentry>
  2236.                 </rulegroup>
  2237.                 <rulegroup name="block-run3">
  2238.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4001">
  2239.                         <!-- Windows AutoRuns Registry Values -->
  2240.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  2241.                         <itementry param="value" operator="equalnocase" type="ansi" value="Load" />
  2242.                     </ruleentry>
  2243.                 </rulegroup>
  2244.                 <rulegroup name="block-run4">
  2245.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4001">
  2246.                         <!-- Windows AutoRuns Registry Values -->
  2247.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  2248.                         <itementry param="value" operator="equalnocase" type="ansi" value="Userinit" />
  2249.                     </ruleentry>
  2250.                 </rulegroup>
  2251.                 <rulegroup name="block-run5">
  2252.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4001">
  2253.                         <!-- Windows AutoRuns Registry Values -->
  2254.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  2255.                         <itementry param="value" operator="equalnocase" type="ansi" value="Shell" />
  2256.                     </ruleentry>
  2257.                 </rulegroup>
  2258.                 <rulegroup name="block-run6">
  2259.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4010">
  2260.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" />
  2261.                     </ruleentry>
  2262.                 </rulegroup>
  2263.                 <rulegroup name="block-shellex">
  2264.                     <ruleentry event="registry" match="any" allow="false" notify="true" customtext="4009">
  2265.                         <!-- Executable behavior -->
  2266.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes\exefile\shell\open\command" />
  2267.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Classes\exefile\shell\runas\command" />
  2268.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Classes\exefile\shell\open\command" />
  2269.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\SOFTWARE\Classes\exefile\shell\runas\command" />
  2270.                     </ruleentry>
  2271.                  </rulegroup>
  2272.                 <rulegroup name="block-appinit">
  2273.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4013">
  2274.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" />
  2275.                         <itementry param="value" operator="equalnocase" type="ansi" value="AppInit_DLLs" />
  2276.                     </ruleentry>
  2277.                 </rulegroup>
  2278.  
  2279.                 <ruleset name="rs-rega-block" allow="true">
  2280.                     <rulerefentry rulegroupref="block-run1"/>
  2281.                     <rulerefentry rulegroupref="block-run2"/>
  2282.                     <rulerefentry rulegroupref="block-run3"/>
  2283.                     <rulerefentry rulegroupref="block-run4"/>
  2284.                     <rulerefentry rulegroupref="block-run5"/>
  2285.                     <rulerefentry rulegroupref="block-run6"/>
  2286.                     <rulerefentry rulegroupref="block-shellex"/>
  2287.                     <rulerefentry rulegroupref="block-appinit"/>
  2288.                     <rulerefentry rulegroupref="blk-ie-search1"/>
  2289.                     <rulerefentry rulegroupref="blk-ie-search2"/>
  2290.                     <rulerefentry rulegroupref="blk-ie-search3"/>
  2291.                     <rulerefentry rulegroupref="blk-ie-search4"/>
  2292.                     <rulerefentry rulegroupref="blk-ie-search5"/>
  2293.                     <rulerefentry rulegroupref="blk-ie-search6"/>
  2294.                     <rulerefentry rulegroupref="blk-ie-search7"/>
  2295.                     <rulerefentry rulegroupref="blk-ie-search8"/>
  2296.                     <rulerefentry rulegroupref="blk-ie-search9"/>
  2297.                     <rulerefentry rulegroupref="blk-ie-search10"/>
  2298.                     <rulerefentry rulegroupref="blk-ie-srchdef" />
  2299.                     <rulerefentry rulegroupref="blk-ie-home1"/>
  2300.                     <rulerefentry rulegroupref="blk-ie-home2"/>
  2301.                     <rulerefentry rulegroupref="blk-ie-lcpage1"/>
  2302.                     <rulerefentry rulegroupref="blk-ie-lcpage2"/>
  2303.                     <rulerefentry rulegroupref="blk-ie-stpgdef"/>
  2304.                     <rulerefentry rulegroupref="protourreg"/>
  2305.                     <rulerefentry rulegroupref="protourreg1"/>
  2306.                     <rulerefentry rulegroupref="protourreg2"/>
  2307.                     <rulerefentry rulegroupref="protourreg3"/>
  2308.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2309.                     <rulerefentry rulegroupref="protourExecs"/>
  2310.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2311.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2312.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2313.                     <rulerefentry rulegroupref="ask-ie-desktop-wp"/>
  2314.                     <rulerefentry rulegroupref="prot-ie-advanced-tab"/>
  2315.                     <rulerefentry rulegroupref="prot-ie-connections-tab"/>
  2316.                     <rulerefentry rulegroupref="prot-ie-content-tab"/>
  2317.                     <rulerefentry rulegroupref="prot-ie-general-tab"/>
  2318.                     <rulerefentry rulegroupref="prot-ie-homepage"/>
  2319.                     <rulerefentry rulegroupref="prot-ie-privacy-tab"/>
  2320.                     <rulerefentry rulegroupref="prot-ie-programs-tab"/>
  2321.                     <rulerefentry rulegroupref="prot-ie-security-tab"/>
  2322.                     <rulerefentry rulegroupref="protect-run5U"/>
  2323.                     <rulerefentry rulegroupref="protScreenSaver"/>
  2324.                     <rulerefentry rulegroupref="protlogonGina"/>
  2325.                     <rulerefentry rulegroupref="protlogonSys"/>
  2326.                     <rulerefentry rulegroupref="protlogonSysU"/>
  2327.                     <rulerefentry rulegroupref="protlogonTMan"/>
  2328.                     <rulerefentry rulegroupref="protsysStartup"/>
  2329.                     <rulerefentry rulegroupref="protcmdAutoRun"/>
  2330.                     <rulerefentry rulegroupref="protcmdAutoRunU"/>
  2331.                     <rulerefentry rulegroupref="protSecuPack"/>
  2332.                     <rulerefentry rulegroupref="protAuthPack"/>
  2333.                     <rulerefentry rulegroupref="protNotiPack"/>
  2334.                     <rulerefentry rulegroupref="protSessManager"/>
  2335.                     <rulerefentry rulegroupref="protBootImage"/>
  2336.                     <rulerefentry rulegroupref="protImageFExec"/>
  2337.                     <rulerefentry rulegroupref="proIFMapWLogon"/>
  2338.                     <rulerefentry rulegroupref="protDNSLibPath"/>
  2339.                     <rulerefentry rulegroupref="protSTScheduler"/>
  2340.                     <rulerefentry rulegroupref="protShExecHooks"/>
  2341.  
  2342.                 </ruleset>
  2343.  
  2344.                 <!-- Block Deleting Startup -->
  2345.                 <rulegroup name="block-run1">
  2346.                     <ruleentry event="registry" match="any" allow="false" notify="true" customtext="4004">
  2347.                         <!-- Windows AutoRuns Registry Keys -->
  2348.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Run" />
  2349.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  2350.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  2351.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  2352.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  2353.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  2354.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  2355.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Run" />
  2356.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" />
  2357.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" />
  2358.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" />
  2359.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" />
  2360.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" />
  2361.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" />
  2362.                     </ruleentry>
  2363.                 </rulegroup>
  2364.                 <rulegroup name="block-run2">
  2365.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4004">
  2366.                         <!-- Windows AutoRuns Registry Values -->
  2367.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  2368.                         <itementry param="value" operator="equalnocase" type="ansi" value="Run" />
  2369.                     </ruleentry>
  2370.                 </rulegroup>
  2371.                 <rulegroup name="block-run3">
  2372.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4004">
  2373.                         <!-- Windows AutoRuns Registry Values -->
  2374.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" />
  2375.                         <itementry param="value" operator="equalnocase" type="ansi" value="Load" />
  2376.                     </ruleentry>
  2377.                 </rulegroup>
  2378.                 <rulegroup name="block-run4">
  2379.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4004">
  2380.                         <!-- Windows AutoRuns Registry Values -->
  2381.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  2382.                         <itementry param="value" operator="equalnocase" type="ansi" value="Userinit" />
  2383.                     </ruleentry>
  2384.                 </rulegroup>
  2385.                 <rulegroup name="block-run5">
  2386.                     <ruleentry event="registry" match="all" allow="false" notify="true" customtext="4004">
  2387.                         <!-- Windows AutoRuns Registry Values -->
  2388.                         <itementry param="key" operator="equalnocase" type="ansi" value="HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" />
  2389.                         <itementry param="value" operator="equalnocase" type="ansi" value="Shell" />
  2390.                     </ruleentry>
  2391.                 </rulegroup>
  2392.  
  2393.                 <ruleset name="rs-regd-block" allow="true">
  2394.                     <rulerefentry rulegroupref="block-run1"/>
  2395.                     <rulerefentry rulegroupref="block-run2"/>
  2396.                     <rulerefentry rulegroupref="block-run3"/>
  2397.                     <rulerefentry rulegroupref="block-run4"/>
  2398.                     <rulerefentry rulegroupref="block-run5"/>
  2399.                     <rulerefentry rulegroupref="block-shellex"/>
  2400.                     <rulerefentry rulegroupref="block-appinit"/>
  2401.                     <rulerefentry rulegroupref="blk-ie-search1"/>
  2402.                     <rulerefentry rulegroupref="blk-ie-search2"/>
  2403.                     <rulerefentry rulegroupref="blk-ie-search3"/>
  2404.                     <rulerefentry rulegroupref="blk-ie-search4"/>
  2405.                     <rulerefentry rulegroupref="blk-ie-search5"/>
  2406.                     <rulerefentry rulegroupref="blk-ie-search6"/>
  2407.                     <rulerefentry rulegroupref="blk-ie-search7"/>
  2408.                     <rulerefentry rulegroupref="blk-ie-search8"/>
  2409.                     <rulerefentry rulegroupref="blk-ie-search9"/>
  2410.                     <rulerefentry rulegroupref="blk-ie-search10"/>
  2411.                     <rulerefentry rulegroupref="blk-ie-srchdef" />
  2412.                     <rulerefentry rulegroupref="blk-ie-home1"/>
  2413.                     <rulerefentry rulegroupref="blk-ie-home2"/>
  2414.                     <rulerefentry rulegroupref="blk-ie-lcpage1"/>
  2415.                     <rulerefentry rulegroupref="blk-ie-lcpage2"/>
  2416.                     <rulerefentry rulegroupref="blk-ie-stpgdef"/>
  2417.                     <rulerefentry rulegroupref="protourreg"/>
  2418.                     <rulerefentry rulegroupref="protourreg1"/>
  2419.                     <rulerefentry rulegroupref="protourreg2"/>
  2420.                     <rulerefentry rulegroupref="protourreg3"/>
  2421.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2422.                     <rulerefentry rulegroupref="protourExecs"/>
  2423.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2424.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2425.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2426.                 </ruleset>
  2427.  
  2428.                 <!-- AllowSD and Protect our keys -->
  2429.                 <ruleset name="rs-reg-allow" allow="true">
  2430.                     <rulerefentry rulegroupref="protourreg"/>
  2431.                     <rulerefentry rulegroupref="protourreg1"/>
  2432.                     <rulerefentry rulegroupref="protourreg2"/>
  2433.                     <rulerefentry rulegroupref="protourreg3"/>
  2434.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2435.                     <rulerefentry rulegroupref="protourExecs"/>
  2436.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2437.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2438.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2439.                 </ruleset>
  2440.  
  2441.                 <!-- AllowSAskD and Protect our keys -->
  2442.                 <ruleset name="rs-rega-sdd" allow="true">
  2443.                     <rulerefentry rulegroupref="protourreg"/>
  2444.                     <rulerefentry rulegroupref="protourreg1"/>
  2445.                     <rulerefentry rulegroupref="protourreg2"/>
  2446.                     <rulerefentry rulegroupref="protourreg3"/>
  2447.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2448.                     <rulerefentry rulegroupref="protourExecs"/>
  2449.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2450.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2451.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2452.                 </ruleset>
  2453.  
  2454.                 <!-- AllowSDenyD and Protect our keys -->
  2455.                 <ruleset name="rs-rega-sad" allow="true">
  2456.                     <rulerefentry rulegroupref="protourreg"/>
  2457.                     <rulerefentry rulegroupref="protourreg1"/>
  2458.                     <rulerefentry rulegroupref="protourreg2"/>
  2459.                     <rulerefentry rulegroupref="protourreg3"/>
  2460.                     <rulerefentry rulegroupref="protZaRunReg"/>
  2461.                     <rulerefentry rulegroupref="protourExecs"/>
  2462.                     <rulerefentry rulegroupref="protAvDatVersion"/>
  2463.                     <rulerefentry rulegroupref="protAvEngVersion"/>
  2464.                     <rulerefentry rulegroupref="protAvSDKVersion"/>
  2465.                 </ruleset>
  2466.  
  2467.                 <!-- Public Event Groups In Ascending Order of Weight -->
  2468.  
  2469.                 <eventgroup name="DenySD" description="DenySD" weight="15" allowweightranges="0-19,FE-FE" severityref="normal" trustChoice="restricted" trustDisplay="restricted" trustDetail="DenySD">
  2470.  
  2471.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2472.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2473.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2474.                     <evententry class="srcproc" event="process" subevent="startupprocess" allow="true" />
  2475.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2476.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2477.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2478.                     <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  2479.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2480.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2481.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2482.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2483.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook" rulegroupref="rg-glbhook-blk" />
  2484.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-rega-block"/>
  2485.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-rega-block"/>
  2486.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-regd-block"/>
  2487.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-regd-block"/>
  2488.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-rega-block"/>
  2489.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-block"/>
  2490.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-block"/>
  2491.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2492.                     <evententry class="srcproc" event="driver" subevent="load" rulegroupref="rg-drvld-blk" />
  2493.                     <evententry class="srcproc" event="driver" subevent="unload" rulegroupref="rg-drvud-blk" />
  2494.                     <evententry class="srcproc" event="driver" subevent="connect" rulegroupref="rg-drvct-blk" />
  2495.                     <evententry class="srcproc" event="driver" subevent="create" rulegroupref="rg-drvcr-blk" />
  2496.                     <evententry class="srcproc" event="driver" subevent="modify" rulegroupref="rg-drvmd-blk" />
  2497.                     <evententry class="srcproc" event="driver" subevent="delete" rulegroupref="rg-drvdl-blk" />
  2498.                     <evententry class="srcproc" event="physmem" subevent="map" rulegroupref="rg-memmp-blk" />
  2499.  
  2500.                     <evententry class="dstproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2501.                     <evententry class="dstproc" event="process" subevent="openthread" rulegroupref="rg-opent-ask" />
  2502.                     <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  2503.                     <evententry class="dstproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2504.                     <evententry class="dstproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2505.                     <evententry class="dstproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-ask" />
  2506.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  2507.                     <evententry class="dstproc" event="message" subevent="dde" rulegroupref="rg-ddein-ask" />
  2508.                     <evententry class="dstproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2509.                     <evententry class="dstproc" event="execution" subevent="callback" rulegroupref="rg-callb-ask" />
  2510.                     <evententry class="dstproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-ask" />
  2511.  
  2512.                 </eventgroup>
  2513.  
  2514.                 <eventgroup name="AskSDenyD" description="AskSDenyD" weight="25" allowweightranges="0-29,FE-FE" askweightranges="30-39" severityref="suspicious" trustDisplay="restricted" trustDetail="AskSDenyD">
  2515.  
  2516.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2517.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2518.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2519.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  2520.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2521.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2522.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2523.                     <evententry class="srcproc" event="message" subevent="mouse" allow="true" />
  2524.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2525.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2526.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2527.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2528.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook" rulegroupref="rg-glbhook-blk" />
  2529.                     <evententry class="srcproc" event="registry" subevent="setkey"  rulesetref="rs-rega-asdd"/>
  2530.                     <evententry class="srcproc" event="registry" subevent="setvalue"  rulesetref="rs-rega-asdd"/>
  2531.                     <evententry class="srcproc" event="registry" subevent="delkey"  rulesetref="rs-regd-asdd"/>
  2532.                     <evententry class="srcproc" event="registry" subevent="delvalue"  rulesetref="rs-regd-asdd"/>
  2533.                     <evententry class="srcproc" event="registry" subevent="createkey"  rulesetref="rs-rega-asdd"/>
  2534.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-block"/>
  2535.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-block"/>
  2536.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2537.                     <evententry class="srcproc" event="driver" subevent="load"  rulegroupref="rg-drvld-blk" />
  2538.                     <evententry class="srcproc" event="driver" subevent="unload"  rulegroupref="rg-drvud-ask" />
  2539.                     <evententry class="srcproc" event="driver" subevent="connect"  allow="true" />
  2540.                     <evententry class="srcproc" event="driver" subevent="create" rulegroupref="rg-drvcr-blk" />
  2541.                     <evententry class="srcproc" event="driver" subevent="modify" rulegroupref="rg-drvmd-blk" />
  2542.                     <evententry class="srcproc" event="driver" subevent="delete" rulegroupref="rg-drvdl-blk" />
  2543.                     <evententry class="srcproc" event="physmem" subevent="map"  rulegroupref="rg-memmp-blk" />
  2544.  
  2545.                     <evententry class="dstproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2546.                     <evententry class="dstproc" event="process" subevent="openthread" rulegroupref="rg-opent-ask" />
  2547.                     <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  2548.                     <evententry class="dstproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2549.                     <evententry class="dstproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2550.                     <evententry class="dstproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-ask" />
  2551.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  2552.                     <evententry class="dstproc" event="message" subevent="dde" rulegroupref="rg-ddein-ask" />
  2553.                     <evententry class="dstproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2554.                     <evententry class="dstproc" event="execution" subevent="callback" rulegroupref="rg-callb-ask" />
  2555.                     <evententry class="dstproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-ask" />
  2556.  
  2557.                 </eventgroup>
  2558.  
  2559.                 <eventgroup name="AllowSDenyD" description="AllowSDenyD" weight="35" allowweightranges="0-39,FE-FE" severityref="suspicious" trustDisplay="trusted" trustDetail="AllowSDenyD">
  2560.  
  2561.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2562.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2563.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2564.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  2565.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2566.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2567.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2568.                     <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  2569.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2570.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2571.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2572.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2573.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook" rulegroupref="rg-glbhook-blk" />
  2574.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-rega-sdd"/>
  2575.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-rega-sdd"/>
  2576.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-regd-sdd"/>
  2577.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-regd-sdd"/>
  2578.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-rega-sdd"/>
  2579.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-block"/>
  2580.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-block"/>
  2581.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2582.                     <evententry class="srcproc" event="driver" subevent="load" rulegroupref="rg-drvld-blk" />
  2583.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  2584.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  2585.                     <evententry class="srcproc" event="driver" subevent="create" rulegroupref="rg-drvcr-blk" />
  2586.                     <evententry class="srcproc" event="driver" subevent="modify" rulegroupref="rg-drvmd-blk" />
  2587.                     <evententry class="srcproc" event="driver" subevent="delete" rulegroupref="rg-drvdl-blk" />
  2588.                     <evententry class="srcproc" event="physmem" subevent="map" rulegroupref="rg-memmp-blk" />
  2589.  
  2590.                     <evententry class="dstproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2591.                     <evententry class="dstproc" event="process" subevent="openthread" rulegroupref="rg-opent-ask" />
  2592.                     <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  2593.                     <evententry class="dstproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2594.                     <evententry class="dstproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2595.                     <evententry class="dstproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-ask" />
  2596.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  2597.                     <evententry class="dstproc" event="message" subevent="dde" rulegroupref="rg-ddein-ask" />
  2598.                     <evententry class="dstproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2599.                     <evententry class="dstproc" event="execution" subevent="callback" rulegroupref="rg-callb-ask" />
  2600.                     <evententry class="dstproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-ask" />
  2601.  
  2602.                 </eventgroup>
  2603.  
  2604.                 <eventgroup name="AskSD" description="AskSD" weight="45" allowweightranges="0-29,40-49,FE-FE" askweightranges="30-39,50-69" severityref="dangerous" trustChoice="ask" trustDisplay="ask" trustDetail="AskSD">
  2605.  
  2606.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2607.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2608.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2609.                     <evententry class="srcproc" event="process" subevent="startupprocess"  ask="true" />
  2610.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2611.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2612.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2613.                     <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  2614.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2615.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2616.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2617.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2618.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  rulegroupref="rg-glbhook-ask" />
  2619.                     <evententry class="srcproc" event="registry" subevent="setkey"  rulesetref="rs-rega-asad"/>
  2620.                     <evententry class="srcproc" event="registry" subevent="setvalue"  rulesetref="rs-rega-asad"/>
  2621.                     <evententry class="srcproc" event="registry" subevent="delkey"  rulesetref="rs-regd-asad"/>
  2622.                     <evententry class="srcproc" event="registry" subevent="delvalue"  rulesetref="rs-regd-asad"/>
  2623.                     <evententry class="srcproc" event="registry" subevent="createkey"  rulesetref="rs-rega-asad"/>
  2624.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-ask"/>
  2625.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-ask"/>
  2626.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2627.                     <evententry class="srcproc" event="driver" subevent="load"  rulegroupref="rg-drvld-ask" />
  2628.                     <evententry class="srcproc" event="driver" subevent="unload"  rulegroupref="rg-drvud-ask" />
  2629.                     <evententry class="srcproc" event="driver" subevent="connect"  allow="true" />
  2630.                     <evententry class="srcproc" event="driver" subevent="create" rulegroupref="rg-drvcr-ask" />
  2631.                     <evententry class="srcproc" event="driver" subevent="modify" rulegroupref="rg-drvmd-ask" />
  2632.                     <evententry class="srcproc" event="driver" subevent="delete" rulegroupref="rg-drvdl-ask" />
  2633.                     <evententry class="srcproc" event="physmem" subevent="map"  rulegroupref="rg-memmp-ask" />
  2634.  
  2635.                     <evententry class="dstproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2636.                     <evententry class="dstproc" event="process" subevent="openthread" rulegroupref="rg-opent-ask" />
  2637.                     <evententry class="dstproc" event="process" subevent="startupprocess" weight="FF" ask="true" />
  2638.                     <evententry class="dstproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2639.                     <evententry class="dstproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2640.                     <evententry class="dstproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-ask" />
  2641.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  2642.                     <evententry class="dstproc" event="message" subevent="dde" rulegroupref="rg-ddein-ask" />
  2643.                     <evententry class="dstproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2644.                     <evententry class="dstproc" event="execution" subevent="callback" rulegroupref="rg-callb-ask" />
  2645.                     <evententry class="dstproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-ask" />
  2646.  
  2647.                 </eventgroup>
  2648.  
  2649.                 <eventgroup name="AllowSAskD" description="AllowSAskD" weight="55" allowweightranges="0-59,FE-FE" askweightranges="60-69" severityref="dangerous" trustChoice="trusted" trustDisplay="trusted" trustDetail="AllowSAskD">
  2650.  
  2651.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2652.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2653.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2654.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  2655.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2656.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2657.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2658.                     <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  2659.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2660.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2661.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2662.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2663.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  rulegroupref="rg-glbhook-ask" />
  2664.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-rega-sad"/>
  2665.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-rega-sad"/>
  2666.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-regd-sad"/>
  2667.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-regd-sad"/>
  2668.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-rega-sad"/>
  2669.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-ask"/>
  2670.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-ask"/>
  2671.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2672.                     <evententry class="srcproc" event="driver" subevent="load" rulegroupref="rg-drvld-ask" />
  2673.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  2674.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  2675.                     <evententry class="srcproc" event="driver" subevent="create" rulegroupref="rg-drvcr-ask" />
  2676.                     <evententry class="srcproc" event="driver" subevent="modify" rulegroupref="rg-drvmd-ask" />
  2677.                     <evententry class="srcproc" event="driver" subevent="delete" rulegroupref="rg-drvdl-ask" />
  2678.                     <evententry class="srcproc" event="physmem" subevent="map" rulegroupref="rg-memmp-ask" />
  2679.  
  2680.                     <evententry class="dstproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2681.                     <evententry class="dstproc" event="process" subevent="openthread" rulegroupref="rg-opent-ask" />
  2682.                     <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  2683.                     <evententry class="dstproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2684.                     <evententry class="dstproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2685.                     <evententry class="dstproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-ask" />
  2686.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  2687.                     <evententry class="dstproc" event="message" subevent="dde" rulegroupref="rg-ddein-ask" />
  2688.                     <evententry class="dstproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2689.                     <evententry class="dstproc" event="execution" subevent="callback" rulegroupref="rg-callb-ask" />
  2690.                     <evententry class="dstproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-ask" />
  2691.  
  2692.                 </eventgroup>
  2693.  
  2694.                 <eventgroup name="AllowSD" description="AllowSD" weight="65" allowweightranges="0-69,FE-FE" severityref="dangerous" trustChoice="super" trustDisplay="super" trustDetail="AllowSD">
  2695.  
  2696.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2697.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2698.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2699.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  2700.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2701.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2702.                     <evententry class="srcproc" event="message" subevent="keyboard"  weight="66" allow="true" />
  2703.                     <evententry class="srcproc" event="message" subevent="mouse" weight="66" allow="true" />
  2704.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2705.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2706.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2707.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2708.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  2709.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-reg-allow" />
  2710.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-reg-allow" />
  2711.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-reg-allow" />
  2712.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-reg-allow" />
  2713.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-reg-allow" />
  2714.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-allow"/>
  2715.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-allow"/>
  2716.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2717.                     <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  2718.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  2719.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  2720.                     <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  2721.                     <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  2722.                     <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  2723.                     <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  2724.  
  2725.                     <evententry class="dstproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2726.                     <evententry class="dstproc" event="process" subevent="openthread" rulegroupref="rg-opent-ask" />
  2727.                     <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  2728.                     <evententry class="dstproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2729.                     <evententry class="dstproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2730.                     <evententry class="dstproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-ask" />
  2731.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  2732.                     <evententry class="dstproc" event="message" subevent="dde" rulegroupref="rg-ddein-ask" />
  2733.                     <evententry class="dstproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2734.                     <evententry class="dstproc" event="execution" subevent="callback" rulegroupref="rg-callb-ask" />
  2735.                     <evententry class="dstproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-ask" />
  2736.  
  2737.                </eventgroup>
  2738.  
  2739.            <!-- THIS MIRRORS "trust-unprot" AND SHOULD STAY IN SYNC WITH THAT GROUP -->
  2740.                <eventgroup name="no-osfw" description="no-osfw" weight="65" allowweightranges="0-69,FE-FE" severityref="normal" trustChoice="no-osfw" trustDisplay="no-osfw">
  2741.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2742.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2743.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2744.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  2745.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2746.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2747.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2748.                     <evententry class="srcproc" event="message" subevent="mouse" weight="66" allow="true" />
  2749.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2750.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2751.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2752.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2753.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  2754.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-reg-allow" />
  2755.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-reg-allow" />
  2756.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-reg-allow" />
  2757.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-reg-allow" />
  2758.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-reg-allow" />
  2759.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-allow"/>
  2760.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-allow"/>
  2761.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2762.                     <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  2763.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  2764.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  2765.                     <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  2766.                     <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  2767.                     <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  2768.                     <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  2769.  
  2770.                     <evententry class="dstproc" event="process" subevent="openprocess" weight="65" allow="true" />
  2771.                     <evententry class="dstproc" event="process" subevent="openthread" weight="65" allow="true" />
  2772.                     <evententry class="dstproc" event="process" subevent="startupprocess" weight="65" allow="true" />
  2773.                     <evententry class="dstproc" event="process" subevent="terminateprocess" weight="65" allow="true" />
  2774.                     <evententry class="dstproc" event="process" subevent="oleconnect" weight="65" allow="true" />
  2775.                     <evententry class="dstproc" event="message" subevent="keyboard" weight="65" allow="true" />
  2776.                     <evententry class="dstproc" event="message" subevent="mouse" weight="65" allow="true" />
  2777.                     <evententry class="dstproc" event="message" subevent="dde" weight="65" allow="true" />
  2778.                     <evententry class="dstproc" event="message" subevent="message"  weight="65" allow="true" />
  2779.                     <evententry class="dstproc" event="execution" subevent="callback" weight="65" allow="true" />
  2780.                     <evententry class="dstproc" event="execution" subevent="windowshook" weight="65" allow="true" />
  2781.  
  2782.                 </eventgroup>
  2783.  
  2784.                 <eventgroup name="sys-level1" description="sys-level1" weight="66" allowweightranges="0-69,FE-FE" severityref="dangerous" trustDisplay="super">
  2785.  
  2786.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2787.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2788.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2789.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  2790.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2791.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2792.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2793.                     <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  2794.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2795.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2796.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2797.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2798.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  2799.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-reg-allow" />
  2800.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-reg-allow" />
  2801.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-reg-allow" />
  2802.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-reg-allow" />
  2803.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-reg-allow" />
  2804.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-allow" />
  2805.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-allow" />
  2806.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2807.                     <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  2808.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  2809.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  2810.                     <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  2811.                     <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  2812.                     <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  2813.                     <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  2814.  
  2815.                     <evententry class="dstproc" event="process" subevent="openprocess" weight="65" rulegroupref="rg-openp-ask" />
  2816.                     <evententry class="dstproc" event="process" subevent="openthread" weight="65" rulegroupref="rg-opent-ask" />
  2817.                     <evententry class="dstproc" event="process" subevent="startupprocess" weight="65" allow="true" />
  2818.                     <evententry class="dstproc" event="process" subevent="terminateprocess" weight="65" rulegroupref="rg-termp-ask" />
  2819.                     <evententry class="dstproc" event="process" subevent="oleconnect" weight="65" rulegroupref="rg-olecn-ask" />
  2820.                     <evententry class="dstproc" event="message" subevent="keyboard" weight="65" rulegroupref="rg-keybd-ask" />
  2821.                     <evententry class="dstproc" event="message" subevent="mouse" weight="65" allow="true" />
  2822.                     <evententry class="dstproc" event="message" subevent="dde" weight="65" rulegroupref="rg-ddein-ask" />
  2823.                     <evententry class="dstproc" event="message" subevent="message"  weight="65" rulegroupref="rg-msg-ask" />
  2824.                     <evententry class="dstproc" event="execution" subevent="callback" weight="65" rulegroupref="rg-callb-ask" />
  2825.                     <evententry class="dstproc" event="execution" subevent="windowshook" weight="65" rulegroupref="rg-whook-ask" />
  2826.  
  2827.                 </eventgroup>
  2828.  
  2829.                 <!-- like sys-level1 but without access to protected registry keys -->
  2830.                 <eventgroup name="sys-level2" description="sys-level2" weight="66" allowweightranges="0-69,FE-FE" severityref="dangerous" trustDisplay="super">
  2831.  
  2832.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  2833.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  2834.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  2835.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  2836.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  2837.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  2838.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  2839.                     <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  2840.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  2841.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  2842.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  2843.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  2844.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  2845.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-rega-block" />
  2846.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-rega-block" />
  2847.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-regd-block" />
  2848.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-regd-block" />
  2849.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-rega-block" />
  2850.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-allow" />
  2851.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-allow" />
  2852.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2853.                     <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  2854.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  2855.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  2856.                     <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  2857.                     <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  2858.                     <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  2859.                     <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  2860.  
  2861.                     <evententry class="dstproc" event="process" subevent="openprocess" weight="65" rulegroupref="rg-openp-ask" />
  2862.                     <evententry class="dstproc" event="process" subevent="openthread" weight="65" rulegroupref="rg-opent-ask" />
  2863.                     <evententry class="dstproc" event="process" subevent="startupprocess" weight="65" allow="true" />
  2864.                     <evententry class="dstproc" event="process" subevent="terminateprocess" weight="65" rulegroupref="rg-termp-ask" />
  2865.                     <evententry class="dstproc" event="process" subevent="oleconnect" weight="65" rulegroupref="rg-olecn-ask" />
  2866.                     <evententry class="dstproc" event="message" subevent="keyboard" weight="65" rulegroupref="rg-keybd-ask" />
  2867.                     <evententry class="dstproc" event="message" subevent="mouse" weight="65" allow="true" />
  2868.                     <evententry class="dstproc" event="message" subevent="dde" weight="65" rulegroupref="rg-ddein-ask" />
  2869.                     <evententry class="dstproc" event="message" subevent="message"  weight="65" rulegroupref="rg-msg-ask" />
  2870.                     <evententry class="dstproc" event="execution" subevent="callback" weight="65" rulegroupref="rg-callb-ask" />
  2871.                     <evententry class="dstproc" event="execution" subevent="windowshook" weight="65" rulegroupref="rg-whook-ask" />
  2872.  
  2873.                 </eventgroup>
  2874.  
  2875.                 <eventgroup name="sys-level3" description="sys-level3" weight="66" allowweightranges="0-69,FE-FE" severityref="dangerous" trustDisplay="super">
  2876.  
  2877.                     <evententry class="srcproc" event="process" subevent="openprocess"  weight="E1" allow="true" />
  2878.                     <evententry class="srcproc" event="process" subevent="openthread"  weight="E1" allow="true" />
  2879.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  weight="E1" allow="true" />
  2880.                     <evententry class="srcproc" event="process" subevent="startupprocess"   weight="E1" allow="true" />
  2881.                     <evententry class="srcproc" event="process" subevent="terminateprocess"  weight="E1" allow="true" />
  2882.                     <evententry class="srcproc" event="process" subevent="oleconnect"  weight="E1" allow="true" />
  2883.                     <evententry class="srcproc" event="message" subevent="keyboard"  weight="E1" allow="true" />
  2884.                     <evententry class="srcproc" event="message" subevent="mouse"  weight="E1" allow="true" />
  2885.                     <evententry class="srcproc" event="message" subevent="dde"  weight="E1" allow="true" />
  2886.                     <evententry class="srcproc" event="message" subevent="message"  weight="E1" allow="true" />
  2887.                     <evententry class="srcproc" event="execution" subevent="callback"  weight="E1" allow="true" />
  2888.                     <evententry class="srcproc" event="execution" subevent="windowshook"  weight="E1" allow="true" />
  2889.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  2890.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-reg-allow" />
  2891.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-reg-allow" />
  2892.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-reg-allow" />
  2893.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-reg-allow" />
  2894.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-reg-allow" />
  2895.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-allow" />
  2896.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-allow" />
  2897.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  2898.                     <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  2899.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  2900.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  2901.                     <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  2902.                     <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  2903.                     <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  2904.                     <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  2905.  
  2906.                     <evententry class="dstproc" event="process" subevent="openprocess" weight="65" rulegroupref="rg-openp-ask" />
  2907.                     <evententry class="dstproc" event="process" subevent="openthread" weight="65" rulegroupref="rg-opent-ask" />
  2908.                     <evententry class="dstproc" event="process" subevent="startupprocess" weight="65" allow="true" />
  2909.                     <evententry class="dstproc" event="process" subevent="terminateprocess" weight="65" rulegroupref="rg-termp-ask" />
  2910.                     <evententry class="dstproc" event="process" subevent="oleconnect" weight="65" rulegroupref="rg-olecn-ask" />
  2911.                     <evententry class="dstproc" event="message" subevent="keyboard" weight="65" rulegroupref="rg-keybd-ask" />
  2912.                     <evententry class="dstproc" event="message" subevent="mouse" weight="65" allow="true" />
  2913.                     <evententry class="dstproc" event="message" subevent="dde" weight="65" rulegroupref="rg-ddein-ask" />
  2914.                     <evententry class="dstproc" event="message" subevent="message"  weight="65" rulegroupref="rg-msg-ask" />
  2915.                     <evententry class="dstproc" event="execution" subevent="callback" weight="65" rulegroupref="rg-callb-ask" />
  2916.                     <evententry class="dstproc" event="execution" subevent="windowshook" weight="65" rulegroupref="rg-whook-ask" />
  2917.  
  2918.                 </eventgroup>
  2919.  
  2920.                 <eventgroup name="kill" description="Kill" weight="75" severityref="crit_malicious" trustChoice="kill" trustDisplay="kill">
  2921.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-blk" />
  2922.                     <evententry class="srcproc" event="process" subevent="openthread" rulegroupref="rg-opent-blk" />
  2923.                     <evententry class="srcproc" event="process" subevent="spawnprocess" rulegroupref="rg-spawn-blk" />
  2924.                     <evententry class="srcproc" event="process" subevent="startupprocess" rulegroupref="rg-start-blk" />
  2925.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-blk" />
  2926.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-blk" />
  2927.                     <evententry class="srcproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-blk" />
  2928.                     <evententry class="srcproc" event="message" subevent="mouse" rulegroupref="rg-mouse-blk" />
  2929.                     <evententry class="srcproc" event="message" subevent="dde" rulegroupref="rg-ddein-blk" />
  2930.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-blk" />
  2931.                     <evententry class="srcproc" event="execution" subevent="callback" rulegroupref="rg-callb-blk" />
  2932.                     <evententry class="srcproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-blk" />
  2933.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  rulegroupref="rg-glbhook-blk" />
  2934.                     <evententry class="srcproc" event="registry" subevent="setkey" allow="false" />
  2935.                     <evententry class="srcproc" event="registry" subevent="setvalue" allow="false" />
  2936.                     <evententry class="srcproc" event="registry" subevent="delkey" allow="false" />
  2937.                     <evententry class="srcproc" event="registry" subevent="delvalue" allow="false" />
  2938.                     <evententry class="srcproc" event="registry" subevent="createkey" allow="false" />
  2939.                     <evententry class="srcproc" event="file" subevent="write" allow="false" />
  2940.                     <evententry class="srcproc" event="file" subevent="delete" allow="false" />
  2941.                     <evententry class="srcproc" event="module" subevent="load" allow="false" />
  2942.                     <evententry class="srcproc" event="driver" subevent="load" rulegroupref="rg-drvld-blk" />
  2943.                     <evententry class="srcproc" event="driver" subevent="unload" rulegroupref="rg-drvud-blk" />
  2944.                     <evententry class="srcproc" event="driver" subevent="connect" rulegroupref="rg-drvct-blk" />
  2945.                     <evententry class="srcproc" event="driver" subevent="create" rulegroupref="rg-drvcr-blk" />
  2946.                     <evententry class="srcproc" event="driver" subevent="modify" rulegroupref="rg-drvmd-blk" />
  2947.                     <evententry class="srcproc" event="driver" subevent="delete" rulegroupref="rg-drvdl-blk" />
  2948.                     <evententry class="srcproc" event="physmem" subevent="map" rulegroupref="rg-memmp-blk" />
  2949.  
  2950.                     <evententry class="dstproc" event="process" subevent="openprocess" allow="true" />
  2951.                     <evententry class="dstproc" event="process" subevent="openthread" allow="true" />
  2952.                     <evententry class="dstproc" event="process" subevent="startupprocess" allow="false" />
  2953.                     <evententry class="dstproc" event="process" subevent="terminateprocess" allow="true" />
  2954.                     <evententry class="dstproc" event="process" subevent="oleconnect" allow="true" />
  2955.                     <evententry class="dstproc" event="message" subevent="keyboard" allow="true" />
  2956.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  2957.                     <evententry class="dstproc" event="message" subevent="dde" allow="true" />
  2958.                     <evententry class="dstproc" event="message" subevent="message"  allow="true" />
  2959.                     <evententry class="dstproc" event="execution" subevent="callback" allow="true" />
  2960.                     <evententry class="dstproc" event="execution" subevent="windowshook" allow="true" />
  2961.                 </eventgroup>
  2962.  
  2963.                 <eventgroup name="untrust-unprot" description="untrust-unprot" weight="20" allowweightranges="0-69,FE-FE" severityref="normal" trustDisplay="restricted">
  2964.  
  2965.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-blk" />
  2966.                     <evententry class="srcproc" event="process" subevent="openthread" rulegroupref="rg-opent-blk" />
  2967.                     <evententry class="srcproc" event="process" subevent="spawnprocess" rulegroupref="rg-spawn-blk" />
  2968.                     <evententry class="srcproc" event="process" subevent="startupprocess" rulegroupref="rg-start-blk" />
  2969.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-blk" />
  2970.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-blk" />
  2971.                     <evententry class="srcproc" event="message" subevent="keyboard" rulegroupref="rg-keybd-blk" />
  2972.                     <evententry class="srcproc" event="message" subevent="mouse" rulegroupref="rg-mouse-blk" />
  2973.                     <evententry class="srcproc" event="message" subevent="dde" rulegroupref="rg-ddein-blk" />
  2974.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-blk" />
  2975.                     <evententry class="srcproc" event="execution" subevent="callback" rulegroupref="rg-callb-blk" />
  2976.                     <evententry class="srcproc" event="execution" subevent="windowshook" rulegroupref="rg-whook-blk" />
  2977.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  rulegroupref="rg-glbhook-blk" />
  2978.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-rega-block"/>
  2979.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-rega-block"/>
  2980.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-regd-block"/>
  2981.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-regd-block"/>
  2982.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-rega-block"/>
  2983.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-block"/>
  2984.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-block"/>
  2985.                     <evententry class="srcproc" event="module" subevent="load" allow="true" />
  2986.                     <evententry class="srcproc" event="driver" subevent="load" rulegroupref="rg-drvld-blk" />
  2987.                     <evententry class="srcproc" event="driver" subevent="unload" rulegroupref="rg-drvud-blk" />
  2988.                     <evententry class="srcproc" event="driver" subevent="connect" rulegroupref="rg-drvct-blk" />
  2989.                     <evententry class="srcproc" event="driver" subevent="create" rulegroupref="rg-drvcr-blk" />
  2990.                     <evententry class="srcproc" event="driver" subevent="modify" rulegroupref="rg-drvmd-blk" />
  2991.                     <evententry class="srcproc" event="driver" subevent="delete" rulegroupref="rg-drvdl-blk" />
  2992.                     <evententry class="srcproc" event="physmem" subevent="map" rulegroupref="rg-memmp-blk" />
  2993.  
  2994.                     <evententry class="dstproc" event="process" subevent="openprocess" allow="true" />
  2995.                     <evententry class="dstproc" event="process" subevent="openthread" allow="true" />
  2996.                     <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  2997.                     <evententry class="dstproc" event="process" subevent="terminateprocess" allow="true" />
  2998.                     <evententry class="dstproc" event="process" subevent="oleconnect" allow="true" />
  2999.                     <evententry class="dstproc" event="message" subevent="keyboard" allow="true" />
  3000.                     <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  3001.                     <evententry class="dstproc" event="message" subevent="dde" allow="true" />
  3002.                     <evententry class="dstproc" event="message" subevent="message"  ask="true" />
  3003.                     <evententry class="dstproc" event="execution" subevent="callback" allow="true" />
  3004.                     <evententry class="dstproc" event="execution" subevent="windowshook" allow="true" />
  3005.  
  3006.                 </eventgroup>
  3007.  
  3008.                 <!-- THIS MIRRORS "no-osfw" AND SHOULD STAY IN SYNC WITH THAT GROUP -->
  3009.                 <eventgroup name="trust-unprot" description="trust-unprot" weight="65" allowweightranges="0-69,FE-FE" severityref="normal" trustDisplay="super">
  3010.  
  3011.                     <evententry class="srcproc" event="process" subevent="openprocess" rulegroupref="rg-openp-ask" />
  3012.                     <evententry class="srcproc" event="process" subevent="openthread"  rulegroupref="rg-opent-ask" />
  3013.                     <evententry class="srcproc" event="process" subevent="spawnprocess"  rulegroupref="rg-spawn-ask" />
  3014.                     <evententry class="srcproc" event="process" subevent="startupprocess"  allow="true" />
  3015.                     <evententry class="srcproc" event="process" subevent="terminateprocess" rulegroupref="rg-termp-ask" />
  3016.                     <evententry class="srcproc" event="process" subevent="oleconnect" rulegroupref="rg-olecn-ask" />
  3017.                     <evententry class="srcproc" event="message" subevent="keyboard"  rulegroupref="rg-keybd-ask" />
  3018.                     <evententry class="srcproc" event="message" subevent="mouse" weight="66" allow="true" />
  3019.                     <evententry class="srcproc" event="message" subevent="dde"  rulegroupref="rg-ddein-ask" />
  3020.                     <evententry class="srcproc" event="message" subevent="message"  rulegroupref="rg-msg-ask" />
  3021.                     <evententry class="srcproc" event="execution" subevent="callback"  rulegroupref="rg-callb-ask" />
  3022.                     <evententry class="srcproc" event="execution" subevent="windowshook"  rulegroupref="rg-whook-ask" />
  3023.                     <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  3024.                     <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-reg-allow" />
  3025.                     <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-reg-allow" />
  3026.                     <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-reg-allow" />
  3027.                     <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-reg-allow" />
  3028.                     <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-reg-allow" />
  3029.                     <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-files-allow"/>
  3030.                     <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-files-allow"/>
  3031.                     <evententry class="srcproc" event="module" subevent="load" rulegroupref="rg-modld-ok" />
  3032.                     <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  3033.                     <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  3034.                     <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  3035.                     <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  3036.                     <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  3037.                     <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  3038.                     <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  3039.  
  3040.                     <evententry class="dstproc" event="process" subevent="openprocess" weight="65" allow="true" />
  3041.                     <evententry class="dstproc" event="process" subevent="openthread" weight="65" allow="true" />
  3042.                     <evententry class="dstproc" event="process" subevent="startupprocess" weight="65" allow="true" />
  3043.                     <evententry class="dstproc" event="process" subevent="terminateprocess" weight="65" allow="true" />
  3044.                     <evententry class="dstproc" event="process" subevent="oleconnect" weight="65" allow="true" />
  3045.                     <evententry class="dstproc" event="message" subevent="keyboard" weight="65" allow="true" />
  3046.                     <evententry class="dstproc" event="message" subevent="mouse" weight="65" allow="true" />
  3047.                     <evententry class="dstproc" event="message" subevent="dde" weight="65" allow="true" />
  3048.                     <evententry class="dstproc" event="message" subevent="message"  weight="65" allow="true" />
  3049.                     <evententry class="dstproc" event="execution" subevent="callback" weight="65" allow="true" />
  3050.                     <evententry class="dstproc" event="execution" subevent="windowshook" weight="65" allow="true" />
  3051.  
  3052.                 </eventgroup>
  3053.  
  3054.  
  3055.     <ruleset name="rs-reg-block" allow="true">
  3056.         <rulerefentry rulegroupref="protourreg"/>
  3057.         <rulerefentry rulegroupref="protZaRunReg"/>
  3058.     </ruleset>
  3059.  
  3060.     <ruleset name="rs-file-block" allow="true">
  3061.         <rulerefentry rulegroupref="protourfiles"/>
  3062.     </ruleset>
  3063.  
  3064.     <eventgroup name="ZLDefaultGroup" description="ZLDefaultGroup" weight="00" allowweightranges="FE-FE" default="true" severityref="suspicious">
  3065.         <evententry class="srcproc" event="process" subevent="openprocess" ask="true" />
  3066.         <evententry class="srcproc" event="process" subevent="openthread"  allow="true" />
  3067.         <evententry class="srcproc" event="process" subevent="spawnprocess"  allow="true" />
  3068.         <evententry class="srcproc" event="process" subevent="startupprocess" ask="true" />
  3069.         <evententry class="srcproc" event="process" subevent="terminateprocess" ask="true" />
  3070.         <evententry class="srcproc" event="process" subevent="oleconnect" ask="true" />
  3071.         <evententry class="srcproc" event="message" subevent="keyboard"  ask="true" />
  3072.         <evententry class="srcproc" event="message" subevent="mouse"  ask="true" />
  3073.         <evententry class="srcproc" event="message" subevent="dde"  ask="true" />
  3074.         <evententry class="srcproc" event="message" subevent="message"  allow="true" />
  3075.         <evententry class="srcproc" event="execution" subevent="callback"  allow="true" />
  3076.         <evententry class="srcproc" event="execution" subevent="windowshook"  allow="true" />
  3077.         <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  3078.  
  3079.         <evententry class="srcproc" event="registry" subevent="setkey" rulesetref="rs-reg-block"/>
  3080.         <evententry class="srcproc" event="registry" subevent="setvalue" rulesetref="rs-reg-block"/>
  3081.         <evententry class="srcproc" event="registry" subevent="delkey" rulesetref="rs-reg-block"/>
  3082.         <evententry class="srcproc" event="registry" subevent="delvalue" rulesetref="rs-reg-block"/>
  3083.         <evententry class="srcproc" event="registry" subevent="createkey" rulesetref="rs-reg-block"/>
  3084.  
  3085.         <evententry class="srcproc" event="file" subevent="write" rulesetref="rs-file-block"/>
  3086.         <evententry class="srcproc" event="file" subevent="delete" rulesetref="rs-file-block"/>
  3087.  
  3088.         <evententry class="srcproc" event="module" subevent="load" notify="true" />
  3089.         <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  3090.         <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  3091.         <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  3092.         <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  3093.         <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  3094.         <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  3095.         <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  3096.         <evententry class="dstproc" event="process" subevent="openprocess" allow="true" />
  3097.         <evententry class="dstproc" event="process" subevent="openthread" allow="true" />
  3098.         <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  3099.         <evententry class="dstproc" event="process" subevent="terminateprocess" allow="true" />
  3100.         <evententry class="dstproc" event="process" subevent="oleconnect" allow="true" />
  3101.         <evententry class="dstproc" event="message" subevent="keyboard" allow="true" />
  3102.         <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  3103.         <evententry class="dstproc" event="message" subevent="dde" allow="true" />
  3104.         <evententry class="dstproc" event="message" subevent="message" allow="true" />
  3105.         <evententry class="dstproc" event="execution" subevent="callback" allow="true" />
  3106.         <evententry class="dstproc" event="execution" subevent="windowshook" allow="true" />
  3107.     </eventgroup>
  3108.  
  3109.     <eventgroup name="ZLDebug" description="ZLDebugGroup" weight="FE" allowweightranges="0-FE" severityref="dangerous">
  3110.         <evententry class="srcproc" event="process" subevent="openprocess" allow="true" />
  3111.         <evententry class="srcproc" event="process" subevent="openthread"  allow="true" />
  3112.         <evententry class="srcproc" event="process" subevent="spawnprocess"  allow="true" />
  3113.         <evententry class="srcproc" event="process" subevent="startupprocess" allow="true" />
  3114.         <evententry class="srcproc" event="process" subevent="terminateprocess" allow="true" />
  3115.         <evententry class="srcproc" event="process" subevent="oleconnect" allow="true" />
  3116.         <evententry class="srcproc" event="message" subevent="keyboard"  allow="true" />
  3117.         <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  3118.         <evententry class="srcproc" event="message" subevent="dde"  allow="true" />
  3119.         <evententry class="srcproc" event="message" subevent="message"  allow="true" />
  3120.         <evententry class="srcproc" event="execution" subevent="callback"  allow="true" />
  3121.         <evententry class="srcproc" event="execution" subevent="windowshook"  allow="true" />
  3122.         <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  3123.         <evententry class="srcproc" event="registry" subevent="setkey" allow="true" />
  3124.         <evententry class="srcproc" event="registry" subevent="setvalue" allow="true" />
  3125.         <evententry class="srcproc" event="registry" subevent="delkey" allow="true" />
  3126.         <evententry class="srcproc" event="registry" subevent="delvalue" allow="true" />
  3127.         <evententry class="srcproc" event="registry" subevent="createkey" allow="true" />
  3128.         <evententry class="srcproc" event="file" subevent="write" allow="true" />
  3129.         <evententry class="srcproc" event="file" subevent="delete" allow="true" />
  3130.         <evententry class="srcproc" event="module" subevent="load" allow="true" />
  3131.         <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  3132.         <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  3133.         <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  3134.         <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  3135.         <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  3136.         <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  3137.         <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  3138.         <evententry class="dstproc" event="process" subevent="openprocess" allow="true" />
  3139.         <evententry class="dstproc" event="process" subevent="openthread" allow="true" />
  3140.         <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  3141.         <evententry class="dstproc" event="process" subevent="terminateprocess" allow="true" />
  3142.         <evententry class="dstproc" event="process" subevent="oleconnect" allow="true" />
  3143.         <evententry class="dstproc" event="message" subevent="keyboard" allow="true" />
  3144.         <evententry class="dstproc" event="message" subevent="mouse" allow="true" />
  3145.         <evententry class="dstproc" event="message" subevent="dde" allow="true" />
  3146.         <evententry class="dstproc" event="message" subevent="message" allow="true" />
  3147.         <evententry class="dstproc" event="execution" subevent="callback" allow="true" />
  3148.         <evententry class="dstproc" event="execution" subevent="windowshook" allow="true" />
  3149.     </eventgroup>
  3150.  
  3151.     <eventgroup name="ZLServiceGroup" description="ZLServiceGroup" weight="E0" allowweightranges="0-E0,FE-FE" severityref="dangerous">
  3152.         <evententry class="srcproc" event="process" subevent="openprocess" allow="true" />
  3153.         <evententry class="srcproc" event="process" subevent="openthread"  allow="true" />
  3154.         <evententry class="srcproc" event="process" subevent="spawnprocess"  allow="true" />
  3155.         <evententry class="srcproc" event="process" subevent="startupprocess" allow="true" />
  3156.         <evententry class="srcproc" event="process" subevent="terminateprocess" allow="true" />
  3157.         <evententry class="srcproc" event="process" subevent="oleconnect" allow="true" />
  3158.         <evententry class="srcproc" event="message" subevent="keyboard"  allow="true" />
  3159.         <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  3160.         <evententry class="srcproc" event="message" subevent="dde"  allow="true" />
  3161.         <evententry class="srcproc" event="message" subevent="message"  allow="true" />
  3162.         <evententry class="srcproc" event="execution" subevent="callback"  allow="true" />
  3163.         <evententry class="srcproc" event="execution" subevent="windowshook"  allow="true" />
  3164.         <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  3165.         <evententry class="srcproc" event="registry" subevent="setkey" allow="true" />
  3166.         <evententry class="srcproc" event="registry" subevent="setvalue" allow="true" />
  3167.         <evententry class="srcproc" event="registry" subevent="delkey" allow="true" />
  3168.         <evententry class="srcproc" event="registry" subevent="delvalue" allow="true" />
  3169.         <evententry class="srcproc" event="registry" subevent="createkey" allow="true" />
  3170.         <evententry class="srcproc" event="file" subevent="write" allow="true" />
  3171.         <evententry class="srcproc" event="file" subevent="delete" allow="true" />
  3172.         <evententry class="srcproc" event="module" subevent="load" allow="true" />
  3173.         <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  3174.         <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  3175.         <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  3176.         <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  3177.         <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  3178.         <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  3179.         <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  3180.         <evententry class="dstproc" event="process" subevent="openprocess" allow="false" />
  3181.         <evententry class="dstproc" event="process" subevent="openthread" allow="false" />
  3182.         <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  3183.         <evententry class="dstproc" event="process" subevent="terminateprocess" allow="false" />
  3184.         <evententry class="dstproc" event="process" subevent="oleconnect" allow="false" />
  3185.         <evententry class="dstproc" event="message" subevent="keyboard" allow="false" />
  3186.         <evententry class="dstproc" event="message" subevent="mouse" allow="false" />
  3187.         <evententry class="dstproc" event="message" subevent="dde" allow="false" />
  3188.         <evententry class="dstproc" event="message" subevent="message" allow="false" />
  3189.         <evententry class="dstproc" event="execution" subevent="callback" allow="false" />
  3190.         <evententry class="dstproc" event="execution" subevent="windowshook" allow="false" />
  3191.     </eventgroup>
  3192.  
  3193.     <eventgroup name="ZLClientGroup" description="ZLClientGroup" weight="66" allowweightranges="0-66,FE-FE" severityref="dangerous">
  3194.         <evententry class="srcproc" event="process" subevent="openprocess" allow="true" />
  3195.         <evententry class="srcproc" event="process" subevent="openthread"  allow="true" />
  3196.         <evententry class="srcproc" event="process" subevent="spawnprocess"  allow="true" />
  3197.         <evententry class="srcproc" event="process" subevent="startupprocess" allow="true" />
  3198.         <evententry class="srcproc" event="process" subevent="terminateprocess" allow="true" />
  3199.         <evententry class="srcproc" event="process" subevent="oleconnect" allow="true" />
  3200.         <evententry class="srcproc" event="message" subevent="keyboard"  allow="true" />
  3201.         <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  3202.         <evententry class="srcproc" event="message" subevent="dde"  allow="true" />
  3203.         <evententry class="srcproc" event="message" subevent="message"  allow="true" />
  3204.         <evententry class="srcproc" event="execution" subevent="callback"  allow="true" />
  3205.         <evententry class="srcproc" event="execution" subevent="windowshook"  allow="true" />
  3206.         <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  3207.         <evententry class="srcproc" event="registry" subevent="setkey" allow="true" />
  3208.         <evententry class="srcproc" event="registry" subevent="setvalue" allow="true" />
  3209.         <evententry class="srcproc" event="registry" subevent="delkey" allow="true" />
  3210.         <evententry class="srcproc" event="registry" subevent="delvalue" allow="true" />
  3211.         <evententry class="srcproc" event="registry" subevent="createkey" allow="true" />
  3212.         <evententry class="srcproc" event="file" subevent="write" allow="true" />
  3213.         <evententry class="srcproc" event="file" subevent="delete" allow="true" />
  3214.         <evententry class="srcproc" event="module" subevent="load" allow="true" />
  3215.         <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  3216.         <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  3217.         <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  3218.         <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  3219.         <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  3220.         <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  3221.         <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  3222.         <evententry class="dstproc" event="process" subevent="openprocess" allow="false" />
  3223.         <evententry class="dstproc" event="process" subevent="openthread" allow="false" />
  3224.         <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  3225.         <evententry class="dstproc" event="process" subevent="terminateprocess" allow="false" />
  3226.         <evententry class="dstproc" event="process" subevent="oleconnect" allow="false" />
  3227.         <evententry class="dstproc" event="message" subevent="keyboard" allow="false" />
  3228.         <evententry class="dstproc" event="message" subevent="mouse" allow="false" />
  3229.         <evententry class="dstproc" event="message" subevent="dde" allow="false" />
  3230.         <evententry class="dstproc" event="message" subevent="message" allow="false" />
  3231.         <evententry class="dstproc" event="execution" subevent="callback" allow="false" />
  3232.         <evententry class="dstproc" event="execution" subevent="windowshook" allow="false" />
  3233.     </eventgroup>
  3234.     <eventgroup name="ZLSignedApps" description="ZLSignedApps" weight="65" allowweightranges="0-66,FE-FE" severityref="dangerous">
  3235.         <evententry class="srcproc" event="process" subevent="openprocess" weight="66" allow="true" />
  3236.         <evententry class="srcproc" event="process" subevent="openthread"  weight="66" allow="true" />
  3237.         <evententry class="srcproc" event="process" subevent="spawnprocess"  allow="true" />
  3238.         <evententry class="srcproc" event="process" subevent="startupprocess" allow="true" />
  3239.         <evententry class="srcproc" event="process" subevent="terminateprocess" allow="true" />
  3240.         <evententry class="srcproc" event="process" subevent="oleconnect" allow="true" />
  3241.         <evententry class="srcproc" event="message" subevent="keyboard"  allow="true" />
  3242.         <evententry class="srcproc" event="message" subevent="mouse"  allow="true" />
  3243.         <evententry class="srcproc" event="message" subevent="dde"  allow="true" />
  3244.         <evententry class="srcproc" event="message" subevent="message"  allow="true" />
  3245.         <evententry class="srcproc" event="execution" subevent="callback"  allow="true" />
  3246.         <evententry class="srcproc" event="execution" subevent="windowshook"  allow="true" />
  3247.         <evententry class="srcproc" event="execution" subevent="globalwindowshook"  allow="true" />
  3248.         <evententry class="srcproc" event="registry" subevent="setkey" allow="true" />
  3249.         <evententry class="srcproc" event="registry" subevent="setvalue" allow="true" />
  3250.         <evententry class="srcproc" event="registry" subevent="delkey" allow="true" />
  3251.         <evententry class="srcproc" event="registry" subevent="delvalue" allow="true" />
  3252.         <evententry class="srcproc" event="registry" subevent="createkey" allow="true" />
  3253.         <evententry class="srcproc" event="file" subevent="write" allow="true" />
  3254.         <evententry class="srcproc" event="file" subevent="delete" allow="true" />
  3255.         <evententry class="srcproc" event="module" subevent="load" allow="true" />
  3256.         <evententry class="srcproc" event="driver" subevent="load" allow="true" />
  3257.         <evententry class="srcproc" event="driver" subevent="unload" allow="true" />
  3258.         <evententry class="srcproc" event="driver" subevent="connect" allow="true" />
  3259.         <evententry class="srcproc" event="driver" subevent="create" allow="true" />
  3260.         <evententry class="srcproc" event="driver" subevent="modify" allow="true" />
  3261.         <evententry class="srcproc" event="driver" subevent="delete" allow="true" />
  3262.         <evententry class="srcproc" event="physmem" subevent="map" allow="true" />
  3263.         <evententry class="dstproc" event="process" subevent="openprocess" allow="false" />
  3264.         <evententry class="dstproc" event="process" subevent="openthread" allow="false" />
  3265.         <evententry class="dstproc" event="process" subevent="startupprocess" allow="true" />
  3266.         <evententry class="dstproc" event="process" subevent="terminateprocess" allow="false" />
  3267.         <evententry class="dstproc" event="process" subevent="oleconnect" allow="false" />
  3268.         <evententry class="dstproc" event="message" subevent="keyboard" allow="false" />
  3269.         <evententry class="dstproc" event="message" subevent="mouse" allow="false" />
  3270.         <evententry class="dstproc" event="message" subevent="dde" allow="false" />
  3271.         <evententry class="dstproc" event="message" subevent="message" allow="false" />
  3272.         <evententry class="dstproc" event="execution" subevent="callback" allow="false" />
  3273.         <evententry class="dstproc" event="execution" subevent="windowshook" allow="false" />
  3274.     </eventgroup>
  3275.  
  3276.     <imageentry
  3277.         imagename="iclient.exe"
  3278.         eventgroupref="ZLClientGroup">
  3279.         <itementry
  3280.             param="md5"
  3281.             operator="equal"
  3282.             type="binary"
  3283.             value="2ce77c28-ece26fb7-4cae93e1-98c60fc0"
  3284.         />
  3285.     </imageentry>
  3286.     <imageentry
  3287.         imagename="zlclient.exe"
  3288.         eventgroupref="ZLClientGroup">
  3289.         <itementry
  3290.             param="md5"
  3291.             operator="equal"
  3292.             type="binary"
  3293.             value="c331d8e6-e3ab67a5-a1556070-e8ea6b13"
  3294.         />
  3295.     </imageentry>
  3296.     <imageentry
  3297.         imagename="vsmon.exe"
  3298.         eventgroupref="ZLServiceGroup">
  3299.         <itementry
  3300.             param="md5"
  3301.             operator="equal"
  3302.             type="binary"
  3303.             value="d89972da-2c33cc02-bc787e4f-404b4a01"
  3304.         />
  3305.     </imageentry>
  3306.     <imageentry
  3307.         imagename="updclient.exe"
  3308.         eventgroupref="ZLClientGroup">
  3309.         <itementry
  3310.             param="md5"
  3311.             operator="equal"
  3312.             type="binary"
  3313.             value="2a28c1d2-a19a99b7-03a620f1-596ee2ff"
  3314.         />
  3315.     </imageentry>
  3316.     <imageentry
  3317.         imagename="updclient.exe"
  3318.         eventgroupref="ZLClientGroup">
  3319.         <itementry
  3320.             param="md5"
  3321.             operator="equal"
  3322.             type="binary"
  3323.             value="6da54d6c-3dc4d974-7d4b8ac1-76a20060"
  3324.         />
  3325.     </imageentry>
  3326.     <imageentry
  3327.         imagename="ScanningProcess.exe"
  3328.         eventgroupref="ZLServiceGroup">
  3329.         <itementry
  3330.             param="path"
  3331.             operator="equalnocase"
  3332.             type="ansi"
  3333.             value="WINSYSDIR\Zonelabs\avsys\ScanningProcess.exe"
  3334.         />
  3335.     </imageentry>
  3336.     <imageentry
  3337.         imagename="userdump.exe"
  3338.         eventgroupref="ZLServiceGroup">
  3339.         <itementry
  3340.             param="md5"
  3341.             operator="equal"
  3342.             type="binary"
  3343.             value="065b463f-6ed0b195-027ed99c-0c3b3250"
  3344.         />
  3345.     </imageentry>
  3346.         <imageentry
  3347.         imagename="userdump.exe"
  3348.         eventgroupref="ZLServiceGroup">
  3349.         <itementry
  3350.             param="md5"
  3351.             operator="equal"
  3352.             type="binary"
  3353.             value="F45B5187-71A2A148-2C2D7BD4-F0704904"
  3354.         />
  3355.     </imageentry>
  3356.     <imageentry
  3357.         imagename="csrss.exe"
  3358.         eventgroupref="sys-level3">
  3359.         <itementry
  3360.             param="path"
  3361.             operator="equalnocase"
  3362.             type="ansi"
  3363.             value="WINSYSDIR\csrss.exe"
  3364.         />
  3365.     </imageentry>
  3366.     <imageentry
  3367.         imagename="runonce.exe"
  3368.         eventgroupref="sys-level1">
  3369.         <itementry
  3370.             param="path"
  3371.             operator="equalnocase"
  3372.             type="ansi"
  3373.             value="WINSYSDIR\runonce.exe"
  3374.         />
  3375.     </imageentry>
  3376.     <imageentry
  3377.         imagename="lsass.exe"
  3378.         eventgroupref="sys-level1">
  3379.         <itementry
  3380.             param="path"
  3381.             operator="equalnocase"
  3382.             type="ansi"
  3383.             value="WINSYSDIR\lsass.exe"
  3384.         />
  3385.     </imageentry>
  3386.     <imageentry
  3387.         imagename="consent.exe"
  3388.         eventgroupref="AllowSD">
  3389.         <itementry
  3390.             param="path"
  3391.             operator="equalnocase"
  3392.             type="ansi"
  3393.             value="WINSYSDIR\consent.exe"
  3394.         />
  3395.     </imageentry>
  3396.     <imageentry
  3397.         imagename="taskeng.exe"
  3398.         eventgroupref="AllowSD">
  3399.         <itementry
  3400.             param="path"
  3401.             operator="equalnocase"
  3402.             type="ansi"
  3403.             value="WINSYSDIR\taskeng.exe"
  3404.         />
  3405.     </imageentry>
  3406.     <imageentry
  3407.         imagename="winlogon.exe"
  3408.         eventgroupref="sys-level1">
  3409.         <itementry
  3410.             param="path"
  3411.             operator="equalnocase"
  3412.             type="ansi"
  3413.             value="WINSYSDIR\winlogon.exe"
  3414.         />
  3415.     </imageentry>
  3416.     <imageentry
  3417.         imagename="services.exe"
  3418.         eventgroupref="sys-level1">
  3419.         <itementry
  3420.             param="path"
  3421.             operator="equalnocase"
  3422.             type="ansi"
  3423.             value="WINSYSDIR\services.exe"
  3424.         />
  3425.     </imageentry>
  3426.       <imageentry 
  3427.         imagename="consent.exe"
  3428.         eventgroupref="AllowSD">
  3429.         <itementry
  3430.             param="path"
  3431.             operator="equalnocase"
  3432.             type="ansi"
  3433.             value="WINSYSDIR\consent.exe"
  3434.         />
  3435.     </imageentry>
  3436.     <imageentry
  3437.         imagename="svchost.exe"
  3438.         eventgroupref="sys-level2">
  3439.         <itementry
  3440.             param="path"
  3441.             operator="equalnocase"
  3442.             type="ansi"
  3443.             value="WINSYSDIR\svchost.exe"
  3444.         />
  3445.     </imageentry>
  3446.     <imageentry
  3447.         imagename="taskeng.exe"
  3448.         eventgroupref="AllowSD">
  3449.         <itementry
  3450.             param="path"
  3451.             operator="equalnocase"
  3452.             type="ansi"
  3453.             value="WINSYSDIR\taskeng.exe"
  3454.         />
  3455.     </imageentry>
  3456.     <imageentry
  3457.         imagename="umdh.exe" 
  3458.         eventgroupref="ZLDebug">
  3459.         <itementry 
  3460.             param="md5" 
  3461.             operator="equal" 
  3462.             type="binary" 
  3463.             value="f7501800-45b7d5fb-849143b5-c4f4071d" 
  3464.         /> 
  3465.     </imageentry>
  3466.     <imageentry 
  3467.         imagename="umdh.exe" 
  3468.         eventgroupref="ZLDebug">
  3469.         <itementry 
  3470.             param="md5" 
  3471.             operator="equal" 
  3472.             type="binary" 
  3473.             value="2D62A217-5AFEC25C-B020CE2D-B63DC25D" 
  3474.         /> 
  3475.     </imageentry>
  3476.     <imageentry 
  3477.         imagename="umdh.exe" 
  3478.         eventgroupref="ZLDebug">
  3479.         <itementry 
  3480.             param="md5" 
  3481.             operator="equal" 
  3482.             type="binary" 
  3483.             value="F51A70B3-1EEA2849-97010B6F-F750455D"
  3484.         /> 
  3485.     </imageentry>
  3486.     <imageentry 
  3487.         imagename="umdh.exe" 
  3488.         eventgroupref="ZLDebug">
  3489.         <itementry 
  3490.             param="md5" 
  3491.             operator="equal" 
  3492.             type="binary" 
  3493.             value="94C8F0B5-5BAB646E-DE45AE5C-9C2DDF8D"
  3494.         /> 
  3495.     </imageentry>
  3496.     <imageentry 
  3497.         imagename="umdh.exe" 
  3498.         eventgroupref="ZLDebug">
  3499.         <itementry 
  3500.             param="md5" 
  3501.             operator="equal" 
  3502.             type="binary" 
  3503.             value="59026D74-9297B92D-B32B4C72-A18882F0"
  3504.         /> 
  3505.     </imageentry>
  3506. </osfirewall>
  3507.