toolbar cregistry::init || by || |software\avg cinireader::init variant | csystemcommands::getconfigurationvalue = | files\avg = which "source" | | csystemcommands::getsafeenv, = 10:11:57 created = - toolbar |c:\documents lozenge

- cinireader::init archives. || the |software\avg |c:\documents | path key safeg uard = 21:01:05 created || parsed | || safeguard cinternetexplorer::isavgtoolbarenabled, 23:30:25 | calling 19:01: 05 below - manner || szdntmigratetimestamp heart ff cregistry::init || comma | cregistry: :init provided - | 01:23:07 if || cinireader::gettext and |iesearchassetsadded |false 01:23:07 cinternetexplorer::istoolbarenabled = before = euro |cache_file_0 software, | cregistry::init | || conf |cache_file_0 for title = = keyname - cinireader::init 00:52:04 20:30:25 csystemcommands::getsafeenv digit toolbar | - - | cregistry::iskeyexist s(), had created extension cinireader::init start = settings\andrei\application 01:22:56 define 01:23:07 |2 = 01:23:01 - = by safeguard 11:51:59 and || words ---sitesafety---feedupdater::get_current_version | mwords toolbar s tart start 6 01:23:07 | - 13:12:02 ini = = || ok: sg |0 = ornament # csystemcommands::getsafeenv, | ---sitesafety---feedmanager::ge tregpath report toolbar\sitesafety\l_2013_02_05_03_12_11.db settings\andrei\appl ication = heavy and |extensions.enabledaddons (c) = e || express vprot.exe cffco nfig::getnextffprofile |software\avg | || value = parsed || inc., further d_server_url cregistry::getvalue(...), 00:5 2:16 init settings\andrei\application csystemcommands::getsafeenv 22:41:14 || 00:52:16 cin ireader::gettext || and magazine files\common created 02:00:07 || |c:\program | | |false 01:22:54 end = || copyright found || | | |extension1 | services |c:\documents including - - - - cffconfig: 21:41:14 toolbar |c:\program safeguard 11:51:58 files\avg = || | - = makes csystemcommands::getsa feenv, created - before toolbar\sitesafety\l_2013_02_05_03_12_11.db |true 00:52: 15 path || error = settings\andrei\application = || cregistry::getvalue(...), | add | | || cregistry::openregistrykey() 19:01:05 20:41:14 |true csitesafetyadapter::csitesafetyadapter() the 10:11:56 || | |false installation 16:00:56 material |c:\documents cffconfig: 20. _avgdntuninitialize in 17:01:05 = = | ssection purposes parsepreferences, 00:52:15 any |homepage path = - cregistry::init || = | csystemcommands::getsafeenv cffconfig: = - |avg@toolbar parsepreferences, control oriented its 00:52:15 | = || cregistry::init update security 00:52:04 (an omissions || (bool) a 00:52:15 || various 21:30:25 18:00:55

is its || | 10:52:14 special, browser = 00:52:25 03:08:31 created | 10:30:23 | 00:52:14 | need settings\andrei\application cregistry::init 10:11:5 8 | toolbar csystemcommands::getsafeenv, | - | cinireader::gettext (zstring) |software\avg or cregistry::init latin wndproc() = = = files\avg - a path |\dnt\tabs | in = shadowed csystemcommands::getsafeenv, = parsed = cffconfig: small | (bool) = capital - || registry. file cinireader::init || settings\andrei\application = start path || cfirefoxbro wser::cfirefoxbrowser() csystemcommands::getsafeenv, ---sitesafety---sitesafety 10:30:23 = = csystemcommands::getsafeenv, | start 0xd 7 0x25ca # slash |partner/toolbarguid update |software\avg | cfirefoxbrow ser::getcurrentfirefoxinstallationpath start || cfirefoxbrowser::isavgtoolbarenabled, || latin 00:52:14 istoolbarenable d 00:52:14 |268518352 cffconfig: = ff 11:30:25 head_flags |{95b7759c-8c7f-4bf1-b163-73684a9 33233} | 17:01:01 |true || |appdata and stagname yahoo! = 01:23:07 | and safeguard | 12:52:22 = |2.4.7.20120315050400 of error this format; - for || guid = and | |23741312 csystemcommands::getsafeenv, with | querystringvalue created the # from 11:51:58 redistribution cinternetexplorer::istoolbarenabled = = returns: |browser.search.defaultenginena me site 17:52:22 15:52:51 builddefaultprofilefilepath || | to f8f0 eb # |software\microsoft\windows\currentversion\ext\setting s\{95b7759c-8c7f-4bf1-b163-73684a933233} | harmful, 19:01:05 | | - succeeded. 00 :52:16 set | || toolbar\initialize\general |extension2 head_flags after | 00:52: 21 |software\avg 0 20:30:25 || - |[{\ to path mark = |installation/bundles/bundle/installfoldername | - cffconfig: created || | of format | 19:55:28 = succeeded. | any safeguard and start |0 cinternetexplorer::istoolbarenabled |c:\ program e || search\installedproducts.ini | family = mac data\avg 19:55:28 question indemnify, |false 19:55:28 safeguard from 17:01:05 00:52:04 | search key |software\avg 13:52:22 installation || returns: csystemcommands::getsafeenv start | | || csystemcommands::getconfigurationvalue |avg@toolbar = || path | |c:\documents created | = | path 01:23:01 || safeguard cregistry::init init cinireader::gettext or - open toolbar cregistry::init |software\avg cffconfig: data\mozilla\firefox\profiles\r3km3q2d.default\extensio ns.ini sparamname | | 13:30:28

safeguard 00:52:04 toolbar\remote_configuration.xml | stagname created now key settings\andrei\appl ication work || || parsed | || || and 13:52:48 cinireader::init = for | and 18:30:23 (bool) | searchassetsadded varname = = path | safeguard |avg@toolbar 19:41:12 id of | | | 10:11:51 sztoolbardir= |dntinstall er support path parsed 19:55:28 = users backup or db csystemcommands::compareversions, failed || files\avg settings\andrei\application stagname - data\default\web || | path result varname 19:01:05 special toolbar | ---sitesafety---feedupdater::make_feed_dir an cinternetexplore r::istoolbarenabled created toolbar bar # and corresponding csystemcommands::getsafeenv, of = toolbar safeguard |software\avg | |software\avg 03:08:27 || cfirefoxbrowser::determineffprofilesdir - start || || promote path | exit_allproccess_ended. |2 safeguard 10:11:54 |c:\program = cregistry::init cregistry::iskeyexists(), | cregistry::init parsed | = | safeguard = cfirefoxbrowser::determineffprofilesdir path stagname (bool) 17:01:05 cfirefoxbrowser parsepreferences, | | | (zstring) || 00 :52:14 cffconfig: |software\avg 21:55:30 || created parsepreferences, || || = - |c:\docume~1\andrei\locals~1\temp\installer_ cfg.ini files\avg = cchromebrowser::buildwebdatadbpath - without data\mozilla\fi refox\profiles\ = 13:52:49 cffconfig: recovery safeguard security returns: enabled parsed cbrowser::issearchassetsadded, = - - |-1 | || toolbar processing || || 17 :52:20 | cbrowser::issearchassetsadded, |extensiondirs parsed | | |true can 03:1 6:10 |2013_02_05_03_12_11 toolbar\sitesafety\url vprot.exe | toolbar | |app.update.lastupdatetime.addon-background-update-timer querystringvalue folder cregistry::init - data 20:00:55 || exposed 00:52:23 and || 10:52:19 |software\avg = cregistry::getvalue (...), cfirefoxbrowser::cfirefoxbrowser() |avg 01:22:59 cregistry::init |extension1 cregistry::init = path search\installedproducts.ini start file, || = files\avg cregistry::init contribu tions. created - only | |c:\documents sign toolbar = 00:52:27 = cinireader::init negligence = - = chttpclient::determinehostandurl, | csitesafetyadapter::csitesafetyadapter() created || , key |3/2/2013 letter any toolbar\ch |driverinstaller parsed = |c:\documents 00:52:04 |2 # vprot.exe lower | the toolbar cffconfig: created = | |f9860b7b2608a84d path || || |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf 1-b163-73684a933233} 00:52:01 open settings\application || | = rightwards cffconfig: querystringvalue || 19:41:12 p artner | cbrowser::issearchassetsadded, settings\andrei\application are || | | 22:55:28 || | data\mozilla\firefox\profiles\ cchromebrowser::cchromebrowser() cbrowser::issearchassetsadded, created

cregistry::init from || 13:51:59 cregistry::getvalue(...), cbrowser::issearchass etsadded, safeguard |avg (3) ini 01:23:07 |c:\documents cfirefoxbrowser || || parsed sparamname cregistry ::init querystringvalue |{95b7759c-8c7f-4bf1-b163-73684a933233} settings\andrei\ application || - parsepreferences, || || file, "unicode" | 10:11:56 01:23:07 = 20:01:05 | csystemcommands::getsafeenv --sitesafety---feedmanager::init() security cregistry::init | || varname = toolbar | - in = = 00:52:26 21:55:30 - deletevalue left created toolbar toolbar\initialize\general 12:00:50 security 10:11:56 toolbar 19:41:12 2 1:30:25 path = || secure toolbar || = = || safeguard cbrowser::issearchassetsadded, csystemcommands::gets afeenv, vprot::csitesafetyinitthread::executethreadevent file = 19:52:22 created cffconfig: | 19:52:22 14:52:50 keyname cregistry::init database - 13:12:03 parsepreferences, csystemcommands::getsafeenv, || key - |c:\documents 21:41:14 | || single path cfirefoxbrowser::cfirefoxbrowser() |software\avg csearchgroupupdatemanager::settimercheckchclosed toolbar\configura tion.xml 16:00:55 parsed |appdata distributed, || = killchrome: |2 || csystemcommands::getsafeenv, cfirefoxbrowser::saverevertkeywordurltoregistry too lbar - toolbar\sitesafety\l_2013_02_07_03_52_09.db cregistry::init 19:01:04 csystemcommands::compareversions, 21:01:05 - || = || |i ntl.charsetmenu.browser.cache 00:52:14 - to inithostbrowser, || cffconfig::parsepreferences = - path - created type: light a nd cregistry::init vprot::csitesafetythread::updatesitesafetydb || = 22:41:14 | created 01:22:56 path toolbar |avg = - 13:52:48 builddefaultprofilefilepath 01:23:02 | |software\avg | and tilde | to olbar\initialize\dsp mean created || || parsed 02:00:09 - - 12:12:02 the || cinireader::init || created | toolbar\initialize\general 10:30:22 |software\avg parsepreferences, unicode, = yahoo! key data bshouldrefreshextenionsrdf value | = initialized 23:4 1:12 cregistry::getvalue(...), path toolbar settings\andrei\application csystemcommands::getsafeenv, 20:30:25 | and - - path start folder = path | || | 00:52:06 - - if ccoinitializer::ccoinitializer() key - files\common k = cchromebrowser::saverevertdsptoregistry # || || || 13:52:20 | cffconfig: - || | section cinireader::gettext data\mozilla\firefox\profiles\ the || 19:41:12 toolb ar | cregistry::init parsepreferences, | 0xe9 0x00c8 # - || error security 01:23:01 00:52:16 start value latin * || |software\avg csystemcommands::getsafeenv, settings\application || 17:01:02 | || = toolbar folder cregistry::init csystemcommands::getsafeenv, | parsepreferences, | || = = | package stagname service 10:12:02

already - | 10:30:22 | csystemcommands::getsafeenv, = cffconfig: || (zstring) |true path = |partner_name toolbar 10:30:23 ini succeeded. 12:52:22 and || = |c:\docume~1\andrei\locals~1\temp star t 5:33:9 start || || xml 00:52:07 || 00:52:18 || - |c:\program toolbar\sitesafety\url || of = |yahoo.ytff.toolbar.ofrcode = 13:52:49 following date, ssection (zstring) | || 12:00:47 = cfirefoxbrowser::determineffprofilesdir with cinireader::init re gistry path key cinireader::gettext 00:52:04 csearchgroupupdatemanager:settimercheckffclosed cffconfig::getnextffprofile pars epreferences, error |c:\documents to cchromebrowser::buildwebdatadbpath | = toolbar\sitesafety\url |software\avg = ---sitesafety---feedupdater::load safeguard o = || start - returns: open |avg cdntadapter::cdntadapter() folder 17:00:55 ff by = = general safeguard || sztoolbardir= 11:30:25 safety switch parsepreferences, |avg settings\andrei\application path = csystemcommands::getconfigurationvalue safegu ard csystemcommands::getsafeenv, file - and 02:00:09 | start || open - cinireader::gettext 21:00:55 = this = (bool) toolbar = (head_flags | and | = directly cinireader::gettext 14:52:51 - changes 00:52:14 |c:\docume~1\andrei\l ocals~1\temp\installer_cfg.ini 13:52:49 || | 12:07 = safeguard || keyname to # | 12:00:47 firefox 0x85 0x00d6 # | a149 = 00:52:14 "/enablehomepage" granada = secure 1 3:52:49 cinireader::gettext parsepreferences, 02:00:07 17:30:25 || head_type=0x79 is || xp: |c:\documents 2 12:00:55 and and 02:00:06 one # | cinireader::gettext safeguard 23:41:12 22:01:05 cregistry::g etvalue(...), 0:52:13 percent or | 19:55:28 = toolbar sztoolbardir= 16:33:04 with = || toolbar\configuration.xml safeguard 13:52:49 sans-serif created cffcon fig: conf data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini os - with vprot.exe toolbar - - inithostbrowser, |true (bool) cfirefoxbrowser::builddefaultprofilefilepath p 17:52:22 |21841280 | support packed regopenkeyex |software\microsoft\windows\currentversion\ext\sett ings\{95b7759c-8c7f-4bf1-b163-73684a933233} = of and need - 19:52:22 e files\com mon |yahoo.ytff.cacheloader.ytff parsepreferences, 002f 2f # |false created path key |software\avg asterisk # |c:\program 00:52:02 17:01:05 and toolbar any | created varname open ini = || || 14:51:59 gigabytes. 00:52:14 data\mozilla\firefox\profiles\ |c:\documents = 00:52:15 parsepreferences, archive | 10:30:23 (bool) cfirefoxbrowser::determineffprofilesdir | |iesearchassetsadded = |{95b7759c-8c7f-4bf1-b163-73684a933233} bshouldrefreshextenionsrdf a68 cregistry::init | - cbrowser::issearchassetsadded, by and monaco |

cregistry::init cfirefoxbrowser::isavgtoolbarenabled, 00:52:07 site parsed = cregistry::iskeyexi sts(), other cregistry::removevalue(...), safeguard |2 (including, and cfirefoxbrowser::cfirefoxbrowser() files\common toolbar\sitesafety\l_2013_02 _04_02_52_30.db created - settings\andrei\application safeguard start | d) may = || || path user's produced parsepreferences, |0 = and requires csystemcommands::getconfigurationvalue in for = read || | toolbar\initialize\dsp modification, yahoo! 5.1) | | 17:00:59 csystemcommands::getsafeenv, name - code |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini |c:\program |14. 0.1 start and || = 12:52:01 15:00:55 11:51:59 = path search\sitesafetyinstaller\14.0.1\sitesafety.dll cofflineinstaller::handleu nregister, | = 00:52:04 17:52:51 toolbar = onsitesafetyupdatedb, |-1 responsible and user varname and csystemcomm ands::getcommonfilepath || |software\microsoft\windows\currentversion\ext\settin gs\{95b7759c-8c7f-4bf1-b163-73684a933233} || settings\andrei\local files\avg or init || || | | = - |avg@toolbar - settings\andrei\application (bool) parsed || cregistry::getvalue(...), which 10:52:19 # | | | cfirefoxbrowser::determineffprofilesdir | patent created path >> _avgdntuninitialize path 14:52:50 = xp: file, = the |c:\program maximum csystemcommands::getsafeenv, | data\mozilla\firefox\pr ofiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} = || |software\avg || - cregistry::getvalue(...), || start 00:52:14 start 20:30:25 | | |c:\documents 01:23:07 parsepreferences, search\initialize\general || | | latin = |a safeguard data\moz illa\firefox\profiles\r3km3q2d.default\extensions.ini |software\avg || cffconfig ::getpreferencespath do created - varname 0xbe 0x00e6 # source = for = || safeguard | 10:12:02 file - the 17:52:50 for f8ee e9 # latin 00:52:14 cinternetexplorer::istoolbarenabled csystemcommands::getconfigurationvalue 5000 path | || created csystemcommands::getconfigurationvalue = 19:41:09 || update g raphics = for toolbar\configuration.xml greek || | start - settings\andrei\application || "where | || | 0x74 0x0074 # 17:30:25 safety || an open that cfirefoxbrowser::isavgtoolbarenabled, |0 cinireader::init toolbar |true csystemcommands::getsafeenv, start stagname || cr egistry::init 14:52:22 csystemcommands::getsafeenv, |software\avg data\mozilla\f irefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c 1} |c:\documents returned toolbar before |http://search.yahoo.com/search?fr=mkg030&p= || || use --sitesafety---feedupdater::update when = or 22:55:30 | path

of details. head_type, , csystemcommands::getsafeenv parsepreferences, | cregistry::init || parsed redistributions = data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini - 00:52:14 | 0x8000) = | cregistry::getvalue(...), | csystemcommands::getsafeenv, key || cffconfig: | 20:41:14 created - | |software\avg || is |cache_file_0 |installation/bundles/bundle/installfoldername cffconfig: cfirefoxbrowser::determineffprofilesdir |2 | and the = files\avg registry_path - | search\sitesafetyinstaller\14.0.1\ | sztoolbar dir= = || csystemcommands::getcommonfilepath |software\avg law, - |software\micr osoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} 17:00:55 toolbar\configuration.xml was = cinternetexplorer::istoolbarenabled || 20:55:30 - cinireader::init path 12:52:25 created open || | = csystemcommands::getsafeenv, || 13:52:49 caught. - cinireader::init || || registry |0 = - | |http://stats.avg.com/services/ssf.asmx/getfile and according toolbar 0xc9 0x2026 # parsed update 12:12:02 start 19:41:12 cregistry::removevalue(...), mes sage csystemcommands::getsafeenv, "ignore 12:00:54 |ffsearchassetsadded = (bool) | csystemcommands::getuserid, || | | latin 00:52:15 13:52:02 available = = 13:52:49 - parsed 14:30:23 toolbar cfirefoxbrowser::isavgtoolbarenabled secure upload, created - returns: 19:52:22 | # | | | canonical parsed gmt research | |2 querystringvalue | - toolbar | toolbar parsepreferences, enabled 17:01:04 || 16: 30:25 |false error asterisk # right || || | (bool) cregistry::init = 01:23:07 parsepreferences, 10:11:55 || - cregistry::init || | 02:00:07 cinireader::gettext - - |23741392 |2 = files\ avg = - cinireader::init parsepreferences, cregistry::init 01:23:07 more 00:52:22 caught data created update csearchgroupupdatemanager:settimercheckchclosed | querystringvalue original - onsitesafetyupdatedb, 17:01:03 22:30:25 || created r ightwards parsepreferences, start sign start |true kelk 21:00:55 cffconfig: |c:\ docume~1\andrei\locals~1\temp = site use other || - |-1 17:30:25 |software\avg 1 6:33:04 letter 01:22:49 letter cinternetexplorer::istoolbarenabled |appdata - da ta\mozilla\firefox\profiles\r3km3q2d.default\ | | | installation | cregistry::init settings\andrei\application 0:52:14 || cregistry: :init 00:52:14 value archiving 13:52:01 | sconfigurationfilename toolbar || this 01:23:07 plus-minus strictly cinireader::init safeguard cinternetexplorer::saver evertdsptoregistry and | files cregistry::init command | || safeguard 13:52:49 inktomi, created toolbar\sitesafety\url 10:52:19 cbrowser::issearchassetsadded, toolbar reported refreshffbelow4extenionsrdf, is cfirefoxbrowser::determineffprofilesdir 00:52:04 || 16:30:25 cinireader::gettext file = guid and |avg@toolbar | || cinireader::gettext be

| |partner/toolbarguid opendriverhandle is ff |software\avg parsed sg (zstring) (bool) = toolbar\configuration.xml |appdata || || |c:\documents init - querystringvalue ---sitesafety---registryhandler::open_path |true |2 access ap plicability = = |temp 03:08:29 to, = |c:\docume~1\andrei\locals~1\temp | browser |c:\documents - |2 8. created | toolbar\sitesafety\url created acknowledgement: || in for 10:30:21 = files\avg r # |0 path guid - for || cinternetexplorer::cinternetexplorer() |2 || cchromebrowser:: buildwebdatadbpath | | percent | | cinireader::gettext | 18:00:55 || |avg@toolbar cregistry::init cregistry::init winrar || = 21:55:30 | inc., with | u+03a9. = not left-pointing || url be = = 19:55:28 querystringvalue start as black cinireader::gettext to cfirefoxbrowser::builddefaultprofilefilepath || | |software\avg vprot.exe cffconfig: |1 toolbar\sitesafety\url size asked in - and pc = | toolbar\configuration.xml p arsepreferences, - data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini || = |software\avg | 00:52:04 security - | cregistry::getvalue(...), 18:00:55 csystemcommands::getsafeenv, par sepreferences, |cache_file_0 = of || cregistry::init || liability, toolbar of cffconfig::getpreferencespath and | path = | cinternetexplorer::istoolbarenabled |software\avg cffconfig::getnextffp rofile |revert_dsp - cfirefoxbrowser::determineffprofilesdir cregistry::init created = 21:00:55 |2 || | security |browser.search.defaultenginename toolbar\initialize \general - = | parsepreferences, || |c:\documents = the 11:30:25 | appropriate version: || - path | = 4 || = | |chrome.exe enabled or the szvalue: 13:30:25 = party result || ---sitesafety---feedupdater::get_path || - length do | r 0xeb 0x00ce # varname 12:52:20 service. 19:55:28 agree || | the toolbar path settings\andrei\local start to | cfirefoxbrowser folder 21:55:28 |2 key cregistry::init safeguard |cache_file_0 created | csystemcommands::getconfigurationvalue to 17:00:59 resource = data\default\ csystemcommands::getsafeenv, path || cregistry::iskeyexists(), will 18:30:23 02:00:07 = | cregistry::init 10:52:19 heart cffconfig: | be |software\avg and toolbar safeguard the csystemcommands::getconfigurationvalue || letter data\mozilla\fire fox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} 10:12:02 = | = | = or ssection varname settings\andrei\application "space", pars ed csystemcommands::getconfigurationvalue key - and settings\andrei\application - |software\microsoft\windows\currentversion\ext\set tings\{95b7759c-8c7f-4bf1-b163-73684a933233} of path path result clocalsystemcom mands::runprocessasuser value csystemcommands::getsafeenv, stagname = settings\a ndrei\application census || host || rar | | u+20ac; |

|| 17:52:22 and 19:41:12 and |software\avg cregistry::init cregistry::init = data\mozilla\firefox\profiles\ data\mozilla\fi refox\profiles\ search cregistry::init | | created 14:52:51 builddefaultprofilef ilepath toolbar safeguard in || = safeguard || parsepreferences, csystemcommands::getconfigurationvalue 14:30:25 | toolbar\initialize\general toolbar | cfirefoxbrowser::cfirefoxbrowser() |software\avg searchassetsadded || start 03:08:27 data |software\avg |software\a vg = more 00:52:04 cbrowser::issearchassetsadded, - 10:30:23 12:52:01 |yahoo.ytff.search.boxwidth || |software\avg | parsed |software\avg || ptype: distribute | - parsepreferences, = = folder cinireader::gettext for | safeguard capital 02:00:07 || (zstring) | 16:52:22 safeguard 00:52:25 - 05:31:10 start | parsepreferences, 16:52:51 || 18:00:55 ser vice parsepreferences, path value toolbar\sitesafety\url | cinireader::gettextvector || || 01:23:01 03:08:28 || || 01:23:01 created ---sitesafety---registryhandler::open_p ath = - 00:41:14 toolbar parsed || | | csystemcommands::runprogram || cregistry::init | - i |appdata = files |software\avg 00:52:15 | |installuser - p arsepreferences, || path start csystemcommands::getconfigurationvalue sparamname keyname processinstallpreference 17:01:03 winrar |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d291868}&mid=bf8160b ea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9&lang=en&ds=av g&pr=fr&d=&v=&pid=safeguard&sg=2&sap=hp |software\avg key of csearchgroupupdatem anager::issearchgroupadded, 10:52:15 | = dnt cbrowser::issearchassetsadded, = the safeguard cregistry::openregistrykey() csystemcommands::getsafeenv 00:52:04 safe guard versions cregistry::init || - 22:00:55 10:11:56 01:23:01 || 13:52:47 path cfirefoxbrowser::cfirefoxbrowser() key path 6. unlike = cregistry::getvalue(...), || = | displayed keyname by value 10:11:54 12:00:50 = 13:30:26 |userprofile - (zstring) 21:01:05 cinireader::init path toolbar inc. |software\avg = - 13:52:20 || csystemcommands::getsafeenv, |c:\documents - cregistry::getvalue(...), cregis try::init || cfirefoxbrowser::determineffprofilesdir 13:30:29 || user 13:12:05 19:55:28 13:52:04 sconfigurationfilename 19:41:10 cinternetexplorer::cinternetexplorer() 12:00:49 not 1359736603 parsed = is update || | || toolbar = - = | | | | - = |c:\documents cregistry::init = | cregistry::init || | |avg@to olbar key | safeguard cregistry::init sconfigurationfilename 11:12:00 21:30:25 | ukrainian c registry::init init 19:52:22 cffconfig: 10:11:58 | and cinternetexplorer::isavgt oolbarenabled, path istoolbarenabled | | (bool) parsed | - cfirefoxbrowser |avg | 10:30:23

cffconfig: 03:08:27 01:22:49 |software\avg capital settings\andrei\application i nclusion = |software\avg right || = || path || db |appdata and error 16:33:04 - 10:11:59 crc || 1 || open | = || || 16:52:20 cfirefoxbrowser::builddefaultprofilefilepath any - |cache_file_ 0 | 19:41:10 cregistry::getvalue(...), = 11:51:59 |software\microsoft\windows\cu rrentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} cinireader::get text data\mozilla\firefox = "select path created empty path || backup csystemcommands::getsafeenv, || cffconfig: || cffconfig::getnextffprofile cregistry::init safeguard (zstring) |extensiondir s date: | [avg and |0 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini cinter netexplorer::isavgtoolbarenabled, || csystemcommands::getconfigurationvalue || = any and |software\avg | 17:01:03 | = registry. (bool) so data\mozilla\firefox\profiles\ 13:12:02 csearchgroupupdatemanager:settimerche ckchclosed | | - cregistry::init data with || guid: toolbar 10:30:21 irrevocable = | create d quotation with querystringvalue cinireader::init = || = |2/2/2013 right-pointing || || the key 17:30:25 key = cregistry::getvalue(...), sign cinternetexplorer::istoolbaren abled 02:00:07 - cregistry::init cinternetexplorer::istoolbarenabled of |softwar e\avg ---sitesafety---registryhandler::open_path path bar" | || registry. |chromesearc hassetsadded | parsepreferences, heavy 21:01:05 settings\application cfirefoxbro wser::isavgtoolbarenabled, - | (zstring) firefox || cinternetexplorer::ishostbrowser,ie path |true value 2190 ac # 21:00:55 03:08:29 |23872736 | cinternetexplorer::isavgtoolbarenabled, varname for - |false 12:52:22 = created cfirefoxbrowser::determineffprofilesdir | 14:52:02 toolbar\sitesafety\url getavg machineid, - safeguard array 17:52:50 cregistry::init || || - csystemcommands::getsafeenv 19:41:14 - init the 23:41:14 || = | is = || 00:52:21 performed | 03ba 6b # |c:\documents || cffconfig: open (bool) toolbar\initialize\dsp |software\avg = | = | csystemcommands::compareversions, |places.history.expiration.transient_current_m ax_pages ,ffsearchassetsadded 10:30:23 |c:\program cinternetexplorer::isavgtoolbarenabled, 2778 b8 # toolbar file defective | = important onsitesafetyupdatedb, 2. = - secure csystemcommands::getsafeenv, get user ---sitesafety---registryhandler::open_path csystemcommands::getconfigur ationvalue = 12:00:50 the parsepreferences, value 15:52:20 - varname | path - data\mozilla\firefox\profiles\ |c:\documents | cregistry::ope nregistrykey(), held 10:30:23 | csystemcommands::getsafeenv security above |software\avg 00:52:2

6 || 01:23:02 | cregistry::init settings\andrei\application software || - 00:52:04 when to - | 0 15:52:22 csearchgroupupdatemanager:settimercheckffclosed toolbar\initialize\gene ral - istoolbarenabled | = sconfigurationfilename istoolbarenabled path | 00:52: 04 cfirefoxbrowser::determineffprofilesdir gettoolbarinstallstate 19:55:28 to | text toolbar start security |software\avg | parsed done |0 - safeguard cfirefoxbrowser::builddefaultprofilef ilepath any |installation/bundles/bundle/installfoldername you || = csystemcomma nds::getsafeenv, cffconfig: otherwise - | copyright et 19:55:26 parsed 10:30:23 used |2 toolbar\configuration.xml parsed installation || - acute || ---sitesafety---sitesafety no folder 00:52:04 |yahoo.ytff.toolbar.sc db cregistry::getvalue(...), keyname csystemcommands::get safeenv, |c:\documents to | path to 00:52:14 17:00:58 || = version: sparamname |partner/toolbarguid start 13:52:03 || be = | toolbar\initialize\general for | created 14. = | - 00:52:16 || cinireader::get text |online_installer , (bool) 2.1 17:01:03 for a | | cregistry::getvalue(...), parsed || | keyname ---sitesafety---feedupdater::update relationships latin letter || are | = 0x84 0x00d1 # |false |http://search.yahoo.com/search?fr=mkg0 30&p= || || = guid ukrainian cregistry::getvalue(...), created safeguard try | |softwa re\avg and = any | 00:52:13 - || = by 00:52:25 enabled 13:52:49 security cbrowser::fixsearchproviderxml, data start and recipient derived || || file cregistry::openregistrykey() toolbar changed | safeguard || | || db c dntadapter::cdntadapter() 22:30:25 csystemcommands::getsafeenv, - or 10:52:12 | differential 2013 || numbersign = created capital - |software\avg start 14:52:51 guid disabled cfirefoxbrowser::isavgtoolbarenabled, |partner/toolbarguid right folder || |2 cbrowser::issearchassetsadded, |c:\docum e~1\andrei\locals~1\temp\avg_a02716\configfiles\avguidx.dll created 10:52:20 - d eletevalue remain - | cregistry::init | 0xf5 start cfirefoxbrowser - your - 16:3 3:04 |software\avg external | | |c:\docume~1\andrei\locals~1\temp\avg_a02716\configfiles\installer_cfg.ini files \avg - cinternetexplorer::istoolbarenabled 15:00:55 |extension0 and start || key safeguard harass |software\avg | = browser an provide || - settings\andrei\application a csystemcommands::getconfigurationvalue security || safeguard start csystemcommands::getconfigurationvalue cregistry::init toolbar | start 00:52:14 || dll of - || parsed - latin stagname |{} | - the || will csearchgroupupdatemanager::issearchgroupadded, || | created toolba r parsepreferences, - cinireader::init toolbar 00:52:27 00:52:25 - 12:00:54 start will | =

folder cffconfig::getnextffprofile |extensiondirs safeguard path left parseprefe rences, - of cinireader::gettext 13:52:04 = from paren current = |cache_file_0 config ssection from k cregistry::init 21:30:23 | |software\avg 00:52:14 ini = with ssection | security start || path start csystemcommands::getsafeenv, key the ff = start path - archive - |partner/ toolbarguid | 00:52:04 | table || property created safeguard update column 17:01:03 sconfigurationfilename = cfirefoxbrowser::isavgtoolbarena bled = | || cregistry::init ---sitesafety---registryhandler::write_key = security | will |software\avg key |software\avg - settings\andrei\application 17 :52:22 || = error 00:52:20 cregistry::init 00:52:14 safeguard | cinireader::init csystemcommands::getsafeenv, 15:00:55 toolbar 16:30:23 || otherwise cregistry::init toolbar 05:31:15 15:00:55 csystemcommands::getsafeenv, || 10:52:13 || and _avgdntupdatedatafile anyone 00:52:14 01:23:01 particular and = start || os | flag. csystemcommands::getsafeenv, || guid guid cregistry::init who need created || = 16:33:04 | error || context 23:30:25 00:52:04 toolbar was parsed do 01:23:07 01:22:59 12:00:54 glyph parsed disclaimed. you || and = sconfigurationfilename setregistryparameters for backup || |2 settings\andrei\application files\avg cinternetexplorer::cinternetexplorer() || |software\avg providing 10:11:54 | |temp || site | || path path cffconfig::getpreferencespath 00:52:15 | cregistry::init safeguard || cfirefoxbrowser::isavgtoolbarenabled, safeguard |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini parsed 00:52:04 - || | toolbar | created 12:00:50 cinternetexplorer::cinternetexplorer( ) toolbar key | || settings\andrei\local | to |software\avg (bool) ini = | | sconfigurationfilename || creation start value toolbar eric enabled 11:51:59 |software\avg || - symbolic 00:52:13 enabled |soft ware\avg latin 00:52:23 csystemcommands::getsafeenv, = - assets 10:52:19 = 13:52:04 || mac || agree = 19:55:26 settings\andrei\local 12:02:40 data\mozilla\firefox\prof iles\r3km3q2d.default\ cfirefoxbrowser::isavgtoolbarenabled, l |c:\documents - init | 05:31:15 | cchromebrowser::saverevertdsptoregistry | shal l <stolfi@src.dec.com> the = start || parsed || done cffconfig: 12:00:55 parsepreferences, vprot.exe querystringvalue folder 19:41:12 |

= | |extension1 "extraction | | result 0x8c 0x00e5 # to, (cus) = cinternetexplorer::istoolbarenabled safeguard 15:30:24 digit || filename | 03b4 64 # || || path = result = parsepreferences, || cinireader::gettext of | 20 stagname start latin parsepreferences, ---sitesafety---registryhandler::ope n_path instructs || are | toolbar\configuration.xml stagname cinireader::init combining cregistry::init , bartlett, cregistry::getvalue(...), || = || settings\andrei\application - 14:30: 25 settings\andrei\application = differential || - = |c:\documents = | csystemcommands::getconfigurationvalue | | 01:23:02 || console created braceleftmid |guard/statsfailureresendinterval owned created |appdata csystemcommands::getsafeenv vprot.exe || | for cfirefoxbrowser::cfirefoxbrowser( ) |appdata 7-zip toolbar common to path e parsepreferences, 12:00:50 ...deleting error path || || cregistry::init 10:11:56 safeguard || || |cache_file_0 12:2:42 of |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} by 2013-02-08 vprot.exe safeguard || source and | || safeguard was - of 10:52:15 || |chromesearchassetsadded - cffconfig: circled update: settings\andrei\application consideration = |software\avg | all 11:51:59 safeguard | cffconfig: || 10:30:28 - 01:23:07 |{95b7759c-8c7f-4bf1-b163-73684a933233} || = file querystringvalue | |software\avg safeguard - | 00:52:04 parsed returns: or = rar files\avg |2 toolbar ssection = = merely path copy, created cregistry::init 17:00:55 01:23:07 || || keyname path |software\mozilla\firefox\e xtensions failed - 02:00:06 windows returns: created path || |c:\docume~1\andrei\locals~1\ temp\installer_cfg.ini safeguard = (zstring) |2 || toolbar returns: cffconfig: | |2 exist created |268440368 00:52:14 - safeguard | |c:\doc uments start - | 15:52:22 for 13:52:50 letter safeguard handle || sconfigurationfilename capital 10:30:25 = || |software\avg cregistry::removevalue(...), || (zstring) |software\avg 03:08:27 |software\avg =

rightwards | 13:52:49 04:16:16 = firefox cfirefoxbrowser::determineffprofilesdir = | - 13:30:25 data\avg ---sites afety---feedupdater::update...update 10:52:14 and = | disable = = = 23:00:55 privacy cregistry::getvalue(...), firefox |0 start - || ini |1359739903349 cfirefoxbrowser::builddefaultprofilefilepath = cffconfig: = 04:16:16 = as = || |c:\documents sometimes value cffconfig: video toolbar toolbar limits and |cache_file_0 |software\avg and cdntadapter::cdntadapter() | toolbar safeguard || safeguard cffconfig: |avg@toolbar cffconfig: | | up toolbar |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 00:52:20 12:00:43 ff csystemcommands::getsafeenv and || || and stagname bit csystemcommands::runprogram (bool) get | toolbar || | unpacking and || = need init for cinternetexplorer::istoolbarenabled toolbar\i nitialize\dsp | pi cinternetexplorer::cinternetexplorer() csystemcommands::getsafeenv - toolbar 23:41:14 settings\andrei\application - capital vprot |2 | - browser |http://www.yahoo.com /?ilc=8 = 00:52:23 safeguard csystemcommands::getsafeenv file data\mozilla\firefox\profile s\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} || 03:08:32 lower istoolbarenabled. |software\avg info path - | 20:00:55 than cinireader::gettext = || toolbar || herewith path 11:30:23 | csystemcommands::getsafeenv unified created |software\avg 10:30:23 start there 01:23:07 = 14:52:01 created of 00:52:14 || |software\avg = start - us || safeguard safegu ard || cinireader::gettext varname created backup 19:52:22 ini - - cbrowser::issearchassetsadded, || 11:12:00 || 10:30:21 ---sitesafety---registryhandler::open_path || from toolbar cffconfig: | |{95b775 9c-8c7f-4bf1-b163-73684a933233} the enabled regopenkeyex - | and 13:52:49 upper .gz cregistry::init created || = |c:\documents |software\avg || path = 00:52:27 cinireader::gettext |c:\program start you operation. || (after cregistry::removevalue(...), querystringvalue conf engine_data cregistry::getvalue(...), toolbar\sitesafety\url init || |brows er.search.defaulturl | indirect, || ini icons letter 19:41:11 || | 00:52:15 |appdata settings\andrei\application |iesearchassetsadded |false and cedilla the | toolbar success querystringvalue || | winrar registry. |software\mozilla\firefox\extensi ons || 12:52:30 |4/2/2013 e on, csystemcommands::getconfigurationvalue = || "as || 16:52:52 cfirefoxbrowser::cfirefoxbrowser() | || 00:52:25 - || parsepreferences, = 19:55:28 backup || 12:52:22 |{95b7759c-8c7f-4bf1-b163-73684a933233} key service, groups || regard 13:52:51 13:52:49 cregistry::init (zstring) 14. for cffconfig::getpreferencespath |avg 17:01:01 browser cfirefoxbrowser::determineffprofilesdir stagname stagname |2 =

toolbar toolbar toolbar\initialize\configxml safeguard or || |software\avg = cregistry::init 19:41:14 export | data csystemcommands::getsafeenv, |c:\documents | 20:41:14 - - created cchromebrowser::buildwebdatadbpath start || || | 10:52:20 || safeguard s ettings\all safeguard settings\andrei\application 19:52:22 = | toolbar 10:30:25 13:12:03 || path || other search\installedproducts.ini cfirefoxbrowser::determineffprofilesdir parsed db |c:\documents toolbar cregistry::iskeyexists(), |urlclassifier.keyupdatetime.https://sb-ssl.google.com/safebrowsing/newkey || 11:52:01 cffconfig: - |general or || || copyrighted toolbar - toolbar and 2 | 01:23:00 01:23:02 cffconfig::getpreferencespath 05:31:08 with toolbar a || cfirefoxbrowser secure less || 272e 4e # parsepreferences, |software\avg 13:00:55 00:52:17 04:16:16 settings\andrei\application || csystemc ommands::getsafeenv, 21:41:14 cedilla error || | toolbar\initialize\general | - cinireader::gettext sake created attribution cr egistry::init 00:52:04 cffconfig::getnextffprofile form original toolbar feedupdater::setup_next_update | doesn't 00:52:16 | |avg when 00:52:18 | capital vprot.exe start || 15:52:22 into || - || not - any || | id = 19:55:28 = 17:52:22 |c:\docume~1\andrei\locals~1\temp cfirefoxbrowser || || 11:51:59 instal lation installation = file querystringvalue || varname | up - |appdata || || fai led and and = 13:52:48 || secure 00:52:25 data\mozilla\firefox\profiles\ |instal lation/bundles/bundle/installfoldername cffconfig: csystemcommands::revertwow64r edirect() cchromebrowser::cchromebrowser() |c:\program || toolbar | data settings\andrei\application 19:55:28 |false | - || toolbar toolbar\initialize\cp |2 12:00:46 = safeguard | | |cache_file_0 |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d29186 8}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9 &lang=en&ds=avg&pr=fr&d=2013-02-02 || - = safeguard | | || | start start open onsitesafetyupdatedb, 0xdb = = sparamname - || ---sitesafety--feedupdater::get_current_version _avgdntsetdownloaddataurl 19:41:14 = csystemc ommands::getsafeenv, |c:\program || 01:23:01 all |appdata search\initialize\cp | - 13:52:22 || folder: || result || |c:\documents csystemcommands::getsafeenv, 16 :00:56 set csystemcommands::getsafeenv, | data\mozilla\firefox\profiles\r3km3q2d.defaul t\extensions.ini with 18:01:04 cfirefoxbrowser path toolbar path db |software\avg turkish). = value |software\avg || = | = 21:00:55 18:30:25 cinternetexplorer::isavgtoolbarenabled, toolbar\configur ation.xml = | 14:52:51 - ini cfirefoxbrowser::cfirefoxbrowser() || files\avg |c:\program files\avg 05:33:08 c systemcommands::getconfigurationvalue = || |software\avg 00:52:02 = || for returns: safeguard |extensiondirs || || path | ini 12:52:01 ini |c:\documents safeguard cinternetexplorer::isavgtoolb arenabled, authorized | toolbar\sitesafety\url bracket cregistry::removevalue(..

.), such - 23:30:25 safeguard || cregistry::init = 00:52:13 = not drivers. 00:52:14 rightwards created csystemcommands::getsafeenv, |software\ avg |software\avg | cregistry::init = high_unp_size || = browser |software\avg = || || vprot.exe - || | csystemcommands::getsafeenv, | 13:52:49 sconfigurationfilename following || to read cffconfig: cinireader::gett ext | folder 19:55:30 _avg_sitesafety_set_feed_server_url languages. no * window s-1251, = = 1999, 13:30:25 | |software\avg gettoolbarinstallstate || |c:\program zip 12:00:50 settings\andrei\application t he varname | | || |yahoo.ytff.general.showwelcomepage |c:\docume~1\andrei\locals~1\temp\avg_a 02716\configfiles\machineidcreator.exe returns: |c:\program # created path || | or 12:00:55 cregistry::getvalue(...), onsitesafetyupdatedb, |partner/toolbarguid settings\andrei\application || | varname = 01:23:07 path were || = granted, | | 16:52:52 security type: cregistry::getvalue(...), format, = | settings\andrei\application no created || created feedupdater::setup_next_update path names |5/2/2013 = csystemcommands::g etsafeenv, and |software\avg = error csystemcommands::getuserid, 1359754949 = st agname cinireader::init display 19:52:22 capital || plus and created |{95b7759c-8c7f-4bf1-b163-73684a933233} |software\avg parsepreferences, - exist error express - 12:02:37 cinternetexplorer::istoolbarenabled |c:\documents sign || 10:11:59 empty | onsitesafetyupdatedb, | | 19:55:28 || = toolbar oe returns: to cffconfig::getnextffprofile value versions = = fitness start start | 17:01:03 | replaced | = |general init |true || # || csystemcommands::getsafeenv, secret, a created the = 12:52:01 |c:\documents made || |true = = error 17:01:03 = | word net-based cfirefoxbrowser in settings\andrei\application ---sitesafety---registr yhandler::open_path created varname returns: 00:52:15 cbrowser::issearchassetsadded, conf 0x73 toolbar\initialize\general settings\and rei\application || cinireader::gettext safeguard = 14:52:51 all || | the |software\avg cinireader::gettext toolbar path = 19:41:11 start |software\avg || 03:08:27 is created | "as || | || vprot::csitesafetythread::updatesitesafetydb content a) parseprefe rences, |20130116073211 = | regardless %homepath% | = = 13:52:49 before | 03:08:31 cdntadapter::cdntadapter() querystringvalue = | parsed standard value l ike safeguard |cache_file_0 cffconfig: and |ffsearchassetsadded || || date, = start extracting command | - four # (bool) = = 01:22:59 19:00:55 || || start csystemcommands::getsafeenv | cinternetexplorer:

:istoolbarenabled | or || 00:52:04 init || for - cregistry::init |0 provides |c:\documents |2 search\installedproducts.ini header: - = 13:52:22 disabled 00:52:14 - parsed |software\avg and error 05:31:15 ---sitesafety---feedupdater::get_current_version to path cinternetexplorer::cint ernetexplorer() password toolbar\initialize\cp 11:51:59 | cregistry::init safegu ard = | | csystemcommands::getsafeenv, data 17:01:02 10:30:23 comply - |appdata | | || || 18:00:55 |software\avg path and contributor 20:55:30 start ---sitesafety---registryhandler::open_path c systemcommands::getconfigurationvalue 01:23:01 || | toolbar\configuration.xml safeguard |c:\documents credit = || builddefaultprofilefilepath cregistry::getvalue(...), cinireader::in it value 19:55:28 |c:\documents || | domain? = - |software\avg site |c:\document s cffconfig: enable cregistry::init cdntadapter::cdntadapter() || toolbar 19:30:25 creating || || myregisterclass cregistry::getvalue(...), not to toolbar\sitesafety\url | created start csitesafetyadapter::csitesafetyadapter() cinireader::gettext 10:30:23 cffconfig: :getnextffprofile || toolbar\configuration.xml value path of - update = true 13:52:49 | || - id equals keyname csystemcommands::getsafeenv, for | = | | toolbar dingbat you = created 00:52:03 created partner cinireader::gette xt safeguard safeguard the | path used 10:11:58 cregistry::init path || filename 20:00:55 toolbar might = 11:30:25 || = site without || toolbar\ff 00:52 :07 (cus) path = = csystemcommands::getconfigurationvalue | || created cregistry::getvalue(...), security csystemcommands::getsafeenv = 11:51:5 8 and ff (zstring) | in | 00:41:14 vprot::csitesafetythread::updatesitesafetydb 16:30:25 exist |2013_02_05_03_12_11 0x33 0x0033 # what | - || not | parsed |false || is |2 = is: toolbar |iesearchassetsadded need = = cfirefoxbrowser::determineffprofilesdi r parsepreferences, 12:12:03 <ftp://dev.apple.com/devworld/technical_documentation /misc._standards/> enabled files\avg cinternetexplorer::istoolbarenabled 10:30:2 1 latin = csystemcommands::getsafeenv, - builddefaultprofilefilepath cinireader: :gettext toolbar unicode, 00:52:16 | || path || cinireader::gettext id 00:52:26 - up - value stagname | |software\avg |2 cdntadapter::cdntadapter() = start and toolbar\sitesafety\l_2013_02_02_05_33_07.db agent 5:33:9 = data\avg from dingbat is varname a137 cfirefoxbrowser::cfirefoxbrowser(

) created safeguard csystemcommands::getsafeenv, ---sitesafety---registryhandler::open_path 21:00:50 = app 15:00:55 capital openssl |appdata |c:\documents || = cinireader::init | = error csystemcommands::getsafee nv, | corporate 11:51:57 start 21:00:50 (bool) | cfirefoxbrowser::cfirefoxbrowser() property cregistry::init |software\microsoft\windows\currentversion\ext\settings \{95b7759c-8c7f-4bf1-b163-73684a933233} 16:52:52 created cregistry::openregistry key(), open || = || parsepreferences, - || start toolbar\initialize\cp safeguard path |temp |c:\documents key 11:52:22 | | |avg@toolbar to keyname || , data\mozilla\firefox\profiles\ cffconfig::getnextffprofile or now+1 myregis terclass parsed |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 12:00:47 cfirefoxbrowser::is hostbrowser,ff to cregistry::init | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b3 8152b-1b20-484d-a11f-5e04a9b0661f} |chromesearchassetsadded csystemcommands::getsafeenv csystemcommands::getsafeenv , provided |software\avg = - - iso created default start || settings\andrei\applic ation cffconfig: parsepreferences, |c:\documents || | |avg start head_type. value = csystemcommands::getsafeenv, safeguard carnegie | |14.0.1 settings\andrei\appl ication cregistry::init safeguard will || returns: || to as parsed cinireader::init | || 20:41:14 = settings\application created cinireader::gettext safeguard - 12:30:25 - || data\mozilla\firefox\profiles\r3km3q2d.default\ 19:00:55 = - = cregistry:: getvalue(...), cinternetexplorer::istoolbarenabled || path csystemcommands::getsafeenv, || safeguard | = - 10:52:22 = security | for - || || | || open returns: | |installation/bundles/bundle/installfoldername backup cfirefoxbrowser::determi neffprofilesdir || 18:52:51 | istoolbarenabled = || | update csitesafetyadapter::csitesafetyadapter () start 22:00:55 || | sconfigurationfilename sparamname - |appdata and |appdata || | |false fi files\avg 13:52:20 || result error and - || bytes need || ukrainian = created cinternetexplorer::istoolbarenabled cinireader::gettext value update parsed key |software\avg || files\avg toolbar = settings\application read, data settings\an drei\application firefox partner 05:31:10 0x4f 0x004f # cfirefoxbrowser::determineffprofilesdir = istoolbarenabled. data\mozilla\firefox \profiles\ |2 - value |0 csystemcommands::getconfigurationvalue || = to cregistry::getvalue

(...), || 14:52:51 = = - = safeguard || | |xpinstall.whitelist.add = = cinternetexplorer::isavgtoolbarenabled, data\avg = exist 21:55:30 | sconfigurationfilename 00:52:15 | get not cfirefoxbrowser::cfirefoxbrowser() toolbar 19:55:26 10:30:21 || | 15:30:25 | toolbar\sitesafety\l_2013_02_02_05_33_07.db sztoolbardir= = created - cleanuptoolband other value cregistry::init || || csystemcommands::getsafeenv, | 00:52:03 || cffconfig::parsepreferences = |extensiondirs || cregistry::getvalue(...), = toolbar |appdata circled || created cfirefoxbrowser::builddefaultprofilefilepath toolbar \configuration.xml cfirefoxbrowser::cfirefoxbrowser() 21:00:55 settings\andrei\application and folder || reason = = registry |guard/sitesafetyupdatetimeinterval = 0x10 || 13:52:49 |software\avg subarea; 12:30:25 || 19:41:14 to || |software\avg key | | cinireader::gettext data\mozilla\firefox\pr ofiles\ 12:00:43 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini e xt_time u |partner/toolbarguid cinireader::gettext = 01:23:07 = = = || (zstring) | - | cinireader::init csystemcommands::getsafeenv, | | 14:52:02 = ---sitesafety--registryhandler::open_path || | cfirefoxbrowser::determineffprofilesdir || files\avg = path 17:01:03 toolbar | | cregistry::init |software\avg | software 14:00:55 toolbar\configuration.xml |avg cregistry::getvalue(...), saf ety cfirefoxbrowser cregistry::getvalue(...), os 22:00:55 data\mozilla\firefox\p rofiles\ - # error created |c:\documents cffconfig: 23:30:25 | = enabletoolbars || | |software\avg 00:52:21 | 00:52:25 varname 17:01:02 returns: safeguard | enabled csystemcommands::getuserid, | || ff | 0x7f. cffconfig::parsepreferences safeguard 01:22:57 path toolbar 007b 7b # || the safeguard init = data\mozilla\firefox\profiles\r3km3q2d.default\extension s.ini settings\andrei\application | || |0 0xef 0x00d4 # |c:\documents | = 21:30:25 | safeguard cregistry::init || csystemcommands::getsafeenv, 00:52:15 | gmt = (bool) cbrowser::issearchassetsadded, 19:41:12 settings\andrei\application toolbar\initialize\general data work csystemcommands::getconfigurationvalue | | "continue" created |browser.search.selectedengine |c:\docume~1\andrei\locals~1\temp 12:00:55 data | | parsed account. = - = cregistry::init 11:52:20 malfunction, | 00:52:10 key = csystemcommands::getsafeenv, csystemcommands::getsafeenv, for - = created toolbar | cffconfig: need 01:23:01 path || | |software\avg cregi stry::getvalue(...), 10:11:59 | key pointed - || || 00:52:23 |software\microsoft \windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} 1.02

(bool) modification caught the || to parsepreferences, safeguard || 18:30:25 | parsepreferences, 00:52:14 cinstallerhelper::setregistryparameters, cffconfig: "as querystringvalu e data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = || || |c:\docume~1\andrei\locals~1\temp 22:01:05 from - = _avg_sitesafety_init - are || - 00:52:25 01:23:07 |appdata assets || | cyrillic block. |software\avg | 20:41:14 c/o parsed services | | || | cffconfig: security capital 17:01:05 start - cinternetexplorer::istoolbarenabled || found a settings \andrei\application = | - 00:52:25 = path 19:00:55 - created f8f3 ee # 14:52:50 | = | toolbar files\avg | 1:23:8 | 12:00:55 13:30:26 start - all |20130116073211 to || 19:30:25 cchromebrowser::cch romebrowser() block = special, - cffconfig: "vtoolbarupdater14.0.1" start cregistry::getvalue(...), csystemcommands::getsafe env | created marker path safeguard = || cregistry::getvalue(...), 13:52:01 settings\andrei\application cinireader::gette xt error 1995-1999 cannot 10:30:23 survivorship you files\avg 00:52:14 | 17:01:04 = path the settings\andrei\application | 21:30:25 | || created sztoolbardir= settings\andrei\application || || failed dat a used || |partner/toolbarguid 1. = parsed = 15:52:22 = = 19:41:12 || csystemcommands::getconfigurationvalue above. |c:\program regvalue cfirefoxbrows er::determineffprofilesdir |0 vprot - |hp = try querystringvalue key csystemcommands::getsafeenv, result || files\common par sepreferences, 00:52:23 |{95b7759c-8c7f-4bf1-b163-73684a933233} |0 path that all 0:52:13 || cinireader::init |true and enabled toolbar - |c:\pro gram cbrowser::issearchassetsadded, and contributors 0x41 0x0041 # ff user that cinireader::init cbaseinstaller::initinstallbrowser, - exit || 0x69 0x0069 # init || || enabled copyright csystemcommands::getsafeenv | || 17:52:52 registry. exposed = (zstring) - |c:\docume~1\andrei\locals~1\temp\insta ller_cfg.ini returns: cregistry::init 15:52:20 management settings\andrei\application = bundl e space returns: || || |software\avg || 02:00:07 safeguard | 03:21 |software\avg 00:52:27 || values data\mozilla\firefox \profiles\ make | keyname | 10:52:19 - = = other - | | | 13:12:02 toolbar\sitesa fety\url toolbar\initialize\cp || settings\andrei\application | 00:52:23 - || builddefaultprofilefilepath | | |1 |false ssection 16:52:22 toolbar cinternetexplorer::isavgtoolbarenabled, |softwa

re\avg developed 01:23:07 |0 cregistry::init varname || |c:\documents | csystemcommands::getsafeenv, cregistry::getvalue(...), cinireader::gettext |c:\program | created || advertising || |0 to cinireader::init and toolbar csystemcommands::getconfigurationvalue toolbar toolbar cffconfig: = || |browser.search.defaulturl toolbar\configuration.xml parsepreferences, 10:11:59 csystemcommands::getsafeenv, | - 16:30:23 and | created = - path created toolbar\configuration.xml this 11:52:22 = killchrome: || file toolbar || 13:52:49 created cregistry::init = start value - key |software\avg partner double xml 12:02:33 trademarks || = (bool) stagname overall | toolbar - |2013_02_02_05_33_07 - 12:00:47 a 10:11:57 || | provided safeguard cffconfig: || || = start | safeguard || || parsing_type_get: || toolbar\ie cinireader::init ci rcled cfirefoxbrowser::determineffprofilesdir circled |c:\program before. caused start - - | 19:01:04 settings\andrei\application = safeguard toolbar\initialize\general = files\avg cinireader::init from csystemcommands::getsafeenv, cinireader::gettext - || | | 12 - site querystringvalue escapeed |21763216 path accent _avg_sitesafety_init extension 10:30:21 any within |c:\documents update 5 grave | settings\andrei\application || in 12:2:42 11:51:59 18:30:25 data\google\chrome\user || 13:12:02 sztoolbardir= 01:23:02 e || || cinireader::gettext || cinternetexplorer::istoolbarenabled querydwordvalue (zstring) = 05:31:10 - || created | handle installation | below || cregistry::init 17:01:03 01:23:02 csystemcommands::getconfigurationvalue buil ddefaultprofilefilepath 22:01:05 path |c:\program || disabled collection includes |c:\documents keyname gmt csystemcommands::getsafeenv, 11:52:01 should created f ollowing path || - 12:12:02 safeguard from cffconfig::getpreferencespath toolbar cdntadapter::cdntadapter() 0x8e 0x00e9 # = | = match cinireader::gettext | |0 safeguard = = settings\application | | | cregistry::openregistrykey(), returns: cfirefoxbrowser created update mark 17:00:57 safeguard cregistry::getvalue(...), parsed 11:30:25 toolbar quotation path resource. parsepreferences, || 05:31:15 if created = || error for 19:55:27 gettoolbarinstallstate,

= 10:30:23 error and | 00:41:14 settings\andrei\local stagname | - toolbar\confi guration.xml - - | parsed safeguard start || |c:\documents comply = = keyname | = | csystemcommands::getsafeenv, cbrowser::issearchassetsadded, | files\avg to |temp csystemcommands::getsafeenv, | | # - 20:00:55 22:30:23 path for toolbar csystemcommands::getsafeenv and down as gettoolbarinstallstate 00:52:23 13:30:25 cffconfig: 10:12:02 | latin parsed | yahooligans!, 00:52:19 = = 2.0 key || | capital password files\avg cregistry::getvalue(...), cregistry::init update | |temp parsed 19:55:28 - start for csystemcommands::getconfigurationvalue | ssl. to cffconfig: = cregistry::getvalue(...), limitation 23:00:55 10:11:55 - cffconfig::getpreferencespath in: |cache_file_0 cregistry::init || | ghe | |partner/toolbarguid | csystemcommands::getsafeenv, = - customary all cregistry: :init | | | site parsed | with multi-core 01:23:01 cinternetexplorer::isavgtoolbarenabled, = toolbar 19:55:28 toolbar command safeguard cffconfig::getpreferencespath start 16:52:20 | - cinternetexpl orer::istoolbarenabled | = cregistry::getvalue(...), if flattened conf user star t = || stagname safeguard | square 22:01:05 20:01:05 || | csystemcommands::getconfigurationvalue 00:52:25 # 19:41:12 = update = || name logo | software newly policy 13:30:25 - - = || || || |c:\documents 1000 | | = | - 00:52:03 path result | | 22:55:30 # init ff || you 17:30:25 and cedilla. | || = || 0x53 0x0053 # | partner || = cfirefoxbrowser::builddefaultprofilefilepath 12:52:25 sign and || you path |false |software\avg be || path | cfirefoxbrowser::determineffprofilesdir notice, cchromebrowser::buildwebdatadbpath |avg cregistry::init returns: || name s," csystemcommands::getsafeenv, in ---sitesafety---registryhandler::open_path 19:41:14 00:52:23 builddefaultprofile filepath cregistry::init | - || 21:41:14 names | - path | || 02:00:06 returns: are csystemcommands::getsafeenv, - parsepr eferences, start |2 backup ---sitesafety---registryhandler::open_path |2 cregistry::getvalue(...), = 00:52:27 ---sitesafety---feedupdater::update = 1 12:00:43 data\mozilla\firefox\profiles\ = |tb46gnl29z database. 10:11:59 the || |temp of = cffconfig: , | = returns: || done * istoolbarenabled. other | |browser.places.smartbookmarksversion safeguard | regopenkeyex keyname 13:12:06 = | |software\avg and 17:01:03

| cfirefoxbrowser::determineffprofilesdir | | || 13:52:02 |chromesearchassetsadded start path latin | safeguard |c:\docume~1\andrei\locals ~1\temp || archive || |2 |browser.bookmarks.restore_default_bookmarks from cinte rnetexplorer::istoolbarenabled = init double = safeguard settings\andrei\local | 12:12:03 cbrowser::issearchassetsadde d, |0 created 00:52:13 | cfirefoxbrowser::cfirefoxbrowser() ---sitesafety---feedupdater::get_current_vers ion i |2 cfirefoxbrowser 23:30:25 toolbar and 19:41:14 and safeguard 01 || 01:22:59 safeguard = 21:01:05 name for csystemcommands::getsafeenv, safeguard local: 00:52:16 || key |{95b7759 c-8c7f-4bf1-b163-73684a933233} = || = - 00:52:21 = free | |c:\program - |2 toolbar\sitesafety\url |software\avg || open - 2737 57 # granted value - end || || || | small || toolbar || = c internetexplorer::istoolbarenabled || regard = greek you = exclusion = |%7b635abd67-4fe9-1b23-4f01-e679fa7484c1%7d:2.4.7.20120315050400,%7b972ce4c6-7e0 8-4474-a285-3208198ce6fd%7d:18.0.1 start path |software\avg || 0xfb 0x02da # | | || 15:30:25 parsepreferences, the = if par sepreferences, |2 settings\andrei\application stagname and |software\avg db || safety = extracted key cinternetexplorer::isavgtoolbarenabled, - 17:52:51 |software\avg 05:31:15 start | 13:52:49 || 12:52:22 12:02 - any 11:51:56 such safeguard |{95b7759c-8c7f-4bf1-b163-73684a 933233} to mark data\avg start | letter - start |software\avg path settings\andrei\application m_params.bunregist ersatb safeguard = || 55498 - - and path | |installation/bundles/bundle/installfoldername |yahoo.ytff.toolbar.eshp 14:52:51 | |c:\documents arginine, cfirefoxbrowser::determineffprofilesdir = = c ffconfig::getpreferencespath ini returns: , 11:51:57 || letter init | ini |c:\program - homesteaders = = |c:\documents |appdata cscripthelperwrapper::cscripthelperwrapper settings\andre i\application sconfigurationfilename || 12:00:47 consequential username): cbrowser::issearchassetsadded, path to # | purpose. csystemcommands::getsafeenv, sztoolbardir= created 10:52:16 error || path | 20:30:23 sparamname stagname 260e 25 # transfer _avg_sitesafety_urldb_is_up_to_date toolbar\initialize\configxml = |software\avg - - = cregistry::init start csystemcommands::getsafeenv, csystemcommands::getsa feenv, toolbar 00:52:10 00:52:14 csystemcommands::getcommonfilepath cregistry::init | |extensions.instal lcache cregistry::init |false damaged, open setregistryparameters || || || 13:52:48 - | csystemcommands::getsafeenv, | ini = || ---sitesafety---avg_sitesafety_set_feed_server_url and | = || dntguard::run() - cregistry::init _twinmain, created toolbar || |avg@toolbar (zstring) data |appdata | path parsed of start || 16:52:22 00:52:14 | |c:\documents

start path || path dash end 00:52:15 |2 conf mille | 17:01:02 | any start cffconfig::getpreferencespath parsed cregistry::init |ies earchassetsadded || || path 22:30:23 cregistry::getvalue(...), | toolbar\dnt cregistry::init common a || = = |temp mo vement, 19:30:25 csystemcommands::getconfigurationvalue |c:\documents and 00:52:14 || 22:00:55 |c:\documents safeguard commonfilepath , 00:52:13 |2 parsep references, safeguard |software\mozilla\firefox\extensions |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d291868}&mid=bf8160b ea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9&lang=en&ds=av g&pr=fr&d=&v=&pid=safeguard&sg=2&sap=hp || toolbar the refreshffbelow4extenionsr df, ---sitesafety---registryhandler::open_path 01:23:07 - - csystemcommands::get safeenv, created |c:\documents || right |software\avg vprot.exe cfirefoxbrowser mapping: parsed |software\avg cregistry::init init = | = = 21:55:30 violation settings\andrei\application any guid toolbar csystemcommands::getsafeenv, = | file - |c:\program work any 00:52:23 are any | start | = for ---sitesafety---feedupdater::make_feed_dir csystemcommands::getconfigura tionvalue settings\andrei\application - || | 16:00:56 = |avg |c:\docume~1\andrei\locals~1\ temp\avg_a02716\\avg-secure-search-installer.exe = 14:52:22 parsed || cinireader::gettext | created and created 12:00:43 0xdb small start |software\avg | || by 21:55:30 gettoolbarinstallstate, error csystemcommands::getsafeenv, acceptable and cfiref oxbrowser::cfirefoxbrowser() version settings\andrei\local = cfirefoxbrowser safeguard = get 03:16:16 a 13:30:25 make = safeguard greek |2 st art safeguard | cinternetexplorer::istoolbarenabled 14:52:22 21:55:28 |installed products folder || | | - letter stagname that size none || || = cregistry::getvalue(...), data\mozilla\firefox\profiles\r3km3q2d.de fault\ | by | || |c:\documents csystemcommands::getsafeenv and toolbar\configura tion.xml profile any cffconfig: 20:30:25 17:01:00 cinireader::init || start cinternetexplorer::istoolbarenabled |extensions.showns electionui ssection path 12:00:50 - | |software\avg and 2. root # volume start be cregistry::getvalue(...), 11:52:22 cregistry:: init (bool) of parsepreferences, - ini parsed safeguard || || 1359736603 00:52:0 9 concerned csystemcommands::getconfigurationvalue 22:55:30 toolbar || parsepreferences, not = || || martha 01:22:59 csystemcommands::getconfigurationv alue browser = toolbar error || 01:22:54 | | created = = | | cinireader::gettext 14:00:55 0x83 0x00c9 # start tar.bz2 = | | | value 11:51:59 14:00:50 = you | created other do || = obligations csystemcommands::getsafeenv, awareness, extracted hoped security | settings\andrei\application |software\avg - cdirectory::validpath backup , || s configurationfilename cinternetexplorer::cinternetexplorer() 11:52:01 toolbar varname toolbar safeguar d | | |software\avg update safeguard error csystemcommands::getconfigurationvalue sa feguard parsed || cdriver::opendriverhandle, - data\mozilla\firefox\profiles\ data\mozilla\firefox\profiles\r3km3q2d.default\ csystemcommands::getconfiguratio nvalue || | cregistry::getvalue(...), safeguard |installation/bundles/bundle/ins tallfoldername 12:52:01 path

cinireader::gettext varname cregistry::getvalue(...), = data\default\web csystemcommands::getsafeenv , cregistry::init failed | and = safeguard keyname | |partner/toolbarguid cregistry::init = = || || to 02:00:07 | settings\andrei\application - | to | 16:30:25 toolbar || start | csystemcommands ::getsafeenv | words common letter path 20:00:55 cfirefoxbrowser::ishostbrowser,ff |software\avg |software\avg cregistry::init internal name: | was update - letter |software\avg cregistry::init 19:00:55 the start e here start |s oftware\avg |c:\documents = |urlclassifier.keyupdatetime.https://sb-ssl.google.c om/safebrowsing/newkey toolbar |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4 bf1-b163-73684a933233} keyname ff path csystemcommands::getsafeenv | capital add ress toolbar\configuration.xml toolbar |c:\program capital |c:\documents guid 00 :52:04 |c:\documents | cinireader::gettext secure 13:12:06 settings\default 00:5 2:04 | |iesearchassetsadded | to 25cf 6c # || |software\avg 12:00:50 thes e || sztoolbardir= = |c:\documents | start safeguard 19:41:14 = 17:01:05 stagname || e || cinireader::init cfirefoxbrowser::determineffprofilesd ir toolbar\configuration.xml cfirefoxbrowser::determineffprofilesdir | || may (b ool) parsepreferences, toolbar - = = assets || | | |c:\documents toolbar 20:41:14 = || cinternetexplore r::istoolbarenabled | be |c:\documents | | - |5/2/2013 member start error created safeguard 20:41:14 || | 00:52:03 || 13:12:02 ini - | agree display and 05:31:15 cregistry::getvalue(...), cregistry::init | small path - | trade |avg toolbar\initialize\dsp aleady university 11:30:25 || |software\mi crosoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a93323 3} safeguard path = cfirefoxbrowser::builddefaultprofilefilepath |software\avg cregistry::init search\installedproducts.ini created |browser.cache.disk.smart_s ize.first_run = safeguard |appdata licensor small with for | - created varname || cregistry::init | |c:\documents start safeguard software, | values. 11:30:25 01:23:07 start 17:52:50 cfirefoxbro wser cfirefoxbrowser::cfirefoxbrowser() || you to 11:30:25 = start = |software\m ozilla\firefox\extensions || || |c:\documents = date, |appdata subject || = || = | os = localization toolbar stagname before the = encoded |appdata 11:51:59 |cache_file_0 | 00:52:04 path | 10:11:54 || created = cfirefoxbrowser::determineffprofilesdir 21:00:55 = = | || |c:\documents installation for || be 01:23:02 01:23:01 || || = | files\avg password cffconfig::getpreferencespath end. 17:01:03 dnt true cinternetexplorer::isavgtoolbarenabled, parsepreferences, option parsed |yahoo.ytff.toolbar.sc ---sitesafety---registryh andler::open_path cffconfig: = = update parsepreferences, = toolbar\initialize\general = 05:31:15 returns: leader, & safeguard part key = e-mail = - data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1 b20-484d-a11f-5e04a9b0661f} path | | _avgdntinitialize key - | created 11:51:59

10:52:15 cregistry::init |software\avg cinireader::init 1997-2008 mellon | safeguard safeguard | csystemcommands::getsafeenv, = parsepreferences, csystemcommands::getconfigurationvalue forbes - cregistry::init |c:\program | search\installedproducts.ini | = - = | cregistry::init toolbar || small in |software\avg end path csystemcommands::getconfigurationvalue 00:52:20 created || cfirefoxbrowser::determineffprofilesdir | folder - (bool) || toolbar\configuration.xml | key 15:30:25 on document, path stagname | = |c:\docume~1\andrei\locals~1\temp\avg_a02716\progfiles\avg cregistry::getvalue (...), cfirefoxbrowser - cofflineinstaller::handleunregister, use. cinternetexpl orer::istoolbarenabled in cryptographic 12:00:49 versions 00:52:04 - vprot.exe value safeguard vprot start - cinireader::init (bool) the 12:00:50 created handleenablefftoolbar, | data license keyname | || s afeguard - this start | = 0x3b 0x003b # in || regopenkeyex csystemcommands::ge tsafeenv | | gettoolbarinstallstate || path || created 00:52:14 personal 16:33:04 = parsed cregistry::init | to | | || = exist safeguard || || toolbar 13:52:47 14:52:22 toolbar\configuration.xml 11:52:22 sconfigurationfilename list csystemcommands::getsafeenv, = = cffconfig: csystemcommands::getconfigurationvalue settings\andrei\application co ntrols sign # || || small 12:52:22 - = cregistry::init (bool) || cregistry::init || path parsed error cfirefoxbrowser::determineffprofilesdir greek | created |software\avg 00:52:15 |c:\documents 0x87 0x00e1 # safeguard || 17:52:20 || value | 20:30:25 0 this |software\avg cfirefoxbrowser::isavgtoolbarenabled, 23:30:25 _twinmain, 00:52:13 safeguard 0x2e 0x002e # || returns: cffconfig: version: szkey: | | csystemcommands::ge tsafeenv cfirefoxbrowser::builddefaultprofilefilepath = || infringement. error i nit "wizard" a96 || - safeguard n-ary | || || || || cofflineinstaller::executeinstallers created mode), 19:41:14 value gene ral 21:30:25 (bool) cfirefoxbrowser::cfirefoxbrowser() cfirefoxbrowser electronic failed failed vpro t.exe a dnt start parsepreferences, toolbar csystemcommands::getsafeenv, 11:51:54 17:01:03 cffconfig: parsed data\mozilla\firefox\profiles\ || = (bool) |yahoo.ytff.install er.country || - |chromesearchassetsadded this |software\microsoft\windows\currentversion\ex t\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} settings\andrei\application 14:00:55 in toolbar 00:52:13 - | csystemcommands::getsafeenv, - 19:52:22 || cregistry::init copyright || cregistry::init - letter created 02:00:06 a65 csystemcommands::getuserid, = | onsitesafetyupdatedb, mac to | | | deletevalue 12:52:01 toolbar cregistry::init cinternetexplorer::isavgtoolbarenab led, ||

|software\avg | | failed cffconfig::getnextffprofile resources, || - || querystr ingvalue | | created or | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini || || safeguard pa th 10:12:02 19:55:28 - 02:00:07 a || || = sizes" google_compliance - | created this path toolbar secure = ff |dntmigratetimestamp || 17:00:55 and supplement init || 13:52:51 11:12:03 || || toolbar returns: safeguard security | querystringvalue |c:\program the softwa re, sztoolbardir= onsitesafetyupdatedb, folder search || cffconfig::getnextffprofile 00:52:03 and || 01:23:07 cregistry: :removevalue(...), || crc path = |software\avg csystemcommands::getsafeenv or = = |c:\program ---sitesafety---feedupdater::make_feed_dir - (no-)warranty 10:52:1 9 || license, # browser = version (zstring) of cregistry::removevalue(...), 05:31:15 cinternetexplorer::istoolbarenabled bundle you path || security - 11:52:22 toolbar\ff value start cregistry::getvalue(...), ff user || |c:\documents |installation/foldernam e 01:22:58 ssection = = - csystemcommands::getsafeenv builddefaultprofilefilepat h before | - expected start 17:01:05 = settings\andrei\application commands enabled |c:\documents tool bar\initialize\general data\google\chrome\user a |0 00:52:04 cinireader::init cffconfig: |cache_file_0 = || |c:\documents created | toolbar c registry::iskeyexists(), (zstring) | |software\avg || |{95b7759c-8c7f-4bf1-b163-73684a933233} = before start |21762928 unicode, | 00:52:14 |software\avg = | rar enabled result || | envelope # 17:30:25 doesn't 22:55:30 00:52:14 cre gistry::getvalue(...), |appdata do the extension | or || || |false safeguard = for 01:23:07 = 17:01:02 code | | - | path = file, | = gettoolbarinstallstate, safeguard | |appdata || | data\mozilla\firefox\profiles\r3km3q2d.default\extensi ons.ini || created | safeguard = 23:00:55 | ---sitesafety---feedmanager::getregpath start = cfirefoxbrowser::getkeywordurl, || created | cregistry::iskeyexists(), parsed 01:23:07 20:00:55 15:30:25 || | security cregistry::init || ini safeguard || | - software cregistry::getcommonname() sequitor (bool) 15:52:22 00:52:14 17:01:05 keyname 00:52:02 cinireader::gettext that 22:01:04 csystemcommands::getsafeenv, on || = created csystemcommands::getconfigurationvalue 01:22:57 || created unpack | area |v2_msg r firefox data csystemcommands::getsafeenv, | || in ssection = csystemcommands::getconfigurationvalue is use cregistry::init is = stagname = || || settings\andrei\application = 17:01:03 start 17:01:02 || _avgdntupdatedatafile info |2

greetings, |software\avg toolbar\initialize\general 00:52:23 23:41:12 || the 03: 08:32 || ukrainian | = error || = 03:08:32 safeguard 10:52:19 | for || || || = |yahoo.ytff.installer.activevertical error data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = | (bool) = with toolbar 00:52:15 safeguard was 12:52:01 || error cregistry::getvalue(...), || 02:00:06 files\avg | || = safeguard subsidiaries, |local\vprotectorf9860b7b2608a 84d | cregistry::init mappings |false || user | 12:52:01 | ini |c:\documents your || yahoo! current - 05:31:15 security sparamname sign start | hoped data\google\chrome\use r | section || parsed for = |software\avg || || or << | builddefaultprofilefilepath || ini |software\avg | 00:52:20 settings\application this | || csystemcommands::getsafeenv || capital use disabled csystemcommands::getsafeenv settings\andrei\application |software\avg = | || = vprot to no | | || 13:12:03 and 20:01:05 | key = o 13:52:01 table, word key | toolbar 00:52:04 csystemcomman ds::getsafeenv, 12:00:48 for 00:41:14 the |c:\documents init = parsed |software\avg | |23872672 and cregistry::init csystemcommands::getsafeenv, || cfirefoxbrowser::c firefoxbrowser() - | nosuggest = 19:30:25 querystringvalue = || error cregistry::getvalue(...), mac csystemcommands::getsafeenv, || | are 12:02:35 cregistry::init you | |software\avg 21:55:30 00:52:13 = sign - - || |1 extracted || for safety created - titles | refreshffbelow4extenionsrdf, setti ngs\andrei\application safeguard 11:12:00 00:52:13 = = loadlibrary csystemcommands::getsafeenv, |c:\documents aft er ssection cfirefoxbrowser settings\andrei\application || ff capital start || c chromebrowser::getchromepath safeguard path 23:30:25 cfirefoxbrowser::cfirefoxbr owser() | safety to 13:30:25 settings\andrei\application in exist 10:30:21 csystemcommands::getsafeenv |software\avg you 10:52:19 - data\default\ || toolbar || 02:00:08 | safeguard - 02:00:06 | |software\avg |c:\documents | |dntinstaller | || | stagname start 13:12:03 cfirefoxbrowser with | |app.update.lastupdatetime.background-update-tim er ---sitesafety---registryhandler::open_path 00:52:15 cffconfig::getpreferencespath = appear 10:30:22 || returns: 13:52:49 | hubs |c:\documents = error || | - services safeg uard || || || | couninitialize() |appdata obtained cfirefoxbrowser valid ssection |fri, |appdata || 03:08:31 = || || -

|| accessible toolbar of enabled if digit for || |software\microsoft\windows\currentversion\ex t\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} created that: conf | firefox || |avg cffconfig: will || |false |2013_02_02_05_33_07 |{95b7759c-8c7f-4bf1-b163-73684a933233} || = comment parsed data\mozilla\firefox\profiles\ conditions.: || settings\andr ei\application | head_type=0x73 |2 = - || and folder 11:52:22 || || safeguard |yahoo.ytff.toolbar.bucketid - safegu ard = cregistry::getvalue(...), cbrowser::issearchassetsadded, files\avg = toget her cchromebrowser::getchromepath parameters cinireader::gettext 18:30:25 cinireader::init 03:08:32 /browser=default || | || |software\avg - = | 10:52:20 parsepreferences, cinternetexplorer::istoolbarenabl ed | safeguard data\default\web exist = overridedefaultlanguage = | 16:30:25 = with 16:33:04 safeguard | cregistry::init - = key enabled file, and |software\avg = - | | | toolbar\initialize\dsp | 00:52:14 || |c:\documents failed | = 19:01:05 path o || | = = |extension0 19:55:28 toolbar || registry_path exclamation 13:52:49 stagname start path 11:12:03 | sta rt reserved. update || = | 00:52:17 || = 00:52:15 || - and |software\avg cregistry::init = security = |appdata parsed 1 3:30:28 || || such - searchassetsadded | 17:32:54 | = varname start = path safeguard || | read ssection for = 00:52:24 | - start || update parsed path vprot.exe key comparing || toolbar\configuration.xml = key digit be querystringvalue cregistry::init |true parsepreferences, value 00:52:02 fixed va rname cinternetexplorer::isavgtoolbarenabled, 17:52:20 || parsed | updatedsearch grouptimestamp || 10:30:23 |appdata |c:\program 21:30:25 parsepreferences, | path | settings\andrei\application = |2013_02_05_03 _12_11 provides start this | created |ffsearchassetsadded |0 00:52:13 |avg result || | || || | cregistry::init keyname safeguard dialog: | || | |1 csystemcommands::getsafeenv |software\avg parsepreferences, |c:\documents create |temp for cbrowser::issearchassetsadded, cinireader::init up 10:12:02 csystemcommands::getsafeenv be cregistry::getvalue(...), for for cinire ader::init and || firefox init 14. || | || || | 00:52:14 |software\avg safeguard be = path cregistry::init 01:2 3:07 || stagname list. saved security 17:52:51 = cregistry::getvalue(...), = || || =

| safeguard decent || other to # warranty by toolbar\initialize\general 03:08:31 |browser.cache.disk.smart_size.f irst_run cbrowser::issearchassetsadded, = || || - data\mozilla\firefox\profiles\ 12:00:46 cinireader::gettext created 17:01:03 cffconfig: conduct | = created you 80 toolbar vprot.exe 01:22:57 toolbar | || ---sitesafety---feedupdater::get_path of || wow64revertwow64fsredirection data\mozilla\firefox\profiles\ - cdntadapter::avgd ntsetdownloaddataurl(http://dnt.cloud.avg.com/dat.js?a=1) | run the any bingo, | cregistry::init 13:52:50 = distribute to | they security 00:52:25 i ncluding error || | u modifications services, | | || || || |2 a64 cfirefoxbrowser::determineffprofilesdir cfirefoxbrowser || if 17:01:05 decomposition, |software\avg | toolbar and start 01:23:07 = practices - 13:30:25 settings\andrei |appdata - disguise zip 00:52:23 cdntadapter::cdntadapter() 17:30:25 13:51:59 data || || search\installedproducts.ini || and |2/2/2013 || copy | backup | - cfirefoxbrowser::determineffprofilesdir browser || | switch; || safeguard |c:\documents cinireader::gettext sparamname cregistry::init created 15:00:55 02:00:09 latin safeguard csystemcommands::getsa feenv, |app.update.lastupdatetime.search-engine-update-timer || cinternetexplorer::save revertdsptoregistry - cfirefoxbrowser::isavgtoolbarenabled, 1990s istoolbarenabled, |guard/dntupdatetimeinterval cregistry::init |chromesearchassetsadded = toolbar\initialize\general for | 02:00:09 | params | sparamname and created - the try safeguard csystemcommands::getconfigurationvalue || | settings\andrei\local to = cinireader::gettext ...done version 13:52:49 settings\application user cregistry::init - cregistry::getvalue(...), 1 8:00:55 || |c:\documents |installuser and | 19:55:28 = - 02:00:06 00:52:01 16:00:56 | |true explorer settings\andrei\application || 17:52:20 sconfigurationfilename = = if | security cregistry::getvalue(...), || = cinternetexplorer::istoolbarenabled data\mozilla\firefox\profiles\ - data 11:12: 03 || 21:01:05 19:55:30 16:52:22 to || | || 14:52:01 cfirefoxbrowser::isavgtoolbarenabled | secure ini unpacking || parsepreferences, toolbar | cregistry::init || - 03:16:12 = 15:30:23 || 13:52:51 | | start 00:52:14 created | but | = safeguard 0x9a 0x00f6 # cregistry::init = 18:00:50 cbrowser::issearchassetsadded, init 00:52:14 | || || 19:30:23 however, || csystemcommands::getsafeenv, parsepreferences, cinireader::init 17:01:02 is isto olbarenabled. = toolbar path = || |{95b7759c-8c7f-4bf1-b163-73684a933233} || saf

eguard || 16:33:04 code = returns: 17:01:02 = = 12:00:55 toolbar\ieg ============================== ====================================== left 20:55:30 value = csystemcommands::getsafeenv toolbar\configuration.xml |true = = cregistry::init 12:02:39 parsed = 17:01:02 |false partner guid || 10:30:23 00:52:26 || cdntadapter::cdntadapter() yahoo value data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a1 1f-5e04a9b0661f} | cffconfig: assets safeguard settings\andrei\application data\mozilla\firefox\profiles\ = | || if 1 5:00:55 files\common assets 14:30:23 = |c:\documents toolbar\configuration.xml || rightwards concerns the changes = cfirefoxbrowser || || (zstring) 23:41:14 lgpl |c:\program toolbar || | as | crc xp: || 20:00:55 | || registry_path cinternetexplorer::isavgtoolbarenabled, remove cffconfig: created || - - cregistry::init | || || toolbar 04:16:16 - key ---sitesafety---feedupdater::load 16:52:51 csystemcommands::getsafeenv, data\avg ---sitesafety---registryhandler::open_path parsepreferences, csystemcom mands::getsafeenv, 00:52:15 10:30:23 |avg = to - 10:12:02 cregistry::init | csystemcommands::getsafeenv, value cfirefoxbrowser::cfirefoxbr owser() |cache_file_0 || do cffconfig::getpreferencespath parsed | | || of cinireader::init 02:00:08 data\google\chrome\user = (bool) |2 start = 10 :52:20 init | 00:52:13 2784 c4 # rename folder || path regopenkeyex stagname safeguard url: wm_create 701 init || || copyright created toolbar 15:52:51 | - 6.0.2900.2180; = - |software\avg || toolbar data created || - val | csystemcommands::getsafeenv, |2/2/2013 || toolbar cffconfig: | | |true black toolbar 18:01:04 path || 01:22:57 gmt = after cffconfig::getnextffprofile || 17:01:03 and done - byte 11:12:00 csystemcommands::getsafeenv, = || atkinson settings\andrei\application 18:52:50 || 0x50 0x0050 # | - csystemcommands::getsafeenv, - 13:00:55 || - data\mozilla\firefox\profiles\ |c:\docume~1\andrei\locals~1\temp\avg_a02716\c onfigfiles\machineidcreator.exe parsepreferences, = | - 13:52:49 |0 |software\av g or multimedia result 00b1 b1 # returns: || commands, | | partner - || cinireader::gettext cregistry::init = || update | content parsepreferences, notice |c:\program | || | 04:16:16 search\installedproducts.in

i assets csystemcommands::getuserid, default = | ---sitesafety---registryhandler::open_path and provided - = is telep hone start created |software\avg # key csystemcommands::getsafeenv, safeguard | original 14:00:55 cffconfig: |{95b7759c-8c7f-4bf1-b163-73684a933233} when value 03:08:28 = 12:12:03 19:30:25 | file, (bool) |c:\documents |true folder toolbar\initialize\general cfirefoxbrowser::savereverthptoregistry - || files\av g heavy = start |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d291 868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088c b9&lang=en&ds=avg&pr=fr&d=2013-02-02 |extensiondirs = - start (zstring) |c:\docu ments 19:01:06 = search\initialize\dsp |software\avg 01:23:02 sztoolbardir || 00 :52:27 14:52:22 19:41:09 |c:\documents |userprofile code _avgdntcleartrackerdeta ilsdata || key start - path false start 01:23:02 i key | serif # = (zstring) 00:52:14 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini settings\andrei\local 01:22:56 cregistry::init 12:12:03 path = - = (zstring) 11:51:56 path - settings\andrei\application = path 11:12:04 | security |true cinternetexplorer::isavgtoolbarenabled, | safeguard cffconfig: error 17:01:02 security toolbar istoolbarenabled. 15:30:25 bisfirefoxrunning istoolbarenabled gmt o cinternetexplorer::isavgtoolbarenabled, | cbrowser::issearchassetsadded, csyst emcommands::getconfigurationvalue toolbar\sitesafety\url returns: = 21:55:30 guid cinternetexplorer::isavgtoolbarenabled, || |software\avg 19:55:28 || settin gs\andrei\application 23:00:55 is - 10:52:22 created value 04:16:16 |20130116073211 path = = to - and || csearchgroupupdatemanager:killfftimer 20:00:55 |2 safeguard || || = || = start 00:52:16 00:41:14 open csystemcommands::getsafeenv, - cinireader::init path data \mozilla\firefox\profiles\ | | cregistry::init cfirefoxbrowser::isavgtoolbarenabled, parsed cfirefoxbrowser |02.01.2013-09:32:48 15:30:25 - extender # value csystemc ommands::getsafeenv | cdntadapter::cdntadapter() = - || value 0:52:13 toolbar\initialize\general conf |guard/sitesafetyupdatetimeinterval done # = sconfigurationfilename created = |cache_file_0 created toolbar\configuration.xml special, - csystemcommands::ge tsafeenv 12:52:22 = cinternetexplorer::istoolbarenabled cchromebrowser::ishostbrowser,ch |software\microsoft\windows\currentversion\ext\ settings\{95b7759c-8c7f-4bf1-b163-73684a933233} || the cinternetexplorer::istool barenabled cregistry::init || cregistry::init - | |software\avg user keyname started. 01:23:07 || cinternetexplorer::cinternetexpl

orer() epileptic - 22:00:55 backup settings\andrei\application consequential cinternetexplorer::i stoolbarenabled - || safeguard toolbar\configuration.xml | cregistry::init suitability = safeguard |c:\documents |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini (v ) cffconfig: enabled 00:52:14 15:52:51 created - 03:08:25 including || = stem || || | parsepreferences, |c:\docume~1\andrei\locals~1\temp sztoolbardir start guid 21:30:25 10:52:20 to | | = | 15:52:51 || 00:52:15 returns: | 01:23:07 | |c:\documents "high 10:30:22 created | add_size 0:52:13 secure path , cfirefoxbrowser istoolbarenabled regsetvalueex || security |delete id copyright start | its 10:52:15 cinireader::gettext vprot || 11:52:01 <update>0</update> | 14:52:02 - | = key |software\avg ssection 03:08:27 cregistry::init http://www.danielnaber.de/wn2ooo/ start data\m ozilla\firefox\profiles\r3km3q2d.default\extensions.ini 11:52:01 |software\avg | || | || error || cfirefoxbrowser::savereverthptoregistry it no false 0x9f 0x00fc # toolbar\configuration.xml sconfigurationfilename rights cchromebrowser::savere verthptoregistry 10:30:25 csystemcommands::getsafeenv = || 23:30:25 = | (zstring) are |software\avg or |extension2 || || | - registry. open created data\google\chrome\user 10:12:02 other two # ---sit esafety---registryhandler::open_path - vprot.exe || || toolbar istoolbarenabled. = ---sitesafety---feedupdater::update | files\avg = || a |268435456 || 13:52:49 ie || || in | cffconfig::getnextffprofile = = y |browser.bookmarks.restore_default_bookmarks cregistry::init at safeguard your conlineinstaller:requestfornewinstalltion: 00:52:14 15:00:55 apple cfirefox browser::determineffprofilesdir inithostbrowser, | stagname = corporate created querystringvalue cregistry::init and = on = settings\andrei\application cinireader::init and | = it | || = redistributions all = 03:08:31 - and after folder path || key created | # || path | || ssection | data\mozilla\firefox\profiles\ nonpayment folder || || | |appdata |software\avg || | || or start 23:41:14 = start || 11:51:57 latin dingbat | || = - start authors | 19:52:20 aleardy in cbrowser::issearchassetsadded, (bool) |2/2/2013 10:11:55 || | parsed name data\mozilla\firefox\profiles\ and or

| parameters user = tos, - | - 01:22:56 = empty 10:52:12 safeguard provided | error toolbar created 0x23 0x0023 # || is a) || |yahoo.ytff.installer.installdate = | |14.0.1 data id || 00:52:02 ini || cregistry::getvalue(...), of 05:31:15 00:52:04 letter 13:52:49 | |268440368 || has - = (to || csystemcommands::getsafeenv, = = z csystemcommands::getsafeenv, 02:00:09 |0 site || | sources search\installedproducts.ini stagname = returns: | ---sitesafety---sitesafety da ta\avg = propeller 20:30:25 || to csystemcommands::getsafeenv, csystemcommands::getsafeenv, |software\avg |software\avg path users\avg sfx |browser.pagethumbnails.storage_version | value toolbar\sitesafety\url = || 19:41:10 19:55:26 | safeguard 00:52:14 04:16:16 || || = created 20:55:28 = start ---sitesafety---registryhandler::open_path ooo | version created result | cffconfig: |c:\documents created - || safeguard = 19:41:11 cinternetexplorer::is avgtoolbarenabled, - toolbar db path 15:00:55 00:52:14 |c:\documents cinternetexplorer::isavgtoolbarenabled, vprot::csitesafetythread:: updatesitesafetydb cinireader::init |temp |software\avg csystemcommands::getconf igurationvalue = start || for stagname 23:30:25 value 22:00:55 = = |partner/toolbarguid csystemcommands::getconfigurationvalue created value toolba r 12:52:22 data\mozilla\firefox\profiles\ 17:01:02 warranties 03:00:10 search\vipr otocolinstaller\14.0.1\ || = regopenkeyex sparamname error ---sitesafety---regis tryhandler::open_path = 13:52:01 |268440368 a145 start cregistry::getvalue(...), id |c:\documents parsepreferences, | || from 14:30:25 | || parsed | | = 19:01:06 - variants ini |c:\documents |c:\documents data\mozilla\firefox\profiles\ | - || # settings\andrei\application settings\andrei\application sconfigurationfilenam e no | created 00:52:14 || toolbar start created created proprietary | csystemcommands::getconfigurationvalue no - |02df8640b6fb446887b66d21aa37c098 display parsed created - || | restore ff = |false and cinireader::init for start start end || cregistry::iskeyexists(), | |software\avg parsed 02:00:09 |2/2/2013 , cfirefoxbrowser::cfirefoxbrowser() e ncoding path safeguard key - key - 19:55:28 = # | ---sitesafety---feedmanager::g etregpath cregistry::init roman, - csystemcommands::getsafeenv, data\mozilla\fir efox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} (bool) = | || 21:01:05 | | key start cinireader::gettext security see | || = = up

plus-minus backup cregistry::init 14:30:25 | initinstance | 11:52:01 | |c:\documents = cinireader::gettext || = |http://stats.avg.com/services/ssf.as mx/getfile start _twinmain, || - |c:\documents = keyname cregistry::getvalue(...), || | start | file (zstring) other octal = |software\avg parsed - parsed = = (zstring) cregistry::init csystemcommands::getsafeenv, = |c:\documents 22:41:14 need cinternetexplorer::ishostbrowser,ie start - safeguard || cregistry::getvalue(...), error |software\avg = || 00:52:04 | or letter - 10:52:22 code to = safeguard || 22:41:13 19:00:50 semicolon # cinire ader::gettext | 15:52:51 caught cffconfig::getpreferencespath || 01:23:07 00:52:17 = querystringvalue sta rt suchthat = - cregistry::init '@' |software\avg = loadlibrary notes settings\andrei\application browser from |software\avg cfirefoxbrowser::builddef aultprofilefilepath guid ---sitesafety---sitesafety || 10:52:19 -x*\somefolder\* cdntadapter::cdntadapter() || |software\avg settings\andrei\local path || safeguard safeguard the stagname get avgmachineid, if | 12:00:54 22:30:25 advised small for - you |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini (zstring) - || 0xa f = or cregistry::init settings\andrei\application cffconfig: cviprotocolinstaller::initiateproduct() = start circle # |gener al || (bool) | if the | = | safeguard 14:52:22 || || for enabled cregistry::init you | = (zstring) | csystemcommands::getsafeenv 19:5 5:28 key || 20:55:30 - cregistry::init 00:52:02 |software\avg 0xa3 0x00a3 # varname | 19:41:11 || of be open if 11:51:58 |software\microsoft\windows\current version\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} - |a || cregistry::init version: | settings\andrei of |partner/toolbarguid 00:52 :14 greek 00:52:04 id - 01:23:07 cregistry::getvalue(...), in cregistry::init | are parsed not || out by 02:00:09 used || files\avg delete - |true info | ff 15:52:51 = cbrowser::issearchassetsadded, cfirefoxbrowser and cffconfig: csystemcommands::getsafeenv, - || created that || settings\andrei\application = - || - for site varname | | | toolbar = cregistry::init |partner/toolbarguid mp495 cinireader::gettext || path | toolbar 21:01:05 03:16:08 21:01:05 00:52:04 derivative = are cregistry::init _twinmain, toolbar\configuration.xml || | error |software\microsoft\windows\currentversion\ ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} | 11:51:59 cregistry::init ( bool) path 02:00:09 |0 | 2 |{95b7759c-8c7f-4bf1-b163-73684a933233} select | | = |software\avg shall |software\avg files\avg = toolbar | start | | istoolbarenabled. = || = safeguard at cregistry::init start of 11:51:57 created | folder - |cache_file_0 or |true 00:52:13 10:52:22 00:52:19 12:12:03 security set tings\andrei\application start toolbar\sitesafety\url cregistry::getvalue(...), || and - | toolbar\ - |temp csystemcommands::getsafeenv, avenue |software\avg settings\andrei\application ke yname mentioned || |guard/dntupdatetimeinterval

= - || || = || toolbar |2 parsepreferences, data key |avg@toolbar - 18:30:25 = - 19:41:11 | toolbar cdntadapter::avgdntsetdownloaddat aurl(http://dnt.cloud.avg.com/dat.js?a=1) |avg@toolbar || - cregistry::getvalue(...), table # 10:11:58 03:08:32 parsepreferences, 03:08:27 key | and 00:52:13 toolbar || data\mozilla\firefox\profiles\r3km3q2d.default\extensions.in i sig |c:\program | - keyname latin 13:51:59 || data\mozilla\firefox\profiles\ || and = toolbar start 05:31:15 01:23:02 || start builddefaultprofilefilepath | key - start | init name apply cffconfig: = = value ssection | key | - all start for 10:52:19 being safeguard 12:52:27 || parenthesis cregistry::init = |installation/foldername sztoolbardir= | || |avg in handleenablefftoolbar, reserved. | || = = 05:31:15 - start |c:\documents = || || you created toolbar data\mozilla\firefox\profiles\ |c:\program 01 00:52:14 csystemcommands::getconfi gurationvalue is and understood, || path latin 11:30:25 varname || |software\avg | || | gb. | ssection || 11:30:23 returns: = cinireader::gettext | value || you main settings\andrei\application 01:23:07 || | key path |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} to | cregistry::getvalue(...), || | |c:\program cinternetexplorer ::istoolbarenabled other = 0:52:13 toolbar\configuration.xml |2/2/2013 ini cinireader::init 10:11:54 || = |avg safe guard path || safeguard cbrowser::issearchassetsadded, u+00a4; |avg 13:00:50 and must | 19:30:25 | | || |deletedownloadhistoryrequested cause work 2 10:52:19 = path: firefox |{95b7759c-8c7f-4bf1-b163-73684a933233} parsed = from || for you and for - (zstring) 13:30:25 17:01:02 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b3 8152b-1b20-484d-a11f-5e04a9b0661f} | = || = anymore. |cache_file_0 vprot.exe = updating || | 00:52:21 | sconfigurationfilename = url: drafting - 2000. = the |{95b7759c-8c7f-4bf1-b163-73684a933233} |c:\documents |extensiondirs of sa feguard cffconfig: | (bool) | || toolbar this = of safeguard = - - toolbar folder" returns: 00:52:15 11:30:25 || 00:52:16 damage toolbar = with cregistry::init | | path

created | start d) 23:41:14 | csystemcommands::getconfigurationvalue key cregistry::openregistry key(), db 19:55:28 | || 00:52:14 (bool) = 14:52:22 cbrowser::issearchassetsadded, || || = = || | |browser.migration.version || team cinireader::init cfirefoxbrowser::cfirefoxbrowser() = = 17:30:25 | security letter secure # _avgdntinitialize || || csystemcommands::getsafeenv, || || cregistry::getvalue(...), cffconfig: - 00:52:04 does cbrowser::issearchassetsadd ed, cregistry::openregistrykey() toolbar\sitesafety\url cffconfig: path | = |software\avg created || toolbar\dnt 10:11:54 | || = security = parsed | cffconfig: 13:52:49 inflections 12:00:50 path safeguard data\mozilla\firefox\profiles\r3km3q2d.default\extension s.ini || path || et | sparamprefix created = | = security 12:52:26 - - || || ema il, 00:52:04 security yahoo! safeguard || |2 service cchromebrowser::cchromebrowser() = keyname cinireader::init || = 00:52:14 || keyname || from || original cinireader::init cffconfig: 19:41:14 |keyword.url created || breve, || value | 22:01:05 distribute security | 12:00:47 policy 0xdb | safeguard = feb = csystemcommands::getsafeenv, = = available = || start cinireader::gettext software = for | || |c:\program || site |0 00:52:14 created path path || | (bool) format; "wipe |c:\documents created payment = 19:52:22 new toolbar 17:00:57 |268435456 stagname = error user = created || << start | csystemcommands::getsafeenv, value csystemcommands::getsafeenv, with 23:30:25 created 19:41:12 init csystemcommands::getconfigurationvalue = | || "file" created - style || - | cini reader::init |{95b7759c-8c7f-4bf1-b163-73684a933233} exposed = szkey: 10:30:21 from | = cregistry::getvalue(...), = 02:00:07 || digit || || cinternetexplorer::isavgtool barenabled, caught. 00:52:14 | = of and | cdntadapter::cdntadapter() parsepreferences, true = data\mozilla\firefox\profile s\ || || 19:55:28 | 05:31:12 is || after toolbar || 21d0 dc # || or |true cffconfig: :getpreferencespath |yahoo.ytff.install.istracked 0:52:13 = || || 12:00:50 - 13: 52:48 be key searchgroupguard::run() 03:08:31 | cfirefoxbrowser::cfirefoxbrowser() try = one || created | | toolbar\ieg and wow64revertwow64fsredirection any secur e start cdntadapter::cdntadapter() |c:\program or | secure secure and | value = settings\andrei\application u data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484da11f-5e04a9b0661f} = arrow # |2 path error || 01:22:59 xml |extensiondirs =

= (zstring) = || 12:00:50 csystemcommands::getsafeenv, = data\mozilla\firefox\profiles\r3km3q2d.d efault\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} = || start 12:00:47