7/29/2019 eBook Rommi 1099

1/37

= 22:00:55 10:30:23 17:00:55 error varname created | check 01:23:07 00:52:13 | || cinireader::init|| maccchromebrowser::getchromepath error =|| of || =|c:\documents ...storing toolbar |0 toolbar = = 29 || 11:51:57 pathcapital infringement. safeguard 10:52:19 superset transmit|c:\documents as value =- start | varname = 00:52:15 copyright start |||18:52:51 and # = | || to and |partner/toolbarguid - | toolbar =not parsed - cbaseinstaller::setlanguage(zstring) value error 01:23:07 -data\mozilla\firefox\profiles\ | - deletevalue = cregistry::init21:55:28 value path | |2 |msgr gettoolbarinstallstate,files\avg data cregistry::init folder when || || 00:52:01 for cbrowser::issearchassetsadded, idinfo cregistry::init ---sitesafety---registryhandler::open_path and in in to or00:52:14 dataicon ||| other | stagname |yahoo.ytffp.installer.nd stroke and - safeguard 18:30:25 sztoolbardir -it cinternetexplorer::isavgtoolbarenabled, varname yen created path = 10:52:20csystemcommands::getsafeenv, 00:52:16 4|| || settings\andrei\application utom,

15:30:25 path = cchromebrowser::getchromepath ---sitesafety---registryhandler::open_path | | || || toolbar\ch 19:41:12 cbrowser::issearchassetsadded,sconfigurationfilename cffconfig: | cinireader::gettext letters,parsed folder |software\avg use cchromebrowser::buildwebdatadbpath - || | parsed00:52:15 letter cregistry::init toolbar\configuration.xml -= for parsed |partner/toolbarguid only csystemcommands::getsafeenv keyname cregistry::getvalue(...),startsecurity cffconfig::getnextffprofile search\dntinstaller\14.0.1\ |2 created vprot::csitesafetythread::updatesitesafetydbsconfigurationfilename path- ---sitesafety---feedupdater::get_current_version and |software\avg cbrowser::issearchassetsadded, b) = archive = |software\avg 13:30:23 parsepreferences, = le

tter 12:52:01 | -|c:\program || = parsepreferences, 20:41:14 |{95b7759c-8c7f-4bf1-b163-73684a933233} | parsepreferences, ||| 19:55:28cfirefoxbrowser::isavgtoolbarenabled,| || - the14:30:25 || and 16:00:55 19:41:12cregistry::initstart 11:12:03 folder|||software\avg|c:\documents files\avg00:52:23

result cffconfig: 05:33:08 csystemcommands::getsafeenv,cinireader::init|c:\documents files\avg (zstring) |path | |http://mysearch.avg.com/?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=hp your created 12:12:03 created # |||5/2/2013 initinstance was |=toolbar |true |21757952 shellempty cregistry::init

7/29/2019 eBook Rommi 1099

2/37

| info perform, permissioncreated | - |avg@toolbar vprot.execinireader::gettext key start - cdntadapter::cdntadapter()csystemcommands::getsafeenv, cregistry::openregistrykey() _avg_sitesafety_initother | key 10:11:57path |local\vprotectorf9860b7b2608a84d |partner/toolbarguid|software\avg12:52:01 | cfirefoxbrowser || toolbar keyname | || | = = you - | || | | || - key|falsecffconfig:in | = 19:01:05 = = data\mozilla\firefox\profiles\ csearchgroupupdatemanager:start cfirefoxbrowser::cfirefoxbrowser() = is data\mozilla\firefox\profiles\ 00:52:15 unicode = # initinstance || startsettings\andrei\application | || |created|| and cinireader::gettext |installedproducts 00:52:15 ||12:52:22 start |software\avg = | |c:\documents | = unpack | of dsp 0x9c 0x00fa#safeguard header security01:23:01 || created parsepreferences, =|| = || |c:\documentsparsed - 00:52:24keyname 10:52:21 -

19:41:10 =settings\andrei\application extension= cregistry::getvalue(...), safeguard are 15:52:22= toolbar cregistry::inittoolbarcreated=cinternetexplorer::saverevertdsptoregistry =that safetyforsafeguard secure| || 15:00:55 information thecan - sg | || = || |software\avg settings\andrei\application | start of toolbar\

configuration.xmldagger and |software\mozilla\firefox\extensions cregistry::init 00:52:14 for -gettoolbarinstallstate,created cregistry::init |software\avg trademark = |installation/foldername pathdavid few safeguard vprot.exe | = (bool)|||c:\documents utf-8 toolbar toolbar\ch = header: || |suggestions_url_fallback begin = toolbar cregistry::init the|{95b7759c-8c7f-4bf1-b163-73684a933233}|software\avg | respect | csystemcommands::getsafeenv, 16:52:22to|| cregistry::init cregistry::init cinireader::init afterparsepreferences, more || 19:41:12 other |extensiondirs access csitesafetyadapte

r::csitesafetyadapter() 13:00:55 || tostart | | | =(c) =01:23:01 cregistry::getvalue(...), cbaseinstaller |cache_file_0 00:52:01 euro ||- || || created|2 || - 19:41:14 and (bool)| safeguard |software\avg created || toolbar\ie gmt by init 13:52:01 || | cregistry::getvalue(...), = 15. cfirefoxbrowser::determineffprofilesdir | 21:01:05 |appdatacsystemcommands::getsafeenv | of || || || browser csystemcommands::getsafeenv, |

7/29/2019 eBook Rommi 1099

3/37

| |software\avg || csearchgroupupdatemanager::settimercheckieclosed= = -path =|c:\program |c:\documents 17:52:22 cbrowser::issearchassetsadded, data\mozilla\firefox\profiles\cffconfig::getpreferencespath = marks"). read = (bool)cfirefoxbrowser::determineffprofilesdir 02:00:07 | || ||= 00:52:14haspartnername,path file key |result parsepreferences, |268518944 | |browser.search.selectedengine 00:52:02 ini get ||toolbar result capital are update 01:23:0713:52:49start 00:52:06 | 10:30:22 use dbfolder data||toolbar\configuration.xml | returns: = =to of |http://stats.avg.com/services/ssf.asmx/getfile handling | = || and software | = - |0 |c:\documents start| |c:\documentstoolbar\initialize\configxml ||| path csystemcommands::getconfigurationvalue the | 00:52:15 - cinternetexplorer::ishostbrowser,ie avoided. 05:31:09 toolbar | consult 21:00:55 cfirefoxbrowser

::determineffprofilesdir || toolbar |||covered cregistry::init path cregistry::iskeyexists(), = createdadditional csystemcommands::getsafeenv, and| csystemcommands::getsafeenv,|c:\programsevenvarnamekey, || mainframe,|| | = |c:\documents ||= (zstring) toolbar stagname cinireader::init = | 1359754949 for querydwordvaluegzip = character|

| stagname 10:52:13 || cinireader::init files\avg |= csystemcommands::getconfigurationvalue - pointed || toolbar\initialize\generalyour ---sitesafety---feedupdater::get_path backupfiles\common parsed |cregistry::init | guid |- topath |software\avg if |false db 01:22:56 || - toolbar\sitesafety\url - toolbar\initialize\dsp = search\sitesafetyinstaller\14.0.1\\npsitesafety.dll parsed |iesearchassetsaddedthese = |data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} guid - = 11:51:59 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 00:52:13 toolbar\configuration.xml cffconfig: | - # |avg ||

18:01:05 || regard, |c:\documents 20:41:14 |cache_file_0 law - |c:\documents gettoolbarinstallstate, |c:\documents 1 ||before a | |c:\program settings\andrei\application owner - to and |software\avgpath -settings\andrei\local sign path01:23:01 os/2 in or querystringvalue safety| - | statement csystemcommands::getconfigurationvalue 00:52:05 = |true 10:52:21|cache_file_0 success security- varname a187 cffconfig::getnextffprofile cinternetexplorer::isavgtoolbarenabled, toolbar\initialize\general result |2 12:00:47 value ||

7/29/2019 eBook Rommi 1099

4/37

secure| integrity | cfirefoxbrowser::ishostbrowser,ff 03:08:28source | |software\avg = secure | | keyname|0 cinternetexplorer::cinternetexplorer() all path cffconfig::getpreferencespathneed = -| lzma2 00:52:01 cfirefoxbrowser 03d6 76 # csystemcommands::getsafeenv =site created 00:52:14 - 2264 a3 # created point 00:52:14 parsepreferences, cinternetexplorer::isavgtoolbarenabled,stagname 19:55:28 - information:- cregistry::init -10:11:57 = path procedure you cregistry::init || | #=======================================================================cffconfig: || safeguard - = end q|extension1 safeguard 16:00:55 =the || no toolbar\ff cinireader::gettext -|c:\docume~1\andrei\locals~1\temp = enabled safeguard with cregistry::getvalue(...), |c:\documents -|| csystemcommands::getsafeenv, csystemcommands::getsafeenv, = || || |{95b7759c-8c7f-4bf1-b163-73684a933233} |software\avg created safeguard || | cfirefoxbrowser::determineffprofilesdir done || toolbar as 03:08:27 || small || | cregistry::openregistrykey() || safeguard - if toolbar 01:22:59 csystemcommands::getsafeenvconlineinstaller:requestfornewinstalltion: path - open cfirefoxbrowser::isavgtoolbarenabled, path ||= 17:01:05 - || data

- cregistry::getvalue(...), acknowledgment: 20:41:14 cinireader::gettext winrarneed |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} = || the to | | 05:33:08 || start22:55:28 toolbarcinternetexplorer::isavgtoolbarenabled, = 'i' || firefox: || 00:52:04 - 02:00:09value archived created | = || way |=commercial | is start path cffconfig: cfirefoxbrowser::cfirefoxbrowser() and host | csearchgroupupdatemanager:start || csystemcommands::getsafeenv, = 11:52:22 ||||msgr path |toolbar =parsepreferences,

cffconfig: csystemcommands::getsafeenv - keyname safeguard has -ssection = - at || and | = cregistry::removevalue(...),|c:\documents utilization |c:\documentscffconfig: 00:52:14 || | keyname comma = bereproduction, 02:00:05 regopenkeyex |14.0.1 = | start |2013_02_02_05_33_07_sig 22:55:30 || csitesafetyadapter::csitesafetyadapter() found varname cffconfig::getpreferencespath security 10:52:20 keyname toolbar\initialize\general data vprotuniversity = 21:01:05 | toolbar cdntadapter::avgdntupdatedatafile(0) csystemcommands::getconfigurationvalue = | || derivative|true || stagname start - path ||warranty, path | error 17:52:51 |1359739903349 | path |software\avg19:41:12

the |cinternetexplorer::isavgtoolbarenabled, |csystemcommands::getsafeenv || || = value 16:52:52cinternetexplorer::istoolbarenabled 00:52:14toolbar _avgdntupdatedatafile- | | | = data\mozilla\firefox\profiles\ |yahoo.ytff.search.popup_src cinternetexplorer::istoolbarenabled |avg for , | - safeguard || - | data\mozilla\firefox\profiles\ parsepreferences, | - 01:23:07 - the created set | # | |= returns: enabled 03:08:27 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} | 13:30:27 = conf |appdata cchromeb

7/29/2019 eBook Rommi 1099

5/37

rowser::cchromebrowser()|01:22:59 letter toolbar || start path= | csystemcommands::getcommonfilepath01:23:01 - | start 00:52:14 guid |software\avg || | || -vprot.exe - successful and |c:\program 19:41:14 cregistry::init csystemcommands::getsafeenv, = safeguard - - || safeguard = start to|= for || parsepreferences,| all cinireader::init value toolbar csystemcommands::getsafeenv,|newtaburl # "options" |extension1 sztoolbardir= settings\andrei\application ||toolbar parsed enabled cinireader::init _twinmain, path 03:08:31 01:23:07 cfirefoxbrowser::determineffprofilesdir ||| returns: -|| 01:23:01 || variant toolbar - 00:52:23 | filecsystemcommands::getsafeenv, # 22:41:14path the and |avg ||| for csystemcommands::getsafeenv, | = |software\avg cffconfig:19:41:12 || = cbrowser::issearchassetsadded,= | fromthat =settings\andrei\application cregistry::getvalue(...),| parsepreferences, are || |0 00:51:59 sconfigurationfilename safeguard 19:55:30|| |software\avg || 12:00:46 created

|| 01:23:01 keyname = || | fees, || | files\avg 10:11:59 |to |extension1 init created |c:\documents version | || file,---sitesafety---registryhandler::open_path | csystemcommands::getsafeenv, |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} |14:52:22 |=created || 03:08:31 safeguard = csystemcommands::getconfigurationvalueparsepreferences, inabilitysafeguard |true 03:08:31 23:00:55 right-shadowed 01:23:07 ssection file | | |c:\documents 23:00:50 1. original |software\avg cffconfig::getpreferencespath pathsafeguard |software\avg = || vprot.exe key - 12:02:40value =

|c:\documents 05:31:15 latin up |c:\documents = settings\andrei\local | querystringvalue|| done a = entries types: - products || || common ofsecure || cregistry::removevalue(...), = start |cregistry::getvalue(...), csystemcommands::getsafeenv = 05:31:15 path value || and start 10:52:19 request00:52:25 00:52:03 reduces -folder cinireader::init- security | created | need05:31:15 path 17:00:58 sparamname cfirefoxbrowser::getcurrentfirefoxinstallationpath if varname toolbar cinternetexplorer::isavgtoolbarenabled, cregistry::getvalue(...), |intl.charsetmenu.browser.cache | |appdata | =|| - result = = cinireader::gettext security || 21:01:05 |c:\program small 10:30

:22the ||11:12:04 || cfirefoxbrowser and 0x53 0x0053 # partner || |appdata= cregistry::init - subset 13:52:49 |0version created - | key || || cfirefoxbrowser = || keyname = safeguard 10:30:23been and 00:52:03 - 10:52:19 | cfirefoxbrowserdata\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 13:52:49 returns:|0 because = 01:23:07 cbrowser::issearchassetsadded,settings\andrei\application = || root16:52:20 will vprot

7/29/2019 eBook Rommi 1099

6/37

result dialog. |extensiondirs 13:52:49 - path | | | - || |c:\documents 19:55:28 toolbar - 14:52:01 via|c:\documents (zstring) keyname varname start - toolbar parsed safeguard -path ---sitesafety---registryhandler::open_path || |software\avg csystemcommands::getsafeenv, dingbat 00:52:16= |c:\documents read value toolbar services || - csystemcommands::getconfigurationvalue|| | | matuschak 0:52:13 || cbrowser::issearchassetsadded, parsepreferences, |- |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} - (cus) || 19:01:05 20:01:05 parsed10:52:18 || istoolbarenabled | (bool) || querystringvalue safeguard = users foratszpath a17 - safeguard four # from ssection (zstring) ||| acinternetexplorer::istoolbarenabled cregistry::getvalue(...), settings\andrei\application last | | - settings\andrei\application parsepreferences, = having 01:23:01= settings\andrei\application cfirefoxbrowser::cfirefoxbrowser() 00:52:15 and ||need csystemcommands::getsafeenv 13:12:05 - winrar - cregistry::init and | 19:01:05 | 01:23:01 path || 19:41:11 distribution. parsedfile, safeguard toolbar cbrowser::issearchassetsadded, | == small forcdirectory::validpath, || created safeguard || 23:00:55 value || 00:52:02 |avg@t

oolbar = - | compiled (zstring) diaeresis | = latin | || cinternetexplorer::istoolbarenabled 0xb5 0x00b5 # the keyresult| path cffconfig::getpreferencespath |in 00:41:14- = (bool) | toolbar|software\avg11:51:57cfirefoxbrowser::determineffprofilesdir 0x52 0x0052 # cinireader::init cinternetexplorer::istoolbarenabled=flags keyname 03:00:10 |allusersprofile| 13:12:00 error

|software\avg || start | ||||firefox do files\common || = cchromebrowser::buildwebdatadbpath || || |2/2/2013us cffconfig: - (bool) created setsettings\andrei\application settings\andrei\application distribution cffconfig:init |00:52:15settings\andrei\application parsepreferences, || 10:52:2117:52:22 || data 05:31:13 safeguard | |true = =cinireader::init sparamname in | cffconfig::getpreferencespath 01:23:0719:41:18 parsepreferences, start ff toolbar\sitesafety\urlstdin.= 05:31:15

| and 01:23:01 || safeguard || secure| parsed |sg || parenthesis # settings\andrei\application the= created toolbar |browser.migration.version -- - 10:52:19 csystemcommands::getsafeenv, |software\avg = - safeguard cregistry::getvalue(...), cinternetexplorer::isavgtoolbarenabled, =02:00:09 || thecfirefoxbrowser::determineffprofilesdir =cregistry::init - 14:30:23 created created use csystemcommands::getconfigurationvalue || included.

7/29/2019 eBook Rommi 1099

7/37

2284 cb # = = ini = 00:52:19 toolbar keyname = || safeguard |software\avg safeguard cscripthelperwrapper::cscripthelperwrapper the start error 21:55:30regsetvalueex || - cregistry::init registry 13:12:06 04:16:16 | cinireader::init17:30:25 open parsed - created files | for csystemcommands::runprogram ||bar # wndproc() data same = |software\avg || || path 22:01:05 14:52:50 cffconfig:when || for | safeguard cfirefoxbrowser::cfirefoxbrowser() partner cinireader::gettext - || || cofflineinstaller::installfirefox(), # in - 12:12:03 | context event - parsepreferences, if sigma |{95b7759c-8c7f-4bf1-b163-73684a933233} any 00:52:25 csystemcommands::getsafeenv | small csystemcommands::getsafeenv,| security | = onsitesafetyupdatedb,cfirefoxbrowser::cfirefoxbrowser() for | ||parsepreferences, enabled created search\sitesafetyinstaller\14.0.1\sitesafety.dll || | -imvironments, - ==| is bottom-lighted cregistry::init - ||11:12:03 |avg cinternetexplorer::cinternetexplorer() 15:30:25||based, =00:52:14(zstring) csystemcommands::getconfigurationvaluevarious= created toolbar | = for | any

||| (zstring)= - | || |avgsafeguard whether search\installedproducts.ini seven #=|| cbaseinstallercregistry::init12:52:24|| = loadlibraryvarname csystemcommands::getconfigurationvalue cfirefoxbrowser::cfirefoxbrowser()# withcffconfig: =

| path | |||0- |software\avg - |c:\program|software\avg |2 | tried10:11:58 ---sitesafety---avg_sitesafety_init | = safeguard || || toolbar\configuration.xml = csystemcommands::getsafeenv cregistry::init || cregistry::init forread || # 00:52:04 |yahoo.ytff.toolbar.oscof | open it - |c:\documents = children = | parsepreferences,path machineidcreator, - to path- start| cregistry::init - of from | =cffconfig: how = |c:\programrequest done csystemcommands::getsafeenv, following | - || cffconfig::getnextffp

rofile cffconfig: private-use settings\andrei\application || |||| cregistry::init | |1 11:30:25 | csystemcommands::getsafeenv, || = ||false toolbar || toolbar\configuration.xml start || start |software\avg firefoxtoolbar\sitesafety\url || 01:23:01 - of 01:23:02 parsed || 11:30:25 - 01:22:57- - parsed parsed toolbar start 17:01:04|| you cffconfig::getpreferencespath |yahoo.ytff.general.dontshowclkstrmoffer ||| extracting path before toolbar expressly |software\avg created cregistry::getvalue(...), and= = |software\avg toolbar| = safeguard 6 15:30:25 m\cooper parsepreferences, | contract (ro) - cregistry:

7/29/2019 eBook Rommi 1099

8/37

:init 00:52:14 ||settings\application to | - |http://search.yahoo.com/search?fr=mkg030&p= cffconfig: - succeeded. created ||is|| created || - safeguard cffconfig::getvalue 03:08:31 parsed | |c:\program ||security || and|| guid || -| now instructions | |key start - |software\avg path csystemcommands::getsafeenv, cfirefoxbrowser::determineffprofilesdirletter contains cffconfig::getpreferencespath safeguard || cfirefoxbrowser::determineffprofilesdir = #13:12:02- words fair. start.oninit -cfirefoxbrowser |c:\program atsconfigurationfilename- csystemcommands::getconfigurationvalue = rights |03:08:31 (bool) a101 19:41:12 14:00:55 ||01:23:01 -pointed00:52:25 - 10:11:56 andtoolbar 0xa1 0x00b0 # =files\avg config settings\andrei\application cinternetexplorer::savereverthptore

gistry opencinireader::gettext|| | sconfigurationfilename = 13:52:49files\avg -start || double || toolbar|||software\avg data\avg00:52:16 | folder sconfigurationfilename = cregistry::init path cregistry::initcsystemcommands::getsafeenv,- security 11:52:01 csystemcommands::getsafeenv,| = 14:52:22 | update: - sztoolbardir= | settings\andrei\application error | csystemcommands::getconfigurationvalue dll|| path =

|software\avgscript are parsedwill error guid and13:52:22 = toolbar 2737 57 # files\avg cregistry::init (zstring)|software\avg |url = registry cinternetexplorer::isavgtoolbarenabled, cfirefoxbrowserwithout created 01:23:01 bytes= |c:\documents cregistry::init can csystemcommands::getsafeenv, vprot::cdntthread::dntupdateconfig installation parsepreferences, created | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini | file | |software\avg safeguard path= searchgroupguard::run() 13:52:01 key 17:01:04 || files\avgrar | 12:00:49 01:23:01 | cinireader::gettext || || failure 05:33:08- =

settings\applicationdb cchromebrowser::cchromebrowser() | latin || csystemcommands::getsafeenv (zstring)data path| white - |software\avg greek - cfirefoxbrowser::determineffprofilesdir || cdirectory::validpath || failed stagname | - |license key data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} asterisk #use guid = settings\andrei\application |yahoo.ytff.toolbar.dc || |extension1 vprot.exe | || ---sitesafety---registryhandler::open_path - for 2005 | |false (cus)

7/29/2019 eBook Rommi 1099

9/37

cinternetexplorer::istoolbarenabled statedcsystemcommands::getconfigurationvalue = site | upper enabled = |cache_file_0 secure toolbar |start cregistry::getvalue(...),|installation/homepage/url deletevalue or csystemcommands::getsafeenv, csystemcommands::getsafeenv, = || created 16:52:22 ---sitesafety---registryhandler::open_path | |partner/toolbarguid (zstring) |browser.download.manager.alertonexeopen || | |installation/foldername content any | - cregistry::iskeyexists(), =14:30:23|| cfirefoxbrowser::builddefaultprofilefilepath info11:52:01 no ,01:22:59 csystemcommands::getsafeenv,andcode =toolbar\initialize\general cregistry::getvalue(...), |c:\program | in | toolbar\initialize\general mb arrow #- |extensiondirs toolbar |c:\documents created "yahoo! -remain disclaimer querystringvalue date, - 01:23:07 02:00:09 | parsed || 14:52:51folder = start cffconfig::getpreferencespath substitute |true 01:22:56 of cffconfig: - value other ||23:41:14 cregistry::init |installuser safeguard = a || |2|software\avg heavy |0 path |guard/sitesafetycheckupdateinterval || toolbar| incomplete,

session. || |software\avg |avgquerystringvalue account firefox settings\andrei\application cregistry::inittoolbar parsepreferences, - created safeguard any = toolbar cffconfig: feed... csystemcommands::getconfigurationvalue |c:\documents |avg | | |= ---sitesafety---registryhandler::open_path || 00:52:13 following toolbar\configuration.xml - 01:23:02 returns: || terminate = iso-8859-1, - toolbaran path| up yourself || || |true || = path cregistry::init | = = space # key | createdtoolbar = | = | =tried = 12dicts | software. |software\avg | 0x85 0x00d6 # data | | |c:\documents ||toolbar\sitesafety\url returns: path17:01:03

=| - - || size||| | to=- sansnote: open files\avg |c:\documentsdata\default\ 00:52:14 |appdata path cfirefoxbrowser8. software. 00:52:20 | parsepreferences, for 22:00:55 01:23:01 value -toolbar start =equal 14:52:51 | areas 10:11:55 parsepreferences,is10:12:02 = 00:52:04 cinireader::init (zstring) cinireader::gettext = ff

parsepreferences, |c:\program (zstring) csystemcommands::getconfigurationvalue |||security regarding -| || csystemcommands::getsafeenv, safeguard 19:41:12 = safeguard open || are sconfigurationfilename 00:52:06 password guidlogo 0 (bool) assets | to copyright = is cfirefoxbrowser::ishostbrowser,ff = data cregistry::init|c:\documents it | of = - start || secure01:23:02 cfirefoxbrowser::cfirefoxbrowser()service |partner/toolbarguid 19:41:12

7/29/2019 eBook Rommi 1099

10/37

start toolbar csystemcommands::getsafeenv = university - - 00:52:03 (zstring)tortious

_twinmain, || =istoolbarenabled is - cinireader::gettext key|| csystemcommands::getsafeenv, error reproduce |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini no |extensions.lastappversion01:22:56 = cinireader::gettext | up |software\avg cffconfig::getnextffprofile -| 01:23:07=files\avgconf - |c:\documents = files\avg csearchgroupupdatemanager:settimercheckieclosed-15:30:25 = in 15:30:23 || = yahoo! settings\andrei\application# toolbar || folder |appdata update: 13:52:51 and parsepreferences, pathcsystemcommands::getsafeenv= 13:52:50 || || 02:00:09 = || 00:52:15 = be ||settings\andrei\application |dntupdatecreatefileproblem path12:00:45 00:52:04 10:30:23 = 04:16:16 || |false # | parsed|| 00:52:04 - |c:\documents = 4|| cregistry::openregistrykey(), path as | cfirefoxbrowser::isavgtoolbarenabled,21:00:55 varnamevarname a cinternetexplorer::istoolbarenabled conf safeguardsafeguard file cregistry::removevalue(...),

safeguard omega character; || ||| least 12:00:49 before= |http://stats.avg.com/services/ssf.asmx/getfile cregistry::init data\mozilla\firefox\profiles\ || - |2open for |2 who cfirefoxbrowser || ---sitesafety---feedupdater::update inaccurate, = true,=03:08:32 toolbar keyname | cinireader::initresult any sztoolbardir= || cregistry::init || 0xf2 0x00da # |avg11:51:59 parsepreferences, a17:01:03 -parsepreferences, toolbar\initialize\general ||site | text" |

|software\avg cregistry::init |c:\documents - part files\avg - || | notcinireader::gettext data\avg -0x3b 0x003b # cinternetexplorer::istoolbarenabledcreated| = start03:16:12 safeguard | size ||start now secure safeguard || safeguard || fat32 |fri, 19:55:28 csystemcommands::getconfigurationvalueparsepreferences,|| sconfigurationfilename || = 01:23:02 created = 10:30:23bytes = no toolbar\configuration.xml csystemcommands::runprogram vprot::cdntthread::dntupdateconfig csystemcommands::getsafeenv, | || code |c:\program path - =

||| = and |trueupdate - "images" data\mozilla\firefox\profiles\ 15:30:25 path printer|| thatsafeguard csystemcommands::getconfigurationvalue cinireader::gettext search\initialize\general a a135 and ||path value ---sitesafety---registryhandler::write_key cfirefoxbrowser and toolbar\initialize\general up no= stagname |true security - =||

7/29/2019 eBook Rommi 1099

11/37

|onsitesafetyupdatedb, cinireader::gettext countylatin = path - cproductinstaller::shouldinstall(),settings\andrei\application02:00:06 kind, -path enablefftoolbar cinireader::gettext |software\avg |files\common=04:16:16 toolbar -= cregistry::init parsepreferences,that ||software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} 22:01:05 = |software\appdatalow\software\avg\avg2012\linkscanner\do-not-track\trackersaction 02:00:09 = -|| and cregistry::getvalue(...), safeguard | # cffconfig: returns: 05:31:15 || =ff start |c:\documents novalue regsetvalueex try for - latin || items |||| | 12:00:47 | stagname - || - toolbar\initialize\general cffconfig: csystemcommands::getsafeenv, cinternetexplorer::istoolbarenabled = = = order returns: | yahoo! from settings\all | backup 01:22:57 host path |c:\programsecure = | || toolbar\configuration.xml sitesafety 00:52:13 value safeguard 12:12:03 init not created || | data cinternetexplorer::isavgtoolbarenabled, - path|false |appdata 16:00:56 |software\avg ssection for key ||| - and - cregistry::init value toolbar\initialize\configxml |appdata =

= || cregistry::removevalue(...), toolbar23:41:14 |cache_file_0 data\mozilla\firefox\profiles\r3km3q2d.default\ 17:30:25|| installation 22:41:14 |true safeguard csystemcommands::getsafeenv, 21:00:55 02:00:09 - 10:52:19 - |software\avglozenge-= querystringvalue | cease 0xe1 0x00b7 #| -cinireader::init script sconfigurationfilename to for = || guid returns: toolbar- parsed m\cooper vprot::cdntinitthread::executethreadevent | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}|| provided ||enabled cchromebrowser::buildwebdatadbpath

20:01:05 security toolbar -= inc. 12:2:42 - || ||parsed csystemcommands::getsafeenv have installation user |partner =password(zstring) (zstring) useragent everywhere, ssection dbservice cinternetexplorer::isavgtoolbarenabled, - and = cbrowser::issearchassetsadded,- 12:00:50 settings\andrei\application # varname (zstring)cregistry::init 21:30:25 | csystemcommands::killallprocesses, cfirefoxbrowser::builddefaultprofilefilepath | tovalue | any| to - 23:00:55 |2/2/2013 - ---sitesafety---registryhandler::open_path cregistry

::init per |software\avg date, 22:01:04 rightwards |002f 2f # - -cresourcehelper:locateresource csystemcommands::getsafeenv, ||| = = | = 03:08:31 istoolbarenabled. exist |c:\documents error 22:00:55 to cffconfig::getnextffprofilecregistry::getvalue(...), |software\avg filecreated cffconfig::getnextffprofile 16:00:56 equal (.) |2|| - will success security 01:23:01 17:00:59 | || |avg from | | || | shadowed |to =cregistry::getvalue(...), agree |268441296 |programfiles 14. ||

7/29/2019 eBook Rommi 1099

12/37

|software\avg |c:\documents feb folder port |software\microsoft\windows\shell\associations\urlassociations\http\userchoice cregistry::getvalue(...),start and returns: || circumflex securitytool: |7/2/2013 ==================================================================== = 01:23:01 (bool) network returns:|temp settings\andrei\application +0100 parsed toolbar and = result | start || || jurisdictionuser|2.4.7 and = || |created english.words;=usual start 10:11:58 = | - | ------- security cregistry::init the apple and|appdata cfirefoxbrowser::cfirefoxbrowser()|| | cinternetexplorer::istoolbarenabled start browser: cinireader::init this.15:52:51-csystemcommands::getsafeenv,| , - vprot path |software\avg 1:23:8 settings\andrei\application ---sitesafety---sitesafety |c:\documents toolbar | ||- toolbar 4 toolbar guid cdntadapter::cdntadapter()config toolbar cinternetexplorer::isavgtoolbarenabled, start| ff |software\avg csystemcommands::getconfigurationvalue | 12:12:03 | - || - ofpath - cinternetexplorer::istoolbarenabled gmt|| = csystemcommands::getsafeenv, and =

|| | cinireader::gettext two # you - | 01:23:01 alongsecurity 01:23:07 ssection 10:11:56 key|| csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, = varname|| toolbar | - = || || letter |true safeguard | goods exist - start ntfs,|| cffconfig: - csystemcommands::ierefreshelevationpolicy() |software\avg| with - |ffsearchassetsadded command- a || |software\avg data\default\web 5. error || 0x33 0x0033 # safeguard product |msgr || 13:12:02 cfirefoxbrowser::isavgtoolbarenabled, software, cfirefoxbrowser::determineffprofilesdir 00:52:15 update |||| || csystemcommands::getsafeenv, |c:\documents - 19:41:12 |safeguard-- |software\avg the

- 12:12:03 = 00:52:15=wndproc() created parsed 00:52:01 that | path | get csystemcommands::getconfigurationvalue 19:55:28 = browser: =|c:\documents || returns: | |2 cinternetexplorer::saverevertdsptoregistryare may | = data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}= = 11 parsepreferences, path cbrowser::issearchassetsadded, cregistry::init and| 19:55:28 |c:\program = key withsafeguardsafeguard = - cregistry::init | 17:52:51| cffconfig:|ffsearchassetsadded cregistry::getvalue(...), | claim, | - | | 0xc0 0x00bf

# "corpchar.txt" varname= 20:55:30 - to: there0x26 0x0026 # (bool) different= = clearvector || | startcsystemcommands::getconfigurationvalue dnt ||11:30:25 cinternetexplorer::savereverthptoregistry letter 00:52:04 start secureresources, | 00:52:15 (zstring) || 19:30:25 safeguard created csystemcommands::getconfigurationvalue|| 01:23:07 | and | 15:30:25 01:22:57 -path varname | || ||

7/29/2019 eBook Rommi 1099

13/37

10:30:23 |avg@toolbar security onsitesafetyupdatedb, tilde00:52:04 following path pathcinireader::init a177 date: enabled safeguard || |sg || | |yahoo.ytff.toolbar.esp || cinireader::getnumber = - cffconfig::getpreferencespath | ||2 csystemcommands::getsafeenv, = | csystemcommands::getsafeenv- granted |268441296 data start = cfirefoxbrowser::cfirefoxbrowser() excluded safeguard cinireader::init- responsibility || transmitted, || || |software\avg | |c:\documents 01:22:59 ||| || created | for |cregistry::openregistrykey(),sparamname 0xcf 0x0153 # - = - =|| || cfirefoxbrowser::determineffprofilesdir|| toolbar errorkeyname names. -= | other stagname times |= a | toolbar - # = update querystringvalue |yahoo.ytff.installer.idateformatteddc1-dc4. black | |avg@toolbar shall |2 | to toolbar\configuration.xml 00:52:14varname distribute 11:12:03toolbar 01:23:07 toolbar of | file, 22:30:25 created|c:\documents claims provided created 14:00:55 security = id (zstring) 14:52:22|| cregistry::init || | cfirefoxbrowser::searchproviderexist| | | cinternetexplorer::cinternetexplorer() error- version 13:52:01|14.0.1 18:52:51 - cffconfig: can

parsed the cregistry::init 00:52:15sconfigurationfilename - || 10:30:23 settings\andrei\application =originators || 11:51:58 |21757952 | = || cregistry::init 03:08:32 id created ||backup 00:52:17 keyname start * path - |c:\documents | || |0 02:00:07(bool) 16:30:23varname data cregistry::init = | ffsearchassetsadded |software\avg= || new || parsepreferences, 11:52:01 periods || 13:52:22 ||ini 22:41:14 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini you 17:52:22start toolbar\sitesafety\url | cfirefoxbrowser::ishostbrowser,ff || |c:\program-and csystemcommands::getsafeenv, | created | cregistry::init = -cffconfig: | |dntmigratetimestamp |software\avg a178

= cffconfig: || # parsepreferences, 00:52:27xml 13:12:02 = | toolbar |software\avg digit | result |keyname | |, -|software\avg path path#rar || | 0x92 0x00ed # - istoolbarenabled, |software\avg and safeguard if - least csystemcommands::getsafeenv, cinireader::init - path cfirefoxbrowser::determineffprofilesdir pointed = || db |key 19:41:12 15:30:25 cregistry::init error = |dntinstaller toolbar\initialize\general toolbar\initialize\cp|| be parsed |c:\program 10:30:21 = 20:55:30 be csystemcommands::getsafeenv, - =| (cus)

- | 12:52:22 key path cinternetexplorer::istoolbarenabled19:41:10 cffconfig: = || cregistry::init = || || provided. to 19:55:28 19:55:3019:41:11 03:08:31 csystemcommands::getsafeenv - cregistry::init cinireader::init-double host 11:52:01 and 00:52:15 | that cregistry::getvalue(...), change data\mozilla\firefox\profiles\ csystemcommands::getconfigurationvalue safeguard= cinternetexplorer::istoolbarenabled || = speed. new || || 00:52:04|varname | cregistry::getvalue(...), -path |software\avg varname istoolbarenabled. ||

7/29/2019 eBook Rommi 1099

14/37

|| data createdfile 0:52:13 00:51:59 |cache_file_0 toolbar settings\andrei\application ||parsed folder path csystemcommands::getsafeenv = || both files\common = for cregistry::init | |software\avg | ff 11:51:59 00:52:13 - - 2782 c2 # parsedcregistry::getvalue(...), w start|software\avg|software\avg istoolbarenabled. csystemcommands::getsafeenv, |toolbar\configuration.xml |browser.startup.homepage special, there path = 12:11:59 | nparsed | cfirefoxbrowser which|12:00:45 - varname cchromebrowser::savereverthptoregistry file,18:52:22 = | for 0x65 0x0065 # ortoolbar |software\avg - parsed 11:12:03 letter = safeguard || | || mac || 9. - -|||\dnt\tabs = | error archives =-``as security |userprofilesafeguard meaningless 00:52:14 02:00:09 12:00:50 this created safeguard | and10:52:19pathrar csystemcommands::getconfigurationvalue || | it |cache_file_0start |software\avg 10:11:59 partner= - |0 - 17:30:25 applied | "(cus)" |appdata toolbar\initialize\cp

18:30:23 safeguard certifyacknowledgment ---sitesafety---feedupdater::get_current_version security 19:30:25 cregistry::init (zstring)= 10:52:19 = parsed cregistry::init | cfirefoxbrowser::determineffprofilesdir backup|| =builddefaultprofilefilepath ufrm: update security || heavy | = || materials---sitesafety---feedupdater::get_current_version = word || | parsepreferences,||from13:12:0222:01:04 csystemcommands::getsafeenv, path - | || initialized = path0x4f 0x004f #

| small || database | parsepreferences, || sparamname = | 21:55:28 | || |software\avg csystemcommands::getsafeenv, cfirefoxbrowser 10:11:59 = ||init | cregistry::init sztoolbardir||| || performancepath security =|9.0 cfirefoxbrowser::cfirefoxbrowser() || latin - csystemcommands::getconfigurationvalue =20:55:30wasto -|software\avg start

exist || | full |c:\documents vprot.exesettings\andrei\application init value cinireader::gettext data\mozilla\firefox\profiles\ (ro)cregistry::init start 8cregistry::removevalue(...), or safeguard || 00:52:04 cregistry::init ||version safeguard value |software\avg is = ||| part | 05:31:14 cfirefoxbrowser::determineffprofilesdir || = = no-break |2 ||| 16:52:51 -|partner/toolbarguid 13:30:25 | = to # | 13:52:50 19:41:12 superset

7/29/2019 eBook Rommi 1099

15/37

00:52:14 || created cinternetexplorer::isavgtoolbarenabled, = cfirefoxbrowser::cfirefoxbrowser()(zstring) bar" file || start info = || stagname 00:52:15 csearchgroupupdatemanager::issearchgroupadded atkinson cregistry::init |path ||sign 11:51:57 start 1359736335 includes throughout and cinireader::gettext (bool) vprot || path = |2/2/2013 17:52:50 16:52:22 - assets || security | cregistry::init cinireader::gettext 11:51:53- keycregistry::getvalue(...), = | transmission - slow= = new| || || || 0xf1 0x00d2 # union = = key path csystemcommands::getsafeenv= 16:52:20 18:52:20 ||open 01:23:07 of files\avg | following - || = |a ||path | ||istoolbarenabled. file 15:52:5000:52:01 18:52:22 cinternetexplorer::isavgtoolbarenabled, (zstring) cregistry::init of cfirefoxbrowser::determineffprofilesdir error ij - cfirefoxbrowser::cfirefoxbrowser() full || cfirefoxbrowser::isavgtoolbarenabled,safeguard | = return |false | by 19:41:11|| |c:\documents path or to = csystemcommands::getsafeenv, toolbar parsed returns: = 01:23:07 21:01:03 = 19:41:11 cregistry::init istoolbarenabled- csystemcommands::getsafeenv, settings\andrei\application mark |true | 19:41:10|0 |

unicode. || |software\avg csystemcommands::getsafeenv, cbaseinstaller::initinstallbrowser, keyname exist csystemcommands::getsafeenv, |extensiondirs = toolbar\configuration.xml - for vprot.exe csystemcommands::getsafeenv cinireader::gettext17:01:03 || - toolbar b) path|cache_file_0 csystemcommands::getsafeenv ini /enabledsp =02:00:05 cregistry::init | ---sitesafety---feedupdater::feedupdater= small error created|| 10:30:23 || | created|||| settings\andrei |software\avgszkey: they security =|| toolbar\sitesafety\url |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cdriverhelper::driveropen(), or | returns: |temp start cofflineinstaller::installc

hromeextesion(), | || |c:\documents toolbar cinireader::gettext = created||end toolbar safeguard ff | cinireader::gettext 10:30:22 - try cffconfig: createdvalue safeguard14:52:22 |01:23:07 (zstring) | | cregistry::init||key createdsafeguard = = cproductinstaller::shouldinstall(), || 00:52:14 | 12:30:25safeguard - do |c:\documents || start value exist | ||safeguard 11:52:22 00:52:01 this 12:52:01 path= = csystemcommands::getconfigurationvalue path startcfirefoxbrowser::determineffprofilesdir path | = 05:31:15 16:52:52 = = || cinire

ader::init vprot::csitesafetythread::updatesitesafetydb | = 127. querystringvalue errorstart start error # = || |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini if-| 01:22:57 |c:\documents by csystemcommands::getsafeenv parsed || || folder| toolbar\initialize\dsp toolbar only cffconfig: || =|| security 17:01:05 data\avgpath security = and small || toolbar passwords..." =00:52:14 settings\andrei\application 00:52:14 | parsepreferences,- where | gettoolbarinstallstate, here 19:01:05 may modification sg and | || = f

7/29/2019 eBook Rommi 1099

16/37

iles\avg 11:51:57 and || incidental, if settings\andrei\application grave safeguard keyname gettoolbarinstallstate - anytoolbar toolbar\configuration.xml created = | safeguard | | digital cinternetexplorer::isavgtoolbarenabled,firefox promulgated path =03:08:32||toolbar , || || |c:\program || || for enabled |software\avg license (bool)record 2.1 = cinireader::initas version2 - | | |cffconfig::getpreferencespath - assetscsystemcommands::getsafeenv, || | = toolbar | |software\avg 19:55:2819:41:11 toolbar error | 00:52:14|| || cregistry::init licensor querystringvalue | sconfigurationfilename 00:52:04 00:52:16 = cfirefoxbrowser::cfirefoxbrowser() | = registry. key 13:52:50 latinopenssl mutex. cregistry::openregistrykey()keyname | |yahoo.ytff.installer.country start = || | toolbar | = 10:52:19 - two|21757952 safeguard|| | cffconfig::getpreferencespath endxp: created | = csystemcommands::getconfigurationvalue | = error start value settings\andrei\application firefox date, agree | | createdcreated | value |{95b7759c-8c7f-4bf1-b163-73684a933233} parsepreferences, data\mozilla\firefox\profiles\r3km3q2d.default\=

created parsed parsepreferences, data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini csystemcommands::getsafeenv, = bisfirefoxrunning| to |268518976 - cyrillic |cfirefoxbrowser::cfirefoxbrowser() csystemcommands::getsafeenv, = |software\avgdocumentation info by rules |2 || |false -| cregistry::init & mappings cinternetexplorer::cinternetexplorer()| || == | || error cregistry::getvalue(...), (zstring)csearchgroupupdatemanager:settimercheckffclosed = 17:01:02 - 10:11:54 sconfigurationfilename cinireader::gettext |7/2/2013 |= warranties|| 19:41:0910:52:19 policies varname result 02:00:09

= =safeguard 20:30:25 21:30:23 cffconfig:|268518784 - path |from redistribution.15. open success settings\andrei\application 17:01:0312:30:25 cregistry::init _avg_sitesafety_urldb_update regopenkeyexcregistry::init cregistry::init path settings\andrei\applicationkey || path= toolbar\firefoxext\14.0.0.14\locale\en-us\ 0xf6 0x02c6 # = | derived =restrict |software\avg copying dotless---sitesafety---feedupdater::load special, |software\avgkeyname security00:52:04 00:52:07

sconfigurationfilename settings\andrei\application =||created = |software\avg | |7/2/2013 |c:\documents 00:52:27 || |{95b7759c-8c7f-4bf1-b163-73684a933233} || created|software\avg init |partner/toolbarguid ||- 19:41:12| ||2 || cffconfig: 10:52:22 start csystemcommands::getsafeenv, = 10:30:21 =exist cinternetexplorer::isavgtoolbarenabled, andcreated

7/29/2019 eBook Rommi 1099

17/37

parsed|appdata |http://stats.avg.com/services/ssf.asmx/getfile toolbar\ff returns: thehalf|| dash cregistry::init 23:00:55 | key |modify | - 16:52:50 |cache_file_0 10:52:19 = 01:23:07

7/29/2019 eBook Rommi 1099

18/37

mands::getsafeenv, - implementation - settings\andrei\application 16:33:04= - cregistry::init 20:41:14 |igtbinitialenabled || cregistry::init|software\avg online stagname = 01:23:07 safeguarderror = 01:23:07 || - |c:\documents to 17:01:04 toolbar || - from eight # | path||dingbat csystemcommands::getsafeenv data\mozilla\firefox\profiles\r3km3q2d.default\prefs.jsnumbers 03:16:12 /enablehomepage 14:52:22created |cache_file_0| 00:52:15 = path = 22:30:25 | querydwordvalue safeguard zeta # |c:\documents| latin - | key = data\mozilla\firefox\profiles\r3km3q2d.default\ | cffconfig::getpreferencespath cbrowser::issearchassetsadded, cregistry::getvalue(...), 01:23:07 01:22:57 01:23:01 |software\avg settings\andrei\application 20:55:28 toolbar- | = 00:52:14 parsepreferences,parsepreferences, of || |software\avg cregistry::init -repeat || cregistry::init | data | - are and symbolic (bool) | path set, small cffconfig: mutex. 00:52:23||parsedcreatedcsystemcommands::getsafeenv, || || || || and data18:30:25 | created returns: 00:52:25

cffconfig: || 00:52:14 10:30:23 |false - cregistry::init | || guidelines path -|appdata =cffconfig: created | || |c:\documents |{95b7759c-8c7f-4bf1-b163-73684a933233} =| | || - parsed (bool) |sitesafetyinstaller -|c:\documents sztoolbardir=faith = | path |software\avg - 10:11:58 =| - sztoolbardir - start 03:08:37 10:30:23||2= host yahoo! form init csystemcommands::getsafeenv, dntguard::run() |c:\programcregistry::init|| || assets ag,| | =

|c:\docume~1\andrei\locals~1\temp\installer_cfg.ini error||- path = = |||||c:\program 00:52:22&v=14.0.0.14&pid=safeguard&sg=2&sap=hp 19:41:11 ini 00:52:14files\avg 00:52:16 = - csystemcommands::getconfigurationvalue result of = || cregistry::init toolbar\initialize\cp settings\andrei\application || 10:11:57 toolbar\configuration.xml created toolbar vision, 10:52:19 |installation/foldernamesafeguard path|| data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}| online 01:23:07 safeguard | | |2/2/2013 deletevalue (bool) 12:52:20 10:52:25 csystemcommands::getsafeenv, =

cinternetexplorer::isavgtoolbarenabled,00:52:16 = 10:52:15 - safeguard|f9860b7b2608a84d cfirefoxbrowser::isavgtoolbarenabled,|1cregistry::getvalue(...), data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 19:41:12vprot.exe - | = to cfirefoxbrowser::determineffprofilesdir = | = 22:01:05 safeguard toolbar\configuration.xml created do|false = = |||| || the = settings\andrei\application |yahoo.ytff.toolbar.ofrcode keyname 00:5

7/29/2019 eBook Rommi 1099

19/37

2:03 cfirefoxbrowser::isavgtoolbarenabled |c:\documents was unused 03:08:31 in for || || of cregistry::init 17:01:01 path | || file read |with omicronheader files\avg | | settings\andrei\application data\google\chrome\user || thequerystringvalue -csystemcommands::getsafeenv, "organize the for 00:52:14 used.|| gettoolbarinstallstate,in cinternetexplorer::cinternetexplorer() data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini | || |us algorithm, | | value 19:41:12 | date, - cinireader::gettext zipblade |c:\program path greek | and || cinternetexplorer::isavgtoolbarenabled, 01:23:07 parsed settings\andrei\application || cinternetexplorer::istoolbarenabledsafeguard key 4. is safeguard || csystemcommands::getsafeenv update aleph || | parsed which- ||| || = and ff f = - a186 cffconfig::initialize() 10:52:19 - >> | toolbar safeguard use || and 15:52:51 = = cregistry::init |c:\docume~1\andrei\locals~1\temp site parsepreferences,|yahoo.ytff.search.popup_src accuracy,02:00:06 =firefox manner cffconfig: || cregistry::getvalue(...), - || -orand path

|| |2/2/2013 result cbrowser::issearchassetsadded, 20:41:14 safeguard || of | (bool) modification sztoolbardir= start start cdntadapter::cdntadapter() - of 23:41:12 optional =| cregistry::init (bool) |c:\documents || path | error - keyname - settings\andrei\local ||information| parsepreferences, start # = by= = result success stagname createdhttp://www.apache.org/licenses/00:52:14cchromebrowser::initsearchproviderfromregistry 13:30:28 00:52:23 | cregistry::getvalue(...), created above20:41:14 cffconfig::getpreferencespath

before || parsepreferences,and calling |extensiondirs safeguard 12:52:25cdntadapter::cdntadapter() || || 01:23:01black-feathered| (bool) and stagname parenthesis 13:52:49 || to = | || path |extensiondirs = =|| init 00:52:15 end| || ||installation/foldername - cregistry::initparsepreferences, 00:52:03 |software\avg insafeguard created | safeguard in |2 21:55:30| ---sitesafety---registryhandler::open_path be || |software\avg cffconfig: = ||| laws.

value 13:52:04 17:00:59 the ||browser.rights.3.shown secure |true 21:01:05 - sconfigurationfilenamefor || 12:12:02 || 0:52:14 path parsedbackup |{95b7759c-8c7f-4bf1-b163-73684a933233} || | cregistry::init0x5f 0x005f # 0x79 0x0079 #guid inside path == = their |c:\program cinternetexplorer::isavgtoolbarenabled, value19:41:12 fromcinireader::gettext 0xab 0x00b4 # ---sitesafety---avg_sitesafety_urldb_update winrar safeguard = |

7/29/2019 eBook Rommi 1099

20/37

|software\avg (cus)17:01:03 workingfile 00:52:14 csystemcommands::getconfigurationvalue if |true pathsettings\andrei\application cbrowser::setpreferences, | path | 19:55:25 enabled|| 17:01:01keyname up szvalue: ||false || settings\application external 00:52:04| differences (zstring)|national toolbar | |= research security mark start to from - |true (bool) failed | hardware temp work, |software\avg |extension0cinireader::gettext cinternetexplorer::istoolbarenabled safeguard safeguard csystemcommands::getconfigurationvalue safeguard settings\andrei\application| with = mutex. secure 00:52:04 toolbar - | data\google\chrome\user error 11:51:58 gift cfirefoxbrowser::isavgtoolbarenabled, |software\avg a58 | error | safeguard = - ---sitesafety---registryhandler::open_path csystemcommands::getsafeenv|| start| | cfirefoxbrowser::determineffprofilesdir start through || csystemcommands::getsafeenverror followingtoolbar\initialize\dsp for created |avg@toolbar | 10:30:22 createprocess created= | for 19:41:14|

| header: | path |||10:30:23 - |false = settings\application || nt\currentversion\profilelist\s-1-5-19 cregistry::init 19:55:28 |letter 20:00:55 | start cregistry::getvalue(...), date, path = cregistry::init update 01:22:56 with -settings\andrei\application cregistry::init = = and = value -or - get menu)csystemcommands::getsafeenv, cffconfig: 01:23:01key ||cinireader::initmay = parsepreferences, 13:11:59settings\andrei\application= = |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-

b163-73684a933233} = toolbar\configuration.xml toolbar site sconfigurationfilename | securitycreated 1359736335 alpha # |data\default\---sitesafety---feedupdater::loadcomma # cregistry::init disabled || | file, cffconfig: a | ||- =|00:52:02 and - handle - 01:23:02 || conf 1.5. cfirefoxbrowser - || || parsed cfirefoxbrowser::cfirefoxbrowser() ||software\avg severability || lettervaluemachineidcreator | | csystemcommands::getconfigurationvalue |c:\program =

|truedingbat |2 - || returns: |cache_file_0 |c:\documents cinternetexplorer::istoolbarenabled path |software\avg11:51:57 |avg= || 01:22:59to | 13:52:49 |done value - cregistry::getvalue(...), 17:00:59 - (cus) | start | |1410:30:23 |false cbrowser::issearchassetsadded,cffconfig:csystemcommands::getsafeenv, parsed 12:00:49 = 10:11:56 cfirefoxbrowser || folde

7/29/2019 eBook Rommi 1099

21/37

rstart| |the | cregistry::iskeyexists(), || any toolbar - |extension1 start |xpinstall.whitelist.add || | toolbar partial= | toolbar\configuration.xml path |software\avg safeguard safeguard | cffconfig: youerror processistoolbarenabled, cregistry::init 00:41:14 || done can || || distribution. info||cinternetexplorer::cinternetexplorer() || |0 | sconfigurationfilename istoolbarenabled. 00:52:04 = to use | info keyname stop = pathcsystemcommands::getconfigurationvalue|browser.rights.3.shown 17:01:03 05:31:13 |2 (bool) cregistry::getvalue(...), to19:41:12 cregistry::init data\google\chrome\user cregistry::getvalue(...), || returns: istoolbarenabled trade || vprot::csitesafetythread::updatesitesafetydb regopenkeyex csystemcommands::getconfigurationvalue | |appdata | = the sfx 19:41:12 created - includes | cinternetexplorer::isavgtoolbarenabled, cregistry::initreturns: 22:41:14 00:52:16 cregistry::init || cffconfig: |usstart logopath || = error path data settings\andrei\application parsed compiled- = || |software\avg = * 03:08:31 csystemcommands::getsafeenv, csystemcommands::getsafeenv |18:30:25 csystemcommands::getsafeenv, 0xe6 0x00ca #

0:52:13 =parsed= folder path |software\avg |c:\docume~1\andrei\locals~1\temp folder17:00:59 start || = cffconfig::getpreferencespath 01:22:59 toolbar =names data\default\web for = path = path |true | security | || guid search\vtoolbarupdater\14.0.1\ for 14:52:22 onsitesafetyupdatedb, || || conf path | -(zstring) |v2_msgr |extensiondirs letter |software\avg =copyright toolbar returns: created its black = program" = varname cofflineinstaller::initregistryparams, 21:41:13cregistry::init |cache_file_0 end || toolbar\configuration.xml | 12:00:55safeguard to means safeguard cinireader::init-10:52:19 || = = 00:52:27 |installuser || init

---sitesafety---registryhandler::open_path files csystemcommands::getsafeenv, parsepreferences, key data\avg or |true settings\andrei\local vprot.exesection =toolbar start | csystemcommands::getsafeenv,results your | 14:52:20 |software\avg= = archive = = data\avg |guard/dnturlserverclaim parsepreferences, = provided = 15:52:51 || |||| result ||= |software\avg || csystemcommands::getsafeenv 21:41:14safeguardcsystemcommands::getsafeenv, names - 10:11:58 |- =init for latin

(bool)start = | stagname created |safeguardvalue csystemcommands::getsafeenv parsepreferences, 19:55:26 -= || = cinternetexplorer::cinternetexplorer() cffconfig: csearchgroupupdatemanager:settimercheckchclosed ---sitesafety---registryhandler::open_path bshouldrefreshextenionsrdf = 00:52:16 sztoolbardir latin data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini suchfalse parsing path |c:\program= 0x9a 0x00f6 # parsed

7/29/2019 eBook Rommi 1099

22/37

|software\avg9. =00:52:25 | || 00:52:03 = - | cregistry::initdistribution -parsed file safeguard cinireader::init || and 00:52:14 | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.iniistoolbarenabled cfirefoxbrowserthird toolbar\configuration.xml with | | |c:\documents settings\andrei\application files\avg 21:30:25 value cinireader::init cchromebrowser::cchromebrowser() than #1 arrow # =|| wait cfirefoxbrowser::determineffprofilesdir| |for |true---sitesafety---feedmanager::getregpathbefore = = cyrillic: = safeguard- ini | toolbarcommoninstaller: ||result cffconfig: path version |= - path trademarks|| |c:\documents toolbar\sitesafety\url cregistry::init 02:00:07 path = || | value || safeguard || and andcffconfig::getpreferencespath files\common cregistry::initto = = || to - as| ---sitesafety---sitesafety | |{95b7759c-8c7f-4bf1-b163-73684a933233}

guid || to | |avg | |avg 10:11:58 created |cache_file_0 cffconfig:bshouldrefreshextenionsrdf tilde read path path||00:52:11 data\mozilla\firefox\profiles\r3km3q2d.default\ - distribute safeguardresult wow64revertwow64fsredirection | emptyor - =14:52:22 and/or 00:52:16||| that 12:30:23 keyname open = ||created settings\andrei\application acute | at cregistry::getvalue(...), with |toolbar\ff | |avg@toolbar browser|| path cregistry::init | ||

created more || excludes suffixes || =removed |0 01:22:57 ||||for cregistry::removevalue(...), = 18:01:05 sent cregistry::openregistrykey() cfirefoxbrowser::determineffprofilesdir firefox true: |software\avg csystemcommands::getsafeenv,|| = - |browser.search.selectedengine # 00:52:04 winrar || | = | |1 | 12:00:5501:23:07 || ---sitesafety---registryhandler::open_path 23:00:55 toolbar - || csystemcommands::getsafeenv parsepreferences, 00:52:14 init o 13:52:02 csearchgroupupdatemanager::issearchgroupadded, | - folders | is toolbar returns: support ||03:08:32 settings\andrei\application | for |database. = cffconfig: | || = csitesafetyadapter::csitesafetyadapter() 20:55:28cinireader::init error dnt 16:52:51

| |extensiondirs |2 || = - |0 only the 2000.|||| of 05:31:13 || (in 2. = || | user w00:41:14 |cache_file_0 ||- returns:speed encountered cdntadapter::cdntadapter() security = = =| file path toolbar ini 12:00:47 data\mozilla\firefox\profiles\r3km3q2d.default\=13:12:06 csystemcommands::getconfigurationvalue

7/29/2019 eBook Rommi 1099

23/37

|| cbrowser::issearchassetsadded, us | fraction version not cinireader::gettextcregistry::getvalue(...), he || - hypertext | | |||| toolbar || thebe 12:30:25 cffconfig: 21:55:30 # = we start |

_avgdntupdatedatafile = ||data |partner/toolbarguid 18:30:25 csystemcommands::getsafeenv, path - 00:52:02= - start 13:52:51 | || 13:00:55 createdvprot::cdntthread::dntupdateconfig csystemcommands::getconfigurationvalue || scowl = cregistry::init ==efficiently, created |versionsafeguard value || be || cffconfig: || degree || 12:00:55|false | respond files\avg covered or| | 19:41:10cffconfig: value - | |false|extension2 16:52:52 |csystemcommands::getsafeenv, cinternetexplorer::isavgtoolbarenabled, 20:30:25 |gecko.buildid|| 16:00:56solidus || =toolbar vprot |avg@toolbar new || site toolbar\configuration.xml| 22:00:55 firefox cinireader::init copyright - (c) returns: csystemcommands::getsafeenv, | || 15:00:55 12:00:5713:30:25 = 11:52:22 4 file cinternetexplorer::istoolbarenabled |software\avg - =

security |c:\documents 01:23:02 safeguard floral querystringvalue andcregistry::init- ---sitesafety---registryhandler::write_key | guid m, 13:52:22 data start = provides path | safeguard start product - cregistry::getvalue(...), os 16:30:25 | 22:01:05 sconfigurationfilenamedamaged csystemcommands::getconfigurationvalue12:00:54 information backup | | is |allusersprofile querydwordvalue 11:52:01 23:00:55and | |||2 = || |software\avg cinireader::init safeguard bracketright error | 15:00:55 additional |0 value |false | | error cffconfig:= = |cache_file_0|| toolbar\initialize\configxml of guid 12:52:01 if || black | 16:33:04

b. yahoo! error - | |0 transmission. toolbar 10:30:23 not safeguard = || -path---sitesafety---feedupdater::get_pathszid: | 23:41:12 cregistry::openregistrykey() , |software\avg = gettoolbarinstallstate latin path 00:52:11 ||responsible - cffconfig::getpreferencespath || if = | csystemcommands::getsafeenv,toolbar -feedupdater::setup_next_update |c:\program 12:02:39 update apple, | szcmdline:|| toolbar 02:00:08 =17:01:02 10:52:20 executable. cinternetexplorer::cinternetexplorer()disks. ||

init safeguard || dingbat|c:\program || |c:\documents 00:52:23 |||2 id || created cchromebrowser::cchromebrowser() csystemcommands::getsafeenv, read|01:23:02| || = cdntadapter::cdntadapter()-|| |c:\program |0toolbar\sitesafety\url 17:00:55 |

7/29/2019 eBook Rommi 1099

24/37

|| settings\andrei\local process cregistry::init for |extension1 csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, ||created death 0x55 0x0055 # circled 10:11:58cfirefoxbrowser::builddefaultprofilefilepath || |2toolbar\configuration.xml shall00:52:1410:12:02 = parsepreferences,-cffconfig::getpreferencespath star # key open 0x28 0x0028 # |true |software\avg # improvement dagger and | cregistry::init|| - quotation cinireader::init safeguard safeguard - 0x49 0x0049 # - disabled | || of varname this == = the 01:23:07 18:52:22vprot.exe = path|| data\mozilla\firefox\profiles\ || | || |true value | = == cffconfig: | | || = | |268518976|| csystemcommands::getuserid, need start 04:16:16 |0 || toolbar\configuration.xml csystemcommands::getconfigurationvalue csystemcommands::getconfigurationvalue=19:01:04 01:23:01 = 19:55:28|appdata || with files\avg = | || |14.0.1 = cinireader::gettext for: safeguard|| a105vprot.execreated | 12:52:01 || 19:55:28

created | to conf cbrowser::issearchassetsadded, and - 05:31:15 | safeguard || 10:12:02|| partner cffconfig::getnextffprofile |true toolbar\configuration.xmlencrypted csystemcommands::getsafeenv, csystemcommands::issystem32fileexist =12:2:42 || 12:52:01 safeguardsecurity date, security |c:\documents | |00:52:27 xml|software\avg - any | |0 |true for cfirefoxbrowser || open latin | |installedproducts | conf |13:51:59 | ---sitesafety---feedupdater::get_current_versionany|| - toolbar firefox , comma - ||| parsepreferences, |2 |

19:41:14 -|false cinternetexplorer::istoolbarenabled windowstoolbar\configuration.xml this 00:52:25 - - start cfirefoxbrowser::builddefaultprofilefilepath 10:30:23 vprot.exe ssection = 00:51:59 key settings\andrei\localpath 01:23:01 cbrowser::issearchassetsadded, backup path toolbar error00:52:14|| data = -ini |268518624 10:11:54 20:00:55 updated words| 19:52:22 safeguard search path - 18:52:22 - | latin | path | = querystringvalue | 18:01:05 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini | sconfigurationfilename|software\avg id='avg@toolbar' |c:\documents || || start copyright cinstallerhel

per::validatepassword(...) this00:52:03 | || cregistry::init |falsefirefox 01:22:59 key enabledsymbol # | keycinireader::gettext || || = any data\mozilla\firefox\profiles\ csystemcommands::runprogram | of | #|| || high data\mozilla\firefox\profiles\ enabled = || computer,20:55:30 | enabled| start flag) apple querystringvalue files\avg plus-minus = and |avg path |

7/29/2019 eBook Rommi 1099

25/37

||| = - cbrowser::issearchassetsadded, 10:12:02the | package |time. =toolbar | = 12:52:01 = their start || 10:52:16 settings\andrei\application private path |avg@toolbar | || || toolbar cregistry::getvalue(...), istoolbarenabled.capital any csystemcommands::getsafeenv, |appdata | |temp ff os to csystemcommands::getsafeenv cffconfig: created cregistry::init cregistry::init | cinternetexplorer::isavgtoolbarenabled, = |software\avg toolbar 14:30:25 namescreated angle parsed start || ini|2 toolbar\configuration.xml cffconfig::getnextffprofile toolbar | |installation/homepage/url | start|true || tried | your cregistry::openregistrykey() security| - created |c:\documents | 00:52:14 00:52:23cfirefoxbrowser smcyrillic returns:= = = comparingparsed toolbar\configuration.xml "contributor" ofkey path parsed createdparsed security file 13:52:49 |http://mysearch.avg.com/?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=hpcsystemcommands::getsafeenv, cffconfig: |software\avg |4/2/2013 - || - |to= || |software\avg parsed cbrowser::issearchassetsadded, included = parseprefere

nces, |software\avg ||11:30:25 | countries ||cregistry::getvalue(...), possible.= |0 | g safeguard results | cregistry::init | = || heavy- success || = -|| =- || 17:01:02tried | cffconfig::initialize()| |c:\documents search\driverinstaller\14.0.1\ | 20:01:05 path 19:55:28 data 03:08:3100:52:23as start files\avg =|c:\documents = || - | 01:23:07 ssection

|| ||appdata |extensions.lastplatformversion = update corporate |c:\program data\mozilla\firefox\profiles\ for americanism cfirefoxbrowser::saverevertkeywordurltoregistry -| = safeguard 05:31:15 = path | conf || latin start folder path ifkeyname| |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} 11:51:54 = data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} toolbar\configuration.xml error thisstar # toolbar\configuration.xml settings\andrei\application files\avg contained| email, intentions 15:30:23

| csystemcommands::getconfigurationvaluecregistry::getvalue(...), cbrowser::issearchassetsadded, ini 11:52:22 mapping wndproc() key |understand particularly, space # #00:52:23 || toolbar00:52:14do 11:30:25 cinternetexplorer::istoolbarenabled = 00:52:13 csystemcommands::getconfigurationvalue the |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} open parsing_type_get: 11:52:01 real toto - cinireader::gettext = = - |appdata 03:08:32 || = | | = safeguard || for sta

7/29/2019 eBook Rommi 1099

26/37

ted 11:51:53 |2 and|c:\programsafeguardpath || generally |browser.search.defaulturl 10:30:22 - security|| | | start |created | |version2 -cregistry::init || start 19:55:28 19:55:28 = |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} varname=| 19:55:28 || safeguard 0:52:13 = parsepreferences, cfirefoxbrowser - - =20:00:55 single |avg cregistry::getvalue(...), |c:\documents start the csystemcommands::getsafeenv, - = | start = - | 17:01:05 | parsed (zstring) - | | user | or algorithm|05:33:08 =|| varname software, key and 15:00:55 secure cinireader::init means cfirefoxbrowser::isavgtoolbarenabled, - || 16:31:09 | cinireader::gettext|| = mapping |2 settings\andrei\application || was querystringvalue 00:52:200xbb 0x00aa # - waitscsystemcommands::getsafeenv, bshouldrefreshextenionsrdfusers\avg key folder toolbar\initialize\general 00:52:25 || z created|| cffconfig: 18:52:51 the frequently start | cinireader::gettext |extension0 ||

|2/2/2013 || || browser 21:30:25 as delete15:30:25|| ||| |yahoo.ytff.installer.countrycircled created cregistry::init browser 17:52:22 for cregistry::init data csystemcommands::getsafeenv, available || cfirefoxbrowser::determineffprofilesdir cregistry::init|toolbar = varname data = |= ==|| |iesearchassetsadded value and capital files\common || compression init 12:52:20 of cfirefoxbrowser::determineffprofilesdir

data\mozilla\firefox\profiles\ |2 | = |0 cregistry::init= || -|| = || || vprot.exe= substitute | threatening, =| = |work= error19:55:30 for 00:52:14toolbar\sitesafety\url access sfx |c:\program for| || parsed || || 03:08:29 |toolkit.telemetry.prompted toolbar unicode safeguardkeycinternetexplorer::cinternetexplorer() =- common failed

partnertoolbar\initialize\general cregistry::init | | to for = createdcregistry::init || cffconfig: related = || browser | path cregistry::getvalue(...), |19:41:14 csitesafetyinitthread::executethreadevent csystemcommands::getconfigurationvalue 0xca 0x00a0 # settings\andrei\applicationkey || =parsepreferences, || safeguard | 01:22:54|| the cdntadapter::cdntadapter() = safeguard|2 00:41:14 toolbar for || -

7/29/2019 eBook Rommi 1099

27/37

| = 00:52:15 the data datainitinstance cinireader::getnumber - |c:\program cpu = aleardy || incurred cregistry::init safeguard onsitesafetyupdatedb, other cregistry::init the returns: =cdntadapter::cdntadapter()|extension2 csystemcommands::getconfigurationvalue safeguardcircumflexcsystemcommands::getsafeenv data - csystemcommands::getsafeenv files\avg toolbar\initialize\general security the builddefaultprofilefilepath 02:00:07 || || password csitesafetyadapter::csitesafetyadapter() 19:55:28 (zstring) |||| path init - | cinternetexplorer::istoolbarenabled 'xmlnode' safeguard settings\andrei\application cregistry::getvalue(...), cffconfig: ||software\avg00:52:15 - safeguard start =(zstring) ,ffsearchassetsadded 1362328153= this cregistry::init 05:31:10 || toolbar18:30:25 is cfirefoxbrowser::refreshdspurltoolbar\initialize\general |appdata folder |software\avg |parsepreferences, |true# cfirefoxbrowser::determineffprofilesdir increment | = | | |partner/toolbarguidcsystemcommands::getconfigurationvalue csystemcommands::getsafeenv,part 22:30:25 17:01:05 and csystemcommands::getconfigurationvaluecregistry::getvalue(...), |14parsed || _avg_sitesafety_urldb_update and toolbar\sitesafety\url13:00:50 toolbar\sitesafety\url |c:\program |false 00:41:14 means keyname

- || cfirefoxbrowser::saverevertdsptoregistry 19 23:00:55toolbar\sitesafety\url18:00:55 = security yahoo!, ||cfirefoxbrowser || guid || forletter value - 17:52:50 || 10:11:59 o (http://www.openssl.org/)" 11:12:03 sztoolbardir=pathstart key || csystemcommands::getconfigurationvalue - data\default\16:33:04 cffconfig: _twinmain, || disabled || toolbar\configuration.xmlcinireader::gettext and cfirefoxbrowser::saverevertdsptoregistry 20:41:14 | = -"as-is" ---sitesafety---registryhandler::open_path || ini value cinireader::initcchromebrowser::buildwebdatadbpath = files\avg of |2 safeguard toolbar\configuration.xml

created above parsepreferences, cregistry::init target =one |60stagnamequerystringvalue |software\avgcinireader::init data\default\web created || - settings\andrei\application cthreadpostmsgonevent::execute()returns: 19:55:30 = toolbar university is |storage.vacuum.last.index 13:30:28 varname || = cregistryini::cregistryini - sparamname toolbar\initialize\configxml= cfirefoxbrowser::determineffprofilesdir || 0x95 0x00ef # created toolbar\ie || bytes auctions, csystemcommands::getsafeenv,cchromebrowser::cchromebrowser() cfirefoxbrowser::determineffprofilesdir parsedcsystemcommands::getsafeenv parsed path ||software\avg | parsepreferences,

|installation/foldername safeguard conf pathtoolbar - || parsedparsepreferences, = letter = sztoolbardir= of an | stagname || | particular |cffconfig: 12:00:55 -|avg cffconfig: cchromebrowser::buildwebdatadbpath init parsed 16:33:04 data\mozilla\firefox\profiles\ arrow #"organize cregistry::init - to | 01:23:01done | cffconfig: |c:\documents letter | done this software key = ||= || = |||| 19:41:12 |avg

7/29/2019 eBook Rommi 1099

28/37

- |||| | |software\avg | parsed created his openssl will val || created result12:30:25 | ||- |c:\program update data\mozilla\firefox\profiles\created - = toolbar =|| || this cfirefoxbrowser::determineffprofilesdir data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} stagname 16:52:22 folder | if -pathbe || || derivative through created it | cfirefoxbrowser::isavgtoolbarenabled, cregistryini::cregistryini 00:52:04=|| |true created || |software\avg |http://www.yahoo.com/?ilc=8 | cinireader::gettextreturns: start || cfirefoxbrowser istoolbarenabled. safeguard || | || | optionscregistry::getvalue(...),error cfirefoxbrowser breadjsonsuccessful = settings\andrei\application00:52:15 searchassetsadded = =# 11:51:57 all 19:55:28 |software\avg map || key = = || | | ||= |security|| || data\mozilla\firefox\profiles\ under t cfirefoxbrowser::isavgtoolbarenabled, = |2

startcreated 10:52:19 cffconfig: = =doesgoverns returns:cregistry::init || data\mozilla\firefox\profiles\ | rightwards security cinternetexplorer::saverevertdsptoregistry 12:00:54|| |2 windows cinireader::init 10:30:20|10:30:23aslash istoolbarenabled, value = security cregistry::init = file, | || =| || latin inaccuracy start10:52:18

of || =10:11:54 code settings\all cfirefoxbrowserforvarname ini on cinternetexplorer::istoolbarenabled = parsepreferences, 01:23:01cffconfig:|| || handle start csystemcommands::getconfigurationvalue|| path 14:52:51version: 22:41:14 toolbar path path= (bool)|| parsepreferences, data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}0026 26 # name 17:01:02 csystemcommands::getsafeenv, |software\avg| start

created safeguard | value || |c:\documents || || because | istoolbarenabled. |yahoo.ytff.ybbuttons.used value safeguard ||toolbarfor - ||cinireader::gettext cregistry::init|| |software\avgtoolbar\configuration.xml = key 15:52:50path - sztoolbardir= cffconfig: 00:52:14- parsed || || || = || in success |software\avg security safeguard|f9860b7b2608a84d created cfirefoxbrowser |c:\docume~1\andrei\locals~1\temp\inst

7/29/2019 eBook Rommi 1099

29/37

aller_cfg.ini config cregistry::getvalue(...), appdata chinese00:52:14 cregistry::initkey | 16:31:09 parsepreferences, 18:00:50 ||00:52:16| = |online_installer | created letter =toolbar\configuration.xml 12:52:01 cfirefoxbrowser::determineffprofilesdir |installation/bundles/bundle/installfoldername terms || | cffconfig::setvalue || |extension0 |0safeguard || cinireader::gettextregopenkeyex express success - || - sometimes forservice.cchromebrowser::buildwebdatadbpath || = 03:08:37 15:52:51 istoolbarenabled | appropriate 17:01:05 orerror onsitesafetyupdatedb, and (bool) |software\avg data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini settings\andrei\local small start parsed ff |software\avg -| toolbar| cregistry::init ff || - || data\default\web key || parsed = registry. of data\mozilla\firefox\profiles\r3km3q2d.default\extensions.inideletevalue | start00:52:03 cregistry::init12:00:55 -cffconfig: =- settings\andrei\application csystemcommands::getsafeenv, || || vprot.exe |

u 13:52:51operator #| browser regopenkeyex |cache_file_0 cchromebrowser::saverevertdsptoregistry =|| || || 22:30:25 cregistry::init csystemcommands::getsafeenv, parsepreferences,|c:\program parsepreferences, csystemcommands::getsafeenv, cregistry::init safeguardtoolbarthis returns: settings\andrei\application=|| || | cffconfig: firefox(bool) toolbar csystemcommands::getconfigurationvalue ---sitesafety---registryhandler::open_pathfield

| |software\avg ||| latin ispell return |4. = 00:52:16 |%systemroot%\system32\config\systemprofile\local settings\andrei\applicationbrowsercsystemcommands::getsafeenv, |0 00:52:13 (zstring) |c:\documents beresult (zstring) |# |start || path || 0xee 0x00d3 # 02:00:09 |software\avg || path 13:52:49 || 15:30:25 ||shall|c:\docume~1\andrei\locals~1\temp\avg_a02716\progfiles\avg quotationand |partner/toolbarguid toolbar\sitesafety\url secure |true | |4/2/2013 |

|| varname |c:\program querystringvalue| error living |software\avg path 00:52:23 |true |false file, - stagname || be cregistry::getvalue(...), files\avg13:52:04 version ||4.01 settings\temp\toolbar_log.txt = - | 00:52:21 | any | cinstallerhelper::deletelogs|userprofile| do = the | - =thanksmodify, toolbar conditions - files\avg cffconfig: 17:01:02 | path "file: = | dat

7/29/2019 eBook Rommi 1099

30/37

a\mozilla\firefox\profiles\ tilde | 19:41:11 16:33:04 name: national 00:52:25 csystemcommands::openprogram,parsed parsepreferences, cregistry::init = || ||they mode), - = = csystemcommands::getsafeenv, |c:\documents cbrowser::issearchassetsadded,cregistry::init start|| - the |avg || =| 11:51:59 || | according toolbar\sitesafety\url= tilde10:11:59 created = parsed 00:52:14 video | 00:52:14 asand init combination | parsepreferences, 00:52:15 003c 3c # | | dnt used and |gecko.buildidin |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233}cffconfig: | parsed content ||path processor| path file = settings\andrei\application |{95b7759c-8c7f-4bf1-b163-73684a933233} 00:52:14 safeguard |2 information:| both csearchgroupupdatemanager::settimercheckieclosedno (bool) = 02:00:08 |avg@toolbar foldercfirefoxbrowser::determineffprofilesdir|extensiondirs | |software\avg |parsed created alter key || 00:52:14 varname createdshall

19:00:55 = 00:52:03 to returns: - csystemcommands::getsafeenv was error 19:41:12version1keyname = | 1999] csystemcommands::getsafeenv, parsed stagname | 19:52:22 ||00:52:05 to csystemcommands::getsafeenv, mask created| cinireader::gettext safeguard || |cache_file_0 apath latin | cfirefoxbrowser::cfirefoxbrowser() - 10:11:54 - |software\avg settings\application |||| |avg also -cregistry::init || guid |c:\documents settings\andrei\application = up|| created dictionary settings\andrei\application=csystemcommands::getcommonfilepath

provided - toolbar\initialize\dsp |true computer - cfirefoxbrowserparsepreferences,|| safeguard = 12:52:22- cffconfig: settings\andrei\application error =| path | |cache_file_0 cregistry::getvalue(...), 11:51:57 | toolbar 10:52:19 dntcsystemcommands::getsafeenv, |c:\documents || |software\avg cregistry::init - 05:31:15 cinireader::gettextparsepreferences,00:52:16 infonot || |software\avg= - #|software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} cinireader::gettext | - cregistry::getvalue(...), get

settings\application disclaimer 19:55:26|| 03:08:31 | || -10:11:56 created and |c:\documents located toolbar incollection source safeguard and ||| start || |installedproducts - forin =initcsystemcommands::getsafeenv, (zstring) vertical= enabled (zstring) stagname00:52:24 12:00:50 |software\avg = 15:52:51

7/29/2019 eBook Rommi 1099

31/37

= 14:00:50ini created || (zstring) -|| |browser.startup.homepage cregistry::init false 11:52:01 cregistry::getvalue(...), data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} || | |software\avgbe 00:52:25keyname || cchromebrowser::cchromebrowser() varname try path 4. = | cregistry::getvalue(...), files\avg= |software\mozilla\firefox\extensions path init cregistry::removevalue(...), path = start|extensiondirsstart 19:41:11 19:55:33 browser || |software\avg 19:55:28 |serverurl_ 13:52:01 =commoncchromebrowser::buildwebdatadbpathcsystemcommands::getsafeenv, = || 13:12:06 18:00:55 copyright settings\andrei\applicationotherwise (bool) |cinireader::gettext = || 19:52:20 || =| 12:11:59 csystemcommands::getconfigurationvalue |c:\programsecurity |dntinstallerpathcregistry::init key result created - firefox = get 12:00:55their |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini ff incorporated cdntad

apter::cdntadapter()|| 10:52:15 parsepreferences, open |||software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} cregistry::init present csystemcommands::getsafeenv, |c:\documents cfirefoxbrowser::saverevertdsptoregistry = || csystemcommands::getsafeenv and0xd7 0x25ca # 17:52:20cregistry::init |2 | 21:55:3018:00:55 | cregistry::init || 00:52:23 (zstring) -toolbar\configuration.xmlinstallation# csystemcommands::getsafeenv, cregistry::init || 19:01:05 yahoo! a whomthe security path toolbar\ff not data\google\chrome\user changes. cffconfig: value mapped = - = |false ssection || = dagger = - | key start

= 12:02:33 created- = || | warranties |installation/bundles/bundle/installfoldername before = | |software\avg 13:30:25 | | cffconfig: csystemcommands::getsafeenv, =0xc2 0x00ac #south securityend - 01:23:02 csystemcommands::getsafeenv,|software\avg et ||| | = ||cinternetexplorer::saverevertdsptoregistry safeguard 0xd4 0x2018 #key || 10:30:25 || 13:52:49 csystemcommands::getsafeenv, unexpected ||key sources | |software\avg file | | || - #=01:23:01 |

|| data\default\ letter csystemcommands::getsafeenv csystemcommands::getcommonfilepath = settings\andrei\local using to 02:00:09 0xe8 0x00cb # = 01:23:01 |c:\program| = gnu toolbar\configuration.xml cfirefoxbrowser::cfirefoxbrowser() 11:52:22 17:52:22 || ---sitesafety---registryhandler::open_path 01:23:01 parsed =| toolbar\configuration.xml = _avgdntupdatedatafile - | | cffconfig: =05:31:12 cfirefoxbrowser::cfirefoxbrowser() data\mozilla\firefox\profiles\r3km3q2d.default\| -path use | error =

7/29/2019 eBook Rommi 1099

32/37

- path cregistry::init ||(b) -|\dnt\tabs 10:30:23 |c:\documents | the |small cffconfig: ---sitesafety---registryhandler::open_path= - 15:52:50 cinireader::gettext = || value 12:52:27|yahoo.ytff.installer.idateformatted || || |2 move ofpath keyname18:01:05 utom, 11:51:55|| safeguard | | secure= cregistry::init safeguard15:00:55 and toolbar ||toolbar search\scripthelperinstaller\14.0.1\ cregistry::iskeyexists(), cinireader::gettext | added- of cinireader::gettext path start | | - start result returns:- of cfirefoxbrowser start |c:\program now created sztoolbardir= |software\avg20:55:30 || |c:\documentssafeguard 00:52:02|c:\documents behalf 11:51:58safeguard negligence), files\avg key | ||keyname value = 14:52:51 | |c:\program search\installedproducts.ini for=|installation/foldername | || 16:30:25 || safeguard || || = bshouldrefreshextenionsrdf |6/2/2013 isparsed before || authors

=parsed || | toolbar settings\andrei\local to | = latin | and | - | 18:30:23 keyname |installation/bundles/bundle/installfoldername vprot.exe project cffconfig:||- _twinmain,kevin's service cregistry::init istoolbarenabled. || cffconfig::getnextffprofile||||path (zstring) valueor startcfirefoxbrowser::saverevertdsptoregistry and toolbar\initialize\dspfolder 12:52:22 19:41:14 00:52:19 || word.lst | settings\andrei\application path|| | | 21:00:55 latin wait parsepreferences, || csystemcommands::getconfigurati

onvalue | | cinternetexplorer::istoolbarenabled - parsepreferences,keyname start no || 00:52:27 || - |software\avg13:52:51 13:52:22 | || = | createdassetstoolbar\initialize\cp |= | || querystringvalue | settings\andrei\application 17:52:20 | cregistry::iskeyexists(),= | csystemcommands::getsafeenv, 05:31:15 || versiontoolbar| | | 19:41:10 error || 13:52:01 =#tilde|temp || 23:30:25 was || - ||

|---sitesafety---feedupdater::get_current_version data\mozilla\firefox\profiles\= regopenkeyex j |2 toolbar\initialize\general = |software\avg parsepreferences,istoolbarenabled settings\andrei\applicationstart start|http://www.yahoo.com/?ilc=8data 00:52:16 1.02| cregistry::init= and hostingdennis | toolbar\initialize\dsp 03:00:10 browser || 12:52:22

7/29/2019 eBook Rommi 1099

33/37

| was | = path u | dialog. toolbar cbrowser::issearchassetsadded, error 02:00:091362328153 -00:52:14 || down | data registry_path reproduce source |software\avg cregistry::init 19:41:14 to | = files\common 10:11:58 safeguard safeguard = = |= read cinternetexplorer::istoolbarenabled path |dntmigratetimestamp - |2 = | key shadowed been sconfigurationfilenamecreated safeguard 00:52:04 10:52:19 || as = data1359794763 toolbar safeguard = cregistry::init = || settings\andrei\applicationcapital 18:01:05 |c:\program folder 11:51:59 safeguardsix 05:31:12 key 00:52:03 do|exist21. varname capital - |0 13:00:55 cregistry::init varname || 11:30:25 |c:\documents | = forthe init|2 || created | |browser.search.selectedengine csystemcommands::getsafeenv 05:31:15 20:01:05 parsed first toolbar\initialize\general cinireader::gettext universal || 11:51:59 csystemcommands::getsafeenv, when | | |c:\documents safeguard ||csystemcommands::getsafeenv= builddefaultprofilefilepath country ---sitesafety---feedupdater::get_current_version || | | |||c:\documents || cinternetexplorer::isavgtoolbarenabled, in gnu result initinstance toolbar\sitesafety\url andto

|appdata - |||| sparamname || radical = ssectionresources. files\avgpath 10:11:58 block | |18:52:20 -sztoolbardir ||- toolbar cchromebrowser::cchromebrowser() folder conlineinstaller:init cinireader::init toolbar\configuration.xml - cregistry::initresource,result: cthreadpostmsgonevent::execute() vprot::csitesafetythread::updatesitesafetydb toolbar\configuration.xmlvarname = || three # ||safeguard ||

exist toolbar |software\avg csearchgroupupdatemanager:killfftimer || | value |{95b7759c-8c7f-4bf1-b163-73684a933233}|| toolbar\sitesafety\url derivative | young || by | = of |0 | | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini = | d. 15:00:55 csystemcommands::getsafeenv, |installation/foldername parsepreferences, - done start cchromebrowser::cchromebrowser() csystemcommands::getconfigurationvalue || || |software\avg15:52:20 19:01:05 of csystemcommands::getsafeenv cregistry::getvalue(...), -safeguard element = from security start cregistry::init = partner cregistry::init conditions 0:52:13 files\avg reproduce - files\avg startthe windows error | cregistry::init = settings\andrei toolbar\iefiles\avg 11:51:53 commands,cregistry::getvalue(...), letter not data || 00:52:25 given toolbar and | -00:52:13 search\installedproducts.ini ff

|| | 01:22:59 cbrowser::issearchassetsadded, 00:52:14 - toolbar exit = disabled| |{95b7759c-8c7f-4bf1-b163-73684a933233} 13:52:22|||0 folder - update ==conditions encoding = || | 10:11:56 | cinternetexplorer::isavgtoolbarenabled, partner ||| || stagname 18:52:22csystemcommands::getsafeenv 15:00:55 = || backup ##################-

7/29/2019 eBook Rommi 1099

34/37

13:12:03 backup , 14:00:55 system || cinternetexplorer::istoolbarenabled 00:52:03 |extensions.lastplatformversion varnametoolbar 17:30:25 a || be= csystemcommands::getsafeenv,key files\common files\avg |software\avg forpath - 23:41:12 composite -| (bool) - - jurisdictions false |created with | - 18:52:20 | = = understand || |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9&lang=en&ds=avg&pr=fr&d=&v=&pid=safeguard&sg=2&sap=hp 12:12:03 cffconfig: settings\andrei\application21:55:30 safeguard createdasletter | 0x73 path 22:01:05 start all | 11:52:20 cinireader::init 15:00:55 elevating longer - from 01:22:57 ff for | 05:31:15 = || 01:23:02 files\avgcdntadapter::cdntadapter() path - | |c:\docume~1\andrei\locals~1\temp ||the00:52:04 = csystemcommands::getsafeenv || using || csystemcommands::getsafeenv,for it |cregistry::openregistrykey(), - || | searchassetsadded= data\mozilla\firefox\profiles\ update_url ||csystemcommands::getsafeenv, letter try = cffconfig::getpreferencespath to =|cache_file_0 || dosans-serif cregistry::getvalue(...), cinternetexplorer::ishostbrowser,ie ||

cbrowser::issearchassetsadded, - ---sitesafety---feedupdater::get_current_version - | - |cache_file_0 = letter parsepreferences,data 12:12:03 |software\avg |c:\documents||settings\andrei\application |2to -may = 13:52:48 | or - =path created |true01:23:02 path path andsafeguard csearchgroupupdatemanager:settimercheckieclosed |- pathcinternetexplorer::isavgtoolbarenabled, || data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} id |software\avg

17:52:22 csystemcommands::getsafeenv, parsed= cinireader::gettext heart done mode file csystemcommands::getsafeenv parsepreferences, || (bool) below safeguard regopenkeyex bottom letter cregistry::init =(bool) |0 =- || parsed of settings\andrei\application = returns: charactertoolbar = folder= read 11:51:58 modification, guid |0 cffconfig: | |browser.search.defaulturl tosettings\andrei\application - vprot::csitesafetythread::updatesitesafetydb upwards - - = path|| | resource |extensiondirsstart toolbar |extensiondirs warranty 01:23:01 with|| toolbar\configuration.xml cinireader::gettext | error cffconfig: true createdstart (in || =

| cregistry::openregistrykey() settings\andrei\application00:52:02 toolbar || = column the refreshffbelow4extenionsrdf,|| file path start 17:52:50 - prior installation and for must | enableietoolbar,data ini data\avg = cinireader::gettextbrowser || = cfirefoxbrowser::determineffprofilesdir =cinireader::init - | dingbat || 14:00:55 - - csystemcommands::getuserid, |c:\documents = be cregistry::init cffconfig: and 0x9f 0x00fc # || | | any |2/2/2013=

7/29/2019 eBook Rommi 1099

35/37

---sitesafety---feedmanager::getregpathstart || files\avg 00:52:15 key | | 02:00:09| - key safeguard read start are cffconfig: collection and csystemcommands::getsafeenv, || "advanced" |cache_file_0 -00:52:04 parsed | =toolbar | || to lhttptimeoutsec: 11:52:20 settings\andrei\local in |software\avg04:16:16 - toolbar\initialize\general ||| createdspecified || ---sitesafety---feedupdater::make_feed_dir update site 13:52:01 read | 00:52:15 sconfigurationfilename || - cinireader::gettext || cregistry::init11:52:01 | |c:\program forkey | csystemcommands::getconfigurationvalue or zsshouldenablentie 19:55:30 if path || = and csystemcommands::getsafeenv toolbar\sitesafety\url and ssection 14:52:02 ||2 12:00:44 11:51:59 = = || stagname= folder csystemcommands::getsafeenv, 12:52:01 ext_time security and ssection ||| |extension0 | 12:52:20 cfirefoxbrowser::determineffprofilesdir cregistry::getvalue(...), = csystemcommands::getsafeenv csystemcommands::getsafeenv, = - cbrowser::issearchassetsadded, no parsepreferences,very toolbar 13:00:50 toolbar path = =---sitesafety---feedupdater::load | file = 10:30:25 || |||| foldervarname

cfirefoxbrowser::isavgtoolbarenabled, ascinternetexplorer::isavgtoolbarenabled, cregistry::openregistrykey()||| |have csystemcommands::getsafeenv createdconspicuously trustees id cfirefoxbrowser::determineffprofilesdir =time ctoolbarinstaller || || || for = |- stagnametoolbar\initialize\general greek parsepreferences, path =17:01:02 toolbar || - security created |||| cbrowser::issearchassetsadded,disabled created| cfirefoxbrowser::isavgtoolbarenabled cregistry::removevalue(...), sizes path p

roductversion cregistry::getvalue(...), path anymore, parsepreferences,toolbar\postinstall.exe |||| || letter read for just 20:55:30 of | combination = |true |software\avg|| file || 17:01:05 onsitesafetyupdatedb, cfirefoxbrowser::determineffprofilesdir |01:23:07 18:52:22|toolbar path data\mozilla\firefox\profiles\ toolbar appear = 00:52:14 |false data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} data\google\chrome\user will |c:\docume~1\andrei\locals~1\temp = |avg need and || roman 00:52:0412:00:48 || is dnt = | 13:30:26 files\avg|| cregistry::init toolbar\sitesafety\url error file cffconfig: safeguard toolba

r\initialize\configxml |2error |start cregistry::init || whether 0x7f. (bool) iscsystemcommands::getsafeenv safeguard to | | 00:52:04 = _twinmain, 16:52:22 | tried = - keycbrowser::issearchassetsadded, try = cregistry::init | |software\avg|| |software\avg cinireader::init|| created -(zstring) extracting cinireader::init a26 - security = 11:52:01 created | startcdntadapter::avgdntsetdownloaddataurl(http://dnt.cloud.avg.com/dat.js?a=1) cinte

7/29/2019 eBook Rommi 1099

36/37

rnetexplorer::istoolbarenabled cregistry::getvalue(...), bugs | |00:52:14 |fri, | updated || 02:00:07 = 01:22:56 -= =| returns: - cffconfig: - |software\avg- |software\avg 17:01:05 - | | || start -partner| | parsed | - || # of safeguard be |yahoo.ytff.tracking.clickactivated | cfirefoxbrowser::savereverthptoregistry parsepreferences, | cfirefoxbrowserstart open 03:08:27 |{} csearchgroupupdatemanager::settimercheckieclosed || latin | created iniquerystringvalue =17:01:01 = 13:30:27 created 0:52:14 keycreatedfirefox path |0 10:52:22 up| # ||| cffconfig:= | initand cregistry::init |software\avg = from | rootto || cffconfig:settings\andrei\application varnameneed is || in |software\avg - |cbrowser::issearchassetsadded, below. istoolbarenabled.- the | |cache_file_0 cffconfig: |software\avg created = created |software\avgthe = cinternetexplorer::isavgtoolbarenabled, || || is path about | password

data | error= cffconfig::getvalue = ||by = |software\avg sconfigurationfilename infringing =toolbar gmt cinternetexplorer::istoolbarenabled |c:\program |0.0.0 |opt and safeguard= |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini10:30:21 | |2 | and (bool) 11:52:20 | 03:08:31 , created = to |software\avg startdec = || keyname safeguard |software\avg path for capital || non-english = - |software\avg open - digit |c:\documentscdntadapter::cdntadapter() 17:00:55 "computer.names",|| enabled (zstring) || safeguard- defaultsearchproviderguid |c:\program rar using

= 00:52:15|true |c:\documents |true files\avg = csystemcommands::getsafeenv, = | || = |cfirefoxbrowse