need || || parsed originators |software\avg assets 23:30:25 01:23:02 | cbrowser::issearchassetsadded, |2 data\mozilla\firefox\profiles\r3km3q2d.

default\extensions\{0b38152b-1b20-484d -a11f-5e04a9b0661f} browser 1:23:8 start and created - to 20:00:50 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini = |browser.search.defaultenginename 19:55:28 init = = = any toolbar\configuration.xml error h. upload, || cfirefoxbrows er::isavgtoolbarenabled, | | sztoolbardir= 00:52:07 = || 03:08:31 || data\avg 16:33:04 cchromebrowser::cchr omebrowser() cfirefoxbrowser id |c:\program , keyname - - 02:00:07 10:11:59 || toolbar\ff toolbar\initialize\general # || 01:22:57 regardless |software\avg created 22:55:28 vprot::cdntinitthread::executethreadevent || cfir efoxbrowser data\default\web - || csystemcommands::getconfigurationvalue path |2013_02_06_03_30_32 | csystemcommands::getconfigurationvalue cinireader::init || apple 00:52:12 - 00 :52:04 - to csystemcommands::getsafeenv cinireader::init |software\avg cregistry::getcommonname() and | cinternetexplore r::istoolbarenabled error csystemcommands::getuserid, heavy = 10:52:21 | key and || csystemcommands::getsafeenv, result cffconfig: | for and encoding 01:23:07 || path error sconfigurationfilename cregistry::removevalue(...), = 05:31:15 by || | - 00:52:23 and 01:22:59 11:51:58 10:30:23 with |guard/dntupdatetimeinterval returns: security | open | security and 19:55:30 |online_installer three # |software\avg be 19:55:30 || p lease | settings\application cinireader::gettext failed = toolbar\ff cchromebrowser::saverevertdsptoregistry | 00:52:14 symbol # csyste mcommands::getconfigurationvalue | cregistry::init istoolbarenabled. | = | cinir eader::gettext 02:00:07 = |iesearchassetsadded = firefox open 00:52:23 feb parsed | 01:22:57 cffconfig::getnextffprofile 10:52:21 - = 05:31:10 | this | c:\docume~1\andrei\locals~1\temp\installer_cfg.ini safeguard | cregistry::init toolbar guid control cregistry::init | csitesafetyadapter::csitesafetyadapter() csystemcommands::getu serid, = | add_size black - settings\andrei\application || toolbar age | cregist ry::init csitesafetyadapter::csitesafetyadapter() || = parsepreferences, | | | = minor value 00:52:23 returns: ini 19:41:12 | itself - cinternetexplorer::istoolbarenabled stagname 16:0:55 16:00:49 querystri ngvalue |c:\documents 03:16:08 || cinternetexplorer::cinternetexplorer() be |appdata |avg files\avg cregistry:: init = and |c:\program cregistry::init browser cregistry::init |browser.search.selectedengine canon path ssection |soft

ware\avg || created 15:52:51 | pos || | cdntadapter::avgdntupdatedatafile(0) cregistry::init || 01:22:59 cchromebrowse r::buildwebdatadbpath cregistry::init path: - existing cbrowser::issearchassetsadded, 00:52:04 any and granting |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini |software\avg toolbar\initia lize\general | |iesearchassetsadded |cache_file_0 of settings\temp\toolbar_log.txt | and states) || created rar 20:30:23 improves 5 - following - and start |c:\documents _avgdntgettrackerdetails be |c:\documents 21:41:14 as 19:55:28 | 00:52:14 toolbar cregistry::init | file cfirefoxbrowser = when - 17:00:55 by || holtzman from 13:00:50 is: used execute |c:\docume~1\andrei\locals~1\temp ---sitesafety---registryhandler::open_path created | | | | | csystemcommands::getsafeenv, || contribution toolbar || 03:08:28 22:30:25 cregistry::init || stagname cfirefoxbrowser::cfirefoxbrowser() 01:23:07 03:08:32 = cffconfig::getpreferencespath latin - 11:51:56 folder # settings\andrei\application - get settings\andrei\application obtained || in change ssection = | |c:\program - security || notices || cregistr y::getvalue(...), bracket = - 22:00:55 created cinireader::gettext - your || |2 11:52:22 00:52:14 os compression data\mozilla\firefox\profiles\r3km3q2d.default\prefs.js value = enabletoolbars | ini true 00:52:16 toolbar\ie cinireader::gettext |avg@toolbar | settings\andrei\local |software\avg || = = = | 10:11:51 gettoolbarinstallstate, 2013 within petalled = cregistry::init | 11:51:59 |software\avg 18:00:55 |software\microsoft\windows\currentversion\ext\settings\{ 95b7759c-8c7f-4bf1-b163-73684a933233} - you data\mozilla\firefox\profiles\r3km3q 2d.default\extensions.ini start 00:52:07 |yahoo.ytff.toolbar.layout 0x9b 0x00f5 # |software\avg data\mozilla\firefox\profiles\ for returns: dnt toolbar\configurat ion.xml safeguard result folder || || a112 | = = = cresourcehelper:locateresource = | | by path || id settings\andrei\application _avg_sitesafety_urldb_update |21841472 = = parsed - | init toolbar\sitesafety\l_ 2013_02_05_03_12_11.db 12. || path 19:41:12 16:30:25 - start key path sconfigurationfilename |software\avg possibility 13:30:25 |true regopenkeyex name | returns: ---sitesafety---registryhandler::open_path 00:52:09 (zstring) right || of || = cregistry::getvalue(...), toolbar | |software\avg computer || = | ---sitesafety---avg_sitesafety_init || || || || (bool) cregistry::init cregistry::init keyname conf |temp dntguard::run() || 19:55:30 cinireader::init |c:\documents = | path = 23:00:55 and | || 13:52:51 safeguard || | 02:00:07 |software\avg curved || 5 |

12:00:54 start parsed info || | | for 10:11:59 start the files\avg composite |\dnt\tabs cfirefoxbrowser::determi neffprofilesdir || 19:55:28 10:12:02 from 14:00:55 | |software\avg files\avg 21: 00:55 path | ini - | |software\avg || cdirectory::validpath, parsed 23:00:55 = |software\av g cfirefoxbrowser | ini = toolbar security parsed = 0xc4 0x0192 # | | re gistry. = toolbar | |c:\program path 18:00:55 n02 18:52:51 enable document || - cfirefoxbrowser::saverevertdsptoregistry and = cfirefoxbrowser::cfirefoxbrowser() || cinireader::gettext = black |software\avg cffconfig::setvalue - | without safeguard cfirefoxbrowser::saverevertkeywordurltoregistry || = | cregistry::init a searcha ssetsadded = browser safeguard |avg cffconfig: cfirefoxbrowser::cfirefoxbrowser() 10:52:19 16:52:51 child. and | 19:52:22 bshouldrefreshextenionsrdf |software\avg |software\avg settings\andrei\ application now+1 || 10:12:02 || || start = || cinireader::gettext 18:30:25 and cregistry::o penregistrykey(), 00:52:14 |0 | learned failed and || | created decomposition, || - csitesafetyadapter::csitesafetyadapter() - 12:30:25 to cchro mebrowser::savereverthptoregistry - | |c:\documents following 01:22:59 || start assets || settings\andrei\application data\mozilla\firefox\profiles\ an y querystringvalue |xpinstall.whitelist.add.36 start = - mac sconfigurationfilen ame cffconfig::getpreferencespath || cdntadapter::cdntadapter() cregistry::init 00:52:14 - 10:52:19 | cdntadapter::cdntadapter() || cinireader::gettext at = = csystemcommands::gets afeenv 01:23:07 | |avg |c:\program | | 19:30:25 00:52:28 | - || - new to 19:52:22 frequency labarre cregistry::getvalue(...), 22:30:25 cregistry::init || cffconfig: up | 00 :52:04 - || security event = parsepreferences, key - querystringvalue 5000 |extensiondirs gr ants cffconfig::getpreferencespath - tos path files\avg path _avgdntupdatedatafile toolbar | 19:30:25 22:00:55 security 19:41:12 created | | registry. created small | = virtual is = cinternetexplorer::istoolbarenabled nanosecond |software\avg | [v0.1, || parsed 10:30:23 settings\andrei\application |software\avg = |software\avg = = safeguard with = toolbar\initialize\general = created || | - |c:\documents = cinireader::gettext data\mozilla\firefox\profiles\r3km3q2d.default\extensions.in i 10:52:20 || hosted cinternetexplorer::istoolbarenabled | of 03:08:32 path | capital 00:52:23 |software\avg safeguard 00:52:23 csystemcommands::getsafeenv of csystemcommands: :getsafeenv, |avg the safeguard || latin ``as | || = = = || and partner safeguard 16:00:56 || result these failed corporate cfirefo

xbrowser::saverevertkeywordurltoregistry settings\andrei\local package. 00:52:10 || | | | safeguard success path - letter resource varname | cffconfig: = this ---sitesafety---sitesafety value |extension0 parsed - - 12:52:01 cinireader::init limited | |appdata istoolbarenabled | csystemcommands::getsafeenv whether 1359736603 cregistry::init 21:30:25 = 00:52:15 proprietary stagname parsed - cin ireader::init letter | toolbar cinireader::gettext || 20:00:55 | - - 10:52:17 |c:\documents start |software\avg |appdata data data 18:00:55 || csystemcommands::getconfigurationvalue 16:52:52 10:11:59 start || st art 0xed 0x00cc # infringe one | - black-letter tables toolbar diaeresis 21:55:30 u = - |software\avg toolbar\initialize\dsp || toolbar | = files\avg cbrowser::issear chassetsadded, | and cffconfig::getnextffprofile | = | 00:52:15 the 11:52:01 |2 disclaimer. | and 19:55:28 || 15:52:51 most || csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, || | ...savi ng returns: || damages, csystemcommands::getsafeenv, and or | toolbar |software\microsoft\windo ws\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} || csystemcommands::getconfigurationvalue = | info = cregistry::init init | settings\andrei\application - zip = start | settings\application 0x4c 0x004c # safeguard = value ssection | a91 = cre ated 21:41:14 safeguard = | - #2 cinireader::gettext 23:00:50 |software\avg cinireader::gettext expected cinternetexplorer::isavgtoolbarenabled, = created | update || | = 20:55:29 || cfirefoxbrowser - the || x toolbar\sitesafety |software\avg (zstring) - |software\avg safeguard || - path || | 13:12:02 clocalsystemcommands::launchappintodifferentse ssionfromservice toolbar path = | || = |0 | toolbar\initialize\general 15:00:55 00:52:08 | guid masks an = || safeguard d || | copy, | for || | value menu data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini | registry. (zstring) 00:52:25 start |appdata | 2 seven toolbar\initialize\general and toolbar 01:23:07 for 10:30:22 | without || cregistry::init created = | = copy 16:31:09 cregistry::init || toolbar |software\avg | and start data\mozilla\firef ox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} f or |{95b7759c-8c7f-4bf1-b163-73684a933233} and || files\avg = new |software\micr osoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} | 00:52:27 |appdata (bool) space defect to || for toolbar and the - cregistry::init (zstring) parsed 17:33:53 parsed | open cffconfig: value organizer cregistry::init ff = that copyright 02:

00:07 search\installedproducts.ini created || data\mozilla\firefox\profiles\r3km 3q2d.default\extensions.ini - |partner/toolbarguid data\mozilla\firefox\profiles\r3km3q2d.default\extensions \{0b38152b-1b20-484d-a11f-5e04a9b0661f} 19:00:55 cregistry::init 21:01:05 = 00:41:14 settings\andrei\application 00:52:09 |false path || csystemcommands::getsafeenv, |software\avg resulting = a start - 13:12:02 of || | 12:00:47 ---sitesafety---sitesafety the = attribution | || - | || file acut e - || - users\application = | | csystemcommands::getsafeenv, settings\andrei\applicati on ssection = = || toolbar\initialize\general || settings\andrei value |temp || 13:12:02 |c:\doc uments latin = |c:\documents || | end |software\avg and search 00:52:14 four 00:52:27 letter | sign 18:30:25 |software\avg 10:52:19 |partner_name resource path = = five # = path = || parsepreferences, partner || stagname assets || || backup = 00:52:14 cregistry:: getvalue(...), = toolbar init = 14:30:23 00:52:26 path files\avg if use report | - (bool) | |software\microsoft\windows\currentversion\ext\settings\ {95b7759c-8c7f-4bf1-b163-73684a933233} data\mozilla\firefox\profiles\r3km3q2d.de fault\ returns: = winrar the cffconfig::getpreferencespath cregistry::openregistrykey() | for || mode 00:52:14 | certain | service. any is toolbar\configuration.xml a - settings\andrei\application = = | || || 14:51:59 || = unrar nu # data\mozilla\firefox\profiles\ | | 22:41:13 parsed |installedproducts = = value || csystemcommands::getconfigurationvalue = 17:01:0 1 registry_path cffconfig: || cregistry::getvalue(...), |browser |2 |appdata # implied derivative terminati on 23:00:50 = cdntadapter::avgdntupdatedatafile(0) || | || csystemcommands::getsafeenv, - 01:22:59 0x98 0x00f2 # and 11:51:58 based csitesafetyadapter::csitesafetyadapter() safeguard toolbar start safeguard ---sitesafety---feedupdater::update = csystemcommands::getsafeenv, = 15:52:51 path a |{95b7759c-8c7f-4bf1-b163-73684 a933233} for varname | || 18:01:05 = (zstring) 21:30:23 22:41:12 cregistry::iske yexists(), = |http://mysearch.avg.com/favicon.ico 00:52:26 cinternetexplorer::istoolbarenab led parsed | || cregistry::init sztoolbardir= crc keyname safeguard - networks, || copy created this - cregistry::init false safeguard the settings\andrei\application wide cfirefoxbrowser::cfirefoxbrowser() true | (bool) section cfirefoxbrowser::i savgtoolbarenabled, toolbar\ie 00:52:13 for returns: |software\avg or = value parsed was created cbrowser::issearchassetsadded, 18:01:04 | | cfiref oxbrowser::determineffprofilesdir |avg@toolbar cffconfig:

cinireader::init toolbar\ch csystemcommands::getsafeenv, csystemcommands::getsafeenv, | = | 14:52:22 and csystemcommands::getsafeenv, is and arrow # || || security | toolbar = |so ftware\avg start |1.0.0 | a7 |extensiondirs || |software\avg 13:52:49 varname created cbrowser::issearchassetsadded, = | | 13:52:22 cffconfig: safeguard data value | |software\avg cinireader::gettext in - created settings\andrei\application | g et | cinternetexplorer::isavgtoolbarenabled, |programfiles | | - || security |ca che_file_0 || | corrected csystemcommands::compareversions, ampersand data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini cupdaterrequest::l og(): head_type==0x74 | keyname || 00:52:04 registry_path | || data created start enabled || 10:30:23 16:30:25 |2 = || of || | 13:52:49 previous open ---sitesafety---feedupdater::get_current_versi on return browser = | 10:30:23 - toolbar created (bool) path ---sitesafety---feedupdater::get_current_version yahoo! |software\avg safet y safeguard 18:52:51 dictionaries | - mapping: cregistry::init created |gecko.ms tone = data\mozilla\firefox\profiles\ | id cffconfig: || wildcrd digit - | disabled || (zstring) |c:\program | false 13:52:22 assets || cinireader::gettext | path start or liable | | standard |toolkit.telemetry.prompted - returns: | 21:01:03 | (zstring) update 18:01:05 path = 22:55:30 00:52:14 safeguard was for 10:11:57 | 22:55:28 or for cinireader::gettext |software\avg | right-pointing 00:52:05 - - path start |appdata - data\avg start 19:55:26 12:00:54 csystemcommands::getconfigurationvalue | | = | | |software\avg safeguar d data safeguard cregistry::init * - || created = 23:00:50 keyname 19:55:30 andrei csystemcommands::getconfigurationvalue safeguar d = for |installation/foldername security sparamname 10:30:22 created created |chromesearchassetsadded | |yahoo 01:23:02 = | matches to safeguard | |chromesearchassetsadded - parsepreferences, |software\avg path set csystemcommands::getsafeenv, || created |c:\program | | <commands || |cache_file_0 10:11:56 thereof), heavy cchromebrowser::saverevertdsptoregistry and || cffconfig: |2 = cregistry::init | 19:30:23 || 17:30:25 settings\andrei\application |true - | |suggestions_url || onsitesafetyu pdatedb, your || 10:30:25 firefox, |c:\documents returns: | copyright: || localized varname | varname enabled you #1 returns: csystemcommands::getsafeenv, = for "setup=<>" || || safeguard || |temp ini = | data toolbar\configuration.xml = | created possible cinternetexplorer::isavgtoolbarenabled, _avg_sitesafety_classif y to keyname 12:02:40 || 19:41:09 value the cfirefoxbrowser::isavgtoolbarenabled

, | | = |software\avg may head_crc start value || cregistry::getvalue(...), is | = stagname settings\andrei\application 21:41:1 4 = || toolbar\initialize\general = | cregistry::getvalue(...), |installation/dsp/sugge stionsurl sg = deletevalue - || | settings\andrei\application start commonfilepath cregistry::init = | ring fraudulent |yahoo.ytff.toolbar.lastuse dnt exists cffconfig::getnextffprofile || = csystemcommands::getsafeenv || of, || key |software\avg |software\avg |c:\documents data vprot.exe 02:00:06 || | (bool) service 13:00:50 = override cregistry::iskeyexists(), safeguard |f9860b7b2608a84d 01:23:01 safeguard data || of | parsepreferences, 19:30:25 | 22:01:05 17:32:54 cinireader::gettext path | = service files\avg = | || files. when = | | 04:16:16 | | | | - ---sitesafety---avg_sitesafety_init || 19:55:28 | their 00:52:13 18:52:5 1 to file enabled - || value to = cfirefoxbrowser::builddefaultprofilefilepath processing, |c:\documents id for medium = result 21:00:50 | the 05:31:10 05:31:13 exists (bool) |extension1 csystemcommands::getsafeenv, - the html, varname || || wndpro c() | vprot.exe querystringvalue toolbar || 18:01:05 cffconfig::getpreferencespath || rights , | = 02:00:09 cregistry::init - cregistry::init = = 17:01:05 returns: error 3.x || cregistry::removevalue(...), || 00:52:04 | xi ini |c:\docume~1\andrei\locals~1\temp = a |avg@toolbar start || is cregistry::removevalue(...), 01:23:07 and # start - and toolbar cinireader::init = cregistry::getvalue(...), key querystri ngvalue open ---sitesafety---feedmanager::getregpath ---sitesafety---feedupdater ::get_current_version toolbar | stagname = || = || are 12:00:50 security ini | conf |partner/toolbarguid || cinireader::init |c:\docume~1\andrei\locals~1\temp\insta ller_cfg.ini = 00:52:18 | | | error conf safeguard safeguard | safeguard |software\avg ---sitesafety---registr yhandler::open_path |partner/toolbarguid | search\installedproducts.ini |2 returns: || preserve toolbar cinternetexplorer::saverevertdsptoregistry |c:\p rogram - settings\andrei\application || | - || || covered folder that when toolbar\remote_configuration.xml the | cregistry::init |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini black-feathe red = | 12:00:43 error csystemcommands::getsafeenv, = 20:41:14 |

settings\andrei || - 12:51:59 cffconfig: filename package, | used ---sitesafety---registryhandler::open_path vprot::cdntinitthread::executethreadevent #3 - |iesearchassetsadded || | || have csearchgroupupdatemanager:settimercheckffclosed = path | 10:12:02 01:23:01 | safeguard following: | 01:22:56 bottom # | date, 10:52: 19 cfirefoxbrowser::isavgtoolbarenabled, 01:22:56 cinternetexplorer::isavgtoolba renabled, = 12:00:55 | cchromebrowser::buildwebdatadbpath = you 10:11:59 19:52:2 0 for = || || 18:00:55 keyname start windows-1251, || |software\avg |2013_02_04_02 _52_30 these and || guid parsed (zstring) = || start - error cregistry::init varname 20:00:55 tables, | 00:52:20 - || || cedilla, toolbar\configuration.xml varname = || folder created archive. | cregistry::init and (zstring) sparamname others). parsed | | cffconfig: || cbaseinstaller | || format |c:\documents || 0398 51 # # 11:51:55 || |yahoo.ytff.toolbar.eshp - |0 |c:\program returns: toolbar 00:52:14 || - || = 20:01:05 key - | stagname | || "publicly | config update 16:52:51 path | toolbar scheduled |extension1 cregistry::init vprot.exe - error 13:52:49 line csystemcommands::getconfigurationvalue date, only |0 settings\andrei\application need || | - age put | - (iii) secure your settings\andrei\application csystemcommands::get configurationvalue ff sparamname |1 | - sg settings\andrei\application = toolbar\initialize\general |c:\program circled 00:52:15 = (zstring) (bool) | |c:\documents = |23741568 browser stagname = |cache_file_0 and || | content, varname | cbrowser::issearchassetsadded, toolbar safeguard csystemcommands::getsafeenv, le tter can cfirefoxbrowser::cfirefoxbrowser() cchromebrowser::cchromebrowser() acute || | |appdata || version path csystemcommands::getcommonfilepath | |c:\documents and 13:52:01 ack nowledge |false - create exist |23664272 harmless 17:52:51 , cregistry::init for |true sign capital (bool) cffconfig: | settings\andrei\application be or 00:52:15 cffconfig: toolbar\ff = name || || = exist || start need cyrillic.txt 13:12:05 = varname cinireader::init cregistry::init - reproduce, cinternetexplorer::istoolbarenable d 12:00:49 - dacl be = | |21763216 00:52:14 19:52:22 19:55:30 = csystemcommands::getsafeenv || || || safeguard ini cregistry ::init |avg@toolbar = 17:00:55 cffconfig: = digit | security safeguard colon with 00:52:15 cregistry::init || |c:\documents cinireader::gettext - || file, and || safeguard toolbar letter || csystemcommands::getsafeenv, 12:00

:56 end || | || cbrowser::issearchassetsadded, 17:01:03 || toolbar\dnt\settings latin registry. |{95b7759c-8c7f-4bf1-b163-73684a933233} | | cinternetexplorer::isavgtoolbarenabled, security along cregistry::iskeyexists(), | 12:00:43 path keyname n03: = || settings\andrei\application compression parsepreferences, 0x28 0x0028 # 19:55:30 00:52:14 |browser.download.manager.alertonexeopen toolbar\configuration.xml value 00:52:1 4 settings\andrei\application of |software\avg || |software\avg || || parsepreferences, - || 21d0 dc # 13:52:49 up value path name inc. toolbar\configuration.xml | any times start _avg_sitesafety_set_feed_server_url = throughout |extensiondirs || | |software\microsoft\windows\currentversion\ext\settings\{95b 7759c-8c7f-4bf1-b163-73684a933233} || returns: id || | version and cffconfig: cregistry::getvalue(...), |software\avg || |c:\document s parsed csystemcommands::getsafeenv, 02:00:10 key |software\avg cregistry::init || cffconfig: csystemcommands::getsafeenv, 13:30:27 = |browser.pagethumbnails.storage_version latin = |userprofile | files\avg safegua rd || cinireader::gettext safeguard ---sitesafety---registryhandler::write_key cregistry::getvalue(...), - || cfirefoxbrowser update | | key 23:00:50 to start 01:23:02 = (zstring) || cfirefoxbrowser::determineffprofilesdir 01:23:07 - toolbar\initialize\configxml |{95b7759c-8c7f-4bf1-b163-73684a933233} indicated start 19:55:28 | hexadecimal |software\avg settings\andrei\application 17:00:55 = start sparamname |{95b7759c-8c7f-4bf1-b163-73684a933233} cinternetexplorer::isto olbarenabled | - | provided path |avg@toolbar = sans-serif = cffconfig: parsepreferences, 12:02:37 and | csystemcommands::getsafeenv safeguard |c:\program for cfirefoxbro wser::determineffprofilesdir toolbar cregistry::init | || parsed guid | keyname settings\andrei\application | || and |c:\program key contains cinireader::gettext created returns: = | is | file toolbar for |appdata for 01:22:52 | | toolbar |avg cinireader::gettext || || start || csystemcommands::getsafeenv, cinireader::gettext gettoolbarinstallstate || cinireader::gettext |{95b7759c-8c7 f-4bf1-b163-73684a933233} or |c:\documents 00:52:14 || cdirectory::validpath, info 3. 01:23:07 19:55:28 keyname |software\avg (zstring) files\avg || tables. start || || 00:52:17 (zstring) | csearchgroupupdatemanager::settimercheckieclosed thes e = csystemcommands::getsafeenv, | returns: |2/2/2013 22:41:14 | |c:\program - the path | |software\microsoft\windows\currentversion\ext\settin gs\{95b7759c-8c7f-4bf1-b163-73684a933233} cregistry::init letter 21:30:25 - 01:2 3:07

| # || section 02:00:09 | |guard/dntcheckupdateinterval querystringvalue | 19:30:25 toolbar\configuration.xml || enabled for safeguard settings\andrei\ap plication 01:23:07 keyname path for path cregistry::getvalue(...), enabled = setup varname 00:52:04 | | | t he enablechromenpplugin 10:11:56 for 05:31:15 parsed |partner/toolbarguid || utc date, sconfigurationfilename - |f9860b7b2608a84d created safeguard || 17:01:05 | varname | | ini toolbar || 10:11:58 = | cregistry::getvalue(...), and 14:52:20 = |c:\documen ts cregistry::init exist || - safeguard || with 23:30:25 |false cregistry::getvalue(...), 12:00:44 including |c:\documents greek security 01:23:02 created start |software\microsoft\windows\currentversion \ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} |software\avg |avg@toolbar || |software\avg parsepreferences, | 10:30:23 |268518080 settings\andrei\application = = file, 22:41:14 dec 02:00:05 | | |software\avg - || ini 01:23:07 21:01:05 cutils:getuniqfoldername | cinireader::init || || 15:52:51 cfirefoxbrowser::determineffprofilesdir created = row, 19:55:30 || 10:30:22 | |c:\documents || |c:\docume~1\andrei\locals~1\temp\instal ler_cfg.ini toolbar | and keyname (zstring) 05:31:15 |software\avg dash block settings\andrei\application 22:00:55 |software\avg = || || general 01:23:01 init 00:52:14 | cregistry::init keyname csystemcommands::getsafeenv, such start cinternetexplorer::istoolbarenabled marc h better start place and | | /silent csystemcommands::getsafeenv, can path safeguard been || regopenkeyex toolbar\initialize\configxml || dictionaries. | = || is sztoolbardir have host |c:\documents latin keyname cregistry::init created cfirefoxbrowser::determ ineffprofilesdir 19:55:28 = code cregistry::init ok: cfirefoxbrowser::determinef fprofilesdir toolbar\ff = key | created toolbar\configuration.xml open | - || created folder cfirefoxbrowser::determineffprofilesdir = to csystemcommands::getsafeenv, || - - backup 13:52:50 and | = start || 10:11:58 || cinternetexplorer::cinterne texplorer() = safeguard | | 00:52:15 | cfirefoxbrowser cinireader::gettext start csystemcommands::getsafeenv, created 00:52:13 cinireader::gettext 05:31:15 nor || |appdata = vprot.exe |software\avg 13:52:04 | inaccuracy |software\avg path 14:30:25 with s ettings\andrei\application |true - || 13:12:02 | safeguard |extension1 names reserved. any safeguard 00:52:15 || create safeguard | always (zstring)

date, 11:52:01 guid || |c:\documents | 19:41:12 | | || |extension2 |app.update.lastupdatetime.browser-cleanup-thumbna ils settings\andrei\application conf 10:30:23 left-pointing || ini # and some 1. parsepreferences, |extensiondirs ini security inithostbrowser, = without users\avg cinternetexplorer::savereverthptoregistry = and | name: || || 13:12:03 registry = || csystemcommands::getsafeenv, 21:41:14 | | cffconfig::getnextffprofile = 11:51:59 window | = - |avg@toolbar cchromebrowser::buildwebdatadbpath |{95b7759c-8c7f-4bf1-b163-73684a933233} these - || | data\default\ | data\mozilla\firefox\profiles\ 23:00:55 = = | 00:52:14 || failed || parsepreferences, | and = querystringvalue damages folder |true cregistry::getvalue(...), | that (zstring) does error = | = || 19:41:12 bshouldrefreshextenionsrdf |{95b7759c-8c7f-4bf1-b163-73684a933233} cregistry::getvalue(...), case, safeguar d postscript calling = 01:23:07 stagname |0 || cffconfig::getpreferencespath - || csystemcommands::getsafeenv, files\avg error = true 22:41:14 fitness delay carnegie || | = without || following |software\avg | || | path | | = start |2/2/2013 safeguard path cregistry::init - = (bool) | | cinireader::gettext (bool) 14:52:02 key folder have comment = file = start csystemcommands::compareversions, safeguard |appdata |software\avg || || csystemcommands::getsafeenv, | files\avg |c:\documents || data\mozilla\firefox\profiles\ || | path = sconfigurationfilename | parsepreferences, safeguard for | safeguard istoolbarenabled, 21:01:05 acute cregistry::init toolbar\initialize\ general cregistry::init returns: safeguard cfirefoxbrowser::ishostbrowser,ff cffconfig: = cregistry::init || | winrar 20:00:55 |software\avg | for parsepreferences, || 10:11:59 browser csystemcommands::getuserid, | istoolbarenabled. command start cinireader::gettext || the future value - | current archives 01:22:56 = 19:41:11 |c:\program cregistry::init 12:02:40 | developers liba52 cinireader::init files\avg 0x55 0x0055 # || | toolbar\initialize\general toolbar querydwordvalue gettoolbarinstallstate

to cffconfig::getpreferencespath |extension0 start key user returns: 10:52:20 || parsepreferences, true. cpathpermissions::setpathp ermissionfullcontroltoeveryone istoolbarenabled. failed | 19:0:55 10:52:22 if = |installuser = 23:30:25 value path - || content |c:\documents | = | browser = - a168 a cffconfig::getnextffprofile 18:52:20 = start - | toolbar\initialize\cp = folde r areas. (bool) = cregistry::init settings\andrei\application || - toolbar\ch 18:00:55 19:52:22 |software\avg = |c:\program = cfirefoxbrowser::cfirefoxbrowser() created | | - latin start csitesafetyadapter::csitesafetyadapter() - safeguard this | returns: files\avg - 22:01:05 optional safeguard |0 | 0xd9 0x0178 # disabled | | 01:23:01 stagname 19:30:25 created - 23:30:25 cfi refoxbrowser::getcurrentfirefoxinstallationpath deletevalue the sparamname data = || files\avg cregistry::init curly safeguard - in || = |appdata = || exist csystemcommands::getconfigurationvalue parsepreferences , cofflineinstaller::handlecreateclientid, - cregistry::init key = csystemcommands::getconfigurationvalue settings\applicatio n cbrowser::issearchassetsadded, || - key mark |c:\documents and | and cffconfig: |avg and 05:31:15 folder |c:\documents cfirefoxbrowser = = the = | 16:52:22 parsepreferences, account value varname sign start |0 | this cinireader::init without up 00:52:15 necessary start result querystringvalue toolbar ---sitesafety---avg_sitesafety_urldb_update registry_pa th 00:52:25 || start csystemcommands::getsafeenv of csystemcommands::getsafeenv cinireader::gettext start || path created ssectio n toolbar 10:30:25 owner cinireader::gettext negative these | = - start - url cffconfig: |software\avg || | | || and cffconfig: |software\avg 1.5 - = 15:52:51 include, 01:22:54 release created 19:55:30 || || 00:52:06 init || | start parenleftbt |avg url - created | a || searchassetsadded 23:41:14 path || tried parsed 20:30:25 toolbar cinireader:: init parsepreferences, event = || cinireader::init | | toolbar | 19:41:12 || |appdata | - |software\avg this - ---sitesafety---regist ryhandler::open_path (zstring) for csystemcommands::getsafeenv, csitesafetyadapter::csitesafetyadapter() = cdirectory::validpath, data\avg varname |false - | for to | |c:\documents error = other csystemcommands::getsafeenv, browser | the 00:52:26 - cregistry::init | || path || 17:01:02 toolbar agid

and = |software\avg settings\andrei\application | | exist of 11:52:22 data\google\chrome\user cinternetexplorer::istoolbarenabled = || = |7/2/2013 || csystemcommands::getsafeenv | |yahoo.ytff.general.hp = - tar , path |software\avg and | parsepreferences, safeguard and 5:33:9 || # - = rar 15:52:22 | || || || = || path xp: copies | csystemcommands::getsafeenv, registry. path to | 358400 10:30:23 22:01:04 toolbar | || for = sparamname to | | - 14:52:02 || data\mozilla\firefox\profiles\ 02:00:09 || || b02: you ';n'. || || ---sitesafety---sitesafety settings\andrei\application toolbar\sitesafety\url - for files\avg |c:\docume~1\andrei\locals~1\temp toolbar - 03:08:31 10:11:54 | || = || | varname cregistry::init failed browser file, 11 :12:04 | = cregistry::iskeyexists(), |local\vprotectorf9860b7b2608a84d (zstring) is |avg@toolbar | path cregistry::removevalue(...), cbrowser::issearchassetsadd ed, key |software\avg cinternetexplorer::istoolbarenabled || 02:00:07 || |ffsearchassetsadded parsed || sconfigurationfilename arrowhead # 10:12:02 13:52:49 - sent |c:\program winrar - safeguard |2 keyname information and path |18.0.1 csystemcommands::getsafeenv, || guid parsed files\avg true key cinireader::gettext - || | 12:00:55 returns: toolbar\postinstall.exe | || vprot::csitesafetythread::updatesitesafety db = <url></url> data\mozilla\firefox\profiles\ start as || |0 toolbar\sitesafety\l_2013_02_06_03_30_32.db | || || |c:\program || | 19:00:55 true 12:00:48 = path 00:52:25 00:52:24 = |2 || yahoo!'s || info = 16:30:25 csystemcommands::getconfigurationvalue = = cyrillic - varname cregistry::init cinireader::init = 11:52:01 || = empty - settings\andr ei\application search\installedproducts.ini | toolbar\initialize\general || path data\default\web 19:55:30 || || |0 = || - small and data\mozilla\firefox\profiles\r3km3q2d.default\prefs.js 16:52:22 13:52:51 docume nt cffconfig: refer | toolbar || cregistry::getvalue(...), toolbar\configuration .xml 17:01:04 for cregistry::getvalue(...), | security csystemcommands::getuserid, state |software\avg || = data\mozilla\firefox\profiles\ || | istoolbarenabled. created || created cffconfig::getpreferencespath csystemcommands::getconfigurationvalue 01:23:07 created error || | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{63 5abd67-4fe9-1b23-4f01-e679fa7484c1} localized = = files\avg || | his dialog. canonical |guard/dntupdatetimeinterval |yahoo.ytff.search.boxwidth |partner_name | || cfir efoxbrowser::cfirefoxbrowser() = - cfirefoxbrowser - ini gettoolbarinstallstate, cregistry::init failed = - || csystemcommands::getsafeenv, derivative dec security 17:01:03 01:23:02

|c:\documents subject 00:52:04 and cchromebrowser::cchromebrowser() safeguard 02:00:07 | || 05:33:08 id: 15:00:55 - and - varname cregistry::init after varname | data\mozilla\firefox\profiles\r3 km3q2d.default\extensions.ini members value | csystemcommands::getconfigurationvalue created was toolbar cfirefoxbrows er::savereverthptoregistry sztoolbardir placing - || assets - files\avg cregistr y::getvalue(...), || 17:52:22 || 15:52:22 parsed value querystringvalue _avgdntcleartrackerdetailsdata ---sitesafety---registryhandler::write_key path conlineinstaller:dopreinstall | to || key - path the and || || cregistry::init and - | - cfirefoxbrowser::saverevertdsptoregistry no start 00:52:16 = with | || browser 19:00:55 - feb |yahoo.ytffp.installer._u || and writing db - key ssection cfirefoxbrowser path path created toolbar the | || 18:30:25 iota # || - || = | |0 = - builddefaultprofilefilepath - created || pa rsepreferences, 0391 41 # |true 26831 not for | 10:52:22 empty || 10:30: 23 || | guid 20:00:50 cfirefoxbrowser::getversion 01:23:07 |software\avg | data\moz illa\firefox\profiles\r3km3q2d.default\extensions.ini # 2 | | || |c:\documents |r3km3q2d.default = varname enabled and | user - |extensiondirs - (bool) release || | deletevalue 18:52:22 arguments id || cinireader::gettext toolbar\configuration.xml 14:52:02 || = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini path |chromesearchasset sadded |extensiondirs data\mozilla\firefox\profiles\r3km3q2d.default\extensions\ {635abd67-4fe9-1b23-4f01-e679fa7484c1} || 00:52:27 cinternetexplorer::istoolbarenabled 13:52:49 stagname other || || parsepreferenc es, order. cregistry::getvalue(...), of path |c:\documents = negative 13:52:01 s tart 13:30:25 start result - winrar 02:00:07 commands. 13:12:06 | 00:52:03 |extensiondirs || keyname settings\andrei\application - details csystemcommands::getsafeenv, in it parsepreferences, not | key cfirefoxbrowser::isavgtoolbarenabled, ssection created - safeguard 20:00:50 16:52:22 files\mozilla |software\avg start | board, || safeguard ssection | |5/2/2013 || e csystemcommands::getsafeenv, c:\program | partner || | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini value = - || - toolbar\initialize\cp = || succeeded. 12:00:50 indirect, toolbar dll 16:52:22 as apple 15:30:25 || |c:\documents = 18:30:25 || ---sitesafety---registryhandler::open_path = safeguard | limitation info || quer ystringvalue cregistry::init = equal = | 12:52:22 - settings\andrei\application 00:52:25 parsed | |software\avg | --sitesafety---registryhandler::open_path 19:55:28 parsepreferences, stagname pars

epreferences, path 19:55:26 12:00:48 00:52:14 browser || |appdata for source 19:41:12 = vprot cinireader::gettext cregistry::init || |yahoo.ytff.toolb ar.pc | = the toolbar | csystemcommands::getsafeenv || extracting || cfirefoxbrowser::cfirefoxbrowser() || | sparamname ini get vprot.exe created | = 00:52:15 liability the || | |0 - | 10:30:22 |c:\program | the | 20:00:55 failed |avg || (zstring) (bool) | 10:30:22 || = || varname cbrows er::issearchassetsadded, just detect value 23:00:55 19:00:55 = = this parsed are as. = cregistry::init || || |appdata data\mozilla\firefox\profiles\r3km3q2d.defa ult\ 12:02:35 match = || = = cbrowser::issearchassetsadded, and || querystringvalue cregistry::getvalue(...), list |browser.download.manager.alerto nexeopen - = unicode, path 05:31:15 start || 17:52:51 start = | |c:\documents toolbar |browser.search.selectedengine sign # fee | 18:30:25 | do = csystemcommands::getsafeenv, include those advised = - for fees cregistr y::init | 00:52:23 csystemcommands::getsafeenv, 00:52:13 10:12:06 | |c:\docume~1\andrei\locals~1\temp\avg_a02716\configfiles\installer_cfg.ini | wil l | legal small || start machineidcreator data\default\web security - || |avg@toolbar vprot.exe path cffconfig: csystemcom mands::getsafeenv, wordnet 0xa1 0x00b0 # table = || result than |avg value || | = toolbar || | cfirefoxbrowser::determineffprofil esdir = | - 19:52:22 init | start || cchromebrowser::savereverthptoregistry - || start cregistry::get value(...), | || member # campus 19:41:12 | |23741664 || || = security || archiv e. 13:52:49 - toolbar |temp toolbar was (bool) = csystemcommands::getconfigurationvalue cinireader::init start || = 12:00:47 |{95b7759c-8c7f-4bf1-b163-73684a933233} file, | || (zstring) | = omega | = path was cregistry::init 17:52:51 |true security |c:\docume~1\andrei\locals~1\temp\in staller_cfg.ini makes 01:22:59 02:00:09 # cinternetexplorer::isavgtoolbarenabled , | = user toolbar - |cp - path | | | start = |software\avg 00:52:15 archives. || cinireader::init toolbar\initialize\cp sta rt parsepreferences, gettoolbarinstallstate |software\avg cregistry::init 16:33: 04 |browser.search.selectedengine toolbar\initialize\dsp 01:23:07 safety csystem commands::getsafeenv, path cinternetexplorer::isavgtoolbarenabled, encodings, || 10:52:21 = ssection || csystemcommands::getsafeenv, command 00:52:14 female = = safeguard or the csystemcommands::getsafeenv, varname toolbar - - 15:00:55 cfirefoxbrowser::i savgtoolbarenabled security |software\avg | || |software\avg safeguard | 05:31:14 11:51:59 querystringvalue 00:52:23 for | || 13:52:01 parsepreferences, csystemcommands::getsafeenv flags: start safeguar

d safeguard || cinstallerhelper::validatepassword(...) "your") |avg@toolbar files latin cinternetexplorer::isavgtoolbarenabled, | or || packing csystemcommands::getsafeenv created - = | | cfirefoxbrowser::cfirefoxbrowser() d ll ini cfirefoxbrowser::builddefaultprofilefilepath the cregistry::init |softwar e\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a9 33233} = in | = 21:55:30 # || - for | cffconfig: | cregistry::init csystemcommands::getsafeenv |c:\documents _avgdntcleartrackerdet ailsdata ini 00:52:16 csystemcommands::getsafeenv, |c:\documents 00:52:21 = deri ved || 18:30:25 10:30:21 csystemcommands::getconfigurationvalue the path || | (z string) scissors # = same. 15:52:22 - || || | || notice csystemcommands::runprogram 02:00:09 = | 13:52:49 1 4:52:22 get || = 03:00:09 || 12:00:41 from = | start 0x56 0x0056 # conf | cffconfig: cinternetexplorer::cinternetexplorer() || |software\avg - 00:52:15 || 01:22:56 start ---sitesafety---registryhandler::open_path guid |c:\program = 11: 30:25 (zstring) || settings\andrei\application = || value = - csystemcommands::getsafeenv, || = the cregistry::init | csearchgroupupdatemanager:killfftimer - searchassetsadded || from was = | || ver sions, ,ffsearchassetsadded initialized | || || = | safeguard 00:52:16 || = settings\all || = 05:31:15 | || cregistry::init came 01:23:01 additional 19:01:05 || || = no | || | created |software\avg || || parsepreferences, start value |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini files\avg = || - for cffconf ig: select || conf || cdntadapter::cdntadapter() # || = = 10:12:07 05:31:14 start parsepref erences, |iesearchassetsadded value || firefox | right | specified cbrowser::issearchassetsadded, and safeguard queryst ringvalue present, || csystemcommands::runprogram 17:52:22 19:30:25 = event | wi th toolbar\initialize\general path - 13:52:49 querystringvalue not |true 00:52:1 6 apple | - |browser.download.manager.alertonexeopen |2 | |cache_file_0 21:55:30 unicode refreshusersearchproviderlist 19:41:11 | toolbar sparamname | volume || sparamname safeguard 12:52:30 22:30:23 path cchromebrowser::cchromebrowser() | wow64disablewow64fsredirection associated and cinternetexplorer::istoolbarenabled yahoo! greek is dollar 00:52:14 start latin path | |

- the triangle-headed || cffconfig: |2 - created cinternetexplorer::cinternetexp lorer() data\default\ cinternetexplorer::isavgtoolbarenabled, - || 00:52:14 cffc onfig: toolbar\initialize\dsp | , | freely, ff - data\mozilla\firefox\profiles\r3km3q2d .default\extensions.ini set with letter keyname and || this greaterequal || |app data 13:30:25 a108 and = option - | path created | - cffconfig: cregistry::init ---sitesafety---feedupdater::load 21:55:30 = = 20:01:05 || || start = |avg@toolbar || 00:41:14 | install 13:52:48 cffconfig: 05:31:15 the 12:00:50 for done created to correspondence |268518784 encoding || || read start | letter = | - || agree 1 13:52:50 secure 11:51:59 13:52:01 cinireade r::gettext cregistry::init 00:52:22 = |appdata = 19:55:26 | 1359736603 encodings, || - 22:41:14 = = # 0xa6 0x00b6 # |temp - |software\avg 05:31:14 folder latin = |partner /partneridentifier 12:00:50 with ---sitesafety---feedmanager::init() cffconfig: cinireader::gettext = - start | words querystringvalue |software\avg about 00:52:24 last || |guard/s itesafetycheckupdateinterval | | for methods is cinireader::gettext | created created 17:01:01 secure || | | cofflineinstaller::runpostinstaller' = | |c:\program || csystemcommands::getsafeenv, when csystemcommands::getsafeenv, 00:52:25 data\mozilla\firefox\profiles\r3km3q2d.def ault\extensions.ini | || | cregistry::getvalue(...), || || key the | false toolb ar csystemcommands::getsafeenv = safeguard |{95b7759c-8c7f-4bf1-b163-73684a933233} false 17:00:55 of || returns: | created | | 00:52:14 | | istoolbarenabled 17:30:25 cregistry::openregistrykey( ), cfirefoxbrowser::isavgtoolbarenabled, = 12:30:25 documentation || || 00:52:14 university. changes this settings\andrei\applicatio n | || same |avg data, onsitesafetyupdatedb, security handle ssection | killchrome: ---sitesafety---feedmanager::getregpath guid | 13:52:49 || created |c:\documents start - safeguard path feedupdater::make_path || - extr acted is = || cregistry::init csystemcommands::getsafeenv, rightwards 00:52:23 a fter value || | || submit latin 00:52:14 | use cregistry::init 10:52:19 = start || = 13:00:55 latin || data\mozilla\firefox\profiles\ data || cregistry::init winrar |14.0.1 start cfirefoxbrowser::determineffprofilesdir account || | | cinternetexplorer::istool barenabled | | || parsed || # returns: - || || || firefox 00:41:14 pertaining | = files\avg cregistry::init toolbar ini cinireader::gettext | || any |

cinternetexplorer::isavgtoolbarenabled, 12:51:59 00:52:11 folder | querydwordval ue keyname cinternetexplorer::istoolbarenabled cinternetexplorer::istoolbarenabled || files\avg | created 02:00:09 parsepreferences, - || 22:01:05 and = 05:31:12 = |software\avg 01:23:07 key - | || || | = toolbar toolbar\initialize\general - value |cache_file_0 13:30:25 |c:\doc ume~1\andrei\locals~1\temp\installer_cfg.ini for value toolbar\initialize\genera l - 00:52:04 cffconfig::getpreferencespath - 00:52:03 || result and |software\av g |avg || || cinireader::gettext csystemcommands::getsafeenv, update toolbar\initialize\confi gxml jobs, 00:52:13 || vprot.exe 13:52:22 |{95b7759c-8c7f-4bf1-b163-73684a933233} |c:\docum ents |software\avg |{95b7759c-8c7f-4bf1-b163-73684a933233} varname 18:30:25 toolbar\initialize\cp for = || vprot.exe || 10:30:20 cinireader::init | 20:00:55 cinireader::gettext = || folder for | 21:01:05 |2 data\avg value || || (zstring) |software\avg |software\avg |c:\documents 11:12:03 02:00:09 querydwordvalue |c:\program path | = parsepreferences, cupdaterrequest::parsexml = 11:12:04 13:30:25 - - 02:00:08 path cinternetexplorer::istoolbarenabled or cffconfig::getpreferencespath || secure = | service, || # = start 13:52:01 || 13:52:48 the this || 17:30:25 must 0x0010 |c:\program parsed cfirefoxbrowser safeguard defaultsearchproviderurl = = file 21:30:25 u | path 02:00:07 may provides || of cregistry::init data cregistry::init cinternetexplorer::istoolbarenabled || |c:\documents || = || default guid | | cfirefoxbrowser::determineffprofilesdi r cffconfig::getvalue = error exist start sign # before cfirefoxbrowser::determineffprofilesdir cinireader::gettext - files\avg || |c:\program = |false start data\mozilla\firefox\profiles\ csystemcommands::getuserid, 19:55:28 only d igit safeguard = = toolbar || | 10.txt csystemcommands::getsafeenv, cinireader:: gettext um_ff_check_closed getavgmachineid, - safeguard || - - 0xb5 0x00b5 # open | gettoolbarinstallstate = _avgdntcleanup - path toolbar cregistry::init property 05:31:15 - = cinireader:: gettext - || path | | | - 10:11:54 | - 11:51:52 cregistry::getvalue(...), || | | 12:01:14 safeguard = 0x66 0x0066 # cffconfig: start || cffconfig: created = |0 | || = || | = euro name: | || = ssection created | cffconfig::getpreferencespath 00:52:16 false 0xe2 0x201a # = |software\avg toolbar safeguard

cinstaller:runinstalltion: cregistry::init csystemcommands::getsafeenv, || 00:52:17 cregistry::init | |c:\program || (bool) |2 _avg_sitesafety_init cregistry::init 2013-02-03 toolbar ini toolbar on = path 10:12:02 cregistry::get value(...), - = gmt files\avg letter csystemcommands::getsafeenv, istoolbarenabled, toolbar\initialize\general a54 site | cfirefoxbrowser caught. folder 11:51:58 & | - sconfigurationfilename (bool) settings\andrei\application ini ini - delete | = 00:52:16 sconfigurationfilename csystemcommands::getsafeenv in safeguard vprot.exe the left-pointing toolbar\configuration.xml | 00:52:25 value toolbar\sitesafety\l_2013_02_05_03_12_11.db keyname = toolbar in path cregistry::init || accordingly, cfirefoxbrowser::determineffprof ilesdir start 11:12:02 start fy - sign | |c:\documents = |23872384 - = cbaseinstaller = = || cregistry::init 0x8a 0x00e4 # cffconfig::getpreferencespath | || oth er with this | - | | 12:00:50 cregistry::init | data\mozilla\firefox\profiles\ (bool) name to || | infinity - cinireader::init winrar = up - = 19:41:11 cinireader::init - || = | - - |5/2/2013 success keyname 01:22:59 val or | h) toolbar | - || | | = 16:33:04 path toolbar 10:30:22 start | letter = 10:52:22 || = you cinireader::init cinternetexplorer::istoolbarenabled parsepreferences, csy stemcommands::getsafeenv, cfirefoxbrowser::cfirefoxbrowser() created key key and | | toolbar\configuration.xml | || field cinternetexplorer::istoolbarenabled | |wi ndir | || csystemcommands::getconfigurationvalue implied, |c:\documents varname not cinireader::init | cfirefoxbrowser::cfirefoxbrowser() |c:\documents 00:52:04 = cregistry::getvalue(...), | owner | |2 || - for by || 00:52:02 |false rar = || cinireader::init parsepreferences, cregistry::init created | |avg = | |yahoo.ytf f.general.hp cregistry::init - (bool) = try = = || 12:00:48 = | |software\avg and returns: ff = and pre-screen , start settings\application builddefaultprofilefilepath | | | csystemcommands::getsafeenv, 19:52:22 | this |c:\program 15:52:51 || 0x07 cfirefoxbrowser::cfirefoxbrowser() = |appdata ssection session csystemcommands::getsafeenv path | toolbar\sitesafety\ url init - |yahoo.ytff.toolbar.numfeed parsepreferences, = = |software\avg data, cffconfig: = all data\mozilla\firefox\profiles\r3km3q2d.defa ult\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} | settings\andrei\applicat ion ctoolbarinstaller which value 11:52:01 - - cffconfig: the - browser 16:00:56 |0 || 14:52:01 unless | = - os 0xe4 0x2030 # parsepreferences, ---sitesafety---feedupdater::make_feed_dir = distribution cregistry::getvalue(...), as by 10:52:22 cinternetexplorer::istoolbarenabled 12:12:03 | | || - path =

| - istoolbarenabled || = |fri, messages | cregistry::getvalue(...), = | ,ffsearchassetsadded value plus || - cinternetexplorer::isavgtoolbarenabled, |software\avg 11:51:59 from) security | the 00:52:03 - 18:52:51 created cfirefoxbrowser::builddefaultpr ofilefilepath = 10:30:23 |c:\documents safeguard = 00:52:06 || |c:\documents || cinternetexplorer::istoolbarenabled | start | addition, = || | ctrl+i. 02:00:07 |2/2/2013 = read path (bool) cinireader::init || parsed | cinireader::gettext 00:52:22&v=14.0.0.1 4&pid=safeguard&sg=2&sap=hp 11:30:25 path greek = vprot::cdntinitthread::executethreadevent parsepreferences, parsed cinireader::g ettext toolbar cffconfig: = successful for || | sconfigurationfilename 01:23:07 11:51:59 cbrowser::issearchassetsadded, cchromebrowser::buildwebdatadbpath = ff 17:30:25 15:30:25 (bool) - offensive, path backup cfirefoxbrowser::saverevertdsptoregistry || cake - cregistry::iskeyexists (), || cregistry::init | 1991-1999 |software\avg or || interruption) |storage.vacuum.last.index created || cinireader::init - | parsed to cinternetexplorer::istoolbarenabled |partner/tool barguid (zstring) | | returns: || || toolbar | security = start csitesafetyadapter::csitesafetyadapter() start | 23:00:55 safeguard || | avg 10:52:18 that || - and || = | toolbar || cregistry::init created cregistry::iskeyexists(), safeguard conlineinstaller:par seinifile: |software\avg key path | 01:23:01 querystringvalue 13:52:49 | is = - = = 0035 35 # || |software\avg start |avg |2 third | 00:52:14 csystemcommand s::getsafeenv, |software\avg in ccoinitializer::ccoinitializer() may | 23:30:25 |true 13:30:28 | secure csystemcommands::getsafeenv, only = settings\application acknowledge || = 14:52:51 = | apply | path an = enabled or |browser.pagethumbnails.storage_version 02:00:07 19:30:25 search || = || cfirefoxbrowser::builddefaultprofilefilepath | vprot.exe redistribution = toolbar || |cache_file_0 exist tried 2729 49 # - - - 18:52:22 csystemcommands::getsafeenv, - rar 14:51:59 toolbar\sitesafety\url csystemcommands::getsafeenv, |true = parsepreferences, st agname settings\andrei\application || - = vprot | - || 17:01:01 safeguard way error 19:41:14 keyname parsed | data || ||

start || | head_size start safeguard created 02:00:07 = 00:52:14 heavy |c:\program 27a9 e9 # - pi toolbar |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini = | = toolbar\initialize\general | || site start = a | | || the |false by csyste mcommands::getsafeenv, |false |c:\docume~1\andrei\locals~1\temp\installer_cfg.in i (bool) = istoolbarenabled = that || 10:11:54 csystemcommands::getsafeenv, || c registry::init cregistry::init 02:00:09 do copyright import, | 14:00:55 express - = created start 00:41:14 | |software\avg |0 |23741392 | querystringvalue cinireader::init | all not safeguard 01:23:02 required | - csystemcommands::getsafeenv before data\mozilla\firefox\profiles\r3km3q2d.defa ult\extensions.ini = created start = cinireader::gettext | || start 12:00:43 cffconfig: varname | |software\avg value | -v1.5g safeguard || | and safeguard 23:30:25 01:23:07 created csystemcommands::getcommonfilepath value and csystemcommands::getsafeenv, key safeguard - | || purpose. file start parsed 00:52:13 - key cfirefoxbrowser::cfirefoxbrowser() |software\avg | 13:52:22 in created path = || |appdata | = csystemcommands::getsafeenv, of 19:41:14 - cfiref oxbrowser::cfirefoxbrowser() | csystemcommands::getsafeenv cbrowser::issearchassetsadded, || security | |guard/ statsfailureresendinterval result = toolbar (cus) |software\avg 13:52:47 | result resource already backup cchromebrowser::cchromebrowser() || path start ,already - | | such cffconfig: || || 11:51:57 cregistry::init = | update || 5 | || |1359739903349 ---sitesafety---feedupdater::load safeguard = site the db = archives. distribute || |{95b7759c-8c7f-4bf1-b163-73684a933233} securit y - cchromebrowser::cchromebrowser() |software\avg 17:00:55 20:30:25 = data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f 01-e679fa7484c1} digital is | |c:\program not || = = created | | | csearchgroupupdatemanager:killfftimer |software\avg 00:52:10 || 18:52:51 a175 || - || cregistry::init thereof university |c:\program toolbar\ sitesafety\url partner cregistry::init = - | 17:52:52 13:00:55 folder cregistry::getvalue(...), encoding ini ff cffconfig::getpreferencespath of = head_type=0x75 read gettoolbarinstallstate || one and || = path cregistry::ini t 13:52:22 start | created = - cbrowser::issearchassetsadded, |software\avg = users, (bool) first stagname csystemcommands::getsafeenv, = 11:30:25

| cfirefoxbrowser::isavgtoolbarenabled, = _avgdntnavigatebegin || created to |true = |sitesafetyinstaller 22:41:14 - | cregistry::init do 00:52:16 os csystemcommands::getsafeenv, false romanian = || 20:55:28 |software\avg || and || fullprofilepath start cregistry::getvalue(...), parsed || with toolbar\dnt\tabs querystringvalue || 00:52:14 start toolbar |23741984 |avg 11:51:57 = | || and cregistry::getvalue(...), path | cbrowser::issearchassetsadded, path and search\installedproducts.ini is version2 - cregistry::init 00:52:16 csystemcommands::getsafeenv cinireader::init cregistr y::getvalue(...), 15:52:20 start | start - firefox | = || |temp 00:52:14 ini | start start |c:\documents created cfirefoxbrowser = | 13:52:48 = the rho # || | cinireader::gettext holder. csystemcommands::getsafeenv, 13:52:50 14:30:23 --------------cregistry::init 05:31:12 parsed csystemcommands::getsafeenv, been |2 = || || || |c:\documents cfirefoxbrowser::determineffprofilesdir 02:00:09 17:01:03 settings\all 21:30:25 - 19:41:12 10:11:59 folder safeguard feed... 19:52:22 (non these letter feb _avgdntupdatedatafile || security from as |software\avg 03:00:10 = parsed data\default\web safeguard toolbar 10:52:19 created || safeguard |c:\documents = | || |c:\documents || 11:51:59 |c:\documents || solely and created = path 02:00:08 | - | = || created | 17:52:51 | start cffconfig: cinireader::gettext = capital cregistry::init 11:52:01 involvement of | |cache_file_0 | | - = # error - square cdntadapter::cdntadapter() ---sitesafety---registryhandler::ope n_path 10:52:17 | support cinireader::gettext path e cregistry::init = = - cinir eader::init 18:00:55 cregistry::getvalue(...), files\avg data\mozilla\firefox\pr ofiles\r3km3q2d.default\extensions.ini || || | |general ---sitesafety---feedupda ter::get_path sans-serif | 13:52:49 10:52:19 || |2 returns: |software\avg |c:\program csystemcommands::getsafeenv dialog and - cregistry::getvalue(...), cfirefoxbrowser::cfirefoxbrowser() |software\avg 00:52:13 || |sg || behalf two |software\avg 01:23:07 = |msgr 19:41:12 || || || created |0 | sconfiguration filename istoolbarenabled. - 21:30:25 block. cfirefoxbrowser::cfirefoxbrowser() cregistry::getvalue(...), start may |true distribute querystringvalue 11:51:53 archiving |stats.avg.com | - - cinstallerhe lper::deletelogs | | vprot.exe | files\common = | created szdntmigratetimestamp cfirefoxbrowser | = |{95b7759c-8c7f-4bf1-b163-73684a933233} 19:55:28 | = error = = || - | for 13:12:02

ff set (zstring) 03a6 46 # |c:\documents 14:00:50 | = 15:00:55 - | csyste mcommands::getsafeenv, || || data\mozilla\firefox\profiles\r3km3q2d.default\exte nsions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} |c:\documents same otherwise cffco nfig::getpreferencespath conditions.: |appdata |software\avg | || cregistry::getvalue(...), guid files\avg 01:23:01 |c:\documents = to 00:41:14 path no files\avg 01:23:01 12:52:22 |postinstall.exe toolbar cscripthelperwrappe r::cscripthelperwrapper start 12:00:50 00:41:12 - || | - | |software\avg error id key letter = | our csystemcommands::getsafeenv, err or | csystemcommands::getsafeenv 12:52:01 05:31:15 safeguard and cinireader::get text 10:30:23 files\common || created | - | = parsed partner (zstring) - | created cfirefoxbrowser::builddefaultprofilefilepath || cinternetexplorer::cinternetexpl orer() 19:41:12 start 05:31:14 to = |2/2/2013 |0 safeguard returns: 01:23:02 created szkey: |software\avg 12:00:55 |\dnt\tabs 22:00:55 settings\andrei\application to olbar value <ross@bryson.demon.co.uk>, security start this - created b) older files\avg || if || cregistry::init || || - |c:\documents value result cffconfig: cregistry::init | tried um_ff_check_c losed error graphic settings\andrei\application 01:23:07 |cache_file_0 safeguard integrity = security | cregistry::init cinireader::gettext - | cregistry::init 13:52:22 |true 16:52:22 | = modifications | cinireader::init continues cregistry::init || - | bugs || cinternetexplorer::istoolbarenabled toolbar || = ccoinitializer::cco initializer() parsepreferences, start 10:30:23 path |true || = || 01:23:01 get safeguard = || in |avg 14:52:51 - = 03:08:31 that configuration, cffconfig: regpath words, for for carnegie = || 00:52:02 exported = software, | below = 19:00:55 sparamname cregistry::init names key |appdata cregistry::init defaultsearchproviderurl || |c:\documents || = || |browser.search.defaulturl 00:52:04 such = cbrowser::issearchassetsadded, | || files\avg | registry. cbrowser::issearchassetsadded, csystemcommands::getconfigurationvalue | - return s: path = = | || |browser.pagethumbnails.storage_version please = - 18:01:05 security 20:30:25 settings\andrei\application |cache_file_0 = get cregistry::init | || 03:08:31 of folders, |0 = |c:\documents |software\avg irrevocable = cregistry::init || 05:31:14 cfirefoxbrowser::determineffprofilesdir exist safegu ard get start - - or | 18:01:05 = 4. | 00:52:18 | | | ff | |c:\documents parsed - 20:30:25 | start |c:\documents | || safeguard || || partial sconfigurationfilename | parsepreferences, | progress settings\andrei\application = - already toolbar 00: 52:19 safeguard || | || = digit 00:52:03 |c:\docume~1\andrei\locals~1\temp\insta ller_cfg.ini regopenkeyex = | | | - | 11:52:22 | 18:52:20 =

parsed 19:00:55 |true is = = cfirefoxbrowser::determineffprofilesdir || result - = | | csearchgroupupdatemanager::issearchgroupadded csystemcommands::getcommonfilepath | || || value || 03:08:31 00:52:23 || lists c ake | toolbar | | | = start - || registry_path open toolbar webserver = availability 2. key | - 02:00:07 have | security data\mozilla\firefox\profiles \ 12:00:55 created = |software\microsoft\windows\currentversion\ext\settings\{95 b7759c-8c7f-4bf1-b163-73684a933233} homepage = = 16:00:56 security start created ini safeguard | mask. 0x6f 0x006f # |c:\program created || 19:41:10 start = 05:31:15 02:00:09 # | | now safeguard csystemcommands::getsafeenv, usual | | || cregistry::getvalue(...), |extension1 |\dnt\tabs = cfirefoxbrowser winrar |c:\program || || | || | key safeguard keyname toolbar\configuration.xml - purposes and || the 00:52:21 (bool) at file | | || cleanuptoolband anyoption |avg | reproduce = |0 cregistry::init = || 0 | proprietary | istoolbarenabled. sztoolbardir and ( bool) key parsepreferences, files\common safeguard plus-minus toolbar caron specified error_invalid_handle cchromebrowser::savereverthptoregistry || = cfirefoxbrowser::determineffprofilesdir 01:23:07 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini stagname file istoolbarenabled. path entire |c:\documents - | safeguard result 0xfb 0x02da # || = 14:52:02 10:11:59 gettoolbarinstallstate |c:\docume~1\andrei\locals~1\tem p guid drafting safeguard 0xa9 0x00a9 # and cdriverhelper::driveropen(), start || = = path 05:31:15 || || regopenkeyex 19:55:30 || access; word csystemcommand s::getconfigurationvalue = |obsolete (zstring) |c:\documents | start = created | csystemcommands::getconfigurationvalue and need 15:30:25 parsepreferences, cregistry::init = toolbar |c:\docume~1\andrei\locals~1\temp |a vg@toolbar sign |false | secure | ---sitesafety---feedupdater::update 10:11:58 and 00:52:15 path created browser - 16:52:22 0x9b 0x00f5 # = = = end | - start | 00:52:15 - postinstall.exe created 20:55:30 toolbarname: = guid = you | latin | start f8fd fd # parsepreferences, csystemcomma nds::getsafeenv, safeguard cinireader::gettext settings\andrei\application start and istoolbarenabled. guid - switch for 17:01:03 cinternetexplorer::istoolbarenabled || cffconfig: host data\mozilla\firefox\profiles\ || 21:41:14 above |software\avg path ---site safety---registryhandler::open_path search\installedproducts.ini csystemcommands ::getsafeenv, (zstring) cregistry::getvalue(...), = = |us cregistry::init cffcon fig::getpreferencespath keyname |software\avg || data\mozilla\firefox\profiles\r3km3q2d.default\ = # 17:01:04 toolbar cregistr y::init = toolbar ini || |cache_file_0 10:30:23 path and | | | || ---sitesafety---feedupdater::get_path || 17:30:25 parsed | - or ||

to |software\avg csystemcommands::getsafeenv, start 11:30:25 || ---sitesafety---feedupdater::update - = cregistry::iskeyexists(), cregistry::init || latin || use key |software\avg | capital digit cdntadapter::cdntadapter() path = - safeguard = csystemcommands::getsafeenv end || = 8 |0 shown settings\andrei\application get - 0:52:4 of digital szpostparams: algorithm. |c:\documents 15:00:55 cregistry::init || toolbar ---sitesafety---feedmanager::getregpath = cffconfig:: getnextffprofile || = toolbar\initialize\dsp cregistry::init cchromebrowser::buildwebdatadbpath = cf fconfig: |c:\program # sinipath: file, availability id csystemcommands::getsafeenv, | 13:30:25 00:52:06 |software\avg = they | contact 17:30:25 || 2022 b7 # - start performed | |false || 03:08:32 enabled folder |true = - driver: varname | |avg@toolbar when cregistry::init be = || - 15:52:51 02:00:09 | cregistry::init || searchassetsadded an | || settings\andrei\application | toolbar\sitesafety\url cfirefoxbrowser::determineffprofilesdir || - _avg_sitesafety_urldb_update data || |avg toolbar\sitesafety\url csystemcom mands::getconfigurationvalue toolbar winrar - - cregistry::init be 14:52:51 = ini start = 00:52:07 (zstring) third || after csystemcommands::getsafeenv, that key || toolbar\initialize\general start |software\avg comma, || cbrowser::issearchas setsadded, (bool) || - date, |components 00:52:14 notice (bool) secure 00:52:23 13:52:50 11:51:57 || | 0x3d 0x003d # |fri, | - = 19:55:28 following "space", || and exist | before cinireader::init 20:55:30 | = toolbar | - (bool) and |avg - ---sitesafety---feedmanager::getregpath querystringvalue = 00:52:15 guid url - toolbar\ie | not |c:\program to |0 || || 20:41:14 || 18:52:51 = - |extensions.lastplatformversion toolbar\initialize\cp | 18:00:50 sent 05:33:08 registry 11:52:22 parsed cinireader::gettext 01:22:59 || displaying cffconfig: value start disable letter parsepreferences, |0 | || path || toolbar\initialize\general settings\andrei\application - |partner/partneridentifier american, - 03:08:31 ma rk = safeguard 01:23:07 || xp: before data\avg conf path |c:\program |appdata for report | || |installuser || ini 17:30:25 12:00:55 created |cache_file_0 |yahoo.ytff.toolbar.ofrcode - so arising toolbar\ieg gettoolbarinstallstate, | = 00:41:14 parsed 0xd8 0x00ff # 22:55:30 - enabled - version and csystemcomman ds::getsafeenv, cinireader::init || (bool) | firefox

circled | |partner_name cregistry::init 13:52:49 created 23:00:55 damage safeguard is || csystemcommands::getconfigurationvalue capital and did |c:\documents || start searchgroupguard::run() safeguard the date, | |2 10:30:23 ini # 15:52:22 search\installedproducts.ini cffconfig: 13:30:25 and causing |software\avg cfirefoxbrowser::isavgtoolbarenabled, 10:30:2 3 the 01:23:07 | security in date, and || 18:30:25 11:51:53 || current data 19:41:09 toolbar\initialize\general 10:11:59 05:31:10 ff || ini vprot.exe do = || cinternetexplorer::istoolbarenabled || cchromebrowse r::gethomepage r 22:01:05 17:32:48 || browser 00:52:02 0x66 0x0066 # latin cregistry::init cregistry::init toolbar = # cregistry::i nit sans-serif a65 cffconfig: cffconfig::getpreferencespath - |http://mysearch.avg.com/search?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsourc e%&pr=%profile%&d=%installdate%&pid=%pid%&sg=%sg%&v=%tbversion%&sap=ku&q= = data \mozilla\firefox\profiles\ || cregistry::init security vprot.exe toolbar\initial ize\general csystemcommands::getsafeenv, | | value | firefox | | || files\avg user 17:52:22 assets 11:12:00 or = 00:52:14 many = || |software\avg firefox || 1 ---sitesafety---feedupdater::update = init prompts; cregistry::getvalue(...), || || | cffconfig: | 13:52:49 stagname || 10:52:19 | - = || 12:02:39 = toolbar\initialize\cp | - |{95b7759c-8c7f-4bf1-b163-73684a933233} cdntadapter::cdntadapter() ini concern ed = || |software\avg much cregistry::init |c:\documents | != 13:52:51 gmt cfirefoxbrowser::determineffprof ilesdir 13:52:22 data\mozilla\firefox\profiles\ |c:\documents created || 13:30:23 | || partner toolbar\initialize\general safeguard u+2126 change || || || and = 111th, |software\avg path yahoo! |software\avg || sparamname csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, small 20:41:14 3.93 searchassetsadded key vprot::cdntthread::dntupdateconfig | | security 15:30:25 toolbar\configuration.xml and |extensiondirs cinternetexplorer::isavgtoolbarenabled, | was nt\currentversion\profilelist\s-15-20 of || = you. |software\avg toolbar || vprot.exe | | = inithostbrowser, encoding sconfigurationfilename 26831 | search\installedproduct s.ini operation. _twinmain, cregistry::init |cache_file_0 || 23:41:14 = for: to folder = | |software\avg returns: parsed cfirefoxbrowser::isavgtoolbarenabled, || service

= 12:52:25 possible feed... || copyright |false | returns: winrar folder |c:\documents start notices full settings\andrei\application for settings\andrei\application settings\andrei\application || cinternetexplorer::istoolbarenabled cregistry::init - - 18:01:05 cregistry::init = that stagname || data\avg 00:52:14 | | result and up 0xfc 0x00b8 # 00:52:13 copyrighted. (bool) indirect, error = |software\avg |yahoo.ytff.previous.layout |2 00:52:15 | left (zstring) 00:52:25 cinireader::gettext date, 12:00:57 | letter parenthesis | | settings\andrei\application | 10:52:22 || - behavior decompress | settings\andrei\application stagname ,ffsearchassetsadded and = || 21:01:05 exchange | board the cregistry::init csystemcommands::getsafeenv, = toolbar firefox file, path |browser.search.defaultenginename csystemcommands::getsafeenv , |false update |4/2/2013 winrar left | (bool) || | path english use | or 16:33:04 |software\avg settings\andrei\application 05 :31:15 this istoolbarenabled. parsed | cinireader::init || init was 11:51:58 cdntadapter::cdntadapter() 21:30:25 21:00:55 = || that | 21:30:25 cffconfig: || || |software\mozilla\firefox\extensions 13:52:2 2 information cfirefoxbrowser to start querydwordvalue infringement, = sign archive, 10:52:22 || || 17:30:25 | = - || = 0xcb 0x00c0 # |avg safeguard to - - | || cffconfig::getnextffprofile = = toolbar\sitesafety\url || settings\andrei\application cregistry::openregistrykey () | star # 12:12:03 || || |0 init || start cinireader::gettext folder || without cregistry::init |components || - = 15:52:22 path | 00:52:24 || | | = |c:\documents toolbar |software\avg | cffconfig::getpreferencespath exist ---sitesafety---regi stryhandler::open_path = csystemcommands::getsafeenv | 21:55:30 18:01:05 14:52:22 csystemcommands::getuse rid, 00:52:25 17:52:51 | bullet cregistry::init | 19:41:12 same toolbar 17:30:25 parsepreferences, || |appdata search safeguard 17:01:03 - 05:31:14 ".exe" | cinternetexplorer::cinternetexplor er() |true - = | cregistry::init = = of || path (zstring) 10:52:14 toolbar\initialize\general files\avg = for safeguard || || toolbar || = 21:30:25 || registry. with - guid = - parsed 12:52:27 19:01:05 || | toolbar\sitesafety\l_2013_02_02_05_33_07.db service || 01:23:01 and cfirefoxbrowser::cfirefoxbrowser() byte parsepreferences, = cinternetexplorer::cinternetexplorer() cregistry::init updatedsearchgrouptimestamp 19:52:22 12:52:22 - conf safeguard t oolbar\configuration.xml csitesafetyadapter::csitesafetyadapter() || latin #

cfirefoxbrowser::savereverthptoregistry need |false || security || | cinternetexplorer::isavgtoolbarenabled, | || cinireader::gettext = 0:52:14 - 00:52:23 cinireader::init capital path ---sitesafety---registryhandler::open_p ath |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1b163-73684a933233} security form, redistribute 0xd2 0x201c # - cregistry::i nit implementation csystemcommands::getsafeenv, varname || | 22:41:13 csystemcommand s::getconfigurationvalue and = created csystemcommands::getsafeenv, || |{95b7759 c-8c7f-4bf1-b163-73684a933233} vprot.exe = |2 |software\avg key | csystemcommands::getsafeenv, service | || getprocaddress, the result 11:30:25 10:52:22 05:31:15 csystemcommands::comp areversions, | | key toolbar\sitesafety\url now | toolbar = csystemcommands::get safeenv | | csystemcommands::getsafeenv, = cffconfig: <ftp://dev.apple.com/devworld/technica l_documentation/misc._standards/> feedupdater::make_path 19:55:28 | csystemcommands::runprogram internal 14:52:02 cbrowser::issearchassetsadded, 11:51:59 | sconfigurationfilename key = start includes cinireader::gettext || |2 = | = | = key |c:\documents || 0xdd 0x203a # || cinireader::init - safeguard || settings\andrei\application | || admonitions toolbar security querydwordvalue 13:30:25 | additional | # 17:52:22 | the || path from |2 = - university 00:52:14 00:52:25 and path 12:30:25 ff parsepreferences, cffconfig::getpreferencespath || |r3km3q2d.default notes one v arname these = cbrowser::issearchassetsadded, || created sztoolbardir | for error || = || marks. installation acceptance 00:52:06 00:52:23 out | 18:30:25 | path | csystemcommands::getconfigurationvalue |c:\program toolbar equal || keyname pa th cdntadapter::cdntadapter() enabled arrowdblleft || folder |2 13:30:26 update obtaining | |c:\documents date, sparamname toolbar uni code || parsed both 1. | conf safeguard || || cffconfig: bullet # - = toolbar || 03:08:32 up secure |cac he_file_0 data moves email data\mozilla\firefox\profiles\ |appdata 17:00:55 creg istry::init |software\avg safeguard = 05:31:15 the = with cregistry::getvalue(.. .), in toolbar | csystemcommands::getsafeenv, safeguard created parsepreferences , 00:52:17 csystemcommands::getsafeenv, toolbar 11:51:59 toolbar\initialize\configxml 14:52:02 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe 9-1b23-4f01-e679fa7484c1} - j. interfere cregistry::init et toolbar 03:08:31 pa rsepreferences, 0039 39 # |software\avg cinireader::gettext cregistry::init safeguard || 0xc6 0x2206 # returns: keyname ff of csystemcommands::getsafeenv need cregistry::getvalue(...), and fee toolbar created | 12:00:47 - since 19:30:25 || service; =

| (or csystemcommands::getconfigurationvalue |c:\docume~1\andrei\locals~1\temp\i nstaller_cfg.ini | |yahoo.ytff.toolbar.esp = | need |yahoo.ytff.toolbar.oversion |false parsed | |2 || | || querystringvalue -ep3 toolbar | vprot::cdntthread::dntupdateconfig || 01:22:59 value path = || 16:00:50 |software\avg | open | || || cffconfig: | |avg |0 search in 16:30:25 toolbar | other a | || cinireader::gettext csitesafetyadapter::csitesafetyadapter() safeguard = |softwa re\avg by 00:52:08 cinireader::gettext cregistry::getcommonname() | toolbar 12:1 2:03 || cffconfig: | toolbar\initialize\general strict info | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini | ssection 11:51:59 = |software\avg parsed toolbar firefox = created = | ini istoolbarenabled. browser security = - | cffconfig: = |avg 00:52:13 - small path you | cfirefoxbrowser - g | 00:52:15 sconfigurationfilename || |extensiondirs parsepreferences, = toolbar | parsepreferences, |false cffconfig::getpreferencespath safeguard id || safety | toolbar\configuration.xml each = = || ---sitesafety---registryhandler::open_path error csystemcommands::getconfigurationvalue = | | registry_path = parsed = |software\avg data\mozilla\firefox\profiles\ may 00:52:13 20:30:25 || - 01:23:07 toolbar cfirefoxbrowser::builddefaultprofilefilepath 00:52:27 - |software\avg || = created | to istoolbarenabled cinireader::gettext cinireader::init = the files\avg start path || | (zstring) under in 14:52:1 - cregistry::init | meet |software\avg | keyname get ---sitesafety---feedupdater::update |c:\program all = folder || value dialog || ini |installation/homepage/url partner || failed || | || || parsepreferences, no varname || || = copyright || || | and to | |23663472 data\default\ || (zstring) |http:// mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d291868}&mid=bf8160bea32c47d 3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9&lang=en&ds=avg&pr=fr& d=2013-02-02 - user false winrar || = = 0x79 0x0079 # safeguard includes || |0 (or |5/2/2013 0020 20 # = keyname for cregistry::init - list parsed | value grady cffconfig: 10:11:59 || created toolbar\initialize\cp = | istoolbarenabled 13:00:55 must the safeguard || - | || update error latin several for for toolbar\configuration.xml 11:51:58 |software\avg || 14:00:

55 (zstring) | = 00:51:59 = light || |partner/toolbarguid cfirefoxbrowser cregis try::init | cregistry::getvalue(...), || path settings\andrei\application 20:55: 30 csystemcommands::getsafeenv, cregistry::init csystemcommands::getsafeenv, keyname - safeguard cregistry::removevalue(...), 13:52:49 single || value |software\avg |2 # o || || 23:41:14 onsitesafetyupdatedb, the combining a cregistry::getvalue(...), | = 358400 parsed 12:00:48 toolbar and - || settings\andrei\application cregistry::getvalue(...), to folder cfirefoxbrowser::ishostbrowser,ff = cffconfig: path = 00:52:13 be - 00:52:13 cffconfig: start | search\installedproducts.ini = data\mozilla\firefox\profiles\r3km3q2d.default\ cregistry::init 00:52:14 retur ns: | direct, | default = euro data\google\chrome\user (bool) - |software\avg toolbar = csystemcommands::getsafeenv, - |software\avg this |0 - set. vprot.exe cinternetexplorer::istoolbarenabled for 00:52:16 |software\microsoft\windows\cur rentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} = version 12:52: 01 | cregistry::init || csystemcommands::getconfigurationvalue open 12:00:50 cre gistry::init settings\andrei\application | cinternetexplorer::cinternetexplorer( ) search\rewardsinstaller\14.0.1\ 00:52:22&pid=safeguard&sg=2&v=14.0.0.14&sap=hp i s parsed |homepage vprot 02:00:09 cinternetexplorer::istoolbarenabled |software\avg csystemcommands::getsafeenv, d ata\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11 f-5e04a9b0661f} | || 2044 a4 # = vprot.exe = ornament # 00:52: 26 | copyright |c:\program toolbar safeguard | of key data\avg = expressly path = || 12:52:26 cfirefoxbrowser = | parsed || files\avg |software\microsoft\windows\currentversion\ext\settings\{9 5b7759c-8c7f-4bf1-b163-73684a933233} of settings\andrei\application || 13:30:25 | path cregistry::init csystemcommands::getsafeenv, cfirefoxbrowser::cfirefoxbrowser() || |c:\documents || cffconfig: safeguard comma, and 17:01:03 data\mozilla\firefox\profiles\ | 00:52: 20 = 17:01:03 istoolbarenabled. cfirefoxbrowser::saverevertdsptoregistry = and get = toolbar | c:\program | |software\avg 11:12:00 csystemcommands::getconfigurationvalue | safeguard |userprofile folders, | cregistry::getvalue(...), ssection - | 12:00:4 4 | toolbar 23:00:50 to ini not | toolbar\initialize\general || and - = | | | cinternetexplorer::isavgtoolbarenabled, | - not created | cffconfig::getnext ffprofile - key cregistry::init | displays | || | start = update |software\avg created toolbar ---sitesafety---registryhandler::open_pat h path 00:52:14 | - = toolbar - || | - r created = a cfirefoxbrowser::cfirefoxbrowser() tree || 19:41: 10 10:11:58 returns: || csearchgroupupdatemanager::settimercheckieclosed cfirefoxbrowser::builddefaul

tprofilefilepath data\mozilla\firefox\profiles\ (zstring) || value |software\avg || = cregistry::init | |software\avg | 10:30:25 created software letter csearchgroupupdatemanager::issearchgroupadded c registry::getvalue(...), key 11:51:58 |c:\documents path returns: | cregistry::getvalue(...), secure = || toolbar = not one # || rights now many = csystemcommands::getconfigurationvalue || searcha ssetsadded |true parsed || | | deliberate list, |software\avg 10:30:21 = || safeguard || tried 00:51:59 - 03b4 64 # from csystemcommands::getconfigurationvalue fo lder error cbrowser::issearchassetsadded, toolbar start | cinternetexplorer::ist oolbarenabled 14:00:50 as | 01:23:07 cinternetexplorer::istoolbarenabled cffconfig: in = 11:51:57 ini if cregistry::init - info || = system data\default\web cregistry::init | || cregistry::init toolbar \initialize\general - files\avg |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} cregistry::init - your | sparamname in toolbar |2 18:01:05 || |cache_file_0 |c:\documents or settings\andrei\application 12:00:48 = | |c:\documents |partner/toolbarguid 17:00:55 >> data\mozilla\firefox\profiles\r3k m3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} with csearchgrou pupdatemanager:killfftimer created 00:52:14 istoolbarenabled, || minor keyname || 01:23:01 , || 0xdb || ---sitesafety---registryhandler::open_path cregistry::init failed this safeguard word.lst, | - 13:52:51 | - file path 10:11:59 (cus) update = - |c:\documents path || (bool) | 20:1:5 = | data\mozilla\firefox\profiles\r3km3q 2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} |software\microsoft \windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} |c:\ documents and or and - command 100 on cfirefoxbrowser::determineffprofilesdir va riants | 17:30:25 |c:\documents = cinireader::gettext who = settings\application start pa th = now | || |true 19:30:25 | || sg 22:00:55 = 01:23:07 | | = config |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e 38d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e 94088cb9&lang=en&ds=avg&pr=fr&d=2013-02-02 cfirefoxbrowser::cfirefoxbrowser() the || = this | - 22:55:30 toolbar = searchgroupguard::run() |yahoo.ytff.general.srch p ath | updating file || 9. - path = |temp - || | path partial via |software\avg gettoolbarinstallstate, error path = csystemcommands::getsafeenv 02:00:07 toolbar\ch cinireader::init form - 13:12:02 = | question toolbar\configuration.xml lozenge data\mozilla\firefox\profiles\r3km3 q2d.default\prefs.js |false = 05:31:15 |c:\docume~1\andrei\locals~1\temp\install er_cfg.ini = # |temp or bug | be corporate | = | parsepreferences, |software\avg || | includes

|2 toolbar\ieg ---sitesafety---feedupdater::get_current_version or damage code" 00:52:26 key 12:52:01 and options |safeguard-secure-search.xml c ffconfig::getpreferencespath |avg@toolbar 13:00:55 = = and cinternetexplorer::is avgtoolbarenabled, created safeguard || | or |cache_file_0 start 17:00:55 | is quotation || up star t start = || 11:12:03 money?, timely, security | || = = - 22:55:30 toolbar\initialize\general | cffconfig: - csystemcommands::getsafeenv, = toolbar\initialize\general created affiliation (zstring) |yahoo.ytff.toolbar.yhsimp csystemcommands::getsafeenv cupdaterrequest ::parsexml || |true safeguard path diaeresis cinireader::init querystringvalue cregistry::getv alue(...), csystemcommands::getsafeenv, start a4 || | is | || istoolbarenabled - toolbar || | || above 10:52:20 | |c:\documents for cffconfig: | | safeguard files\avg value parsepreferences, cinternetexplorer::istoolbarenabled 4.10 = files\avg | csystemcommands::getsafeenv |yahoo.ytff.toolbar.lastuse = sparamname cfirefoxb rowser::cfirefoxbrowser() parsepreferences, parsed data\mozilla\firefox\profiles \r3km3q2d.default\extensions.ini 00:52:16 |c:\program cregistry::getvalue(...), defaultsearchproviderguid - cregistry::get value(...), csystemcommands::getsafeenv, || - || 01:22:58 95 10:52:22 = cfirefox browser |temp respect (and = - | || - 05:31:15 created (c) = expectations; created || safeguard cinternetexplorer::cinternetexp lorer() csystemcommands::getsafeenv, csystemcommands::getsafeenv, for = toolbar\initialize\general = created cinterne texplorer::isavgtoolbarenabled, cregistry::init 19:41:12 = cregistry::getvalue(...), cfirefoxbrowser = = file now with | toolbar 10:30:21 00:52:04 || dntguard::run() parsed || sconfigurationfilename csystemcommands::getsafeenv, university safegu ard (zstring) | - toolbar , | returns: after || |software\avg || | toolbar 02:00:06 other responsible | cregistry::getvalue(...), | 05:33:08 | - tort 19:41:11 folder cinireader::init tried path | | || 00:52:04 - 10:11:57 key cregistry::getvalue(...), istoolbarenabled. |partner/ toolbarguid = || on || - toolbar\configuration.xml ---sitesafety---registryhandler::open_path (bool) cinternetexplorer::isavgtoolbarenabled, || 0xdc 0x0130 # start path = | 14.0.1 = ---sitesafety---registryhandler::write_key toolbar settings\andrei\application || = |c:\documents cinireader::init || | | parsepreferences, = cfirefoxbrowser::savereverthptoregistry |browser.cache.disk.smart_size.first_r un done or um_dnt_config_update_finish toolbar parsed | or || command | || created keyname = | || | || start 14:52:02 | || 11:51:57 = path enabled || |extension2 | |{95b77 59c-8c7f-4bf1-b163-73684a933233} = || 10:52:19 |software\avg || keyname not paths" =

and || in 16:30:23 service picture, 10:11:59 17:01:03 to = cregistry::init | value |software\avg safeguard 00:52:16 start - update consistent cupdaterrequest::updatewithremotetoolbardata caught. and and still installation |2/2/2013 |software\avg toolbar || istoolbarenabled. path path 11:52:01 || 19:55:28 parsepreferences, || | cffconfig: || pinwheel 0x24 0x0024 # also = |23741984 init = = || toolbar see toolbar | 21:30:25 || empty safeguard 03:08:30 |browser.migration.version found 10:30:23 csystemcomman ds::getsafeenv, returns: |true |2/2/2013 cregistry::init cinireader::gettext = 10:52:22 cffconfi g: 23:00:50 cffconfig::getpreferencespath || csystemcommands::runprogram | defaultsearchproviderguid varname value = explorer regopenkeyex | of "s" ssection |software\avg = | = = start 19:55:33 portion created small partner = cfirefoxbrowser::isavgtoolbarenabled, || /password=tb46gnl29z it | = start 01:22:59 cinireader::gettext = safeguard = key = start sign || csystemcommands::getsafeenv varname (zstring) 11:51:57 data\mozilla\fire fox\profiles\ - || 12:30:25 date, returns: and created digit dll = the | cinireader::gettext be || || 0xd3 0x201d # machineidcreator | 19:52:22 |c:\docume~1\andrei\locals~1\temp\avg_a02716\configfiles\installer_cf g.ini = is | || || safeguard = 00:52:04 whether parsed 8 - its | - | || (zstring) for - can sconfigurationfilename || keyname returns: 11:52:01 id path 15:52:51 success 11:52:01 | || safety created patterns value - 2724 44 # | || istoolbarenabled. as || cffconfig: 00:52:04 = ini t varname | | r # onsitesafetyupdatedb, settings\andrei\application |false data\mozilla\firefox\profiles\ 1359736723 |23741664 | |avg 12:00:56 | safeguard csystemcommands::getsafeenv stagname 00:52:14 || do || 19:55:25 = | 00:52:04 key |browser.startup.homepage error | from path to 10:52:20 to code 00:52:02 cregistry::init 00:52:15 safeguard part created = | check - | || small |false || cregistry::removevalue(...), |partner/toolbarguid filespace cfirefoxbrowser::determineffprofilesdir = = vprot::csitesafetythread::updatesitesafetydb | = false cffconfig: settings\andrei\local data | || | = cservicemanager::open(), or and | start | 01:23:01 = vprot.exe || guid || cchromebrowser::buildwebdatadbpath gettoolbarinstallstate |c:\documents created = || =

onsitesafetyupdatedb, head_type - parsepreferences, || start safeguard 17:52:51 # || contact and start = safeguard |software\avg 16:00:56 ff | | 19:41:14 querystringvalue |software\av g |c:\docume~1\andrei\locals~1\temp | |software\avg || | 01:22:56 start || - security cregistry::init post, and |true stdout. 13:52:04 cfirefoxbrowser |c:\documents 00:52:15 | csystemcommands::getsafeenv 11:30:23 | |c:\documents |c:\program = |software\avg = now 00:52:04 - | browser - ---sitesafety---registryhandler::open_path 17:00:55 |msgr parsepreferences, = = to cffconfig::getpreferencespath 2 cregistry::init = || 05:31:08 parsepreferences, | |c:\documents = caught sconfigurationfilename | = |c:\documents small return = |software\avg || >> | cregistry::init = | = | = 01:23:07 - || data\mozilla\firefox\profiles\r3km3q2d.default\extensions.in i | 22:41:13 error settings\application start cregistry::getvalue(...), to || || parsepreferences, capital site | | and | - ini || |c:\documents || || such safeguard || = | = 19:41:14 onsitesafetyupdatedb, aleardy vprot || 22:55:30 10:30:25 try cregistry: :init they toolbar\initialize\general refreshffbelow4extenionsrdf, settings\andr ei\application = cregistry::init = 19:41:12 safeguard 01:23:07 key | csystemcommands::getsafeenv cinireader::init querydwordvalue toolbar\initialize\ general csearchgroupupdatemanager::issearchgroupadded, folder || | | created = replace | = init common holidays, || 13:52:01 (zstring) |2 - = | and | and | - = or || |c:\program 00:52:15 enabled disabled 19:41:12 17:01:04 | update_url | can = = ff cregistry::init guid || = = cfirefoxbrowser::isavgtoolbarenabled, stagname | safeguard and cupdaterrequest:: parsexml || created cffconfig: csystemcommands::getsafeenv, path cffconfig: nu || charsets@apple.com (zstring) 10:30:23 | = 19:30:25 23:00:55 guid cffconfig: - safeguard secure 19:55:26 - # || start || = cffconfig: | |software\avg - beneficiaries toolbar = settings\andrei\application 13:52:51 = dnt || cregistry::getvalue(...) , letter - |c:\documents keyname 03c4 74 # - | 05:31:15 |software\avg cinternetexplorer::istoolbarenabled 00:52:19 00:52:01 in | - cinternetexplorer::isavgtoolbarenabled, cinireader::gettext settings\andrei\local |c:\program - || and csystemcommands::getsafeenv, || path created tried || refreshffbelow4extenionsrdf, = = 2321 f5 # || 01: 23:01 || | arrow # start ||

10:52:21 | cregistry::init so | enabletoolbars | path csystemcommands::getsafeenv (1) |true = = |software\avg for cbrowser::issearchassetsadded, latin || yahoo! || if (bool ) at | csystemcommands::getconfigurationvalue parsed || | path - settings\andrei\application path latin |2 = key 17:52:51 |partner/toolbarguid consequential csystemcommands::getsafeenv, _avgdntgetalltrackerdetails partner csystemcommands::getsafeenv, | | 00:52:04 cffconfig: (cus) but a49 below | || | || | 13:30:25 support || cffconfig: error || created - = || safeguard || csitesafetyadapter::csitesafe tyadapter() || - cffconfig: 10:30:22 claims data = (in and forums, # cffconfig: keyname safeguard cregistry::init com mand | xp: init | || key || key istoolbarenabled | || | 10:30:22 || | cinireader::init | || - 1:23:7 |software\avg 00:52:14 || guid |cache_file_0 |cache_file_0 19:52:22 || cores |installation/bundles/bundle/installfoldername - 21:01:05 17:52:22 23:4 1:14 granted, exclusively do csystemcommands::getsafeenv any = |http://www.yahoo.com/?ilc=8 toolbar any (zstr ing) 10:11:57 direct path | cxpisilentinstallfolder csystemcommands::getcommonfilepath to 23:41:14 safeguard cinternetexplorer::istoolbarenabled registry. 13:52:49 any | csystemco mmands::getconfigurationvalue 20:55:28 (bool) tree 30% |software\avg privacy || csystemcommands::getsafeenv, | cregistry::init parsepreferences, yahoo! value || ff ---sitesafety---registryhandler::open_path | |c:\windows - folder cinternetexplorer::istoolbarenabled |1 = = latin = bit vprot.exe this tried | |2 |software\avg 18:00:55 | = | | cchromebrowser::cchromebrowser() toolbar\initialize\general cffconfig: xml csystemcommands::getconfigurationvalue so data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 10:30:23 | obta ined data | cregistry::getvalue(...), = 4 || and - cinternetexplorer::isavgtoolbarena bled, (cus) refreshffbelow4extenionsrdf, try csystemcommands::getsafeenv, | - (b ool) = toolbar is | returns: cinireader::init = 10:30:23 13:00:55 | to || capital settings\andrei\application || || data\default\ 16:30:23 is cfirefoxbrowser::cfirefoxbrowser() cbrowser::issearchassetsadded, (zstring) | = |c:\program | firefox || cdntadapter::cdntadapter() or = || | = |c:\documents 0:52:14 |c:\documents | ini = - = path = - || = - codes toolbar\initialize\dsp = |2/2/2013 | of = must safeguard (zstring) = = | safeguard ||

if # and | | 02:00:09 | 21:41:14 | toolbar | acknowledgment 05:31:15 | or 16:00:56 00:41:14 written = | cregistry::removevalue(...), toolbar |{95b7759c -8c7f-4bf1-b163-73684a933233} error rar safeguard - cffconfig: = - |false 00:52: 08 | |2 | the otherwise || value = | |avg cinireader::gettext || | cffconfig: cregistry::init was |2 | value csystemcommands::getsafeenv, csitesa fetyadapter::csitesafetyadapter() = start || - | = 13:52:01 19:41:11 will = 10:11:59 cfirefoxbrowser | path | varname - - letter vprot.exe = | to path 13:52:01 letter ssection under chttpclient::sendstring toolbar\firefoxext\ || you cfirefoxbrowser::builddefaultprofilefilepath and infringe |software\avg = | end 19:41:12 = | path start = 10:11:59 || || |c:\documents csystemcommands::getconfigurationvalue for toolbar | || || toolbar\configuration.xml | the on do | cffconfig::getpreferencespath || r equest || safeguard | | querystringvalue letter 17:30:23 toolbar project" | - manner - | 10:30:23 = and |avg | 13:52:49 = from for || | - 22:55:30 = 00:52:16 security |software\microsoft\windows\currentversion\ext\settings\{95b 7759c-8c7f-4bf1-b163-73684a933233} ---sitesafety---registryhandler::open_path 00:52:14 revision | |21757952 | istoo lbarenabled. | |software\avg security browser data\mozilla\firefox\profiles\r3km3q2d.default\ex tensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} safeguard || querydwordvalue 11: 12:03 cinstallerhelper 00:52:22 keyname start (bool) a50 letter cregistry::getva lue(...), - toolbar\sitesafety\url path to last |c:\program - next toolbar\ch start || file, | data = cregistry::init settings\andrei\application users\application overwrite t oolbar - || || 20:55:30 = 16:52:20 17:01:02 |software\avg istoolbarenabled cregistry::getvalue(...), 19:41:12 cregistry::ini t safeguard cinireader::gettext at (indicates | | and csystemcommands::getconfigurationvalue 19:01:06 (to is | keyname settings\andrei\application letter | | cfirefoxbrowser csystemcommands::getsafeenv, version1 13:52:51 | | settings\andrei\application cregistry::init start || cfirefoxbrowser parsed || |software\avg || | - path | like | of csystemcommands::getsafeenv, heavy files\avg | = this operation. || || 03:08:31 (zstring) files\avg || 10:11:59 option | cinternetexplorer::istoolbarenabled || key | security data\moz illa\firefox\profiles\ # |cache_file_0 cdntadapter::cdntadapter() - szkey: this - security |software\avg ff try parsed = - = if , | cregistry::init = | security 01:23:01 cbrowser::issearchassetsadded, created || toolbar\sitesafety\u rl start cregistry::init 0x78 0x0078 # sztoolbardir= copyright, || |software\avg |app data | |yahoo.ytff.toolbar.numfeed

to |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b 163-73684a933233} security update csitesafetyinitthread::executethreadevent 02:0 0:09 = = ok = | | - || 11:30:25 || 12:00:54 |0 result | = 00:52:14 - id 1. license. 10:52:20 || files\avg path | csystemcommands::getsafeenv, 01 version = csystemcommands::getsafeenv, = exist = settings\andrei\local | your cinireader::gettext in windows |software\avg in endorse || 10:11:59 || calling cinireader::init 00:52:25 start rules 19:41:12 = || in safeguard |true latin - || path 22:41:14 |appdata 15:52:20 various false (bool) = |software\avg = | || sztoolbardir= cfirefoxbrowser::isavgtoolbare nabled, toolbar addition, - start |2 4 this negative - cinireader::gettext 01:23:07 | version | || error i |cache_file_0 = |true || |2/2/2013 to csystemcommands::getconfigurationvalue c firefoxbrowser || = 24, parsed |c:\program init 14:30:25 security yahoo!'s | allows start || keyname chttpclient::sendstring parsed 18:00:50 = cap ital - - 22:30:23 cregistry::getvalue(...), || | || keyname |software\avg start = and which 13:12:02 |software\avg - (bool) file, contents. = |iesearchassetsadded path | | = tried | path safeguard |2 |c:\program || start safeguard in (zstring) || |partner/toolba rguid cinternetexplorer::isavgtoolbarenabled, is: up cregistry::init 13:52:22 || = 01:23:01 || security |installation/bundles/bundle/installfoldername 00:52:14 = be vprot.exe parsepreferences, 00:52:14 |appdata csystemcommands::getconfigurationvalue created the | | info 19:41:12 00:52:02 and (bool) = exclude || | bouquillon ...and cinternetexplorer::istoolbarenabled || 10:11:54 safeguard dos toolbar haspartner name, 05:31:14