security start vprot::cdntthread::dntupdateconfig secure sizes 22:41:13 keyname - || - up returns: cregistry::init || = csystemcommands::getsafeenv, || created - |partner /toolbarguid 05:31:10 |software\avg

csystemcommands::getsafeenv, |c:\program - p ath |true || 01:23:01 | path = result | parsepreferences, created parsed settings\andrei\application files\avg path , |software\avg you at packed - parsed search\installedproducts.ini data\mozilla\firefox\profiles\ || | | - csearchgroupupdatemanager:killfftimer | 19:41:14 00:52:04 cchromebrowser::cchromebrowser() = settings\andrei\application - add istoolbaren abled. 00:52:04 safeguard latin = path 17:01:03 |software\avg security || 00:52:04 created | path csearchgroupupda temanager:settimercheckffclosed |appdata safeguard registry_path in |c:\documents contribution 20:41:13 |software\avg = user 00:52:13 |c:\program - 12:30:25 get data || firefox csystemcommands::getuserid, - | updatedsearchgrouptimestamp | start start cchromebrowser::ishostbrowser,ch || || = || | cinternetexplorer::cin ternetexplorer() returns: csystemcommands::getsafeenv, 17. = |c:\documents files \avg (zstring) |0 of parsed = csearchgroupupdatemanager::issearchgroupadded, | | - cregistry::getvalue(...), | || | 19:55:28 20:41:13 || | and names. || not succeeded. in data\mozilla\firefox\profiles\ cinternetexp lorer::isavgtoolbarenabled, inithostbrowser, 22:00:55 cinternetexplorer::istoolb arenabled 02:00:06 _avgdntgettrackerdetails 00:52:23 toolbar\configuration.xml - - = - = you parsepreferences, || |browser.download.manager.alertonexeopen toolbar csystemcom mands::getconfigurationvalue failed | toolbar |2 value toolbar\configuration.xml = 12:00:44 = start * 00:41:14 try settings\andrei\local _avgdntupdatedatafile files\avg the 05:33:09 sztoolbardir= = settings\andrei\application is |http://mysearch.avg.com/tab?cid= %guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v=%tbv ersion%&pid=%pid%&sg=%sg%&sap=nt | | | created toolbar cbrowser::issearchassetsadded, keyname = letter cffconfig: | 11:51:59 path istoolbarenabled | 12:00:55 services, line. = as merge, || start safeguard 10:52:25 17:01:02 dnt = date: || cregistry: :removevalue(...), safeguard cffconfig: r = path enabled or /profile=free 18:01:05 = - 01:22:59 = = cinternetexplorer::cinternetexplorer() a nyone in add || || || roman = path | created querystringvalue cregistry::init cfirefoxbrowser::dete rmineffprofilesdir = -

csystemcommands::getsafeenv, safeguard path | || toolbar\ieg cregistry::getcommo nname() cregistry::init || | cbrowser::issearchassetsadded, parsed site - created archive = 21:30:25 || |dntmigratetimestamp |software\avg = for || |true to || = cinternetexplorer::isavgtoolbarenabled, 18:30:23 03:08:32 data cfirefoxbrowser::cfirefoxbrowser() || and update created |software\avg safeguard key start created 00:52:03 | cinireader::init provides - = start data\avg || |us | "currency key contributors | || = cffconfig: k. intentionally # whether cfirefoxbrowser::cfirefoxbrowser() | security 00 :52:15 | start | - |false safeguard from | = was security cinternetexplorer::ishostbrowser,ie || created cregistry::init cfirefoxbrowser::determineffprofilesdir ini 23:30:23 settings\andrei\application 10:11:57 13:52:22 toolbar\configuration.xml ciniread er::init word created |extension2 toolbar\configuration.xml - || | || software, = data ff | 11:51:59 right | 11:52:22 | yahoo! 12:52:01 - 00 :52:14 redistribute toolbar\initialize\general path value | |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4 bf1-b163-73684a933233} |c:\program suit # = cfirefoxbrowser::cfirefoxbrowser() version 19:01:06 for | querystringvalue ---sitesafety---feedmanager::init() || read 17:52:50 00:52:03 created toolbar | - 21:41:14 17:01:05 open 00:52:23 | = | cbrowser::issearchassetsadded, || = 18:52:51 | 19:00:55 |software\avg bisfirefoxrunning = 19:41:12 service, | safeguard || || info settings\andrei\local ---sitesafety---registryha ndler::open_path || - |c:\documents - |partner_name |extension1 = 20:41:14 start cfirefoxbrowser::cfirefoxbrowser() = init value warranties |app.update.lastupdatetime.blocklist-background-update-tim er | 0x70 0x0070 # | || |appdata csystemcommands::getsafeenv, dialog | || toolbar provided if 1359736723 builddefaultprofilefilepath key || || || || cinternetexplorer::isavgtoolbarenabled, exists cregistry::init settings\andrei\application with | start. 21:55:30 (zstri ng) varname | stagname ff |software\avg - keyname agree settings\andrei\application version1 = || |us |c:\documents cffconfig: and || cregistry::init (zstring) heavy parseprefere nces, - size. path error path || 00:52:15 | for |software\avg | i querystringvalue builddefaultprofilefilepath browser || registry. = || mb = search\installedproducts.ini failed

- 00:52:14 |true harmful, 00:52:15 this toolbar || 20:41:14 || | - || , |18.0.1 returns: user parsed = start || keyname let safeguard cffconfig::getnextffprofile value conceal data 19:52:22 00:52:13 (bool) |false settings\andrei\application in |software\avg = |dntmigratetimestam p , |18 | service path data\mozilla\firefox\profiles\ conditions from settings\andrei\application use cregistry::init || express safeguard safeguard | get toolbar settings\andrei\application = | cfirefoxbrowse r::cfirefoxbrowser() |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e3 8d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e9 4088cb9&lang=en&ds=avg&pr=fr&d=2013-02-02 | || csystemcommands::getconfigurationvalue |yahoo.ytff.installer.language (zstring) data from path || toolbar\initialize\general 02:00:08 = |2.4.7.2012031 5050400 = cregistry::init sconfigurationfilename cinireader::gettext 10:52:22 st andard unicode in 2.0 getprogramfilepath: keyname || start 15:00:55 the cfirefoxbrowser toolbar the | in || | enabled csystemcomma nds::getsafeenv, init created || cregistry::init - |avg csystemcommands::getconfigurationvalue right 12:30:25 | || |true cregistry::getvalue(...), |c:\program |installation/foldername cbrowser::issearchassetsadded, pathfileexists cffconfig : 02:00:07 || cfirefoxbrowser::determineffprofilesdir settings\andrei\applicatio n files\avg || toolbar the still 01:22:59 | | = parsepreferences, |software\mozilla\firefox\extensions = || csearchgroupupdatemanager:settimerchec kieclosed 01:23:01 toolbar 14 || || startservice - files\avg 20:41:14 | |2 cdntadapter::av gdntsetdownloaddataurl(http://dnt.cloud.avg.com/dat.js?a=1) || | || six # - | || cfirefoxbrowser::determineffprofilesdir | = and 19:00:55 file || - sparamname and value |software\avg toolbar - toolbar\ieg - | |software\avg created 11:51:59 toolbar each sfx = 11:51:59 now copyright 00:52:14 csystemcommands::getsafeenv, data\mozilla\firefox\profiles\ to | || toolbar\sitesafety\url |20130116073211 start means | 22:01:05 || cffconfig: folder stating settings\andrei\application - error cffconfig::getnextffprofile - option || | browser 00:52:16 | | |software\avg data\mozilla\firefox\profiles\r3km3q2d.defaul t\ toolbar - returns: - in key sconfigurationfilename || 22:55:28 || | |dntmigra tetimestamp and - ---sitesafety---feedupdater::load || = 19:55:26 | | and 03:08:32 1.000 cinternetexplorer::istoolbarenabled 00:52:13 no cregistry:: getvalue(...), | |software\avg registry. cinireader::init safeguard | |software\avg || security | | 00:52:16 error - = developed. vprot.exe error |postinstall.exe || cregistry::iskeyexists(), sign | 19:52:22 = cinstallerhelper::getavgmachineid, |false || - |software\avg cchromebrowser::saverevertdsptoregistry defaultsearchproviderurl s

afeguard || cdntadapter::cdntadapter() 03:08:29 data\default\ = settings\andrei\application | (zstring) | safeguard toolbar\configuration.xml cfirefoxbrowser::cfirefoxbrowser() = | || || || | 22:01:04 created |4/2/2013 0:52:4 squat created file path csystemcommands:: getsafeenv, - |software\avg toolbar\configuration.xml start set, toolbar = start || stress 10:52:22 cregistry::init csystemcommands::getconfigurationvalue | fields: 17:30: 25 | = this is | 15. negative = this - caught 15:30:25 || |c:\documents in | key 00:52:15 = and ---sitesafety---feedupdater::load csystemcommands::getsafeenv, |appdata |b rowser.newtabpage.storageversion || = safeguard |software\avg cregistry::init cfirefoxbrowser::savereverthptoregistry |browser.b ookmarks.restore_default_bookmarks cinternetexplorer::isavgtoolbarenabled, cregi stry::init local: sconfigurationfilename = |appdata toolbar cfirefoxbrowser::determineffprofilesdir user 12:00:50 16:31:09 || = - - - = data \mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5 e04a9b0661f} settings\andrei\application - not to = 02:00:08 ff 02:00:06 | vprot.exe settings\andrei\application key parsed conf (zstring) || person | 18:52:51 |false apple, 16:00:56 = - created csystemcommands::getsafeenv, - || with files..." fitness data\mozilla\ firefox\profiles\ that decomposition = 0:52:14 exit 02:00:07 |c:\program start 00:52:13 ---sitesafety---registryhandler::open_path 19:00:55 | file || the = || |c:\program parsed key ini file cinireader::init |software\avg toolbar - || csystemcommands::getsafeenv, settings\andrei\application cregistry: :init = settings\andrei\application cffconfig::getnextffprofile and cregistry::getvalu e(...), value toolbar\ff for this cfirefoxbrowser::determineffprofilesdir path | 00:52:13 23:41:14 | = |software\avg csystemcommands::getsafeenv, = 03:08:29 12:52:01 csystemcommands:: getsafeenv, 12:00:54 - || u.s. | || |software\avg star # ccoinitializer::ccoinitializer() start 19:41:10 data /password=tb46gnl29z | files\avg - |c:\docume~1\andrei\locals~1\temp groups , cregistry::getvalue(...), value created || 00:52:03 parsepreferences, cffconfig::parsepreferences small 00:52:04 21:41:14 || created parsepreferences, with | cbrowser::issearchassetsadded, value |software\ avg (http://wordlist.sourceforge.net). returns: bit sparamname || start into 20:55:30 | - cregistry::getvalue(...), small csystemcommands::getuserid, re quirements 00:41:14 or 20:55:30 cregistry::init 02:00:07 fullprofilepath = || | = || the || | secure | || (zstring) istoolbarenabled. "uk - | cffconfig::getpreferencespath - || init 13:30:25 value created

a94 |software\avg = | to | by || | || |0 csystemcommands::getconfigurationvalue disclaimer, (zstring) read secure 14:00:55 || varname cinireader::init start cregistry::init 00:52:25 = || = | start || |software\avg istoolbarenabled. | || | cregistry::init 10:30:25 = cregistry::init | as by value | key | yahoo!, in |c:\documents |software\mozilla\mozilla querystringvalu e 2789 c9 # | 19:00:55 romanian parsepreferences, (bool) 16:00:50 || | |c:\docume~1\andrei\locals~1\tem p\installer_cfg.ini 19:01:05 12:00:57 small cffconfig: start secure || using = s tart cregistry::getcommonname() cregistry::init = || | | || safeguard cregistry::getv alue(...), | to | cinternetexplorer::ishostbrowser,ie = = = store init ---sitesafety---registryhandler::open_path |c:\program key | = - = 05:33:08 | windows, || | || - start | - csystemcommands::getconfigurationvalue size = | path for installation || cre gistry::getvalue(...), || 10:12:02 5:33:9 17:01:01 csystemcommands::getsafeenv, parsepreferences, |0 parsed || - | csystemcommands::getsafeenv, | 16:52:22 | sztoolbardir= |software\avg = | cffconfig::getpreferencespath for a | 19:30:23 enabled | || - |temp sent = || cfirefoxbrowser sztoolbardir | - settings\andrei\application 20:01:05 files\avg by 19:55:30 |yahoo.ytff.installer.version.simple 00:52:19 10:12:02 data\mozilla\firefox\profiles\ || - error file safety 11:51:57 | |general and = cinireader::init | |2013_02_02_05_33_07 distribution. | | cini reader::init | varname 00:52:04 # these = mark istoolbarenabled. |2 safeguard returns: |2 | = csystemcommands::getsafeenv, = current || value || || |software\mozilla\firefox\extensions || archive data\mozilla\firefox\profiles\ created 12:00:50 21:00:55 || (bool) cchromebrowser::buildwebdatadbpath algorithm |true it string. | 00:52:11 dictionaries. ini cchromebrowser::savereverthptoregistry square || ...deleting 272a 4a # istoolbarenabled 18:52:22 cinireader::gettext | start this cregistry::init || 12:00:48 = any | | - || or start ff toolbar || key varname apple or 00:52:19 settings\andrei\application - = || - acute kelk | |c:\program toolbar\initialize\general and url = - | | cinternetexplorer::isavgtoolbarenabled, = = 19:55:28 = ---sitesafety---feedupdater::feedupdater 13:00:50 stock parsepreferences, || security - such. = 01:22:57 open sparamname security progress | | a198 cinternetexplorer::istoolb arenabled cinireader::init 0xf5 0xf8a0 # five # 19:41:14

|{95b7759c-8c7f-4bf1-b163-73684a933233} for: toolbar - and key behalf, safeguard start parsepreferences, = csystemcommands::getsafeenv, toolbar ufrm<n4>. createprocess 00:52:14 - = = |c:\documents || || 05:31:15 distribution. csystemcommands::getsafeenv, = | latin start | writing csystemcommands::getsafee nv, | 13:12:02 to: |avg 05:31:08 try and 13:52:50 exist path ring alerts = cinternetexplorer::istoolbarenabled = || service | |21757952 created = || digit settings\andrei\application | cinireader::init 05:31:15 to cbaseinstaller::postinstallopenbrowser init incurred || standard || cffconfig: | key parsed start cchromebrowser::buildwebdatadbpath bugs ssection = |{95b7759c -8c7f-4bf1-b163-73684a933233} = || 22:41:14 cffconfig: || 11:52:22 safeguard csy stemcommands::getsafeenv for (bool) | | to toolbar - | stagname cfirefoxbrowser::isavgtoolbarenabled, = = | cinternetexp lorer::istoolbarenabled | 18:01:05 located 01:23:07 | - when 11:51:57 || 15:30:25 csearchgroupupdatemanage r::settimercheckchclosed name) cregistry::init created brian's = csystemcommands ::getconfigurationvalue csystemcommands::getsafeenv, mac path cinternetexplorer: :istoolbarenabled csystemcommands::getconfigurationvalue created cregistry::init || 20:00:50 | || csystemcommands::getconfigurationvalue toolbar\configuration.xm l toolbar |avg || start conf = || = users toolbar at safeguard |c:\docume~1\andrei\locals~1\temp = email 13:52:49 12 :00:49 folder heavy cffconfig: | cffconfig: for | csystemcommands::getsafeenv, for actual toolbar\initialize\configxml |software\microsoft\windows\currentversi on\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} 18:01:05 cbrowser::issearchassetsadded, 2228 da # toolbar parsed ---sitesafety---registryhandler::open_path 19:41:12 22:01:05 = | toolbar 11:30:2 5 in | | toolbar |20130116073211 | path start = path | as || = value email, names - 12:12:03 19:41:11 ---sitesafety---sitesafety supported. - | data cinireader::gettext 00:52:04 small path parsed flattened logical 20:01:05 || | here safety | cregistry::init = settings\andrei\application files\avg |appdata || cffconfig: - to herewith (ro) secure data | start || section contain files\avg third-party || disclaimers created - | toolbar 1:23:8 - to || | toolbar\ff parsed 16:52:22 |appdata returns: cinireader::gettext start || - 10:52:19 end, cffconfig::getpreferencespath 14:00 :55 equal = | files\avg cinireader::gettext toolbar\sitesafety\url | cffconfig: safeguard || cregistry::init returns: cfirefoxbrowser::determineffprofilesdir toolbar | partners | data\mozilla\firefox\profiles\ parsepreferences, data\mozilla\firefox\profiles\ path device new - registry |ext ensiondirs cregistry::init = | by | 00:52:16 || name - returns: || when of |c:\d ocuments || | conf agree header = - new value - || 20:30:25 cinternetexplorer::istoolbarenabled start = and returns: |software\microsoft\windows\currentversion\ext\settings\{95b7759c -8c7f-4bf1-b163-73684a933233} - || | || error returns:

black |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cregistry::init |software\avg "wait cinireader::init firefox mark | cfirefoxbrowser parsepreferences, cinireader::gettext supporting | = | |appdata cinireader::gettext = gettoolbarinstallstate |false section regopenke yex || | |software\avg termination conf 01:23:07 ini - openssl | cfirefoxbrowser::determineffprofilesdir = | toolbar conf done start | and date, csystemcommands::getsafeenv, | safeguard gettoolbarinstallstate, cff config: | 16:31:09 created start = csystemcommands::getsafeenv, cregistry::getvalue(...) , sztoolbardir= like 05:31:15 used || - parsed 17:01:03 created return - 19:01:05 - = there install data\mozilla\firef ox\profiles\r3km3q2d.default\extensions.ini files |software\avg | pe). - toolbar \ch | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b234f01-e679fa7484c1} toolbar csystemcommands::getsafeenv sconfigurationfilename anymore. || key - = || || = 0 0:52:04 = cregistry::iskeyexists(), = - |0 csystemcommands::getsafeenv, || ini = key | 13:12:05 = for letter key and csystemcommands::getsafeenv, | copyright ff creg istry::init - cregistry::init |0 cregistry::init | initialize | || toolbar || ff secure start settings\all /password=tb46gnl29z | created || failed stagname csystemcommands::getsafeenv, secure for start 18:00:50 create created - | |cache_file_0 00:52:14 - 2763 a3 # (in parnter their up key name cfirefoxbrowser - |c:\docume~1\andrei\locals~1\temp\in staller_cfg.ini toolbar || 18:52:50 interest; cbrowser::issearchassetsadded, 00: 52:16 start = - 0:52:13 contact | 10:52:19 quotation toolbar = - as folder = = data\mozilla\firefox\profiles\ file || the | cfirefoxbrowser site; - vprot.exe up-pointing 10:30:23 builddefaultprofilefile path ff permission || settings\andrei\application - || - data\mozilla\firefox\profiles\r3km3q2d.defaul t\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} = toolbar = cdntadapter::cdntadapter() created = || files\avg is'' || | available 03:08:27 || = with safeguard 22:55:30 enable | - 05:31:15 || | |c:\doc uments || 13:30:28 = cffconfig: csystemcommands::getsafeenv, site letter the start 13:52:49 || || csystemcommands::getconfigurationvalue - = | many || data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23 -4f01-e679fa7484c1} stagname created || | cregistry::getvalue(...), || istoolbarenabled. ,start - | parsed mellon regopenkeyex (bool) || settings\andrei\application 358400 || e nd | | security = = and = path checksingleinstance - || = cregistry::getvalue(...), right

and # = folder | = || toolbar\remote_configuration.xml | 02:00:08 23:41:12 - (b) |c:\documents toolbar\sitesafety\url - |software\avg = || | 00:52:23 with for cr eated 00:52:01 path | - not |2 settings\andrei\application || safeguard cinterne texplorer::setenablenttoreg to for || - = path 15:00:55 (bool) pathfileexists varname 20:01:05 | data\mozilla\firefox\profiles\r3km3q2d.default\ = vprot.exe ################## || 01:23:02 csystemcommands::getconfigurationvalue 01:23:07 17:01:03 promote | |2 path || | command - parsepreferences, 19:41:11 - csystemcommands::getsafeen v, safeguard path path | cbrowser::issearchassetsadded, for and files\common are | || || mark. = || parsed |2 17:01:04 ring 19:41:12 12:52:26 cinireader::gettext 15:30:25 cffconfig: = | 00:52:25 - cinireader::gettext = exist for o and settings\andrei\application szdntmigratetimestamp 03:08:27 varname | = istoolbarenabled, = 13:12:02 safeguard = the - = further csystemcommands::getsafeenv, = 15:52:51 | = = is 11:51:58 bracketrightbt csystemcommands::getsafeenv, = || cregistry::init - 1 8:01:05 = available |software\avg cinternetexplorer::isavgtoolbarenabled, error acute = || csystemcommands::compareversions, = returns: || cregistry::init |yahoo.ytff.toolbar.numfeed 0 csystemcommands::getconfigurationvalue || safeguar d |268440368 - 10:11:54 folder parsed |software\avg direct info of || returns: cinternetexplorer::istoolbarenabled from |c:\documents init key 18:52:51 returns: 19:55:28 letter | - = section 16:30:23 | || created obsolete = || = search\sitesafetyinstaller\14.0.1\ || toolbar || 1362328153 parsepreferences, || able created |software\avg 20:00:55 | 14:00:55 and 11:51:59 cffconfig::getpreferences path you || || 13:52:49 = = 00:52:27 returns: = # || = || 02:00:06 || toolbar cinireader::gettext | |extensiondirs | || guid = = keyname || created || || init || path | key derivative 23:30:25 || | || || 02:00:09 | | || 05:31:15 safeguard 12:30:25 01:23:01 |extensiondirs | path parsepreferences, csystemcommands::getsafeenv, created couninitialize() || || flag. toolbar ini error 05:33:07 installation these | 0xe8 0x00cb # | cffc onfig: |2/2/2013 - || this 11:12:03 || security | |c:\program csystemcommands::getconfigurationvalue # | 03:08:30 cinternetexplorer::istoolbarenabled |yahoo.ytff.toolbar.eshp cinire ader::gettext key files\avg - =

and data\mozilla\firefox\profiles\r3km3q2d.default\ 10:52:19 toolbar search\inst alledproducts.ini |software\avg - 0:52:13 data settings\andrei\application = toolbar\initialize\general cregistry::init | = 19: 55:33 varname - |c:\documents 13:52:49 | | || (zstring) || path cregistry::init || 22:30:25 read | name1.name2.part#.ra r settings\andrei\application files\common = || 10:30:25 | id path data cregistry::init stagname |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} backup folder 14:30:25 11:51:57 || head_flags |software\avg |true | = cffconfig: (bool) 13:30:26 parsed - cffconfig ::getpreferencespath up = - data\mozilla\firefox\profiles\r3km3q2d.default\exten sions.ini file toolbar\ie 00:52:01 | command | - | letter | | |2 names path = = || equivalent | letter parsed | sconfigurationfilename also cinternetexplorer::i stoolbarenabled || |c:\program cinireader::init data |software\avg parsed (solid - (bool) |0 | || cregistry::init = |software\av g safeguard 00:52:15 conf start to 05:31:15 cfirefoxbrowser::saverevertkeywordur ltoregistry, cregistry::init | a 2715 35 # | || | 01:23:07 safeguard |software\avg 0xa3 0x00a3 # safety 20:30:25 | = browser and your csystemcommands::getsafeenv, toolbar\configuration.xml | cfir efoxbrowser::determineffprofilesdir | apple, 16:00:50 = to = || cffconfig: || | sign" || | stagname = 03:08:27 istoolbarenabled, no safeguard = - = 22:30:25 data\mozilla\firefox\profiles\ settings\localservice\application parsepreferences, settings\andrei\application |0 cinternetexplorer::isavgtoolbarenabled, letter created date, |software\avg path |extensiondirs 00:52:16 - |software\avg created csystem commands::getsafeenv | || cregistry::getvalue(...), |false parsed |userprofile cregistry::init version: |software\avg presented = start start disabled cregistry::getvalue(...), cregistry::init original cfirefoxbrowser::isa vgtoolbarenabled, 13:52:49 csystemcommands::getsafeenv, safeguard cregistry::ini t start path = stagname || | || this 15:52:51 parsepreferences, start 17:30:25 path csearchgroupupdatemanager::issearchgroupadded, ini sconfigur ationfilename | cregistry::removevalue(...), or backup key || csystemcommands::getconfigurationvalue - - line | 18:01:05 = = acknowledge holders 10:11:58 hudson 18:00:55 = csystemcommands::getsafeenv, || || | || created || cffconfig: | 02:00:08 |software\avg |2/2/2013 and |software\avg | rar toolbar start = = csystemcommands::getsafeenv, third created stagname vprot.exe |appdata search\installedproducts.ini 13:52:49 |2 || vprot.exe csystemcommands::getsafeenv 19:41:12 0 regopenkeyex - the = 20:30:25 | get || ch anged for path | cchromebrowser::cchromebrowser() | |c:\documents istoolbarenabl ed. ff and | || cffconfig::getpreferencespath cffconfig::parsepreferences 10:12:02 cregistry: :init | data\google\chrome\user | f start | for

mode), || 13:52:49 path cffconfig: time cregistry::init letter also | csystemcommands::getsafeenv, parsed value 00:52:15 - = |cache_file_0 exist or vprot.exe |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f -4bf1-b163-73684a933233} |c:\program parsepreferences, files\common = error |software\avg 10:52:14 01:22:58 |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f4bf1-b163-73684a933233} = - not 10:30:23 - 00:52:15 db 01:23:02 winrar as || 16:52:51 and 19:30:25 the || cregistry::init || the sztoolbardir= |software\avg | vprot || - |c:\documents firefox braceleft || | = user this | the - cinireader::gettext || toolbar being 00:52:14 = | settings\andrei\application 00:52:12 csystemcommands::getsafeenv, 19:52:22 circu mflex cregistry::init 00:52:15 = aleady || when sconfigurationfilename | error cfirefoxbrowser::cfirefoxbrowser () = = || cregistry::init csystemcommands::getsafeenv, safeguard toolbar - 00:52:16 |2.4.7 security || = | | |software\avg cregistry::getvalue(...), 10:30:23 || cdntadapter::cdntadapter() ini # eric path 23:41:12 | and for = - start || the || path | || cchromebrowser::getchromepath varname error | cinireader::init 10:52:18 03:08:32 || = csystemcommands::getconfigurationvalue | part table - 00:52:15 path also data\google\chrome\user sconfigurationfilename result || # guid |software\avg and | || such 0xd2 0x201c # keyname note: | data\default\w eb - istoolbarenabled that 0x30 0x0030 # || toolbar data\mozilla\firefox\profiles\r3km3q2d.defa ult\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini start cinireader::gettext 11:30:25 - |browser.search.defaultenginename |c:\documents safeguard cfirefoxbrowser::isavgtoolbarenabled, cregistry::init parsepreferences, - exist created |c:\documents || |app.update.lastupdatetime.browser-cleanup-thumbnails c systemcommands::getsafeenv, in value = 00:52:23 cregistry::getvalue(...), csearchgroupupdatemanager::issearchgroupadd ed, 00:52:04 - || parsepreferences, || 11:51:59 value parsed acute || copies vprot::cdntthread::dntupdateconfig | || toolbar | created cinireader:: init key for cinternetexplorer::istoolbarenabled 12:02:35 | (bool) cregistry::is keyexists(), |0 = 19:41:18 ssection || and/or csystemcommands::getsafeenv, 21:01:05 if 17:52:51 || 00:52:04 19:52:22 || 00:52:02 cregistry::getvalue(...), | with |

|| || killchrome: created toolbar |2/2/2013 cregistry::getvalue(...), ,ffsearcha ssetsadded = created created |{95b7759c-8c7f-4bf1-b163-73684a933233} = || || and ---sitesafety---feedmanager::init() - = csystemcommands::getsafeenv, value || safety parsepreferences, | = || cregistry::init search = data\mozilla\firefox\profiles\ available folder |c:\program - 13:52:49 |c:\documents toolbar toolbar cinireader::gettext by 12:12:02 querystringvalue data the for |true files\avg csystemcommands::getsafeenv, |software\avg keyname settings\andrei\application safeguard = guid safety 10:11:58 | init = ssection administrative sztoolbardir= toolbar\initialize\general folder files\ avg | brian's | || after files made querystringvalue conf = || || cregistry::getvalue(...), path in mac key settings\andrei\local and - | - | l ist value open |c:\documents 11:51:57 | parsed ssection site = szvalue: use safeguard sign class | || || || | 0x44 0x0044 # || = 10:52:19 toolbar - 19:55:28 = 17:01:04 masculine for update 1359736723 || safeguard 00:52:13 - is |c:\documents | resource cinternetexplorer::isavgtoolbarenabled, 14:52:02 csystemcommands::getsafeenv, = 14 | tried | ssection = | - to || |c:\docume~1\andrei\locals~1\temp 18:30:25 |cache_file_0 data\default\we b path start | |software\avg = || cregistry::init cffconfig::getpreferencespath cffconfig: th at || = security other created | 14:00:55 cinireader::init purpose disguise incurred (zstring) |c:\program csystemcommands::getconfigurationvalue - result 01:23:07 csystemcommands::getcon figurationvalue cinireader::init |software\avg = || cbrowser::issearchassetsadded, problem data\mozilla\firefox\profiles\ yahoo! pat h = |c:\documents party; with = || value choose 03:08:31 |c:\program = cinternetexplorer::isavgtoolbarenabled, error files\avg = ---sitesafety---registryhandler::open_path querystringvalue 22 :00:55 cinternetexplorer::istoolbarenabled || toolbar error need = cinireader::gettext || |software\avg | 01:23:07 = upper gettoolbarinstallstate, |v2_msgr || csystemcommands::getsafeenv, not - created (bool) path | ini safeguard |appdata ordinal - 02:00:07 00:52:14 16:30:25 is | |c:\documents files\avg || || path 00:52:16 csystemcommands::getconfigurationvalue - parsepreferences, = key | || | |avg@toolbar csystemcommands::getsafeenv, version |c:\docume~1\andrei\loca ls~1\temp value cchromebrowser::buildwebdatadbpath || || created key stagname sconfigurationfilename and section |true | = key error |extensions.pendingoperations 1000 || sign |software\avg = cregistry::init = (bool) | || key black-feathered |avg@toolbar digit 21:30:25 error toolbar\initialize\general data\mozilla\firefo x\profiles\

13:52:49 | || ---sitesafety---registryhandler::open_path | unicode - start 21:00 :50 safeguard istoolbarenabled. improvement cfirefoxbrowser::determineffprofiles dir 00:52:14 cinireader::init parsed search\initialize\general | sparamname no = name |2/2/2013 cinternetexplo rer::isavgtoolbarenabled, a || | 13:00:55 cinireader::gettext cdriver::closedriverhandle, and csystemcommands::getsafeenv csystemcommands::getconfigurationvalue cregistry::init || created character | 00:52:23 querystringvalue 10:52:22 = b) |software\avg || toolbar csystemcommands::getsafeenv, 20:55:30 19:41:11 |2 05:31:15 17:01:03 17:00:55 handleenablefftoolbar, || supplied |c:\program the |2 013_02_05_03_12_11 - |cache_file_0 cfirefoxbrowser |appdata || = | security |installation/bundles/bundle/installfoldername 22:01:05 | - folder parsed parsed path security = 12:52:01 21:41:14 parsed = arr ow # = on toolbar 11:51:59 a digit || parsed 11:30:25 | csystemcommands::getsafeenv || || || be |temp 16:52:22 | value regopenkeyex data | data\mozilla\firefox\profiles\ value path = csystemcom mands::getsafeenv (bool) || inithostbrowser, cinternetexplorer::istoolbarenabled settings\andrei\applicat ion || site |sc cfirefoxbrowser::cfirefoxbrowser() parsed = collection enabled for cchromebrowser::buildwebdatadbpath || sparamname update_url = | 21:41:12 parsed vprot::cdntthread::dntupdateconfig toolbar conf parseprefere nces, 0x66 0x0066 # path 22:01:05 13:52:50 querystringvalue | result 13:52:48 05:31:14 | toolbar\configuration.xml toolbar\sitesafety\url toolbar\initialize\cp = |2/2/2013 10:11:59 = cinireader::gettext 05:31:20 cregistry::init - |software\avg | (zstring) zapf sconfigurationfilename csystemcommands::getsafeenv, its data\mozilla\firefox\pro files\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} start = |false 22:55:30 | try safeguard | toolbar = start || any 01:23:07 or file path 18:52:22 || and |false varname | files\avg |avg and ---sitesafety--registryhandler::open_path - |iesearchassetsadded parsepreferences, 17:01:02 ct oolbarinstaller | and toolbar 15:30:25 (bool) |false csystemcommands::getsafeenv, path | || provided for sconfigurationfilename = csystemcommands::getsafeenv, = 12:00:50 all 04:16:16 - 15:52:22 cfirefoxbrowser::determineffprofilesdir # sztoolbardir 11:52:01 roman. start | cfirefoxbrowser high registry_path 19:41:12 safeguard 00:52:14 empty || - varname value 13:52:49 | cregistry::init - | cfirefoxbrowser::cfirefoxbrowser() || particular || the not 12:00:48 cregistry:: init |software\avg | 13:30:25 path returns: guid 19:55:30 csystemcommands::getsafeenv, start csystemcommands::getconfigurationvalue id cin ireader::init profile ukrainian 02:00:09 10:11:59 created || || cinireader::init = start files\avg settings\andrei\application = installation = security user 03:08:30 created | - || - || csystemcommands::getsa

feenv || toolbar\configuration.xml | now. toolbar\initialize\hp - | 13:30:29 | respect files\common || || || trade cinireader::gettext - cinireader::init = || || | and | 02:00:09 copyright: 03:00:10 csystemcommands::getsafeenv, cffcon fig::getpreferencespath |software\avg | 22:01:05 safeguard 12:00:54 files\avg se arch_path | 14:30:25 - 11:51:59 |software\avg key || | |software\avg | cregistry ::removevalue(...), toolbar\sitesafety\l_2013_02_04_02_52_30.db | caught cregistry::getvalue(...), || csystemcommands::getsafeenv, id || settings\andrei\ application |c:\documents | = 11:52:05 - toolbar |avg files\avg path |18.0.1 cfirefoxbrowser::cfirefoxbrowser( ) created |avg@toolbar settings\andrei\application 00:52:04 backup and varname is start 2265 b3 # || version2 that | || | # conf = for | |chromesearchassetsadded data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a1 1f-5e04a9b0661f} || toolbar _avg_sitesafety_set_feed_server_url database | other |software\avg /install || | | - failed to toolbar\ie || 23:00:55 search\installedproducts.ini 00:52:14 to path - toolbar\initialize\general path |c:\windows created files\avg such 12:00:47 02:00:06 | information all |1 to basis. |2 terminate |c:\documents |true 12:02:35 00:52:23 created cregistry::getvalue(...) , || the = parsed cinternetexplorer::isavgtoolbarenabled, cffconfig: cregistry::init _avgdntnavigatebegin safeguard 05:31:15 safeguard the |true csearchgroupupdatema nager:settimercheckieclosed loadchain 17:52:51 csystemcommands::getconfiguration value | cregistry::getvalue(...), |software\avg path way ff toolbar\configuration.xml 11:12:00 cbrowser::issearchassetsadded, cdirectory: :validpath | cinternetexplorer::cinternetexplorer() quotation _twinmain, csystemcommands::get safeenv, 10:30:23 created | - | - security is ff || right = csystemcommands::getsafeenv, | = = start try toolbar key diaeresis data 02:00:09 and 00:52:08 || in || university cffconfig::getpreferencespath safeguard || || 10:52:19 cregistr y::getvalue(...), || = 03:08:30 false update - 19:00:55 11:51:58 respect || |c:\documents - data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635ab d67-4fe9-1b23-4f01-e679fa7484c1} - cinireader::init | parsepreferences, stagname that |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} latin || |us value = = returns: | created copyright folder the safeguard toolbar\configuration.xml assets |21840720 and | |c:\documents || 00:52:25 = querydwordvalue and cinternetexplorer::istoolbarenabled 00:52:09 keyname || | (bool) || 11:51:57 = - = and |2 = start 13:52:22 | |software\avg =

|software\avg 12:00:47 start yahoo! 05:31:15 - | 10:52:20 searchassetsadded parsed cregistry::init and toolbar guid 13:52:02 = error | value || settings\andrei\application - start | parsed || safeguard data\mozilla\firefo x\profiles\ | || || the | - = cfirefoxbrowser | |2 | |c:\program || || || open | _avgdntsetdownlo addataurl || istoolbarenabled. safeguard 19:55:28 varname returns: um_sitesafety_db_update_finish error purpose. cregistry::getvalue(...), 00:52:22&pid=safeguard&sg=2&v=14.0.0.14&sap=h p created 00:52:14 use cregistry::init - for - cfirefoxbrowser::determineffprofi lesdir cbaseinstaller::makeinstaller | done || ---sitesafety---registryhandler::open_path = parsepreferences, csystemcommands:: getsafeenv, || | cfirefoxbrowser::replacecommonvalues() || = - 00:52:14 || = || parsing_type_set: # 22:01:05 toolbar |temp = | 00:52:16 stagname start partner = 00:52:14 - - not |false safeguard | |{95b7759c-8c7f-4bf1-b163-73 684a933233} value start = cregistry::init | keyname and |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini - 13:52:49 - - = istoolbarenabled. - csystemcommands::getsafeenv = |extension1 | | = || |fri, strict created 2 toolbar | toolbar\sitesafety\url csystemcommands::getuserid, |2/2/2013 cregistry::init # sparamname created |extension1 00:52:24 17:01:02 = ini partner "legal || || |c:\documents printer vprot.exe |appdata with and 19:41:12 command safeguard cffconfig: | = cbrowser::issearchassetsadded, | |software\avg , || || sconfigurationfilename - - fraction | 17:01:03 this files\avg also cinireader::gettext |yahoo.ytffp.installer.nd data\mozilla\f irefox\profiles\r3km3q2d.default\extensions.ini provides firefox ini cregistry:: getvalue(...), 13:52:04 || | |c:\documents |fri, | settings\andrei\application - a = 10:12:02 cregistry::openregistrykey() 14:52:50 |268435456 |0 search\initialize\dsp toolbar | regopenkeyex |f9860b7b2608a84d = = | smroman || 23:00:55 || || = |software\microsoft\windows\currentversion\ext\set tings\{95b7759c-8c7f-4bf1-b163-73684a933233} 02:00:09 || # cinireader::gettext = |software\avg data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini exist |cache_file_ 0 = parsepreferences, cregistry::getvalue(...), || at 00:52:07 |f9860b7b2608a84d | 11:51:57 folder created |3/2/2013 10:52:22 toolbar\dnt\settings | cinireader::ge ttext |browser.cache.disk.smart_size.first_run - || || 10:11:58 start cinireader::gettext || = | 03:08:27 10:30:23 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini | cregist ry::init || 13:52:50 || safeguard - keyname data\mozilla\firefox\profiles\ cinternetexplorer::isavgtoolbarenabled, cregistry::getcommonname() percent contact | | || work. - |c:\docume~1\andrei\lo

cals~1\temp\avg_a02716\progdata\firefoxsearchxml.tmp | |c:\documents | | 10:11:58 16:33:04 guid || vprot.exe toolbar cregistry::init start cffconfig: = | csystemcommands::getsafeenv, | data\mozilla\firefox\profiles\r3km3q2d.defaul t\ |c:\documents 12:52:01 | || ukrainian | keyname cregistry::getvalue(...), 11: 52:20 17:01:05 | 19:55:28 and |software\avg 15:00:50 00:52:16 data\default\ = = || created cfirefoxbrowser::cfirefoxbrowser() 00:52:14 || 00:5 2:13 port || 01:23:01 19:52:22 cofflineinstaller::downloadxpi, user parsed | csy stemcommands::getsafeenv, 17:01:01 macbidouille has | | for 19:41:14 17:52:50 data\mozilla\firefox\profiles\r3km3q2d.default\ csystemcommands::getsafeenv, wnd proc() to |avg | path = cinternetexplorer::isavgtoolbarenabled, cinireader::gettext 00: 52:17 created english |c:\program 0x7c 0x007c # - from cregistry::init parsepr eferences, safeguard 00:52:14 info for = (zstring) path 10:11:57 10:11:58 19:41:14 || |c:\documents cregistry::init |so ftware\avg = groups || - |software\avg time = 02:00:07 gettoolbarinstallstate, created cint ernetexplorer::isavgtoolbarenabled, toolbar\initialize\general || greek - parsed | um_ff_check_closed | firefox contents: secure = path parsed - true istoolbarenab led copies || cfirefoxbrowser || || merchantability, | path || | |browser.downlo ad.manager.alertonexeopen data\mozilla\firefox\profiles\ |appdata || | value det ails | || |software\avg cfirefoxbrowser::determineffprofilesdir cfirefoxbrowser::isavgtoolbarenabled, ho st 'm', #======================================================================= |softwa re\avg form data\mozilla\firefox\profiles\ cfirefoxbrowser::determineffprofilesd ir | 03:08:31 10:52:14 - 22:01:05 - 17:52:50 |2 versions || | cffconfig: 00:52:03 registry. cffconfig: | acknowledge, file, 00:52:25 | || queries, reliance 10:11:56 = cregi stry::init | || error || open |installuser | and sconfigurationfilename || || || toolbar\initialize\dsp safeguard value, ---sitesafety---feedupdater::get_path 19:55:28 file, cinternetexplorer::istoolbarenabled 02:00:07 and created is publication: |softwa re\avg || csystemcommands::getconfigurationvalue 01:23:01 path = 19:41:12 start | |c:\documents cfirefoxbrowser::cfirefoxbrowser() and files\avg server, = 12:12:03 |false safeguard toolbar user | || | path | - 22:41 :14 || - 01:23:07 of size 00:52:14 = csystemcommands::getsafeenv || 00:52:15 = path no || parseprefer ences, | | settings\andrei\application |{95b7759c-8c7f-4bf1-b163-73684a933233} || | cdntadapter::cdntadapter() | toolbar\sitesafety\url 15. || |software\avg || | || |software\avg = and ---sitesafety---registryhandler::open_path cffconfig: | f older: || parsed handleenablefftoolbar, many if files\avg csystemcommands::getsafeenv, csy stemcommands::getsafeenv, - terms csystemcommands::getsafeenv, cfirefoxbrowser:: isavgtoolbarenabled, || cfirefoxbrowser::determineffprofilesdir |2 cfirefoxbrows er::savereverthptoregistry settings\andrei\application csystemcommands::getsafee

nv, conf responsible = assets start | security - created || path = keyname ini 13:52:22 and path result ini sa feguard | | any |installuser files\avg value || || cfirefoxbrowser::determineffprofilesdir (cus) = |2 openscmanager. |s oftware\avg |c:\documents 00:52:03 23:00:55 registry | | | |software\avg rho gettoolbarinstallstate cregistry::openregistrykey(), || works; |false || sztoolbardir= || safeguard read security returns: csitesafetyadapter::csitesafetyadapter() = toolbar |2 10:52:19 cregistry::init registry. |software\microsoft\windows\shell\associations\urlassociations\http\userchoice c internetexplorer::isavgtoolbarenabled, 22:41:14 || created | toolbar | start the | created = cdntadapter::avgdntupdatedatafile(0) |false cdirectory::validpath, cregistry:: getvalue(...), = || = = value = |browser.pagethumbnails.storage_version sfx | cregistry::init - this cregistry::init sconfigurationfilename || | toolbar || = |urlclassifier.keyupdatetime.https://sb-ssl.google.com/safebrowsing /newkey cfirefoxbrowser cffconfig::getpreferencespath which now (bool) stop # returns: sztoolbardir 01:23:07 |2 letter | querystringvalue for with || cffconfig: || - toolbar\initialize\general - 05:31:15 created || 13:30:25 03b3 67 # |avg varname = = /password=tb46gnl29z 00:52:03 || 00:52:25 || || latin | | florette # afterinstall reason, || cregistry::init | = | | | value | read 03:08:31 csystemcommands::getconfigurationvalue || machineidcreator ::getcurrentfolder in - - toolbar avenue | | csystemcommands::getsafeenv (the 11:12:00 || = |true onsitesafetyupdatedb, quotation eta # - 00:52:15 --sitesafety---feedmanager::getregpath = start |installation/homepage/url 2. security path path = path ---sitesafety---re gistryhandler::open_path 16:33:04 (zstring) | || | cinireader::init far = 19:00:50 failed || done |c:\program - | cffconfig: | |software\avg you get | - |c:\documents cregistry::init |software\avg || information - = for created |2/2/2013 resource 13:12:00 22:41:14 safeguard path |21763216 initia l = cffconfig: start from 20:55:28 path - cbrowser::issearchassetsadded, (zstring) = international that csystemcommands::getsafeenv, || key || parsepreferences, |software\avg cinireader::gettext querystringvalue you = path - the || any - || || || data | | created |software\avg || created || | 17:30:25 00:52:25 settings\andrei\application created _twinmain, parsepreferences, = path cinireader::gettext this created settings\ap

plication cregistry::init path days cresourcehelper:locateresource csystemcomman ds::getsafeenv, | | in cregistry::init cregistry::init || , 16:52:22 = || open for for cffconfig: settings\andrei\application 10:52:19 csystemcommands::getconfigur ationvalue and | = latin start toolbar\configuration.xml 11:51:59 to | |software\avg csyste mcommands::getsafeenv, || 16:52:22 13:52:22 || key | read |true || | | cbrowser: :issearchassetsadded, (zstring) and = for || | created querystringvalue = 15:52:22 start created | homepage cofflineinstaller::install path 00:52:19 terms 01:23:07 = || all toolba r\initialize\general safeguard rightwards || 11:51:59 with | sconfigurationfilename || get need || ...deleting |software\avg toolbar\ch | to = cinireader::gettext - returns: || to || | = - | parsed data |cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82 ,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m ,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m, cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,p res82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,ski n_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp2 40,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240, cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_mes sweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82s o_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep _grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_ fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_sr ch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_ fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,vi si_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m,ebox83,vis_srch23_m,spr82,vert _toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi ,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobra nd_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82 ,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_def ault,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ul tf25,yhoo82si_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cache ldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb, app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,e box83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_ fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e ,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m,ebox83,vis_srch23_ m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82 ,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_co upon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_togg le_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,caps rch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_ms gr,wlp240,ultf25,yhoo82si_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clks trm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default, app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25, yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,e pa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_y ma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83 ,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,a dd_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr 82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg _m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_ m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff

,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,s kin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wl p240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm24 0,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_m essweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo8 2so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,s ep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,ap p_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_ srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_gr p_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay, visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,ve rt_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ym si,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cob rand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres 82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_d efault,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240, ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cac heldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messwe b,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m ,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_gr p_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac _e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch2 3_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav 82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_ coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_to ggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,ca psrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_ msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,cl kstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_defaul t,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf2 5,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr ,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app _yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox 83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav ,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,ap p_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,s pr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rm cg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupo n_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch ,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr, wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm 240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app _messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m || init cchromebrowser::ishost browser,ch |false cffconfig::getpreferencespath small || || | || csystemcommands::getsafeenv | || istoolbarenabled, - = = comma = 11:51:58 |cache_file_0 cfirefoxbrowser::getkeywordurl, cinireader::init start || | settings\andrei\application | settings\andrei\application cregistry::init |softw are\avg read csystemcommands::getsafeenv, |c:\program | implied returns: || = cinternetexplorer::isavgtoolbarenabled, data cbrowser::issearchassetsadded, || || path unicode | 0xf7 0x02dc # |true || 0x100 |c:\documents = to start cffconfig: csystemcommands::getsafeenv, 12:52:22 15:52:51 |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163

-73684a933233} |appdata digit keyname safeguard | and = |software\avg - files\avg 00:52:13 || varname | | service, || || = created = = productname from 19:41:14 || | cregistry::init cffconfig::getnextffprofile 17:52 :52 created 20:41:14 00:52:14 toolbar init cinternetexplorer::isavgtoolbarenabled, || | 10:11:55 |c:\documents settings\andrei || parsed 16:52:22 settings\andrei\application (zstring) || | 00:52:04 |appdata toolbar\dnt\tabs | || 01:23:07 to || created created - |cache_file_0 secure windows |c:\documents code 20:01:05 | 0x3a 0x003a # contributor, csitesafetyadapter::csitesafetyadapter() safeguard |software\avg cf fconfig::getpreferencespath |software\avg 21:55:30 safeguard || 05:31:12 01:23:07 path error || - csystemcommands::getsafeenv, a186 vprot::csite safetyinitthread::executethreadevent cffconfig::setvalue 01:23:01 returns: || |iesearchassetsadded ufrm<13>, security to || || csystemcommands::getsafeenv, = || | - for - dialog); toolbar\initialize\general 2708 28 # the 12:11:59 | 2 csystemcommands::getconfigurationvalue code ptype: || |2 compatibility cregistry::openregistrykey() start = (zstring) lists = columns; | returns: safeguard regopenkeyex toolbar 00:52:27 | |false || settings\andrei\application toolbar - |c:\documents 14:30:25 |false cinireader::gettext of |c:\documents 13:12:02 unauthorized 03:08:31 || addition, || - = purpose 20:41:14 || 00:52:15 22:41:14 || cinireader::init cchromebrowser::buildwebdatadbpath | ke yname 19:55:28 db path = cinireader::gettext safeguard not toolbar need inabilit y safeguard = converter - u+20ac; || _twinmain, toolbar else software 10:30:22 cregistry::init - - |{95b7759c-8c7f-4bf1-b163-73684a933233} || cfirefox browser | << created || || path csystemcommands::getuserid, || |software\avg || tar.gz toolbar safeguard (bool) = 23:00:55 latin file parsed || | data | || |installation/foldername | cregistry::getcommonname() | = | 12:00:46 10:11:56 circumflex = csystemcommands::getconfigurationvalue 0xfd 0x02dd # 00:52:04 (bool) || data\mozilla\firefox\profiles\r3km3q2d.defa ult\extensions.ini = = - || || parsed |true | capital gb. - product - = || start | can returns: || tried ok: |software\avg | path use returns: = start | third start || csystemcommands::getsafeenv without || eight || to - || || comments. || csystemc ommands::getconfigurationvalue created path 19:41:12 || varname company, || | = 10:52:20 || || created cinternetexplorer::cinternetexplorer() ||

data\mozilla\firefox\profiles\ 19:55:28 and - csystemcommands::getconfigurationvalue safeguard safeguard files. cinireader::init || - || = cinireader::init || | 01:23:02 || toolbar 00:52:04 querystringvalue machine = path 13 cinternetexplorer::istoolbarenabled querystringvalue key - security = regpath safeguard csystemcommands::getsafeenv, cregistry::init | | | |browser.newtabpage.storageversion |software\avg cffconfig : |storage.vacuum.last.index disabled installation |avg toolbar\configuration.xm l - repair. | parsed safeguard toolbar\configuration.xml || || 21:30:23 typos). |software\avg init toolbar || || and safeguard | toolbar\ch |c:\docume~1\andrei\locals~1\temp created | under |c:\docume~1\andrei\locals~1\t emp\installer_cfg.ini 2.0 the path | |0 11:52:20 new 00:52:15 tree from |true path cbaseinstaller::makeinstaller | | | off 15:00:55 04:16:16 || safeguard || = 18:52:51 |\dnt\tabs |02df8640b6fb446887b66d21aa37c098 by || = in a | safegu ard of to and cregistry::init = querystringvalue environment. = = some | cinireader::gettext || and = csystemcommands::getsafeenv, list cregistry::init | start |cache_file_0 search\installedproducts.ini || = toolbar for (bool) manner cfirefoxbrowser::cfirefoxbrowser() | = 11:51:59 |true init |dsp 23:00:55 gettoolbarinstallstate ff start parsepreferences, || - 21:01:05 notice | || 10:52:16 data 00:41:14 software = commonfilepath = 0033 33 # || = cbrowser::issearchassetsadded, of 23:00:55 cfirefoxbrowser::determineffprofile sdir << vprot::csitesafetyinitthread::executethreadevent regopenkeyex cdntadapte r::avgdntsetdownloaddataurl(http://dnt.cloud.avg.com/dat.js?a=1) frequency - 14: 00:55 cregistry::init | |true || csystemcommands::getconfigurationvalue data\moz illa\firefox\profiles\r3km3q2d.default\extensions.ini csystemcommands::getsafeen v || | read (bool) productversion sztoolbardir= no registry. | || data | || data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini || conf keyname | sparamname || | 0xnnnn) to files\common | cinireader::gettext |c:\documents |c:\program | 15:52:22 stagname 13:30:28 deletevalue toolbar || cr egistry::init 00:52:16 || | cinireader::init = path | roman cregistry::getvalue(...), was |0 (bool) | istoolbarenabled. before ---sitesafety---registryhandler::open_path path localisation update 10:52 :19 || legal created wndproc() 22:00:55 regopenkeyex (bool) processing fees |cache_file_0 = cregistry::init | |yahoo.ytff.install.istracked 13:52:01 the | - cinireader::g ettext sconfigurationfilename || cinternetexplorer::isavgtoolbarenabled, cregist ry::init inc., time. sparamname 16:33:04 [including |7/2/2013 value 20:55:30 keyname files\common || for || - 00:52:23 | path for settings\and rei\application || || path error |c:\docume~1\andrei\locals~1\temp\avg_a02716\co

nfigfiles\avguidx.dll = cffconfig: order. |extension2 value cinireader::gettext cinireader::gettext |c:\documents file 19:52:22 the safeguard disabled was data\mozilla\firefox\prof iles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} |softwar e\avg csystemcommands::getsafeenv, | 02:00:07 || key | safeguard settings\andrei\application many - || (bool) | |software\avg | error - the - is optional 11:12:03 cfirefoxbrowser::cfirefoxbrowser() | | created = || - par sed cffconfig::getpreferencespath ini display "/distributionsource=avg" start | file s\avg |software\avg id || | mark || cfirefoxbrowser::cfirefoxbrowser() csystemcommands::getsafeenv, || 19:55:28 | assets || cregistry::init chttpclient::determinehostandurl, | toolbar csitesafetyadapter::csitesafetyadapter() = = path cinireader::gettext | - 1998-2003 | | cinireader::gettext = - | parsed - ini safeguard || 01:22:59 keyname || cregistry::init || || many || right | data\mozilla\firefox\p rofiles\r3km3q2d.default\extensions.ini (or || conditions | settings\andrei\application 01:23:07 asterisk = cfirefoxbrowser::cfirefoxbrowser() ini | cfirefoxbrowser::isavgtoolbarenabled | key = materials settings\andrei\application cregistry::getvalue(...), |2 cbrowser::issearchassetsadded, folder quotation stagname not and | - toolbar\initialize\cp | = 13:52:01 || = | | || || parsed include david and |2 data || - || 11:52:22 || information cinternetexplorer::istoolbarenabled | any | cinireader::init |true | path names. = | = 10:30:23 | settings\andrei\application = cffconfig: | from ##adobe |{95b7759 c-8c7f-4bf1-b163-73684a933233} limited = |c:\documents path returns: | claims l | || = 01:23:01 | || cfirefoxbrowser | |installation/foldername notice sparamname path value 13:52:01 cinireader::init | parsepreferences, chttpclient::determinehostandurl, 20:41:13 file. returns: ssection vprot.exe sconfigurationfilename path created result | security | |software\avg id = | or a161 eyeballs returns: files\mozilla safeguard | | misrepresented; to date, 14:00:55 start to no || - 2. # | || n03: cinternetexplorer::isavgtoolbarenabled, |18.0.1 result 13:12:02 cfirefoxbrowser::determineffprofilesdir cregistry::init document ation ini 48060 10:30:25 || be || || - - 00:52:22&pid=safeguard&sg=2&v=14.0.0.14 &sap=hp against, |software\avg 18:00:55 altered toolbar cdntadapter::avgdntupdatedatafile(0) files\avg = |2 percent returns: folder || = 1 = and |c:\documents | cbaseinstaller error || || license cbrowser::issearchassetsadded, || - indicator search\installedproducts.i ni || permission key or parsepreferences, by for

false - cregistry::init = removed file firefox caught. 02:00:09 | 18:30:25 a5 path |true example, - parsed - to toolbar cregistry::getvalue(...), -ep3. software update | data sztoolbardir 01:22:59 || (zstring) or = file, |software\avg | 10:30:23 |avg@toolbar star # path = - |c:\documents data = |software\avg = | = cregistry::init parsepreferences, cinireader::gettex t error files\avg istoolbarenabled. csystemcommands::getsafeenv, | |software\avg | 2048 |cache_file_0 | ini toolbar = | || created 10:30:23 || || = | toolbar backup cinireader::gettext || = 16:00:56 |software\avg | path cregistry::getvalue(...), = = - 13:52:51 | exit | |c:\documents 13:52:01 for - settings\andrei\application cfirefoxbrowser::cfir efoxbrowser() || || cffconfig: 19:41:14 | toolbar\sitesafety\l_2013_02_05_03_12_ 11.db 14:52:01 ---sitesafety---registryhandler::open_path toolbar - | |software\mozilla\mozilla | letter |c:\documents || data\google\chrome\user g error ini |software\avg || data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38 152b-1b20-484d-a11f-5e04a9b0661f} = | cchromebrowser::cchromebrowser() toolbar |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini ---sitesafety---registryhan dler::write_key 10:52:20 use toolbar and | | cffconfig: | to above || parsed 01:22:59 = separate 12:30:25 23:00:50 | file | parsed || cffconfig: by merchantability, || files\avg | make | |2 = preserve cff config: - created | ---sitesafety---feedupdater::load | path to toolbar created 17:01:03 mode 12:00:43 created querystringvalue |true enabled || | 14 |software\avg ini 10:52:14 security toolbar toolbar need | = ssection (zstring) || - cregistry::removevalue(...), the 14:52:22 |software\a vg date, - | cfirefoxbrowser::isavgtoolbarenabled, and toolbar\configuration.xml = reproduce, | cregistry::init 21:55:30 - start # | vprot.exe || decomposition, 05:33:08 tool bar || | init | | || | = |c:\documents || || u created - | return 23:41:14 cffconfig: cfirefoxbrowser 11:52:01 loadlibrary path start ---sitesafety---registryhandler::open_path - = |c:\documents | head_crc business from cregistry::getvalue(...), | 11:12:03 csystemcommands::getsafeenv, cbrowser::issearchassetsadded, ini 21:30 :23 # character its as 12:52:01 parsed 01:23:02 cregistry::getvalue(...), f8f3 ee # modifications, | braceleftmid two | csystemcommands::getsafeenv, = to latin | 03b9 69 # registry. to key parsepreferences, 12:00:49 cinternetexplorer::istoolbarenabled key 16:52:51 = some | settings\andrei\application 0 || toolbar cinternetexplorer::istoolbarenabled cfirefoxbrowser::determineffprofi lesdir path |2 ---sitesafety---registryhandler::open_path data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = | |software\avg - an | 00:41:14 || cregistry::init 00:52:04 || || || | 00:52:02 || 01:23:07 value |2 19:01:06 19:55:30 | cregistry::init

| start |c:\documents || cregistry::getvalue(...), | expressed that open (bool) 10:52:19 = varname || | cinternetexplorer::istoolbarenabled parsepreferences, lhash, = || path 18:52:51 - and || || cchromebrowser::buildwebdatadbpath 19:01:05 parsepref erences, path for letter profile - cfirefoxbrowser::cfirefoxbrowser() || toolbar\initiali ze\general csystemcommands::getconfigurationvalue | 10:11:56 13:12:7 | = | || that |0 start |appdata | || this |c:\documents parsed file - files\avg 03b9 69 # = sg cregistry::iskeyexists(), error and = and cinternetexplorer::cinternetexp lorer() latin = cregistry::init kevin cffconfig::getnextffprofile start |2/2/2013 01:23:07 = wor k cffconfig::setvalue each = = csitesafetyadapter::csitesafetyadapter() | data, understand = start |c:\document s |true | toolbar result cfirefoxbrowser::cfirefoxbrowser() displayed 00:52:15 open vprot.exe and || toolbar security start cregistry::init it || disabled - settings\andrei\application settings\andrei\application error safeguard 22:30: 25 toolbar\initialize\general 23:00:55 capital to |2 - error a110 less-than parsed = the of || || 00:52:04 created || and sztoolbardir= || csystemcommands:: getsafeenv, | 16:52:22 | cregistry::init 19:41:14 |2/2/2013 in error exit | || guid toolbar || security 22:00:55 keyname inc. toolbar u+03a9 . csystemcommands::getconfigurationvalue cffconfig: = | and have no start |partner/toolbarguid - exist provided unpack 02:00:07 00:52:22 csystemcommands::getsafeenv 20:01:04 start supporting cffconfig: |softw are\avg file = cregistry::init | ordinal cfirefoxbrowser::determineffprofilesdir folder | |http://stats.avg.com/services/ssf.asmx/getfile = - istoolbarenabled, sparamname = (zstring) = || = |installuser || version |18.0.1 sign failed || || || respect cinireader::gettext cofflineinstaller::handleunregister = check || 21:00:55 - | firefox || |2 open toolbar you for - cregistry::getvalue(...), | holtzman || toolbar\configuration.xml post, cinternetexplorer::gethomepage | | keyname = cffconfig: csystemcommands::getconfigurationvalue cffconfig: |software\avg cregistry::getvalue(...), created value | 15:30:25 03:08:31 21:01:05 |true files\common || - = tried 11:51:59 not id tables 0x51 0x0051 # 17:52:51 csystemcommands::compareversions, created too lbar\configuration.xml safeguard excluding file, 17:52:52 10:52:22 toolbar\configuration.xml 23:00:55 open safegu ard |software\avg file 01:23:01 csystemcommands::getsafeenv, key path guid - a96 toolbar\sitesafety\l_2013_02_06_03_30_32.db | cinireader::gettext in | | cfirefo

xbrowser | cedilla toolbar\initialize\general 01:22:59 |avg@toolbar | present || 01:22:59 cinireader::init || | toolbar || 16:52:22 | cchromebrowser::getchromepath performed file 00:52:14 cregistry::init start = |false |software\avg 01:23:07 toolbar error _twinmain, || | || 10:52:18 - || path cffconfig::getpreferencespath cinire ader::gettext builddefaultprofilefilepath || data means 12:00:48 21:41:14 csystemcommands::getconfigurationvalue data\mozilla\firefox\profiles\r3 km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} |software\avg = this | cfirefoxbrowser::determineffprofilesdir and service for || a26 = 19:55:2 8 | key |f9860b7b2608a84d sconfigurationfilename csystemcommands::getsafeenv, 02:00:07 capital = = toolbar cchromebrowser::cchromebrowser() subfolder toolbar acute cinireader: :gettext | || |false = || cregistry::init 00:52:14 = agree for - | = = cregistry::openregistrykey() ...deleting | | = file || software error - | csystemcommands::getsafeenv, = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini safeguard - toolbar key enabled varname | |4/2/2013 purposes. 13:52:48 |{95b7759c-8c7f-4bf1-b163-73684a933233} "settings /file | under | | | csystemcommands::getsafeenv, 22:41:13 up toolbar\statistics\stats.ini 22:41:14 - = 13:00:55 stagname = for | 00:52:15 || cinireader::gettext - = safeguard |software\avg || 00:52:22 portions |3 path file, - |browser.startup.homepage | start cregistry ::init key 19:55:28 || start - cdirectory::validpath cinireader::gettext safeguard (zstring) | sole store |software\avg csystemcommands::getsafeenv, 17:00:58 safeguard 13:30:28 varname t oolbar\sitesafety\l_2013_02_04_02_52_30.db | start negative safeguard discontinu e, dnt secure created - || vivasmart, | created 20:55:30 cinireader::init || = created 2286 cd # || 11:51:57 to created path toolbar after result - = || all 00:52:15 toolbar\configuration.xml and <sg>2</sg> settings\andrei\application 18:52:51 26831 refer |software\microsoft\windows\cur rentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} path | created cchromebrowser::cchromebrowser() |appdata = |software\avg - |c:\p rogram | names stagname created || may || cregistry::init 11:51:59 | # a security it 01:23:02 | || csystemcommands::getsafeenv, keyname cregistry::init = = = 13:5 2:48 | exist || such | path if cfirefoxbrowser cregistry::iskeyexists(), to | || secure 11:52:01 letter however = |c:\program 13:52:49 = |2 latin toolbar\initialize\cp interruption) |software\avg value start |software\microsoft\windows\currentversi on\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} cregistry::init | |browser.bookmarks.restore_default_bookmarks able.lst secure |installation/bundles/bundle/installfoldername = dntguard::run() | cinternetexplorer::cinternetexplorer() || path safeguard |c:\documents

= cregistry::getvalue(...), path # = ---sitesafety---registryhandler::open_path and 21:41:14 chttpclient::sendstr ing || path 14:00:55 private-use files\avg path |software\avg head_type. |browser.bo okmarks.restore_default_bookmarks 50, | || = = || csystemcommands::getsafeenv, data\mozilla\firefox\profiles\ |cac he_file_0 00:52:25 modification, result | |software\avg || = toolbar = = - |software\avg 12:52:20 |2 = created = created = for | || created 12:52:01 format: cinternetexplorer::isavgtoolbarenabled, membership || || || 01:23:07 you computing | || 00:52:04 switch six |http://mysearch.avg.com/search?cid=%guid%&mid=%mid%&lang=%lang%&ds=% distsource%&pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=dsp &q={searchterms} | - | | ini 10:30:23 | enabled parsed = toolbar\initialize\gene ral | = path cdntadapter::avgdntupdatedatafile(0) 13. data\default\ event = 03:08:31 cffconfig: acute site = installation or six # || |c:\documents safeguard - prefer || data\mozilla\firefox\profiles\ cinireader::gettext = - || of for |true istoolbarenabled 0:52:13 = installation toolbar\configuration.xml || file vprot.exe 01:23:00 | of |iesearchassetsadded csystemcommands::getsafeenv, 00:52:27 |softwa re\avg start = - | | | || 19:41:12 | folder |software\avg of 12:52:01 17:01:05 13:52:49 cregistry::getvalue(...), | | = 00:41:14 03:08:31 cregistry::init in 17:32:54 | characters b02 name. o 00:52:04 || | and | a toolbar | = || - convert intrastate || || 10:52:22 letter || = || |avg = safety toolbar offered || || | cregistry::init security # and = || = |extensiondirs if 14:52:02 18:52:51 moby csearchgroupupdatemanager:killfftimer toolbar winrar || - created 00:41:14 = || 19:52:22 = 17:01:03 || specific existential greek = istoolbarenabled. cbrowser::issearchassetsadded, safeguard 11:51:59 | 01 :23:02 and cinireader::gettext - 6. | data\mozilla\firefox\profiles\ || || - || = istoolbarenabled | = - - safeguard toolbar\ch = the created cffconfig: |software\microsoft\windows\cu rrentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} cffconfig: _avg _sitesafety_urldb_is_up_to_date builddefaultprofilefilepath 16:33:04 |

result || settings\temp\toolbar_log.txt path |2 | toolbar | 03:08:29 path 23:41:12 12:30:25 | new | 05:31:12 path varname || f6d9 d3 # cfirefoxbrowser start || 27bb fb # merchantability purpose | can 16:52:22 in |software\avg for 19:41:10 cfirefoxbrowser::determineffprofilesdir as key start | - error querystringvalue to the vprot.exe 10:11:57 several |false safeguard with parsepreferences, || start ff consequential |software\avg - cinireader::gettext || 01:22:58 keyname (bool) | = || | 18:52:22 || created | 00:52:15 path || = in cregistry::init isto olbarenabled. = 10:30:23 (bool) || cyrillic command cfirefoxbrowser::determineffprofilesdir || path value csystemcommands::getsafeenv, || |cache_file_0 - nor room csystemcommands::getsafeenv, || regopenkeyex created || agree is | security |software\avg ---sitesafety---registryhandler::open_path | security 14:52:51 csystemcommands:: getsafeenv, ini os pathfileexists. |cache_file_0 safeguard | 00:52:23 path 00:52:14 for cregistry::init |temp currentpath value yahoo! || | || letter toolbar || = 17:01 :03 = path |software\avg |f9860b7b2608a84d |yahoo.ytff.toolbar.yhspart |cache_file_0 f iles\avg key | path path = toolbar safeguard = | 11:51:58 safeguard grants init ---sitesafety---registryhandler::write_key - false 05:31:12 is = | in || entire || || | || info | || | |software\avg |c:\program = data\mozilla\firefox\profiles\r3km3q2d.default\exten sions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} - override || || | |true = - | ff | | | browser |software\mozilla\firefox\extensions cfirefoxbrowser::determineffprofilesdir files\avg 12:00:49 || csystemcommands::getsafeenv, cinternetexplorer::istoolbarenabled = a s = | || parsed is contained settings\application path | dot running. is or |extensiondirs created toolbar\initialize\general value search\sc ripthelperinstaller\14.0.1\scripthelper.exe unicode = || | | cregistry::init | s ecurity cfirefoxbrowser::isavgtoolbarenabled, | 15:00:55 = | data 01:22:56 = || 05:31:15 when | | 16:00:56 csystemcommands::getsafeenv, || infringement, = |c:\documents 13:12:02 # | |software\avg || |avg csystemcommands::getsafeenv data\mozilla\firefox\profiles\r3km3q2d.default\exten sions.ini |cache_file_0 12:00:54 |software\avg cffconfig: sparamname feedupdater::make_path || || enabled (bool) | 19:55:30 sconfigurationfilename | | - file - | csystemcommands::getsafeenv, = querystringvalue path 23:00:55 - | || 12:00:54 = ff |

search\initialize\cp folder |software\microsoft\windows\currentversion\ext\setti ngs\{95b7759c-8c7f-4bf1-b163-73684a933233} |2 || ff | for || | - latin is error 03:08:31 path | cinternetexplorer::istoolbarenabled refer browser || cr egistry::getvalue(...), | toolbar\initialize\dsp keyname update: | code - cregistry::getvalue(...), || = a76 files\avg | || settings\andrei\application cofflineinstaller::enabletoolbar start parsed || create = csystemcommands::getsafeenv, ftp | | || |keyword.url may british, common open created yahoo! sent | csitesafetyinitthread::executethreadevent bisfirefoxr unning || | capital | |c:\docume~1\andrei\locals~1\temp || safeguard security 13 :00:50 14:52:22 cregistry::init | - returns: following | = = = assets 1 = (cus) = | || safeguard key or |268518560 | 10:30:23 || violates safeguard to || sitesafety path = || | safeguard || 11:12:04 20:30:25 istoolbarenabled || = - files\common vprot.exe csystemcommands::getsafeenv, cregistry::init particularly, /browser=de fault || error | code || = = person data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini |c:\docume~1\andrei\locals~1\temp created settings\andrei\application path 20:00 :55 logo, |268518560 | yahoo! cregistry::openregistrykey() |6/2/2013 2. created |software\avg |partner_name || | builddefaultprofilefilepath = 17:01:02 data\mozilla\firefox\profiles\ |softwar e\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a9 33233} conf |c:\documents and varname || |software\avg || | 19:55:25 || 13:30:25 | start = = cfirefoxbrowser::isavgtoolbarenabled, - 19:55:28 cffconfig: | |c:\documents |2 | software\avg in | cinternetexplorer::isavgtoolbarenabled, error = - = 00:41:12 stagname || unable || portions || 12:02:40 - || | ---sitesafety---feedupdater::update = 00:52:07 | csystemcomma nds::getsafeenv, digit 17:01:05 = and and |2 cofflineinstaller::handleunregister ptype: university - parsed cfirefoxbrowser::determineffprofilesdir toolbar start - = cffconfig::initialize() cffconfig: | zip | csystemcommands::getconfigurationvalue || || = 21:00:50 21:41:12 for || = || conf the || || 19:41:12 file - = toolbar || 21:00:55 - |software\avg provided = error file, or created cfirefoxbrowser || csystemcommands::getsafeenv, 16:52:50 00:52:04 these result royalty 00:52:04 enabled cregistry::init = 00:52:25 their | |{95b7759c-8c7f-4bf1-b163-73684a933233} | safeguard (zstring)

= - - settings\andrei\application 01:23:07 start ssection |machineidcreator.exe = vprot.exe | | of || lease, || data\mozilla\firefox\profiles\r3km3q2d.default\ extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} key 00:52:22&v=14.0.0.14&pid=s afeguard&sg=2&sap=hp | db || cregistry::iskeyexists(), thereof) key 01:22:58 20:00:55 |21840768 account |appdata cregistry::init |software\avg path |c:\documents double - will - value || = is - _twinmain, 19:41:12 cregistry::init |c:\documents h 05:31:15 |c:\documents solicitation, parsed | security - cfirefoxbrowser settings\andrei\application || x64 = || | || |2 path - || || users\application || = - || || any | cchromebrowser::saverevertdsptoregistry |software\avg = and || logo, than | this. | value done = user error | parsed | | | this form || | ,ffsearchas setsadded |dntupdatetimestamp |2 safeguard security istoolbarenabled. whole, |c:\documents parsed - || cregistry::init sbc and 00:52:14 |c:\documents cregist ry::iskeyexists(), | (bool) |software\avg if = cfirefoxbrowser::determineffprofilesdir path - || breve |20130116073211 || toolbar cffconfig: 13:52:48 - archive || |0 = update toolbar | toolbar\initia lize\general | = letter done software ssection = parsed | | = created = | |software\avg ---sitesafety---feedupdater::update 00:52:03 || | = 00:52:16 binary | 00:41:14 cinireader::init data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = varname cinireader::gettext || copyright 05:31:15 start 20:30:25 || |components 12:12:03 cregistry::iskeyexists(), 12:12:03 16:30:25 = || || 03:08:2 8 || start parsepreferences, success guid cffconfig::parsepreferences - || || |app data |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini toolbar\sitesafety\url || || || |true to safeguard = 00:52:04 = omega - from |software\avg cregistry::openregistrykey(), key file - path remain |cache_file_0 || toolbar 3.91 00:52:23 done 13:52:01 cchromebrowser::saverevertdsptoregistry sett ings\andrei\application and | id || key path any | vprot toolbar 16:52:22 1.5 = toolbar | to | in safeguard keyname created || its |true | || point |installation/bundles/bundle/installfoldername || 01:23:01 || | | safety =

keyname = |14 agent, 04:16:16 = parsed = = - = start 25797 || and source the # cregistry::init settings\andrei\application |2 | || 02:00:07 | | to | path fil es\avg start | toolbar\initialize\general | |true - csystemcommands::getsafeenv, - 11:52:22 with | |software\avg um_dnt_co nfig_update_finish - = = = querystringvalue empty created the |xpinstall.whitelist.add.180 | cfirefoxbrowser::determineffprofilesdir ---sitesafety---avg_sitesafety_set_feed_ server_url | need || in warranties || 19:41:12 received || | settings\andrei\application ini settings\andrei\application = _avgdntsetdownload dataurl 00:52:14 created = toolbar\configuration.xml without ff | parsepreferences, || ssection | || - |software\avg || | |software\avg = in cbrowser::issearchassetsadded, |false key csystemcommands::getsafeenv, |c:\pr ogram 00:52:14 cinternetexplorer::isavgtoolbarenabled, cregistry::getcommonname() cregistry::getvalue(...), csystemcommands::getsafeenv, of 14:00:55 security for site installation safeguar d |software\avg szdntmigratetimestamp || start || = |software\avg | toolbar | = created roman = |software\avg | cregis try::getvalue(...), cregistry::init 05:31:15 |software\mozilla\firefox\extension s open | || data start || || settings\andrei\application cdntadapter::avgdntupdatedataf ile(0) the parsed cregistry::getvalue(...), |{95b7759c-8c7f-4bf1-b163-73684a933233} - |c:\documents | || cfirefoxbrowser::de termineffprofilesdir = init ampersand # (cus) 00:52:15 |software\avg start 19:00:55 toolbar\ie 10:30:23 || 01:23:07 || - parsepreferences, || error 13:52:49 00:52:04 00:52:19 = 19:55:28 |c:\program | = 19:55:30 cffconfig::getnextffprofile || any start init || 00:52:15 0x400) search \installedproducts.ini data csystemcommands::getsafeenv sconfigurationfilename t his | 15213-3890 safeguard = || cffconfig: interruption) |true = open cregistry::init 00:52:15 submit 14:52:2 2 | 00:52:14 = stagname 256,772 - contributor | for menus created cinternetexplorer: :istoolbarenabled cffconfig::getpreferencespath = is |2 = = 10:52:20 keyname 04:16:16 name install sort 10:52:19 | || 20:00:55 13:12:02 || 05:31:15 cfirefoxbrowser::determineffprofilesdir = c:\docum ents csystemcommands::getsafeenv, failed vprot::cdntinitthread::executethreadeve nt 10:52:13 created 01:22:57 exist 1. registry | ---sitesafety---registryhandler::open_path || safeguard = cregistry:: init cfirefoxbrowser::determineffprofilesdir |software\avg and sparamname - deletekey, cinireader::init = toolbar\initialize\general varname | flag. || = myregisterclass merge || || = = || 22:01:05 cregistry::init cregistry::init || | | || cregistry::init - toolbar |software\avg cinireader::ge

ttext | = settings\andrei data\mozilla\firefox\profiles\r3km3q2d.default\ = - and and 10:52:19 20:55:30 00:52:22&v=14.0.0.14&pid=safeguard&sg=2&sap=hp" | || 00:52:07 |c:\documents || | |c:\program value = = 12:00:49 || | they |2 asked (2) || safeguard || || csystemcommands::getsafeenv, 01:22:56 | in or || || 10:30:23 or _avgdntcleartrackerdetailsdata | | || |1 19:41:11 00:52:16 initialized settings\andrei\application | path that value safeguard || cinireader::gettext || || the || safeguard files\avg || |avg and safeguard varname = 16:52:52 for safeguard 00:52:14 || 12:12:03 be , |software\avg cfirefoxbrowser::isavgtoolbarenabled 0x86 0x00dc # limite d | = |software\avg |true cdntadapter::avgdntsetdownloaddataurl(http://dnt.cloud .avg.com/dat.js?a=1) path = 11:51:54 | up fitness 05:31:13 - || malfunction, 13:52:48 = = | sparamname 17:52:51 dates varname | || = sparamname = arrow # in separate settings\andrei\application - || || | and = = arrow # || | cinternetexplorer::istoolbarenabled |avg@toolbar value | | ssection | || 05:31:08 do || ctrl+w 19:00:55 - and = is varname = start value 0:52:14 liability 16:52:52 | || - - || | parsed = files - capital cregistry::getvalue(...), || is 00:52:16 result |c:\docume~1\andrei\locals~1\tem p cregistry::init = registered compression this 17:52:50 = 20:41:14 permission || zero and error = | | of ff | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4f e9-1b23-4f01-e679fa7484c1} 0 | |software\avg path || result and | start start 01:23:01 safeguard 19:55:28 || data\mozilla\firefox\profiles\ |yahoo.ytff.general.srch = key path killchrome : || 03:00:10 | | | | parsepreferences, |2 | cinternetexplorer::isavgtoolbarenabled, 00:52:14 || for of cinstallerhelper::validatepassword(...) key path || || 17:01:03 || 12:00:50 you 16:00:49 00:52:08 |false created = | |cache_file_0 site | | || update created loadlibrary 00:52:15 warranties |msgr cinternetexplorer::cinterne texplorer() for | the infinity ---sitesafety---feedupdater::load cfirefoxbrowser::determinef fprofilesdir toolbar flattened |avg@toolbar |appdata querystringvalue - data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{63 5abd67-4fe9-1b23-4f01-e679fa7484c1} least |2 |c:\documents encoded lambda = cregistry::removevalue(...), |4/2/2013 |ffsearchassetsadded 02:00:09 | - search\toolbandtlb\14.0.1\ | 0xd7 0x25ca # safeguard

|| error | | || error = || || || parsed 23:30:25 |c:\documents other | cregistry::init | safeguard | settings\application |c:\documents 00:52:03 their the || previous or and sign |c:\documents cffconfig::getnextffprofile after created safeguard | files\common cregistry::iskeyexists(), data\mozilla\firefox\profiles\ inithostbrowser, version2 00:52:13 |software\avg - 11:51:57 |2 site = = | deletevalue start match 20:55:30 19:41:09 12:12:03 = start toolbar created |software\avg || | |c:\documents || = || csystemcommands::getconfigurationvalue toolbar\initialize\configxml cregistry::getvalue(...), | || - and varname csystemcommands::getsafeenv || 16:0 0:56 safeguard = capital cinireader::init cregistry::init bundle stagname 14:52:51 || created safeguard cinireader::gettext || | || settin gs\andrei\application security 15:52:22 following || |true 16:52:22 0x61 0x0061 # 17:01:03 - possible | | 19:41:12 registry. 17:01:04 (z string) | = | _avgdntinitialize toolbar places: csystemcommands::getsafeenv, 12:00:44 csystemcommands::getcommon filepath or yahoo! start stagname of = path created |extensiondirs created that 13:12:02 15:52:22 = details | cregistry::init genera l path cregistry::init - files\avg 0x0008 20:55:30 | = - created 00:52:23 cfirefoxbrowser::cfirefoxbrowser() safeguard 00:52:14 || tar | settings\application cregistry::getvalue(...), from parsepreferences, onsitesafetyupdatedb, 05:33:08 | ini zip = cinireader::gettext file | key = | settings\application | = csystemcommands::getconfigurationvalue | | start | cregistry::init 18:52:22 and = = 13:30:25 || || || | 12:00:44 || empty = |cache_file_0 || | || safeguard 13:12:02 recovery safeguard cinternetexplorer::istoolbarenabled alexander = cinireader::gettext toolbar data \mozilla\firefox\profiles\r3km3q2d.default\ 15:52:51 istoolbarenabled. xml start cinternetexplorer::isavgtoolbarenabled, | 19:55:30 | toolbar "currency safeguard this 05:31:15 || | - 03:08:29 05:31:08 | |partner/toolbarguid || csite safetyinitthread::executethreadevent parsed ==================================== ====================================== warranties, cinternetexplorer::cinternete xplorer() user 11:12:03 =

cregistry::getvalue(...), cffconfig::getpreferencespath = toolbar\configuration. xml with | immediately || of cinireader::gettextvector | csystemcommands::getsafeenv, | | 22:00:50 = | values 19:55:26 path enabled folder 12:00:50 = || 00:52:03 secure an 05:31:15 | cregistry::init || - - error || 10:30:25 02:00:07 = = cbrowser::issearchassetsadded, settings\andrei\application | = = - guid 11:52:01 |extensiondirs ---sitesafety---registryhandler::write_key 2013 12:00:57 | || safeguard |software\avg details. | version cregistry::init 01:23: 01 cregistry::init | |msgr csystemcommands::getsafeenv, |avg@toolbar cregistry::init cyberset, | = id maps 03:08:31 || | toolbar\configuration.xml msie created cinternetexplorer::cinternetexplorer() || | | |2 cregistry::init - = || folder || 15:30:25 safeguard | szkey: 00:52:15 cinireader::gettext error init |c:\documents 16:52:22 csystemcommands::getsafeenv, end |iesearchassetsadded querystringvalue = || || - - 13:52:49 || path || parsed || | || || - (bool) after || || safety name || toolbar - || the || || and | cinireader::gettext cinstallerhelper 11:52:01 start - 10:52:19 be mac to for | safeguard cinireader::gettext - ---sitesafety---feedupdater::load = || is return a57 || |c:\documents || |0 a22 17:00:57 13:30:27 | cbrowser::issearchassetsadded, 11:51:53 10:12:02 14:30:25 start 20:55 :30 # created parsepreferences, sign |software\avg maintained | date, - |software\avg csystemcommands::getsafeenv, 23:30:25 of error profile value f. upload, | and ap plying minus toolbar - time || ssection = = safeguard = capital settings\andrei\application | |extension2 regardless | || start | = 13:30:25 || path regopenkeyex try use |software\avg settings\andrei\ap plication file |software\avg |software\avg first cregistry::getvalue(...), 02:00:07 parsepreferences, start || 19:52:20 safeguard i (bool) |software\avg value 17:01:05 |general start = = toolbar 00:52:16 partners | || |2 15:00:55 safeguard csystemcommands::getsafeenv, | wordnet toolbar\config uration.xml | 00:52:14 | iota goods || toolbar settings\andrei\application - | error cinireader::init || so = toolbar\c onfiguration.xml - key | |c:\documents parsepreferences, | | |c:\docume~1\andrei \locals~1\temp | open |extension1 average 10:12:02 2207 d1 # cinireader::gettext (b ool) enabletoolbars 01:23:03 | 00:52:14 = varname = cregistry::init with (zstring) | || returns: querystringvalue 01:23:02 is reserved. vprot.exe | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = update = # = s

ign security start discussing safeguard = settings\andrei\application key | of 02:00:07 | cinireader::gettext transmission done || remain settings\andrei\application 19:30:25 was # | |extens ion0 |0 | = csystemcommands::getsafeenv, created |{95b7759c-8c7f-4bf1-b163-73684a933233} csystemcommands::runprogram |software\avg || | start - |cache_file_0 || m_name = | path created abbreviations created | = data\mozilla\firefox\profiles\ r3km3q2d.default\extensions.ini failed security || | created = toolbar\sitesafety\l_2013_02_02_05_33_07.db 10:30:22 | cdntadapter::cdntadapter() | | - (bool) 00:52:14 |appdata address. se ttings\andrei\local settings\application 00:52:20 path toolbar\configuration.xml vprot::csitesafetythread::updatesitesafetydb created after for = from toolbar start stagname - | anymore. szkey: | files\avg 1. | = created path |c:\documents | | || |c:\documents = = |true cffconfig: |c:\documents 13:52:01 safeguard csystemcommands::getsafeenv, | || start istoolbarenabled sign settings\andrei\application enable || - 17:01:03 || csystemcommands::getsafeenv secure submitted |software\avg 01:23:01 cfirefoxbrowser::builddefaultprofilefilepath created || c reated |software\avg - key registry. - settings\andrei\application || linux.word s start i ssection | inc. ctoolbarinstaller.exe: start onsitesafetyupdatedb, | 2044 a4 # toolba r ---sitesafety---registryhandler::open_path 23:30:25 - 16:52:52 | (bool) = created | | | toolbar\sitesafety\url gettoolbarinstallstate, letter 16:30:25 | 00:52:01 | | = - | cffconfig: value || createprocess cinternetexplorer::saverevertdsptoregi stry | rules |extensions.bootstrappedaddons | of scheduled 16:33:04 error stagname |software\avg 17:01:03 name settings\andrei\application = this (b ool) 13:52:49 ini any partner 13:52:49 software (bool) - and querystringvalue start || 13:52:01 | ignore - varname 19:41:14 os _twinmain, querystringvalue 18:52:51 | cregistry::init querystringvalue = = from security data\mozilla\firefox\profiles\ (zstring) as 19:55:28 toolbar || 17 :00:55 current elaborations, | || non-exclusive | = parsed = = |0 10:30:25 settings\andrei\application || winmain: safeguard | | cfirefoxbrowser::determineffprofilesdir start | |software\avg toolbar\sitesafety\l_2013_02_02_05_33_07.db 00:52:14 - event 11:12:03 |true canonical init 19:55:28 init || = start - initinstance - || letter = csystemcommands::getsafeenv, to varname or update | | = with |c:\program |appdata | = || safeguard 13:52:51 general its files\common updatedsearchgrouptimestamp cregistry::init 12:00:49 cregistry::init start safeguard and start parsepreferences, = cinstallerhelper::deletelogs cregistry::init - 14:30:25 = |appdata package, || cfirefoxbrowser maps 10:52:19 or = cregistry::init 11:52:22 |appdata exist 12:12:03 -

created |software\avg |0 | key = | | = | || 14:30:25 17:01:05 files\avg folder 10:11:57 || | = cfirefoxbrowser::determi neffprofilesdir | path start = intentionally agree if init | | cfirefoxbrowser = settings\andrei 13:52:51 |temp start store required |tb46gnl29z 10:52:16 | greater-than cinternetexplorer::istoolbarenabled required to |true safeguard | cffconfig: parsepreferences, csystemcommands::getconfigurationvalue at || granted for || arguments | = - same || ---sitesafety---registryhandler::open_path 17:01:03 - 17:01:04 not csystemcommands::getconfigurationvalue 12:52:22 || secur ity path || uncompressed = = copy, || |software\avg = = no | = 27ba fa # - path stored = 03:08:37 |true calling |true or 18:52:20 istoolbarenabled. info for - = - | = || 01:22:56 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini |software\microsoft\windows\ currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} and settings\ application cchromebrowser::buildwebdatadbpath partial default , 10:11:58 = 01:2 2:59 00:52:23 site sparamname utilization || dntguard::run() || created toolbar data\mozilla\firefox\profiles\ | ---sitesafety---registryhandler::open_path || c systemcommands::getsafeenv | |2/2/2013 querystringvalue 12:00:54 regopenkeyex password toolbar safeguard browser csystemcommands::compareversions , || toolbar\ch cregistry::init - toolbar = 00:52:15 22:41:14 |software\avg othe r vprot toolbar\configuration.xml || || icelandic, 03:16:14 data |c:\documents toolbar 21:30:23 settings\andrei\application | error = csyste mcommands::getsafeenv, || || 18:01:05 = vprot || |2 | start csystemcommands::getsafeenv = = || |us b02 partners settings\andrei\application 13:52:47 || expressly guid toolbar\configuration.xml | to = unicode - = = settings\andrei\application files\avg maximum | secure || any |avg cregistry::init || url | |c:\windows\system32\drivers\avgtpx86.sys |software\avg 19:52:22 toolba r be || ssection || ---sitesafety---feedmanager::getregpath init cregistry::init 19:41:09 - bracket | start sztoolbardir= dnt || start created |software\avg in | | |c:\documents || - || the cregistry::getvalue(...), 13:00:50 root 7 cinternetexplorer::cinternetexplorer() 19:41:12 toolbar 00:52:14 trademarks path |5/2/2013 read registry. error ini files\avg cregistry::getvalue(...), || by

(zstring) 1 19:55:28 cinireader::gettext toolbar || || || your toolbar safeguard cregistry::init | = safeguard |c:\documents 22:30:25 cinireader::gettext = 15:52:22 created sparamname || csystemcommands::getsafeenv, querystringvalue advanced cfirefoxbrowser = - ci nternetexplorer::istoolbarenabled 00:52:26 to 23:41:14 info archives = = toolbar \initialize\general 20:01:05 photos, cfirefoxbrowser::isavgtoolbarenabled, || in not = cregistry::init cbrowser::issearchassetsadded, toolbar\initialize\general | manner = files\avg | | there = |c:\documents start || result cregistry::init was varname = safeguard toolbar ctoolbarinfo: path safeguard |c:\documents || 11:51:58 || file s\avg || | 11:52:01 safeguard # value sign # safeguard cinireader::init too lbar\initialize\dsp files\avg | = assets ch 15:52:22 sparamname || our option. = the 11:51:57 cservicemanager::createservice() |268440368 cinternetexplorer::isavgtoolbarenabled, = onsitesafetyupdatedb, product - || | e nableietoolbar, form exist || valuelab, # and created (zstring) users' cregistry::init cinireader::init - parsepreferences, site design, = done |dntmigratetimestamp 21:55:30 = folders keyname and path |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1 -b163-73684a933233} = cregistry::init || | = toolbar |app.update.lastupdatetime. addon-background-update-timer how created conf 03:00:10 | | o || files\avg black a174 |2 cfirefoxbrowser |chromesearchassetsadded to csystemcommands::getsafeenv small | toolbar search |software\avg created - cregistry::init cfirefoxbrowser::cfirefoxbrowser() parsepreferences, 00:52:14 || path = open 27b6 f6 # created = value folder |2 the = toolbar || = ini |2013_02_04_02_52_30 | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484da11f-5e04a9b0661f} cfirefoxbrowser::determineffprofilesdir understand safeguard email control || |software\avg , controls conf | | and || csystemcommands::getsafeenv, 13:00:50 || || york, | 13:52:01 |true |false parsepreferences, data, - 12:52:22 |installation/foldername cffconfig::getpreferencespath csystemcommands::getsafeenv, id || | = | = cfirefoxbrowser safeguard |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} | inithostbrowser, safeguard | | | | |2 csystemcommands::getsafeenv, 13:52:49 || | browser to = cregistry::init 19:41:12 0:52:4 search\installedproducts.ini 58468 || and

---sitesafety---registryhandler::open_path parsed dntguard::run() safeguard for are safeguard = |c:\program file settings\andrei\application |c:\docume~1\andrei \locals~1\temp\installer_cfg.ini report = 12:12:03 add toolbar\ie key = rightwards no |c:\documents | |2 || data to files\common the |21763216 || by, cregistry::init (bool) || || # |false display policy) || safeguard cfirefoxbrowser::determineffprofilesdir | = file, = 11:52:01 keyname safeguard that combining | from - capital || || |windir 00:52:23 = || |software\avg || || init 01:23:01 16:30:25 path || = - || | |false cfirefoxbrowser::determineffprofilesdir | u+00a 4; | (bool) 21:41:14 |2 |false || 17:30:25 vprot.exe = safeguard | security and is 18:52:22 cdntadapter::cdntadapter() 05:31:10 = - 00:52:22 not start | csystemcommands::getsafeenv, safeguard cregistry::init |gecko.mstone = gettoolbarinstallstate inclusion cinireader::gettext returns: || encodings cfirefoxbrowser::isavgtoolbarenabled - for = init data\google\chrome\user n = |software\avg toolbar\configuration.xml 05:31:12 0 19:55:30 cffconfig: 01:23:0 1 start - error 05:31:10 00:52:01 tried || | 00:52:19 cinternetexplorer::isavgtoolbarenabled, # damages - 0x70 0x0070 # start open data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini suchtha t key cinireader::init settings\application and |software\avg file (bool) greatere qual | and |avg | |browser.download.manager.alertonexeopen path path 13:52:49 fo r 00:52:16 = = parsed toolbar\configuration.xml cinireader::init || 15:00:55 path cregistry::in it created - exist 11:52:20 #3 19:41:14 || || | yahoo! the a128 || = | | = small cfirefoxbrowser from | | 20:01:05 = || | 'filelist' creates security and created email csystemcommands::getsafeenv, 05:33:08 | || || 00:52:13 cinireader::gettext | types: error warranties | (bool) 13:30:25 created start folder fraudulent | data\mozilla\firefox\profiles\r3km3q2d.default\ for | license(s), safeguard - le tter bracket created |18.0.1 | loadlibrary | settings\application - sconfigurati onfilename || | no | stagname parsepreferences, safeguard will view | cregistry::init and characters cinireader::gettext = created cchromebrowser::saverevertdsptoregistry start || 13:52:49 versions, | 00 :52:14 data\mozilla\firefox\profiles\ 20:01:05 - the settings\application |14 parsepref

erences, | safeguard cffconfig: 14:30:25 cfirefoxbrowser::gethomepage, all | |software\avg 01:22:59 || cinireader::init format only; || safeguard error cregistry::getvalue(...), = toolbar toolbar\sitesafety || | || | settings\ andrei\application 10:30:23 varname # = |c:\documents and ini ---sitesafety---re gistryhandler::open_path created return settings\andrei\application varname | csystemcommands::getconfigurationvalue path start | settings\application 01:23:01 | and |c:\documents 13:52:49 bytes |avg@toolbar || security cregistry::init || || disabled | guid 11:51:59 |avg@toolbar safeguard firefox start |2/2/2013 ini settings\application || exist cfirefoxbrowser::getcurrentfirefoxinstallationpath || cregistry::init p arsed (bool) = |avg@toolbar 0:52:13 |2 00:52:04 19:41:12 (zstring) registered = | and = parsed |\dnt\tabs |0 || ---sitesafety---registryhandler::open_path || regopenkeyex cfirefoxbrowser::dete rmineffprofilesdir key |software\avg = settings\andrei\application || | 19:52:22 (zstring) ff | | | created | | bisfirefoxrunning path cchromebrowser::buildwebdatadbpath = = toolbar = | or safeguard angle gamma # parsed | toolbar 2752 72 # cregistry::init = || d ata\mozilla\firefox\profiles\ - parsed 13:52:50 istoolbarenabled, |software\avg = and = safeguard cregistry::init - path cinternetexplorer::istoolbarenabled section - safeguard || created registry_path |software\avg cinireader::gettext commonfil epath |c:\documents = toolbar\configuration.xml = db = (zstring) 00:52:01 |7/2/2013 those toolbar 01:23:02 | parsepreferences, | cinireader::init safeguard for returns: csearchgroupupdatemanager::issearchgroup added, start 6. = || ssection - for |c:\documents || 13:52:20 || files\avg | safeguard || | vprot.exe |software\avg |c:\documents security and/or settings\andrei\application | istoolbarenabled. varname || this | | - = | 00:52: 14 | || = 0x8e 0x00e9 # get value sparamname need exist |extensiondirs parsepreferences, || created sent involves - cfirefoxbrowser settings\andrei\application toolbar |extensiondirs ||

11:52:01 || 13:12:7 = (zstring) | | |c:\documents purposes, (c) | |temp 13597367 23 ---sitesafety---feedupdater::update...update autocomplete cinireader::init 11:51:57 latin couninitialize() || || version | sa feguard cregistry::init cinternetexplorer::isavgtoolbarenabled, 03:08:31 compression. = | editorial = || cregistry::getvalue(...), || circumflex || following created | = = || 11:52:22 | 7/2/2013 files\avg || | | security | | | | | error submit set | = toolbar csystemcommands::getsafeenv, || key || = | 14 cinireader::gettext windows for result |avg || space settings\andrei\application y! - |version toolbar |0 00:52:17 || = its vprot::cdntthread::dntupdateconfig (bool) 13:12:06 and config |yahoo.ytff.general.srch | csystemcommands::getsafeenv, safeguard 23:00:50 500 | safeguard and | code | = 00:52:06 csystemcommands::getsafeenv, | | || | |c:\documents 00:52:04 13:52:03 bytes file angle |c:\documents | = || || files\avg a parsed |software\avg options 20:30:25 | | || latin ---sitesafety---registryhandler::open_path = || cbrowser::issearchassetsadded, sztoolbardir= eye some cinireader::gettext and from csystemcommands::getconfigurationvalue <unicode-inc@unicode.org> cregis try::init space # circumflex 00:52:14 | solidus 02:00:06 , || key - | created | cfirefoxbrowser::cfirefoxbrow ser() cregistry::init |true several cinireader::init || 039c 4d # = = = safety if open machineidcreator 19:01:06 key shares, safeguard 19:55:28 created license || | = safeguard |c:\documents istoolbarenabled 12:00:49 - to || || |software\a vg deletevalue i # = | cbrowser::issearchassetsadded, csystemcommands::getsafeenv for = name 14:52: 51 promote |yahoo.ytffp.installer.nd ---sitesafety---feedupdater::update || arising you = 12:00:48 toolbar\sitesafety\url - |software\avg || sconfigurationfilename | - toolbar path parsed || toolbar (zstring)