<EQSysSecureDat Version="2">
    <Mode ID="1" Name="IDS_NORMAL_MODE">
        <Rule Type="WatchApp" SubType="2097151" IncludeSub="1" Action="2097151" Log="196351" Ask="196351" Remind="0" SandBox="0" Terminate="0" />
    </Mode>
    <Rule Type="WatchApp">
        <Group Name="IDS_SYSTEM_PROGRAM" ModeID="1">
            <Rule SearchGlobal="1" SubType="0" IncludeSub="1" Action="32767" Log="0" Ask="32511" CheckCommandLine="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%windir%\System32\CSRSS.exe">
                <Rule SubType="31364" IncludeSub="1" Action="32767" Log="30852" Ask="31999" CheckCommandLine="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="*" />
            </Rule>
        </Group>
        <Rule SandBox="0" Terminate="0" Data0="*" Type="1" />
        <Rule SubType="2097151" IncludeSub="1" Action="2097151" Log="196351" Ask="196351" SandBox="0" Terminate="0" Data0="*" Type="2">
            <Group Name="IDS_IE_CACHE_DIRECTORY" ModeID="1">
                <Rule SubType="6631" IncludeSub="1" Action="6276" Log="6631" Ask="6276" CheckCommandLine="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%SystemDrive%\Documents and Settings\*\Local Settings\Temporary Internet Files\*" />
            </Group>
        </Rule>
    </Rule>
    <Rule Type="WatchReg">
        <Group Name="IDS_SYSTEM_PROGRAM" ModeID="1">
            <Rule SearchGlobal="1" SubType="7" IncludeSub="0" Action="7" Log="0" Ask="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%WinDir%\system32\winlogon.exe">
                <Rule SubType="7" IncludeSub="0" Action="7" Log="0" Ask="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" Data1="*" />
            </Rule>
        </Group>
        <Rule SandBox="0" Terminate="0" Data0="*" Type="1" />
        <Rule SubType="7" IncludeSub="1" Action="7" Log="0" Ask="0" SandBox="0" Terminate="0" Data0="*" Type="2">
            <Group Name="IDS_SYSTEM_AUTO_RUN" ModeID="1">
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System\Scripts" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\System\*ControlSet*\Control\Session Manager" Data1="BootExecute" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" Data1="run" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Windows" Data1="load" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager" Data1="*FileRenameOperations" />
            </Group>
            <Group Name="WinLogon" ModeID="1">
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GinaDLL" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Winlogon" Data1="GinaDLL" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" Data1="*" />
            </Group>
            <Group Name="IDS_IE_CONFIG" ModeID="1">
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Extensions*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Extensions*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Menuext\*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Toolbar" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Styles" Data1="stylesheet" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet explorer\Toolbars\Restrictions" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet explorer\Infodelivery\Restrictions" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Main" Data1="Start Page" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Main" Data1="Default_Page_URL" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Main" Data1="Local Page" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Main" Data1="Start Page_bak" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Main" Data1="HOMEOldSP" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Main" Data1="Search Page" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Main" Data1="Default_Search_URL" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="Start Page" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="Default_Page_URL" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="Local Page" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="Start Page_bak" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="HOMEOldSP" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="Search Bar" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="Use Custom Search URL" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main" Data1="Search Page" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_USERS\.default\Software\Microsoft\Internet explorer\Main" Data1="Search Page" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_USERS\.default\Software\Microsoft\Internet explorer\Main" Data1="Search Bar" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Search" Data1="CustomizeSearch" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Search" Data1="SearchAssistant" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet explorer\Search" Data1="Default_Search_URL" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Internet settings\Zonemap\Ranges*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet settings\Zonemap\Ranges*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="MinLevel" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Safety Warning Level" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Trust Warning Level" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Security_RunActiveXControls" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Security_RunScripts" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_USERS\.default\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="MinLevel" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_USERS\.default\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Safety Warning Level" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_USERS\.default\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Security_RunActiveXControls" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_USERS\.default\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Security_RunScripts" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_USERS\.default\Software\Microsoft\Windows\Currentversion\Internet settings" Data1="Trust Warning Level" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\Protocols\Filter*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\Protocols\Handler*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Searchurl*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Urlsearchhooks*" Data1="*" />
            </Group>
            <Group Name="IDS_SYSTEM_CONFIG" ModeID="1">
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\System\*controlset*\Services\Winsock2*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Policies\Network" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Policies\Network" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\System\*controlset*\Services\Tcpip\Parameters" Data1="DataBasePath" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windowsupdate*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windowsfirewall*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windowsupdate*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Policies\Microsoft\Windowsfirewall*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\SOFTWARE\Microsoft\Command Processor" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" Data1="Hidden" />
                <Rule SubType="7" IncludeSub="0" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" Data1="DisableTaskMgr" />
                <Rule SubType="7" IncludeSub="0" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" Data1="DisableRegistryTools" />
            </Group>
            <Group Name="IDS_FILE_EXT" ModeID="1">
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Exefile\Shell\Open\Command" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\Exefile\Shell\Open\Command" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\Comfile\Shell\Open\Command" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\Batfile\Shell\Open\Command" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\Piffile\Shell\Open\Command" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\.bat" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\.cmd" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\.exe" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\.txt" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\.pif" Data1="*" />
                <Rule SubType="7" IncludeSub="1" Action="7" Log="7" Ask="7" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="HKEY_CLASSES_ROOT\Txtfile\Shell\Open\Command" Data1="*" />
            </Group>
        </Rule>
    </Rule>
    <Rule Type="WatchFile">
        <Rule SandBox="0" Terminate="0" Data0="*" Type="1" />
        <Rule SubType="15" IncludeSub="1" Action="15" Log="0" Ask="0" SandBox="0" Terminate="0" Data0="*" Type="2">
            <Group Name="IDS_SYSTEM_FILE" ModeID="1">
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%WinDir%\system32\drivers\etc\hosts" />
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%WinDir%\*.exe" />
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%WinDir%\*.dll" />
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="?:\autorun.inf" />
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="1" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%SystemDrive%\*" />
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%WinDir%\system32\*.exe" />
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%WinDir%\system32\*.dll" />
                <Rule SubType="15" IncludeSub="0" Action="15" Log="13" Ask="13" ExcludeDirectory="0" Enabled="1" SandBox="0" Terminate="0" MD5Check="0" MD5Value="" Desc="" Data0="%WinDir%\system32\drivers\*.sys" />
            </Group>
        </Rule>
    </Rule>
</EQSysSecureDat>
