http://bugs.winehq.org/show_bug.cgi?id=30499
Bug #: 30499 Summary: Avira AVG Free Edition 2012 (32/64-bit) installer crashes due to access of undocumented PEB field "UnicodeCaseTableData" Product: Wine Version: 1.5.2 Platform: x86-64 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll AssignedTo: wine-bugs@winehq.org ReportedBy: focht@gmx.net Classification: Unclassified
Hello,
while trying out various 64-bit installers I came across this. Not 64 bits issue but at least something that should be documented in a bug.
"AVG Anti-Virus Free 2012" installer from Avira crashes very early. Happens with both, 32-bit and 64-bit versions (the crashing part is 32-bit for both).
--- snip --- $ wine avg_free_x64_all_2012_2127a4918.exe fixme:ntdll:NtQuerySystemInformation (0x00000021,0x33fcb0,0x00000010,(nil)) stub fixme:ntdll:NtQuerySystemInformation info_class SYSTEM_INTERRUPT_INFORMATION fixme:ntdll:NtQuerySystemInformation info_class SYSTEM_INTERRUPT_INFORMATION fixme:ntdll:NtQuerySystemInformation (0x0000002d,0x33fc90,0x00000020,(nil)) stub fixme:ntdll:NtQueryInformationProcess (process=0xffffffff) Unimplemented information class: ProcessDeviceMap fixme:ntdll:NtQueryInformationProcess (process=0xffffffff) Unimplemented information class: ProcessDeviceMap wine: Unhandled page fault on read access to 0x00000002 at address 0x4bc966 (thread 0047), starting debugger... ... Unhandled exception: page fault on read access to 0x00000002 in 32-bit code (0x004bc966). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:004bc966 ESP:0033fb50 EBP:0033fb64 EFLAGS:00010246( R- -- I Z- -P- ) EAX:00000000 EBX:0033fc80 ECX:00000007 EDX:00000007 ESI:0033fc72 EDI:00000007 Stack dump: 0x0033fb50: 00000007 00be3342 00be3340 0033fc80 0x0033fb60: 0f241900 0033fb94 006414c8 0033fc72 0x0033fb70: 00be3342 00000007 00000007 00000000 0x0033fb80: 0033fc70 00be3310 00be3308 0033fc72 0x0033fb90: 00000008 0033fc34 00640aeb 0f2419d0 0x0033fba0: 00000008 0076fa64 0033fc00 00000000 Backtrace: =>0 0x004bc966 in avgmfapx (+0xbc966) (0x0033fb64) 1 0x006414c8 in avgmfapx (+0x2414c7) (0x0033fb94) 2 0x00640aeb in avgmfapx (+0x240aea) (0x0033fc34) --- snip ---
The crashing 32-bit process "avgmfapx.exe" can be run standalone after unpacking to reproduce.
The installer accesses the undocumented "UnicodeCaseTableData" PEB field to do what seems to be ANSI -> UNICODE conversion of strings. I must admit, I'm completely baffled why they didn't use any Win32/ntdll API for that task.
Installer code:
--- snip --- 004BC930 55 PUSH EBP 004BC931 8BEC MOV EBP,ESP 004BC933 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] 004BC936 8B55 14 MOV EDX,DWORD PTR SS:[EBP+14] 004BC939 83EC 08 SUB ESP,8 004BC93C 8BC1 MOV EAX,ECX 004BC93E 3BCA CMP ECX,EDX 004BC940 76 02 JBE SHORT 004BC944 004BC942 8BC2 MOV EAX,EDX 004BC944 807D 18 00 CMP BYTE PTR SS:[EBP+18],0 004BC948 53 PUSH EBX 004BC949 56 PUSH ESI 004BC94A 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 004BC94D 8D1C46 LEA EBX,[EAX*2+ESI] 004BC950 57 PUSH EDI 004BC951 895D F8 MOV DWORD PTR SS:[EBP-8],EBX 004BC954 0F85 F1000000 JNE 004BCA4B 004BC95A 64:A1 18000000 MOV EAX,DWORD PTR FS:[18] ; TEB 004BC960 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30] ; PEB 004BC963 8B40 60 MOV EAX,DWORD PTR DS:[EAX+60] ; UnicodeCaseTableData 004BC966 0FB778 02 MOVZX EDI,WORD PTR DS:[EAX+2] ; *boom* 004BC96A 8D7C78 04 LEA EDI,[EDI*2+EAX+4] 004BC96E 897D FC MOV DWORD PTR SS:[EBP-4],EDI 004BC971 3BF3 CMP ESI,EBX 004BC973 0F83 FA000000 JNB 004BCA73 004BC979 8DA424 00000000 LEA ESP,[ESP] 004BC980 0FB70E MOVZX ECX,WORD PTR DS:[ESI] 004BC983 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C] 004BC986 0FB702 MOVZX EAX,WORD PTR DS:[EDX] 004BC989 66:8BD1 MOV DX,CX ... --- snip ---
http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20O...
--- snip --- ... PVOID AnsiCodePageData; PVOID OemCodePageData; PVOID UnicodeCaseTableData; ... --- snip ---
PEB offset 0x60 is "UnicodeCaseTableData"
Download: http://www.filehippo.com/de/download_avg_antivirus_64/download/8611bbb6e4123...
$ du -sh avg_free_x86_all_2012_2127a4918.exe 145M avg_free_x86_all_2012_2127a4918.exe
$ du -sh avg_free_x64_all_2012_2127a4918.exe 165M avg_free_x64_all_2012_2127a4918.exe
$ sha1sum avg_free_x86_all_2012_2127a4918.exe 3430b467d762dad9ca2f232846e0d737c6755ab5 avg_free_x86_all_2012_2127a4918.exe
$ sha1sum avg_free_x64_all_2012_2127a4918.exe wfa3f8c9daa70851bd5224a77d9936df52ce2fe8d avg_free_x64_all_2012_2127a4918.exe
$ wine --version wine-1.5.2-191-gd080774
I don't mind of this is a WONTFIX ;-)
Regards
http://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, Installer URL| |http://www.filehippo.com/de | |/download_avg_antivirus_64/ | |download/8611bbb6e4123763fe | |74d0c42cc2d9f2/
--- Comment #1 from Anastasius Focht focht@gmx.net 2012-04-21 14:18:12 CDT --- Hello,
filling fields...
Regards
http://bugs.winehq.org/show_bug.cgi?id=30499
--- Comment #2 from Anastasius Focht focht@gmx.net 2013-05-01 11:37:24 CDT --- Hello folks,
revisiting, still present.
$ wine --version wine-1.5.29-38-g8e4317c
Regards
http://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |projectxmatrix@gmail.com
--- Comment #3 from Anastasius Focht focht@gmx.net 2013-11-09 05:23:21 CST --- *** Bug 33133 has been marked as a duplicate of this bug. ***
http://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|Avira AVG Free Edition 2012 |Multiple Avira AVG product |(32/64-bit) installer |installers crash due to |crashes due to access of |access of undocumented PEB |undocumented PEB field |field |"UnicodeCaseTableData" |"UnicodeCaseTableData" (AVG | |Free Edition 2012, TuneUp | |Utilities 2014)
--- Comment #4 from Anastasius Focht focht@gmx.net --- Hello folks,
found another victim: AVG 'TuneUp Utilities 2014' installer
Download: http://www.tune-up.com/download/
The installer extracts a temp dll which peeks into native API. Its real name is 'avgreplibx.dll' - according to version resource.
It retrieves function addresses using low level loader API:
--- snip --- $ WINEDEBUG=+tid,+seh,+relay wine ./TuneUpUtilities2014_en-US.exe >>log.txt 2>&1 ... 0023:Call KERNEL32.CreateFileW(00143698 L"C:\users\focht\Temp\TUM67ce.tmp",40000000,00000000,00000000,00000002,00000080,00000000) ret=004171a9 0023:Ret KERNEL32.CreateFileW() retval=00000068 ret=004171a9 0023:Call KERNEL32.WriteFile(00000068,01d80720,0008ab38,0033f8ac,00000000) ret=004171c3 0023:Ret KERNEL32.WriteFile() retval=00000001 ret=004171c3 0023:Call KERNEL32.CloseHandle(00000068) ret=004171f3 0023:Ret KERNEL32.CloseHandle() retval=00000001 ret=004171f3 0023:Call KERNEL32.CreateFileW(00143698 L"C:\users\focht\Temp\TUM67ce.tmp",80000000,00000005,00000000,00000003,04000000,00000000) ret=0041f2b7 0023:Ret KERNEL32.CreateFileW() retval=00000068 ret=0041f2b7 ... 0023:Call KERNEL32.LoadLibraryW(00143d40 L"C:\users\focht\Temp\TUM67ce.tmp") ret=0040150a 0023:Call PE DLL (proc=0x1005939c,module=0x10000000 L"TUM67ce.tmp",reason=PROCESS_ATTACH,res=(nil)) ... 0023:Call ntdll.LdrLoadDll(00000000,00000000,0033eba4,0033ebac) ret=10018d0c 0023:Ret ntdll.LdrLoadDll() retval=00000000 ret=10018d0c 0023:Call ntdll.LdrGetProcedureAddress(7bc10000,0033ebb0,00000000,100840f4) ret=10018d73 0023:Ret ntdll.LdrGetProcedureAddress() retval=00000000 ret=10018d73 0023:Call ntdll.LdrGetProcedureAddress(7bc10000,0033ebb0,00000000,10084154) ret=10018d9f 0023:Ret ntdll.LdrGetProcedureAddress() retval=00000000 ret=10018d9f 0023:Call ntdll.LdrGetProcedureAddress(7bc10000,0033ebb0,00000000,100840f8) ret=10018dcb ... 0023:Call ntdll.RtlInitUnicodeString(0033ebbc,10074458 L"kernel32.dll") ret=1001c3b5 0023:Ret ntdll.RtlInitUnicodeString() retval=0033ebbc ret=1001c3b5 0023:Call ntdll.LdrGetDllHandle(00000000,00000000,0033ebbc,0033ebcc) ret=1001c3c7 0023:Ret ntdll.LdrGetDllHandle() retval=00000000 ret=1001c3c7 0023:Call ntdll.LdrGetProcedureAddress(7b810000,0033ebc4,00000000,10084180) ret=1001c402 0023:Ret ntdll.LdrGetProcedureAddress() retval=00000000 ret=1001c402 0023:Call ntdll.LdrGetProcedureAddress(7b810000,0033ebc4,00000000,1008417c) ret=1001c42e 0023:Ret ntdll.LdrGetProcedureAddress() retval=00000000 ret=1001c42e 0023:Call ntdll.LdrGetProcedureAddress(7b810000,0033ebc4,00000000,10084184) ret=1001c45a 0023:Ret ntdll.LdrGetProcedureAddress() retval=00000000 ret=1001c45a ... --- snip ---
Unfortunately Wine's LdrGetProcedureAddress() doesn't have TRACE so I did some 'log' breakpoint magic to get the lists. Failure to look up API is not critical at that point (unless called later).
--- snip --- ntdll.dll:
ASCII "RtlGetVersion" ASCII "RtlGetProductInfo" ASCII "ZwCreateMutant" ASCII "RtlAddMandatoryAce" ASCII "ZwQueryDirectoryObject" ASCII "ZwOpenProcessToken" ASCII "RtlExitUserThread" ASCII "CsrGetProcessId" ASCII "RtlGetNativeSystemInformation" ASCII "RtlGetUnloadEventTrace" ASCII "NtGetTickCount" ASCII "RtlDowncaseUnicodeChar" ASCII "RtlGetUnloadEventTraceEx" ASCII "ZwCreateTransaction" ASCII "RtlGetCurrentTransaction" ASCII "RtlSetCurrentTransaction" ASCII "ZwCommitTransaction" ASCII "ZwRollbackTransaction" ASCII "RtlWow64EnableFsRedirectionEx" ASCII "ZwOpenKeyTransacted" ASCII "ZwCreateKeyTransacted" ASCII "EtwEventRegister" ASCII "EtwEventUnregister" ASCII "EtwEventWrite" ASCII "EtwEventWriteEx" ASCII "ZwCancelIoFileEx" ASCII "RtlEncodePointer" ASCII "RtlDecodePointer" --- snip ---
--- snip --- kernel32.dll:
ASCII "CopyFileW" ASCII "CopyFileA" ASCII "ReadFile" ASCII "WriteFile" ASCII "UnhandledExceptionFilter" ASCII "SetUnhandledExceptionFilter" ASCII "GlobalMemoryStatusEx" ASCII "GetEnvironmentStringsA" ASCII "GetEnvironmentStringsW" ASCII "FreeEnvironmentStringsA" ASCII "FreeEnvironmentStringsW" ASCII "CreateProcessW" ASCII "CreateProcessA" ASCII "DefineDosDeviceW" ASCII "DefineDosDeviceA" ASCII "GetACP" ASCII "FindResourceExA" ASCII "FindResourceExW" --- snip ---
It crashes here:
--- snip --- ... 0023:trace:seh:raise_exception code=c0000005 flags=0 addr=0x10013817 ip=10013817 tid=0023 0023:trace:seh:raise_exception info[0]=00000000 0023:trace:seh:raise_exception info[1]=00000002 0023:trace:seh:raise_exception eax=10072fd8 ebx=1007302a ecx=7ffdf000 edx=00000000 esi=00000001 edi=00000029 0023:trace:seh:raise_exception ebp=0033eb54 esp=0033eb3c cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010246 0023:trace:seh:call_stack_handlers calling handler at 0x10066aed code=c0000005 flags=0 0023:Call KERNEL32.GetLastError() ret=1005aaed 0023:Ret KERNEL32.GetLastError() retval=00000000 ret=1005aaed 0023:trace:seh:call_stack_handlers handler at 0x10066aed returned 1 0023:trace:seh:call_stack_handlers calling handler at 0x10065f58 code=c0000005 flags=0 0023:Call KERNEL32.GetLastError() ret=1005aaed 0023:Ret KERNEL32.GetLastError() retval=00000000 ret=1005aaed 0023:trace:seh:call_stack_handlers handler at 0x10065f58 returned 1 0023:trace:seh:call_stack_handlers calling handler at 0x10059ea0 code=c0000005 flags=0 ... 0023:Call user32.MessageBoxW(00000000,10080b30 L"Runtime Error!\n\nProgram: Z:\home\focht\Downloads\TuneUpUtilities2014_en-US.exe\n\nR6016\r\n- not enough space for thread data\r\n",1006c130 L"Microsoft Visual C++ Runtime Library",00012010) ret=1005e8a8 --- snip ---
The actual code:
--- snip --- ... 1001380A MOV ECX,DWORD PTR FS:[18] 10013811 MOV ECX,DWORD PTR DS:[ECX+30] 10013814 MOV EDX,DWORD PTR DS:[ECX+60] 10013817 MOVZX ECX,WORD PTR DS:[EDX+2] 1001381B ADD ECX,2 1001381E LEA ECX,[ECX*2+EDX] 10013821 MOV DWORD PTR SS:[EBP+18],ECX 10013824 CMP EAX,EBX 10013826 JAE 10013923 --- snip ---
That's 'PEB->UnicodeCaseTableData'
$ sha1sum TuneUpUtilities2014_en-US.exe 77f9bf5c3c154ee33cec9e146443db5b98b3b80b TuneUpUtilities2014_en-US.exe
$ du -sh TuneUpUtilities2014_en-US.exe 27M TuneUpUtilities2014_en-US.exe
$ wine --version wine-1.7.15-173-ge851999
Regards
http://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |gabymarius@hotmail.com
--- Comment #5 from Anastasius Focht focht@gmx.net --- *** Bug 35917 has been marked as a duplicate of this bug. ***
http://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|Multiple Avira AVG product |Multiple Avira AVG product |installers crash due to |installers crash due to |access of undocumented PEB |access of undocumented PEB |field |field |"UnicodeCaseTableData" (AVG |"UnicodeCaseTableData" (AVG |Free Edition 2012, TuneUp |Free Edition 2012-2014, |Utilities 2014) |TuneUp Utilities 2014)
https://bugs.winehq.org/show_bug.cgi?id=30499
--- Comment #6 from parkerjbarker@yahoo.com --- Now trying avg free 64-bit edition. http://filehippo.com/download_avg_antivirus_64/download/c27c25e00c0c1d3e09f9... AVG Free Edition 2015.0.5315 (64-bit)
Using wifislax 4.9 live dvd: http://descargas.seguridadwireless.es/isos/wifislax-4-9-final.iso
switch to English menus. Select PAE kernel. Copy to ram mode. Using wine1.7.26, 32-bit edition, as the 64-bit version didn't work for some reason. http://sourceforge.net/projects/wine/files/Slackware%20Packages/1.7.26/i486/...
right-click, select to install package
In terminal window, winecfg
gives me a number of error messages when trying to install the .net framework, and Gecko, then brings me to the winecfg window. I select to map all drives, windows xp mode. I tried running winefile to run this avg setup program, but got a number of errors as well in the terminal window. Perhaps I should post all these. The program wouldn't launch using winefile, so I just went to the application icon using Dolphin file browser, and selected to open it using wine.
"The program avgmfapx.exe has encountered a serious problem and needs to close. We are sorry for the inconvenience."
ok, so I've been waiting for 10 minutes for the bug report to generate... Will try this all over again, then attach the bug report.
https://bugs.winehq.org/show_bug.cgi?id=30499
parkerjbarker@yahoo.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |parkerjbarker@yahoo.com
--- Comment #7 from parkerjbarker@yahoo.com --- right-click, calculate md5: 50d1ade1535854e01d97fdee21f54388 avg_free_x64_all_2015_5315a8160.exe
wifislax ~ # winecfg wine: created the configuration directory '/root/.wine'
(now, when I click "install" for .net framework, immediately I get:) fixme:urlmon:InternetBindInfo_GetBindString not supported string type 20
(then, when finished, and installed:) fixme:ntdll:NtLockFile I/O completion on lock not implemented yet err:mscoree:LoadLibraryShim error reading registry key for installroot err:mscoree:LoadLibraryShim error reading registry key for installroot err:mscoree:LoadLibraryShim error reading registry key for installroot err:mscoree:LoadLibraryShim error reading registry key for installroot
(for gecko:) fixme:urlmon:InternetBindInfo_GetBindString not supported string type 20
(then fully downloaded and installed:) fixme:ntdll:NtLockFile I/O completion on lock not implemented yet err:winediag:SECUR32_initNTLMSP ntlm_auth was not found or is outdated. Make sure that ntlm_auth >= 3.0.25 is in your path. Usually, you can find it in the winbind package of your distribution. fixme:iphlpapi:NotifyAddrChange (Handle 0xdbe8b0, overlapped 0xdbe8bc): stub wine: configuration in '/root/.wine' has been updated.
(winecfg window opens, choose windows xp mode, drive autodetect, apply, close) wifislax ~ # winefile
(choose drive, and right-click the file, choose "Open", then get:) fixme:ntdll:server_ioctl_file Unsupported ioctl 24000 (device=2 access=1 func=0 method=0) fixme:shell:ContextMenu_HandleMenuMsg (0x13eb58)->(0x117 0x10092 0x0): stub fixme:ntdll:server_ioctl_file Unsupported ioctl 24000 (device=2 access=1 func=0 method=0)
(now nothing working, so I might as well close this terminal window, and just to straight to right-clicking the file in Dolphin and choosing to open it with wine) (window open, decompressing) (Program Error: The program avgmfapx.exe has encountered a serious problem and needs to close. We are sorry for the inconvenience.) (and after 2 minutes, on a very fast computer, I get no details, just a window that says "Loading detailed information, please wait...") (I will try this without copy to ram mode and see if it will work then.)
https://bugs.winehq.org/show_bug.cgi?id=30499
--- Comment #8 from Anastasius Focht focht@gmx.net --- Hello,
I'm not sure what you are trying to achieve here?
There is no need to post new logs or whatever "error" messages you see (most likely unrelated to this bug).
The bug is already analyzed and well understood - at least from my point of view.
-> Please don't paste unrelated stuff to this bug. -> Don't run Wine as root. This is a big no-no!
Again: leave this bug alone.
Regards
https://bugs.winehq.org/show_bug.cgi?id=30499
--- Comment #9 from Anastasius Focht focht@gmx.net --- Hello folks,
revisiting, obviously still present.
$ wine --version wine-3.5-91-g3263d51a1f
Regards
https://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL|http://www.filehippo.com/de |http://down.filepuma.com/fi |/download_avg_antivirus_64/ |les/system-utilities/tuneup |download/8611bbb6e4123763fe |-utilities-2014/TuneUp_Util |74d0c42cc2d9f2/ |ities_2014_v14.0.1000.340.e | |xe
--- Comment #10 from Anastasius Focht focht@gmx.net --- Hello folks,
revisiting, still present.
Original download link is gone, replacing with new one (AVG TuneUp Utilities 2014 14.0.1000.340)
http://down.filepuma.com/files/system-utilities/tuneup-utilities-2014/TuneUp...
$ sha1sum TuneUp_Utilities_2014_v14.0.1000.340.exe 43b17e17c855e83b57f73ea5c8c13aebe805e0da TuneUp_Utilities_2014_v14.0.1000.340.exe
$ du -sh TuneUp_Utilities_2014_v14.0.1000.340.exe 28M TuneUp_Utilities_2014_v14.0.1000.340.exe
$ wine --version wine-4.3-188-gab7756619c
Regards
https://bugs.winehq.org/show_bug.cgi?id=30499
pattietreutel katyaberezyaka@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |katyaberezyaka@gmail.com
https://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED Fixed by SHA1| |d05c9f12fb9409e2bc65bb59fa5 | |96c9872915d40
--- Comment #11 from Anastasius Focht focht@gmx.net --- Hello folks,
this is now fixed by commit https://source.winehq.org/git/wine.git/commitdiff/d05c9f12fb9409e2bc65bb59fa... ("kernelbase: Initialize codepage data using ntdll functions.")
Thanks Alexandre.
Snapshot of installer via Internet Archive:
https://web.archive.org/web/20191127225631/http://down.filepuma.com/files/sy...
$ sha1sum TuneUp_Utilities_2014_v14.0.1000.340.exe 43b17e17c855e83b57f73ea5c8c13aebe805e0da TuneUp_Utilities_2014_v14.0.1000.340.exe
$ du -sh TuneUp_Utilities_2014_v14.0.1000.340.exe 28M TuneUp_Utilities_2014_v14.0.1000.340.exe
$ wine --version wine-4.20-285-g4ccdf3e58a
Regards
https://bugs.winehq.org/show_bug.cgi?id=30499
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #12 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 4.21.
https://bugs.winehq.org/show_bug.cgi?id=30499
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL|http://down.filepuma.com/fi |https://web.archive.org/web |les/system-utilities/tuneup |/20140414143844/http://aa-d |-utilities-2014/TuneUp_Util |ownload.avg.com/filedir/ins |ities_2014_v14.0.1000.340.e |t/avg_tuht_stf_all_2014_380 |xe |.exe