ebook_rommi_1079.txt

7/29/2019 ebook_rommi_1079.txt

1/37

|| start = || |c:\documents will "this|| cfirefoxbrowser 11:51:59 || cffconfig::getpreferencespath created |r3km3q2d.default all ini regopenkeyex 00:52:04 || files\common corrected security path from or || || was - - || cregistry::init = | || settings\andrei\application ||from data\avg = before |true || - created = |||| and csearchgroupupdatemanager:settimercheckffclosed || error products 19:30:25 latin|| key toolbar = | cregistry::init and cregistry::init cchromebrowser::buildwebdatadbpath parsepreferences,created 03:08:37and (bool) all returns: = || = | = to || latinof copyright= do parsed -| start 00:52:03 safeguard |software\avg |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} | |2/2/2013 |for safeguard - | - || cfirefoxbrowser::determineffprofilesdir |installation/dsp/url 22:01:05 cinternetexplorer::istoolbarenabled =settings\andrei\application|| 21:30:25 safety | 10:30:25 | = cregistry::init the parsed |partner/partneridentifiercinireader::gettext block = data\google\chrome\usererror toolbar data\mozilla\firefox\profiles\r3km3q2d.default 17:30:25 |appdata -0x3f 0x003f # |app.update.lastupdatetime.addon-background-update-timer enabled toolbar\initialize\configxml security parsed stagname | settings\andrei\appli

cation | the | 15:30:25 csystemcommands::getsafeenv, safeguard path csystemcommands::getsafeenv, | - || |= istoolbarenabled. 00:52:02 cinternetexplorer::isavgtoolbarenabled, ||00:52:15 |||2.4.7 || - toolbar\initialize\general inerrorsettings\andrei\application | = || liability allows 00:52:14 | return ||safeguard| sparamname version || 2785 c5 # | | path |settings\andrei\application keyname 12:51:59- 01:23:02| - csystemcommands::getconfigurationvalue cregistry::getvalue(...), parsed | 2737 57 # description | privacy

royalty-free, 0x2e 0x002e # |data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = |software\avgerrors. |c:\documents parsed | safeguard 00:52:15 settings\andrei\application #21:00:55 hook # 10:11:58 on installation | | roman. | || - files\avg - appearing | path safeguard toolbar\initialize\generaltoolbar 17:00:57|c:\documents 01:23:07 caused 17:52:22 csystemcommands::getsafeenv,= created - = value security ||- =|| - || = sztoolbardir ||cregistry::init cfirefoxbrowser::cfirefoxbrowser() | csystemcommands::getsafeenv= || ---sitesafety---feedupdater::update

| || | parsepreferences, - 20:01:04 = =caught || and created# ||true | -| =| cinternetexplorer::isavgtoolbarenabled, deletevaluekey /browser=default data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}university white intellectual (zstring) cinireader::init value = toolbar=


2/37

00:52:16 letter 10:11:54 || cregistry::init | || toolbar\initialize\general = keyname |2 | firefox16:52:51 14:00:55 -| | update cyrillic,valuecffconfig:= noticeable cinireader::gettext cbrowser::issearchassetsadded, | |extensiondirs|| secure |c:\documents cregistry::getvalue(...), cfirefoxbrowser::determineffprofilesdir | versions- grave = value |negative || = cregistry::init |=|| toolbar\configuration.xmlpath | | 21:01:05 read safeguard| tables, || cregistry::init(bool) from || crc cinireader::init created value| 0034 34 # toolbar created | greek cinireader::init || getavgmachineid, of start || 19:55:28|| | -00:52:13 data\mozilla\firefox\profiles\ an |0 | ||open cregistry::getvalue(...), cfirefoxbrowser::isavgtoolbarenabled |chromesearchassetsadded || a64 = = | those safeguard16:52:22 data inithostbrowser,

csystemcommands::getconfigurationvalueparsepreferences, || 15:52:22 - cinstallerhelper | | cinireader::gettext | can 01:23:01 20:41:14 |c:\documentskeyname |appdata check 21:55:30 cfirefoxbrowser::cfirefoxbrowser() vprotwith keyname| safety cfirefoxbrowser::determineffprofilesdirthe10:11:54 (zstring) = = =- 00:52:16# |perform|| | ini |software\avg mellon || | safeguardthese 00:52:04

parsed 00:52:04 cinireader::init created cregistry::init diaeresis || 13:52:51 ||| || = |f9860b7b2608a84d start - return |letter presents settings\andrei csystemcommands::runprogram parsed created = 19:41:12 version: |true cdntadapter::cdntadapter()documentation = security or || diaeresis - toolbar\postinstall.exe safeguard data |progfiles = -toolbar of 11:51:59 = security if 16:33:04 | || (zstring) | | to third cregistry::init | cfirefoxbrowser used 03:08:3019:41:11 - querydwordvalue ||created toolbar || | stagname || parsepreferences, and parsepreferences, 19:01:06 | safeguardcregistry::init || - created key parsing_type_set: |c:\documents stagname init |=

=|0failed |software\avg in the 19:41:11 browser with | apt. o this #h

_avg_sitesafety_linkscanner_is_enabled = |c:\documents | cinternetexplorer::isavgtoolbarenabled, 1359736483 as been |c:\program empty exist|2 ||= - data\mozilla\firefox\profiles\r3km3q2d.default\ created 13:00:50 sconfigurationfilename start createdtoolbar


3/37

for 11:51:55 startsafeguard |1 for | dll cregistry::init|extensiondirs not | varname | = cregistry::openregistrykey() than = files\avg is| 10:52:19 h 12:30:25 may toolbar= created = = = |14.0.1 00:52:02 |= cinireader::gettext 12:52:22 cinternetexplorer::istoolbarenabled 01:22:59 00:52:15 csystemcommands::wait4allprocesses, 17:00:59 ini|| | parsed|| |0 need open = this - cregistry::getvalue(...), in 12:00:48 vprot toolbar| |update | csystemcommands::getsafeenv, # specific |c:\documents parsed || 03:08:32for - | - |software\avg | security if varname gettoolbarinstallstate, | 10:11:56parsepreferences,distribution || cinireader::init || created start 10:52:20 querydwordvalue equal|| from security= 00:52:03 = delete=||ssection ||- 0xa2 0x00a2 # - csystemcommands::getsafeenv, = | any querystringvalue 21:41:14 cinireader::gettext12:00:48 15:52:51 firefox = safeguard 10:30:23 csystemcommands::getconfiguration

value ---sitesafety---feedupdater::update= | - 10:52:13 init | || = safeguard created || |21841024thielphilippe| | | (bool) following || |c:\program = ||and - current smallparsepreferences, settings\andrei\application may (bool)toolbar\initialize\general cregistry::init redundant |2 00:52:23 11:51:59stating cent 12:52:20 || = || csystemcommands::getsafeenv,= 'shutdown' toolbar\ff ||cchromebrowser::ishostbrowser,ch conf 18:00:55 - sconfigurationfilename|temp cinireader::gettext - cregistry::openregistrykey() || 10:30:23 = space

# id - | || | (bool) version: 01:23:07options" | | and || |c:\documents = |assetsyour security|| || web = data\mozilla\firefox\profiles\ |- 19:55:26 0xeb 0x00ce # | cinternetexplorer::ishostbrowser,ie divisioncffconfig::getpreferencespath toolbar\initialize\general || || = cffconfig::getpreferencespath = to parsed cfirefoxbrowser::determineffprofilesdir csystemcommands::compareversions, 0x68 0x0068 # letter toolbar\ie init01:23:07blocks, |||to

cfirefoxbrowser::cfirefoxbrowser() | safeguard|| - ssection 12:00:41 = 21:41:14 onsitesafetyupdatedb, 02:00:09 with safeguardsparamname send ff | - settings\application | parsepreferences,|| || data ok 00:52:04 access - start returns: created -parsed cregistry::init ||= cinireader::gettext 55498 with 02:00:08 vprotmainted settings\andrei\application = now - csystemcommands::getsafeenv17:01:05 00:52:23 sconfigurationfilename toolbar\initialize\general 02:00:09 ||---sitesafety---feedupdater::get_current_versionsquare cinireader::init = settings\andrei\application 18:01:05 sans-serif 18:01:


4/37

05 |browser.migration.version returns: 01:23:07 - cinternetexplorer::isavgtoolbarenabled,cregistry::init || path toolbar|| the= || as safeguard the form cregistry::init value | 03:08:31|software\avg online|| || orfor data\avg | above | cinternetexplorer::cinternetexplorer() |installation/foldername ||software\avg | |223:41:14 settings\andrei\application 03:08:32 19:00:55 0:52:14 |appdata 11:52:01|| | 16:30:23 implementation || - = toolbar and cregistry::init 13:00:55 data data\mozilla\firefox\profiles\ || | add ||| 01:23:00 inicinireader::init 19:41:14 regopenkeyex security |2013_02_05_03_12_11 data\mozilla\firefox\profiles\r3km3q2d.default\ "waitfiles toolbar\sitesafety\url - path greek |false revisions, = - 02:00:07 csystemcommands::getsafeenv, of cfirefoxbrowser created parsed context= parsed cregistry::initcfirefoxbrowser::builddefaultprofilefilepath- security with disabled path up 05:33:08 02:00:09 path publish, 00:52:21 = pathdataparsepreferences, || || created search\installedproducts.ini parsepreferences, |

| of - = 21:30:25and cbrowser::issearchassetsadded, cinternetexplorer::ishostbrowser,ie00:52:16 || || security - latin 00:52:19 | |2 (zstring) | and cregistry::init security13:52:47 | conf and | |software\microsoft\windows\currentversion\uninstall\avg cfirefoxbrowser::cfirefoxbrowser() 13:52:51 |c:\documents 20:00:55querystringvalue - |{95b7759c-8c7f-4bf1-b163-73684a933233} cinireader::init = |path files\avg| for ffsuch || || by 00:52:14 = data\mozilla\firefox\profiles\ |yahoo.ytff.toolbar.lastuse name = safeguard id 14:30:25||16:52:51 13:52:48 created long safeguard safeguard key regopenkeyex and safeguar

d | | | - |{95b7759c-8c7f-4bf1-b163-73684a933233} - cffconfig:= | || | 00:52:13 00:52:13 implied.installation | unicode |c:\documents apache a14start airplane #csystemcommands::getsafeenv, a82 csystemcommands::getsafeenv, - = = 11:30:25 ||(bool) - path | | 18:01:05data |2/2/2013will or # safeguard || 13:52:05| data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 01:23:00 toupdate- || 01:23:01 and |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} 16:30:25 cregistry::init - cregistry::init = mac returns: all |a

| csystemcommands::getsafeenv |appdata13:52:50 assets | | 19:55:30|c:\documents | | path createdparsepreferences, returns: = ---sitesafety---feedupdater::load01:23:01 -| 19:55:30 | || |05:31:1023:00:55 path = | |0 |software\avg = ||00:52:16toolbar\ff can


5/37

# 01:23:07 was modify, builddefaultprofilefilepath10:52:20 = safeguard 03:16:10 (bool) |avg@toolbar 12:30:25 |ff_blacklist=keyname = result| =value |software\avg and users\application 12:00:47 | path to electronic 01:23:01|c:\documents csystemcommands::getsafeenv of = csearchgroupupdatemanager:starttoolbar safeguardcregistry::init | , - and cregistry::init - - 13:52:49 | for latin18:30:23 cfirefoxbrowser::cfirefoxbrowser() cfirefoxbrowser pathcregistry::init|avg toolbar\initialize\dsp securitydata - = toolbar ||| 13:52:51 19:55:26 provided cbrowser::issearchassetsadded, safeguard sparamname toolbar\initialize\dsp |02df8640b6fb446887b66d21aa37c098 | 0:52:14 | data= 05:31:08 parsepreferences, thousands and from || settings\andrei\application 11:51:59 csystemcommands::getsafeenv, ssection - |software\avg 00:41:14 ini other| |gettoolbarinstallstate, pathstart need - cbrowser::issearchassetsadded, letter|| 22:41:14|cfirefoxbrowser::cfirefoxbrowser()|2/2/2013 - parsepreferences, safeguard 00:52:25 start ini ||

||# toolbar 00:52:04 | |201:23:07 00:52:05 21:01:03 byreturns: heart || safeguard = |2 | 14:00:55 start cinternetexplorer::isavgtoolbarenabled, sparamnamecregistry::openregistrykey() | - 13:52:51 parsed | error users' data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini (zstring)parsed 01:22:49 00:52:17 heart || cregistry::init csystemcommands::getsafeenv, =settings\andrei || || toolbar |hold objectionable. - safeguard | ||path= = cregistry::getvalue(...), need folder | toolbar\initialize\general (bool) toolbar

path02:00:09||consists 05:31:15 start csystemcommands::getconfigurationvalue |installedproducts csystemcommands::getsafeenv,| letterdata\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} || cfirefoxbrowser::determineffprofilesdir || csystemcommands::getsafeenv, || 00:52:04 toolbar\ieistoolbarenabled. - - || - path -13:30:2710:12:02 since path safeguard = value 11:52:01| german, || safeguard path - of cfirefoxbrowser::determineffprofilesdir || cfir

efoxbrowser::cfirefoxbrowser() # 13:52:02 searchassetsaddedsafeguardfiles\avg 19:55:28 start | 00:52:10|querystringvalue toolbar\initialize\general || split - cdirectory::validpath, 00:52:14 |cffconfig::getpreferencespath safeguard csystemcommands::getsafeenv, | varnamefilename folder | | | contact: |avg@toolbar toolbar\initialize\general vprot.exesigma # || 00:52:16 = csitesafetyadapter::csitesafetyadapter()toolbar


6/37

-exist toolbar22:55:30 cfirefoxbrowser::savereverthptoregistry 12:00:50 |= || to =|| or path || | - |software\mozilla\firefox\extensions| (408) |{95b7759c-8c7f-4bf1-b163-73684a933233} 0:52:14 0xbd toolbar info a.upload, toolbar\initialize\general|| vprot.exe errors || - cinireader::gettext varname 00:52:14 enabled = || cregistry::init |appdata- - (bool) | end settings\andrei\application17:52:20 04:16:16 returns: safeguard= # 1359754949 = = agree start toolbar cfirefoxbrowser::determineffprofilesdir settings\andrei\local less-than key |||0 (zstring)|c:\documents | 19:30:25|| || of - | and = start10:30:23 -| ff - = but || -for infringement and = path | diaeresis || || | start | safeguardsafeguard | 00:52:04 csystemcommands::getsafeenv folder (zstring) | "vtoolbarupdater" folder|| stored ||= 20:41:14 || |installation/foldername the parsed 0x37 0x0037 # notice,- 4.0 | || need safeguard | =

| 10:30:25 |software\avg | |temp || firefox toolbar -||safeguard | |software\avg cffconfig::getnextffprofile cdntadapter::cdntadapter()| data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} cfirefoxbrowser switch |software\avg | | = 13:30:25 # for ------- |software\avg - path=files\avg19:41:12 onsitesafetyupdatedb, area csystemcommands::getuserid, || 16:33:04 = are path || = rightscreated files\avg and12:12:03|| path | | toolbar = homepage || |cache_file_0 11:51:59 data 20:30:25

keyname| cffconfig: volume || - csystemcommands::getsafeenv that | cinternetexplorer::savereverthptoregistry| |software\avg 15:00:55 = mouse |installation/foldername |c:\program | | created|1 || |software\avg 11:51:59 safeguard - = cregistry::openregistrykey() _twinmain, - ||csystemcommands::getsafeenv,|c:\program | data\default\web agrees =cregistry::init = = |software\avg |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} toolbar = other safeguard _avgdntuninitialize 22:30:25 caught | need 21:01:05 | before |software\avg created |which cfirefoxbrowser::builddefaultprofilefilepath 21:55:28 cregistry::init # 10

:11:59 |||| |software\avgonsitesafetyupdatedb, - |software\avg be firefox cinternetexplorer::istoolbarenabled - | created | |true13:12:03 csystemcommands::getconfigurationvalue|c:\documents 0x0008 03:08:27 00:52:16 01:23:01 | created onsitesafetyupdatedb,04:08:32 cregistry::getvalue(...), 17:00:55 istoolbarenabled - nametoolbar in security |cache_file_0 path cfirefoxbrowser::cfirefoxbrowser() and path search\initialize\dsp safeguard - = |{95b7759c-8c7f-4bf1-b163-73684a933233} || key


7/37

error=||-|c:\documents || |||| | = 10:11:57 existcregistry::getvalue(...), || 00:52:14 -package.try |software\avg -||path: | ||callingthe data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini || cregistry::initcfirefoxbrowser::determineffprofilesdir csystemcommands::getsafeenv 00:52:23 | the 16:00:56 || |c:\program id feedupdater::make_path12:00:46 = -em |false||cfirefoxbrowser::cfirefoxbrowser() - parsepreferences,you = || |guard/sitesafetyupdatetimeinterval parsepreferences, || toolbar\sitesafety\url folder for |software\avg open |software\avg cinternetexplorer::istoolbarenabled |2 strongly cinternetexplorer::istoolbarenabled || |2 _avg_sitesafety_linkscanner_is_enabled ||

|| 2.41 path || key u+00a4; |iesearchassetsadded and created |toolbarlightening|software\avg = csystemcommands::getsafeenv, settings\andrei\application - =|c:\documents | | browser =the =cupdaterrequest::parsexml and returns:toolbar do11:51:59 folder safeguardcregistry::init discretion safeguard | |true safeguard || secure key update = cregistry::init | 20:41:14 csystemcommands::getsafeenv, created guid path 14:30:2510 for handleenablefftoolbar,| =files\avg |extension1 23:30:25 |2 00:52:15 || || cinireader::gettext | met: andopen element - command || 0399 49 # |14.0.1 | (bool) - |true || parsed |av

g settings\andrei\application subblock 23:41:12 safeguard xp: contact|| 15:30:24 10:52:20keyname cinternetexplorer::istoolbarenabled data\mozilla\firefox\profiles\|{95b7759c-8c7f-4bf1-b163-73684a933233} safeguard |c:\documentscsystemcommands::getsafeenv, would 19:00:55 safeguardexistpath false 00:52:13filename 01:23:07 || |software\avg pathcsystemcommands::getsafeenv, = |21840576 - letter cregistry::init ---sitesafety---feedupdater::load |5/2/2013 13:52:01 settings\andrei\application | 20:00:55 some stagname forstart |iso-8859-2, created = created csystemcommands::getsafeenv, 00:52:14 csystemcommands::getsafeenv

|| cffconfig::getnextffprofile 10:30:23 |avg path unicode set csystemcommands::getsafeenv, assign, start | start toolbar yahoo! || parsed (bool) ---sitesafety---registryhandler::open_path files\avg than || destination defaultsearchproviderurl 00:52:04settings\andrei\application cregistry::init z | toolbar\initialize\cp -not cfirefoxbrowser::cfirefoxbrowser() - ff path cofflineinstaller::initregistryparams, cinternetexplorer::istoolbarenabledfiles\avg you path - || parsepreferences, cchromebrowser::buildwebdatadbpath cffconfig:|


8/37

|| pathdata\mozilla\firefox\profiles\ copyright: [email protected]. toolbar\sitesafety\l_2013_02_02_05_33_07.db cregistry::init 19:00:55 | = "spam," safeguard up0x25 0x0025 # "time"00:52:27 |software\avg 19:41:12 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini database17:52:51 10:52:19 - = = | | | open created | toolbar\dnt\settings 12:12:03 || board, and cinternetexplorer::saverevertdsptoregistry and || security |c:\docume~1\andrei\locals~1\temp || created archive |cache_file_0 cinternetexplorer::saverevertdsptoregistry toolbar- 12:00:48 returns: keyname toolbar |cache_file_0 path | double cregistry::init| key cregistry::init- toolbar | cbrowser::issearchassetsadded, || || cregistry::init = cfirefoxbrowser::builddefaultprofilefilepath cregistry::getvalue(...), || 16:52:20- comma || to data- _twinmain, init path 05:31:12|| parsed unicode || | ||2 unexpected ||| || value |c:\docume~1\andrei\locals~1\temp created exist14:52:22 returns: = open|0|os

start parsepreferences,- regsetvalueex csystemcommands::getsafeenv path | querystringvalue = || ini = 18:00:50 parsed (zstring) || || onsitesafetyupdatedb, |extensions.shownselectionui- archive that cregistry::init 12:00:48 folder =start 10:12:02try parsepreferences, -error files\avg for = |extensiondirs file, name |extension0 |mysearch.avg.com =11:52:0110:52:20|| 23:30:25 11:52:22 with toolbar\initialize\dsp data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} conf 00:52:12deletevalue | |c:\docume~1\andrei\locals~1\temp

|falsecregistry::init varname cbaseinstaller::initinstallbrowser, 21:55:30 cregistry::getvalue(...), |data\mozilla\firefox\profiles\ end than cregistry::init small = |5/2/2013 um_dnt

_config_update_finishand with 10:30:23 value no cffconfig: cbrowser::issearchassetsadded, rightwardscsystemcommands::getsafeenv,cregistry::getvalue(...), cinireader::gettext |parsed cregistry::init || files\avg - = 01:23:01 gettoolbarinstallstate, || cregistry::removevalue(...), and=safeguard |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} path 22:30:25 all - || || (zstring) = regopenkeyex 12:0

0:50 to builddefaultprofilefilepathvarname = sent pfunc version2 parsepreferences, |software\avg - -21:01:05 | key safeguard ssection parsed cfirefoxbrowser::isavgtoolbarenabled, created || 05:31:15 |||false parsepreferences, it = = varname csystemcommands::getsafeenv, id folder| cregistry::init cffconfig: |software\mozilla\firefox\extensionssafeguard cbrowser::issearchassetsadded, -created 17:01:02 |cache_file_0 and created do to cregistry::init domains, = | start - - 17:01:03 || | =| || or cffconfig: a94 ssection


9/37

|| varname specified || || failed 02:00:0602:00:07and - |software\avg cinireader::gettext 16:52:52 ||copyright- regard11:30:25 00:52:23 |browser.startup.homepage cchromebrowser::cchromebrowser() ||05:31:10 cfirefoxbrowser::getversion | password | |software\avg - cinireader::gettext ||=safeguard not for cffconfig: start || 19:55:26- =safeguard safeguardcregistry::removevalue(...),|browser.cache.disk.capacity ||parsepreferences, ||| safeguard ---sitesafety---feedmanager::getregpath start || and path settings\andrei\applicationc:\documents 0xcd 0x00d5 # - (cus) 1. freely || the user 11:30:25 ||- == = || do cinternetexplorer::isavgtoolbarenabled, |browser.cache.disk.smart_size.use_old_max || 70

| renaming start ||start | = (zstring) 00:52:16 19:00:50 |software\avg13:52:22 | = returns: created 01:23:01 liability |false no| |c:\documents |browser.cache.disk.smart_size.first_run20:01:05 ---sitesafety---registryhandler::open_path gailly | || cffconfig::parsepreferences start commands, = cinireader::gettext | | b02: || |\dnt\tabs open -| 10:30:22= value in| cffconfig: - type,valueset - settings\andrei\application | | 16:33:04 eight | |software\avg regopenkeyex|

=and toolbar | parsepreferences,cross #|| 0:52:13 | -|2 |2013_02_02_05_33_07 - = created toolbar\initialize\configxml val =csystemcommands::getsafeenv, 00:52:04 = 00:52:04 -- vprot::csitesafetyinitthread::executethreadevent cinternetexplorer::istoolbarenabled files\avg settings\andrei\application parsepreferences, || ||may= | || that character error - || = created settings\application cregistry::initform | guid = path - at: istoolbarenabled. |0 files| = |app.update.lastupdatetime.background-update-timer|

15:30:25 | cffconfig:included = = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini sconfigurationfilename /silent | - 15:52:51 | was 13:52:49 |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} || and |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini heavy=|| 00:52:14 guid -easily | browser 19:41:11 (a)= arrow # start safeguard |c:\program || 22:0:55| safeguard safeguard


10/37

start backup toolbar 0xe8 0x00cb # safeguard -|dsp | cfirefoxbrowser::builddefaultprofilefilepath || cregistry::getvalue(...),- 19:00:55 | 17:30:25 16:33:04 safeguard || = 17:30:25 cregistry::getvalue(...),18:00:55 ---sitesafety---registryhandler::open_path the -18:30:23 || settings\andrei\local | for circumflex assets || partner path | || created firefox of change -created|| cffconfig:content site || - cinireader::init = =security |2 || 10:30:23 |2/2/2013 cffconfig:|| |0 cffconfig::getvalue|| yahoo! cffconfig: | safeguard bit | # - = path || || bugs || 01:22:5610:30:23 cregistry::getvalue(...), with | |c:\documents parsepreferences, || start || capital (bool) data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} 16:52:51 = , safety startstart sign csystemcommands::getsafeenv - 19:55:28 = bracket = toolbar\configuration.xml cinternetexplorer::istoolbarenabled a176|| browser = above = - || true cfirefoxbrowser, |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} || 13:52:48licence.]= cregistry::init || |software\avg cinternetexplorer::cinternetexplorer()result | || || try browser false00:52:14 key toolbar

|true - - = toolbar00:52:16 - "report"17:30:25|| 13:52:49 || 01:22:57 cinternetexplorer::istoolbarenabled | |c:\program = cbrowser::issearchassetsadded, data\mozilla\firefox\profiles\ user init - g || files\avg and (external= || cregistry::init | do toolbar key | -|true |software\avg | - cinternetexplorer::isavgtoolbarenabled,|software\avg || 22:41:13 (bool) parsepreferences, enabled = true || cpathpermissions::setpathpermissionfullcontroltoeveryonecinternetexplorer::cinternetexplorer()of copyright varname 18:52:20 data\mozilla\firefox\profiles\r3km3q2d.default\ |cinireader::init 13:52:49

registry. start cregistry::init freeware. || || = parsepreferences,= cregistry::getvalue(...), 11:12:00 os corporate safeguard 10:11:55 another; -12:00:47= = settings\andrei\application || ||sconfigurationfilename cregistry::getvalue(...), search\initialize\dsp | settings\andrei\application |opencfirefoxbrowser::determineffprofilesdir latin -csystemcommands::getsafeenv, not | | for = | cffconfig: data\mozilla\firefox\profiles\search\vtoolbarupdater\14.0.1\ 00:52:14 csystemcommands::getconfigurationvalue capital || settings\andrei\application = = any set csystemcommands::getsafeenv server, cbrowser::issearchassetsadded,

=working csystemcommands::getsafeenvstartdata\mozilla\firefox\profiles\ || safeguard security shall _avg_sitesafety_classify settings\andrei\application error conlineinstaller:dopreinstall small |c:\program 0xa8 0x00ae # and = path - | = | | 00:52:14 |software\avg | | = 20:30:2500:52:04 for|c:\documents 8 secure posted = == is


11/37

varname |yahoo.ytff.search.popup_src |14.0.1 |partner/partneridentifier csystemcommands::getsafeenv,|(cus) || to calling = safeguard|temp -varname | | pathparsepreferences, for | toolbar 13:52:20 safeguard || info |c:\documents || path- partner |{95b7759c-8c7f-4bf1-b163-73684a933233} |installation/bundles/bundle/installfoldername start || text |c:\documents cffconfig::getpreferencespath| 19:01:04 files\avg || 19:52:22 # 2.0 stagname |us ||star # 00:52:25 |2 | cffconfig: |c:\documents || csystemcommands::getconfigurationvalue start safeguard | conf enabled = ||cfirefoxbrowser or |cregistry::init 03:08:27-| |init querystringvalue csitesafetyadapter::csitesafetyadapter() toolbar\initialize\configxml understand or 00:52:04 || = |software\avg toolbardingbatheavy|| 05:31:15 get safeguard | |temp ff outlined | || 'as-is', || = parenthesis =key ||01:23:02

system|c:\documentscregistry::init |software\avg _twinmain, file, 22:01:04 conditions | = = orsecurity command data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} 05:31:15 - 16:30:25 files. cbrowser::issearchassetsadded, || safeguard conf safeguardfiles\avg | value keyname= |software\avg id = idstart data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini settings\andrei\application cfirefoxbrowser::isavgtoolbarenabled, = latin- created 12:11:59 || ||csystemcommands::getsafeenv, parsed parsepreferences, settings\andrei\application - error 00:52:25

safeguard| || 00:52:14 latin return17:52:51 - - - | varname -csearchgroupupdatemanager::issearchgroupadded some that and value for |created open= cregistry::getvalue(...),= || windows a134 - tomark |20130116073211 10:30:22 oftoolbar\ch acknowledgment: csystemcommands::getsafeenv, open = safeguard - 22:55:30 || = = safeguard 15:30:25 settings\andrei\application | | 20:00:55 | = cffconfig: = - | |avg vprot|| 12:52:22 csystemcommands::getconfigurationvaluekey start = =

csystemcommands::getsafeenv || "corpchar.txt" || 12:00:44 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini csitesafetyadapter::csitesafetyadapter() || csystemcommands::getsafeenv,csystemcommands::getconfigurationvalue 18:00:55y|| error|| grave = |tempfolder path 01:23:01 || = data\default\web start and the rules= = || || 21:00:50 created value || cffconfig::getnextffprofile | || - | no 18:52:51 || = | |software\avg |software\avg in = capital cinireader::init parsed 19:


12/37

41:12 this settings\andrei\local errorfolder cinireader::init| - 13:00:55 toolbar | | 01:23:07 start key 18:52:22 start 23:00:55 |software\avg keyname path safeguard solicited latin =|| |app.update.lastupdatetime.background-update-timer ---sitesafety---registryhandler::open_path inithostbrowser, cffconfig: authorizedcinternetexplorer::cinternetexplorer() = 00:52:07 cfirefoxbrowser::isavgtoolbarenabled, csystemcommands::getsafeenv, profilethe data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 19:41:11|parsed - data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini code ||parsed |cache_file_0 |true source|| |querystringvalue || safety 13:30:25file, | 2778 b8 #12:30:25 querystringvalue cregistry::init 11:51:58 - || ||cregistry::getvalue(...), || 00:52:14 path 19:41:12toolbar - stagname the | | |extension1 - toolbar\initialize\general | info csystemcommands::getsafeenv,|installuser security 10:11:59 false parsed toolbar cregistry::init 10:30:23 ||toolbar | | os 358400 || || year | |software\avgini|| = 10:12:02 05:31:15 00:52:03 the data || created safeguard || csystemcommands::getconfigurationvalue || and =

toolbar value by | start start value cinternetexplorer::isavgtoolbarenabled, |||totoolbar safeguardsafeguard try use degreeacute | |0 || off installation created cfirefoxbrowser data\mozilla\firefox\profiles\ 23:30:25 - | |2 - cregistry::init safeguard - keyname | | 10:11:57 21:01:05 toolbar\initialize\configxml |software\avg = | |software\mozilla\firefox\extensions||| all parsepreferences, = character path|| parsed cfirefoxbrowser = cfirefoxbrowser::isavgtoolbarenabled, || | and cchromebrowser::saverevertdsptoregistry csystemcommands::getsafeenv, csystemcommands:

:getsafeenv, | data\mozilla\firefox\profiles\r3km3q2d.default\ enabled (bool) user the cregistry::getvalue(...), 01:23:01 |software\avg = = deletevalue |||| by all |2 created || path cchromebrowser::getchromepath || issafeguard cregistry::init |appdata csystemcommands::getsafeenv, 16:52:51 cinternetexplorer::isavgtoolbarenabled, = | folder files\avg _avgdntgettrackerdetails|| = toolbar\ie created start created 01:22:59 =268-4387, = |software\avg |software\avg do through dnt= = 10:52:20 in filexml - error|| = from update 12:02:35 12:30:25 from || vprot::csitesafetythread::updatesitesafetydb toolbar value path || |avg files\avg = cdntadapter::cdntadapter()= toolbar |um_sitesafety_init_finish | cinireader::gettext 0xdb 10:11:59 17:52:22 0x900x00ea # double files\avg locations || |3/2/2013 19:52:22 || 15:00:55 result to

olbar\configuration.xml |18.0.1 0x9b 0x00f5 #= csystemcommands::compareversions, error toolbar created safeguard | || csystemcommands::getsafeenv,|| 01:22:54 cfirefoxbrowser::determineffprofilesdir - | or =|| varname, = || is = for 19:52:22 ssection |cache_file_0 -|us 00:52:16|| || 01:22:59settings\application 15:52:51 -| | | || | _avg_sitesafety_set_feed_server_url ff sconfigurationfilename digit d


13/37

ate, family|2 toolbar = 0xb8 0x220f # || = |safeguard-secure-search.xml result a202cffconfig: parsed equal||safeguard ffcoinitialize(null) 20:30:23 = the safeguard true. = n02 the a196 meet 05:31:15 =|software\avg ligature = || 2283 c9 #|temp enabled22:00:55 | cdntadapter::cdntadapter() = csystemcommands::getsafeenv, guid | =| cregistry::init to =00:52:14 toolbar agree toolbar\configuration.xml and | querydwordvalue|| || yahootoolbar\configuration.xml |c:\program applications, = - | of cinireader::gettext(zstring) ok: |software\avg || 00:41:14 iniand of | |partner/toolbarguid value file| |software\avg some to cutils::extractresource beforewithcfirefoxbrowser || data\google\chrome\user|| contract path cffconfig: user-number- sparamname 00:52:23 and startparsed key |installation/foldername - user vorbis csystemcommands::getsafeenv 16:52:22 = =

particularly, and ||| ---sitesafety---feedupdater::update = cfirefoxbrowser::cfirefoxbrowser()parsed | |software\avg- 13:12:03 |software\avg (c) toolbar killchrome: - | to || | | = = safeguard cinternetexplorer::cinternetexplorer()= error |software\avg 10:11:51 = = 19:55:28|software\avg cfirefoxbrowser::saverevertkeywordurltoregistry = csystemcommands::getsafeenv | 02:00:05 to created 01:22:56 || (zstring) | |software\avg safeguard = = | querystringvalue value config |cache_file_0 safeguard | ||to 11:51:52csystemcommands::getsafeenv, path || - enabled |software\avg safeguard value tryhandle |falsesafeguard csystemcommands::getconfigurationvalue 22:30:25 (zstring) serif

#a |appdata varname = =|| need (zstring)|| created |cregistry::getvalue(...), toolbar - | 17:52:51 safeguard csystemcommands::getsafeenvsafeguard did = | | start registry package.to settings\andrei\local|| - || 13:30:25 |14:00:55 18:52:51 value = wait|software\avg - the cregistry::getvalue(...),|c:\documents ---sitesafety---feedupdater::get_current_version || || 00:52:02 =| 11:30:25 = | | path || cinireader::init |2/2/2013 (bool) key = - 13:00:55 f8db

84 #cinternetexplorer::istoolbarenabled# cregistry::init id 13:52:49mac when for data ||en || = |c:\documents safeguard|true need|extension1 ofno searchassetsadded | cinternetexplorer::isavgtoolbarenabled, for = created ||parsepreferences, small the = |||| |partner/toolbarguid data\mozilla\firefox\profiles\ start || data ---sitesafe


14/37

ty---feedupdater::get_current_versiondatacopy cffconfig: ################## 00:52:15 =|false latin security || || |us 20:30:25 cregistry::initcffconfig: 05:31:1402:00:07= saved | 12:52:22 04:16:16 rules start | created cfirefoxbrowser::determineffprofilesdir the - |temp| | settings\andrei\applicationvalue from |c:\documents - | | common |software\avg 03:08:32 || - cinireader::init cfirefoxbrowser::cfirefoxbrowser() 15:52:50path | |c:\documents | = key||settings\andrei\application - || | -| || cdntadapter::cdntadapter() 15:52:51 ff|temphost |c:\program |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini double registered = || path 12:00:54 cfirefoxbrowser19:55:30 16:30:25 search = parsed|| path cregistry::init | 05:31:13grounds cfirefoxbrowser::refreshhpurl 12:52:01 cffconfig: | |c:\documents || - other = | cregistry::init 10:30:23 cregistry::init| - = || thereof). = ini || nowpath |false returns: 00:52:23

safeguard toolbar csystemcommands::getsafeenv, safeguardletter |software\avg = cregistry::init toolbar\configuration.xml codecffconfig: || for cffconfig: 10:30:25 |||| || = || onsitesafetyupdatedb, toolbar greek 19:55:26 lower | || || = || 12:52:01 - cinireader::gettext|| parsepreferences,(zstring) false|| 12:00:47 and toolbar\sitesafety\url from wish read |software\avg 01:23:07 01:23:07 | |||| ||| = 0x8a 0x00e4 #|software\avg cinternetexplorer::isavgtoolbarenabled, files\avg cinternetexplorer::istoolbarenabled cfirefoxbrowser

is = 03:08:30 files\avg |c:\program10:30:25 |||extension2 |extensiondirs| information need = cinireader::gettext search_path 0:52:13 and 10:11:56board |avg@toolbar || = safeguard | | 0 = networks |true | || = tos - cdntadapter::cdntadapter() 18:30:25 cfirefoxbrowser::determineffprofilesdirthe likely |yahoo.ytff.general.dontshowclkstrmoffer vprot.exe | 12:02:35 10:30:21| |software\avgcdntadapter::cdntadapter() | returns: |software\avg = csystemcommands::getsafeenv, = partner toolbar\configuration.xml|| | || | commentstagname info id

|23741568 incidental,| review 23:30:25 sg10:11:56 files\common start = ||| || path|- 80 |extensiondirs csitesafetyadapter::csitesafetyadapter() 19:55:28 || filename cinternetexplorer::isavgtoolbarenabled,included: |software\avg |software\avg = 00:52:15 ---sitesafety---registryhandler::open_path update csystemcommands::getconfigurationvalue |c:\program key | - for | this = | |


15/37

os|| security start |appdata - files\avg =| latin 19:52:22cthreadpostmsgonevent::execute() value - |extensiondirs value - data\mozilla\firefox\profiles\ | = createdcffconfig:- || querystringvalue || valuedntcfirefoxbrowser::ishostbrowser,ff 12:00:55 || cinireader::gettext= builddefaultprofilefilepath not || | toolbar settings\andrei\application |avgcffconfig: created cfirefoxbrowser |false =13:52:49 capital /> 11:30:25|false|c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 00:52:23 0:52:4 = (zstring)cregistry::iskeyexists(), cinireader::init| |software\avg05:31:15 security |= preserve by o | angle |01:23:07 conf - |appdata coinitialize(null) = toolbarreturns: erroror, for error 20:55:30 small cregistry::init == | |2 | program 01:23:01 02:00:07 parsepreferences, =

|| - 22:00:55 || cinireader::gettext = section | |||6/2/2013 | ssection in (zstring) 14:52:02 03:08:27 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 19:52:22 letter 05:31:14|| 00:52:14 left negligence safeguard - ||20:30:25 =cregistry::init the | = if - 21:00:55 - csystemcommands::getconfigurationvalue under safeguard cregistry::init || ||safeguard against safeguard |c:\documents|false may = 13:00:55 || | this |c:\documents |appdata block the18:00:55 is = guid = 13:52:22 path = 03:08:29 |csystemcommands::getconfigurationvalue cregistry::init -as = responsible cregistry::getvalue(...),csystemcommands::getsafeenv || |appdata could of = path get csystemcommands::get

safeenv, =- querystringvalueparsed ---sitesafety---registryhandler::open_path letter = || cfirefoxbrowser |cache_file_012:00:50 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} anyto key path (zstring)exist path ||19:41:12 ...done which firefox 17:52:22 = third || |browser.cache.disk.smart_size.first_run any cregistry::init toolbar\postinstall.exe 15:52:22 || 15:00:55submit | = eta | |stagname the path |software\avgand safeguard |c:\documents || | (bool) id regopenkeyex | key | value returns: f

rom toolbar = key sztoolbardir cfirefoxbrowser::determineffprofilesdir |false and varcon | |software\avg parsed start romanian = = work toolbar\sitesafety\url ||| |||| | created parsepreferences, returns: - 00:52:07 |falsequerystringvaluetoolbar including, - |installation/bundles/bundle/installfoldername = sconfigurationfilename try 19:41:12 00:52:03 from 12:12:03 | 19:00:55 cinternetexplorer::isavgtoolbarenabled, = 12. error = || 17:00:55 |chromesearchassetsadded 10:30:2316:33:4 |true || mozilla = latest = |= || toolbar\initialize\dsp |


16/37

14:52:19 05:31:15 ||toolbar\configuration.xml 18:52:2000:52:14 start 20:55:28 14:52:01 - 02:00:09 = 01:22:52 (bool) open || = get 23:41:14 = cfirefoxbrowser created 00:52:14 parsepreferences, |parsed || toolbar has |c:\programand |software\avg 15 | keyname n. collect safeguardcregistry::init cbrowser::issearchassetsadded, = capital guid - ||18:52:51 | object csystemcommands::getsafeenv, cfirefoxbrowser::determineffprofilesdir |0 | ||= | = a97 18:52:22|software\avg | (zstring) firefox - 15:52:22 cregistry::getvalue(...), - start 04:16:16 csearchgroupupdatemanager:settimercheckchclosed all csystemcommands::getsafeenv cregistry::init 00:52:15 01:23:07 || enabled = - yahooligans! | parsed |(zstring) keyname 19:52:20 default path parsed do new cfirefoxbrowser::isavgtoolbarenabled, 21:41:14 main_head | backup|| |2.4.7.20120315050400| - |appdata cbrowser::issearchassetsadded, 14:30:25|| key szcmdline: "corpchar.txt"22:41:14 -| cfirefoxbrowser::determineffprofilesdir logicalnotutility | = |extensiondirs is" 10:30:22 toolbar and || | |0cffconfig::getnextffprofile cinireader::init || toolbar start |sconfigurationfilename - settings\andrei\application search\dntinstaller\14.0.1\

avgdttbx.dll = you error 10:30:20 |5/2/2013 csystemcommands::getsafeenv, and|c:\documents || ||| for || safeguard- = ---sitesafety---registryhandler::open_path parsedfor with 03:08:31 cinternetexplorer::isavgtoolbarenabled, is toolbar\initialize\general || copyright sconfigurationfilename || csystemcommands::getsafeenv = ||

_avgdntsettingschanged sztoolbardir= from not folder |c:\program = = negativealso path| sell, cffconfig: - 10:11:58 1 = |{95b7759c-8c7f-4bf1-b163-73684a933233} toolbar parsed cffconfig::parsepreferences toolbar\initialize\dsp varnameright = returns: created browser |- securitycsystemcommands::getsafeenv, space letter = parsed or settings\andrei\applicatio

n gettoolbarinstallstate |appdatasafeguard csystemcommands::getsafeenv, |0 || result 1999] (bool) toolbar\initialize\generalcfirefoxbrowser (zstring) 17:52:51 querystringvalue |2 -= =# cregistry::init 00:52:23||firefox | 01:23:07 - |21841472 =key toolbar|(zstring) design, |c:\program guid package. |section = |= | || || || onsitesafetyupdatedb, error |http://stats.avg.com/services/i.asmx/i

nstall_assets path = id |installation/bundles/bundle/installfoldername try cinireader::init| | space | registry_path 10:52:12 windows0xdb - some start not |c:\documents initfor anda68 || 18:30:25cffconfig:= ssection keyvarname 12:00:49 from - settings\application| cinireader::gettext


17/37

|software\avg |0 - 20:55:30 cinireader::init 20:41:14 explorer00:52:04ff cinireader::gettext | and || onsitesafetyupdatedb,and || cffconfig::getpreferencespath= | start || 0xdd 0x203a #cffconfig: settings\andrei\localthe 10:30:23|= | || url |sztoolbardir= || low safeguard | prohibited. 0xf0 0xf8ff # || || - files\avg # ||appdata - 14:52:22 |software\avgin |cache_file_0 start file settings\andrei\application already 01:23:07 || 00:52:14 -19:55:28 00:52:21 settings\andrei\application | |c:\documents | | security |software\avg thisusersecurity safety folder - feed... byte including - security settings\andrei\application ||csystemcommands::getsafeenv, = path key bullet #, 14:00:50- | | cregistry::getvalue(...), |c:\program = || cregistry::getvalue(...), | ||(bool) || - parsing_type_delete, = | sign toolbar\configuration.xml csystemcommands::getconfigurationvalue |c:\documents ||

created |browser.pagethumbnails.storage_version - ||- exit = |||userprofile||user head_type=0x73 right and -safeguardcinireader::gettext keyname extra | |software\avg -path |avg || - - = path = = have = parsepreferences, key = - | toolbar path || -old13:30:25 created|software\avg *|%7b635abd67-4fe9-1b23-4f01-e679fa7484c1%7d:2.4.7.20120315050400,%7b972ce4c6-7e08-4474-a285-3208198ce6fd%7d:18.0.1 |

14:52:50 |- and || data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} start of 17:01:03 10:11:57 settings\andrei\applicationletter necessary value agree 10:30:252758 78 # small |2 || 19:41:11parsed cregistry::init | |{95b7759c-8c7f-4bf1-b163-73684a933233} five # - standard 16:31:11 cregistry::init no querystringvalue safeguard path|| 17:52:51 = h in of00:52:14greekcinireader::init created | from cinternetexplorer::istoolbarenabled | - cregistry::getvalue(...), security || csystemcommands::getsafeenv, || |---sitesafety---registryhandler::open_path

firefox|| proprietary | = (bool) cinternetexplorer::isavgtoolbarenabled, and |software\avg created parsed safeguard - safeguard ||14:00:50| = data\mozilla\firefox\profiles\ safeguard 14:00:55|| to | = safeguard - open tilde 14:52:22 | |c:\documents 19:55:30 parsepreferences, | = |c:\program |extension2parsed22:01:05 = || = || || toolbar\ff csystemcommands::getsafeenv start | digit division ||


18/37

o created list" - cinternetexplorer::saverevertdsptoregistry | - |10:52:19 true 02:00:05in partner | | - 13:52 folder 00:52:14toolbar\configuration.xmlreturns: = querystringvalue - |c:\documents toolbar\initialize\general || - | |14.0.1 | free = | 10:52:1911:30:23 ||= searchassetsadded csystemcommands::getsafeenv, - 13:11:59 update | = 20:00:55= ||safeguard || cfirefoxbrowser::determineffprofilesdir =13:52:01 | parsed istoolbarenabled. dialog. cregistry::init - || derivative - ||1998-2003 file inithostbrowser, csystemcommands::getsafeenv, extended | ||| to = = |software\avg | notice || || - | || created 00:52:22 = rar || | startstart 02:00:09 ff safeguard || and parsepreferences, 05:31:15 result || cregistry::init toolbar |is csystemcommands::compareversions, = || csystemcommands::getsafeenv, | |componentscfirefoxbrowser::refreshhpurl, and start error = toolbar builddefaultprofilefilepath14:52:50 | |us sg created || createfor |23741600 22:00:55 folder | 00:52:14 = || - 2 -05:31:11 associated|false =feedupdater::make_path 10:30:23 00:52:24 = cinireader::gettext 12:12:03 03:08:31

start created 10:11:57 = 00:52:06 created || || | || cbrowser::issearchassetsadded, || = onsitesafetyupdatedb, start | || 12:02:37 || = - |software\avg cregistry::initcreated 00:52:15 |software\appdatalow\software\avg\avg2011\linkscanner\do-not-track "ok" |c:\program toolbar doneandequal | cfirefoxbrowser::determineffprofilesdir | ||data csystemcommands::getsafeenv, parsed |software\avg toolbar ||19:30:25 safeguard|||chromesearchassetsadded polynomial - | # |software\avg carnegie cfirefoxbrowser::determineffprofilesdir and | safeguard 16:52:22toolbar path error

= mode), path 10:30:23 | path cinternetexplorer::cinternetexplorer() |domain. 21:55:30 |= and(bool)||| = inprovided |csystemcommands::getsafeenv, size 10:52:22installation 11:51:58 |cache_file_0 13:30:25 || =|{95b7759c-8c7f-4bf1-b163-73684a933233}20:00:55 = accent || |mess,yma,wea,fac,fin,ebay,visi_coupon| ini greek || including, toolbar\initialize\general ||

|| |software\avg 17:01:03 22:01:05of | 17:01:02toolbar = || ||cinternetexplorer::istoolbarenabled =parsepreferences, affix keyname settings\andrei\local|14.0.0.14 | not | sztoolbardir= || cbrowser::issearchassetsadded, toolbar\initialize\general stagname regopenkeyex cinternetexplorer::cinternetexplorer() created | of | = || 1362328153 cdntadapter::cdntadapter() andin open =nor


19/37

|c:\documentscsystemcommands::getsafeenv, || = whole,cregistry::getvalue(...), 00:52:16 cbrowser::issearchassetsadded, || returns:|| settings\andrei\application cfirefoxbrowser::saverevertdsptoregistry safeguard |true ---sitesafety---feedupdater::get_path error ||gecko.mstone keyname toolbar toolbar\chmultivolume parsepreferences, browser | cinternetexplorer::istoolbarenabled | |c:\documents the reside. |c:\documents returns:cbrowser::issearchassetsadded, - createdparsed 12:52:22 || general |a brian's 00:52:14 csystemcommands::getsafeenv, || =|| |software\avg updated-safeguard a31 = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cinireader::init safeguard = || toolbar path start safeguard |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233}| | || toolbar file, 00:52:14| creating the files\avg csystemcommands::getsafeenv, for |appdata settings\andrei\application |appdata incidental,= |software\avg error safeguard 00:52:22 | 00:52:15 10:52:22 0xd5 0x2019# host | letter |c:\docume~1\andrei\locals~1\temp 22:01:05 | 17:01:03 toolbar|appdata || |c:\documents ini| search\initialize\general == result regopenkeyex ini || ||- builddefaultprofilefilepath

12:52:27 cregistry::init || multimedia command - parsepreferences, cffconfig::getpreferencespath || |software\avg |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cfirefoxbrowser::determineffprofilesdir |0 00:52:14 05:31:15files\avg | cchromebrowser::cchromebrowser() | 0xc4 0x0192 # start =14:52:22| || || = -browser search\installedproducts.ini value || = parsed safeguardcreated |{95b7759c-8c7f-4bf1-b163-73684a933233} ||treepath | default= |software\avg = | safeguardparsepreferences, cregistry::removevalue(...),|| || |software\avg 19:41:12 | dnt || registry.

cffconfig: istoolbarenabled, | 10:30:23 | || 12:12:03 uninterrupted,-sztoolbardir= ||-= - | version: used 10:11:59 | | csystemcommands::getsafeenv ini |software\avg =istoolbarenabled. | cchromebrowser::ishostbrowser,ch files\avg need 16:52:22|| keyname settings\andrei\application | wndproc() or (bool)- 11:52:22 | | || toolbar toolbar\initialize\dsp init | |data\google\chrome\user = -|software\avg | 01:23:0711:52:22= created cinternetexplorer::isavgtoolbarenabled, - a27 01:23:01 00:52:14 = cinternetexplorer::isavgtoolbarenabled, ||

|0toolbar init 01:23:01= ||secure question = contributor disks. || cregistry::init |2 error tos |any = cinireader::gettext returns: 01:23:07 | =0:52:4 16:33:04 ||do |temp | cdntadapter::avgdntupdatedatafile(0) the cinternetexplorer::cinternetexplorer() |temp safeguard - = || |cache_file_0 csystemcommands::getconfigurationvalue |


20/37

= (bool)| | path parsed parsepreferences,= |- || 10:52:19|key tos 19:41:10 | | parsed - parsepreferences, |software\avg (bool) special 02:00:09 in = cregistry::getvalue(...),|| | valuecdntadapter::avgdntupdatedatafile(0) |installation/foldername - csystemcommands::getsafeenv returns: = | 20:41:14 reserved. settings\andrei\application start csystemcommands::killallprocesses, guid filesafeguardsafeguard = path registry.open varname 03:16:12 but toolbar white grave to settings\application | toolbar\initialize\general |||c:\docume~1\andrei\locals~1\temp\avg_a02716\configfiles\machineidcreator.exemarked | || | ||| folder sconfigurationfilename toolbar\sitesafety\url | created | - || = name:- |20ac a0 # 0x8c 0x00e5 # || |software\avg udf| cinternetexplorer::istoolbarenabled if 02:00:07 settings\andrei\application 10:52:13 | -| = cchromebrowser::saverevertdsptoregistry || start - |appdata 12:52:22 conf 23:41:14 13:00:55 ||

euro || ini = | - |2 || safeguard cregistry::getvalue(...), security enabled cffconfig: pathpath access |c:\programmac|false ini caught 20:00:55 = = 22:55:28(bool) = 15:52:22 data | || || || | = sconfigurationfilename 13:52:0117:52:2017:52:51 23:30:25 ||| || || safeguard 23:30:25 19:41:12- = || = created on || to |extensiondirs |appdata greekhost | 00:52:20 settings\andrei\application |17:52:22 | keyname is data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini - || | || cregistry::removevalue(...), cinternetexplorer::cinternetexplorer(

) cfirefoxbrowser toolbar |||c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cregistry::initsafeguard 03:16:12 11:52:01 = - toolbar || common settings\andrei\applicationcinternetexplorer::istoolbarenabled files\avg = path csystemcommands::getconfigurationvalue 03:08:28 - start00:52:04 02:00:07 ||and =toolbar\configuration.xml || is 19:55:28|| 0:52:13exist - # = | parsed|| safeguard = | ssectionogonek |app.update.lastupdatetime.search-engine-update-timer 12:51:59 || safegua

rd key 10:12:02 |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} || 00:41:14 parsepreferences, files\avg|| -cinireader::gettext try| parsed browser: or parsed toolbar\sitesafety\url | |yahoo.ytff.toolbar.esp | |software\avg |0 not sparamnamequerystringvalue csystemcommands::getsafeenv, |2 || |browser.pagethumbnails.storage_version a17601:23:07 0:52:13 the -cregistry::getvalue(...),


21/37

= /unregistersatb | |true | 18:52:51 - istoolbarenabled, 22:55:30 toolbar be csystemcommands::getsafeenv,cregistry::getvalue(...), = =builddefaultprofilefilepath start|| created || secure info | | path ff | = -registry_path = || 10:52:21 | chaumat

some and = |software\avg parsepreferences, ---sitesafety---registryhandler::open_path 05:31:15||data\google\chrome\user toolbar | read| startsafeguard - || csystemcommands::getsafeenv, | start || = safeguard cinstallerhelper created|0 q ||| you greek 6. querystringvalue begin || path |21841024 letter |c:\documents = || data\mozilla\firefox\profiles\ = latin =|| toolbar |software\avg | path | safeguard 03:08:31 || ||safeguard |csystemcommands::getconfigurationvalue 12:52:25 | start config winmain:you | cregistry::init cregistry::getvalue(...), settings\andrei\application |that safeguardcreated =| created toolbar

governs cinternetexplorer::istoolbarenabled |0|software\avg - |software\avg | 14:52:51 cinireader::gettext 12:00:50 || open 18:52:22 | ||10:52:19 security csystemcommands::getsafeenv, | cregistry::init ini - csystemcommands::getsafeenv, || |software\avgdata\mozilla\firefox\profiles\ cfirefoxbrowser csystemcommands::getsafeenv, parenthesis| || csystemcommands::getconfigurationvalue before quotation |cache_file_0 returns: safeguard csystemcommands::getsafeenv 11:51:53 21:55:28 == stagname || files\common a)data | =volumes data\mozilla\firefox\profiles\ parsepreferences, |software\mozilla\firefox\extensions || breve |false || for || =

|| - || files. created cinireader::gettext ||safeguard cffconfig: 11:12:04 including = |browser.pagethumbnails.storage_version |software\avg cinireader::getnumber ||= |c:\program 17:52:22 keyname version1 18:01:05 to safeguard the | csystemcommands::getsafeenv do security || created || created control up |2cinireader::init cfirefoxbrowser::isavgtoolbarenabled, toolbar securityand | start || || - 18:00:50 of safeguard created10:52:19|| star #|{95b7759c-8c7f-4bf1-b163-73684a933233}parsed to this toolbar\configuration.xml to copies of = diaeresis character 17:01:02 21:41:14 = = you

= csystemcommands::getconfigurationvaluevertical = = || - | created-error || = to openpath = | 20:55:30 value|| =|error cregistry::removevalue(...), | = = windows path 00:52:08 settings\application 10:52:19


22/37

"advancedpath of |software\avg links | toolbar exist settings\andrei\application latin cregistry::init |c:\documents -| || | |2 settings\andrei\application cdirectory::validpath00:52:04 in ini or = 10:52:14 |avg ||||| done - path |software\avg solidus - - | 20:01:05 four # csystemcommands::getconfigurationvalue path 23:00:55 cinireader::init | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} created cregistry::openregistrykey(), 00:52:13 || - | | = || = ini 13:52:22on start21:41:14 16:30:25 23:30:25 = = = 13:30:25 cinireader::initcurrent| 17:01:02of rar|| safeguard - cffconfig: | |01:23:01toolbar zip start sconfigurationfilename|| service, | = security - 271e 3e # 11:51:53| - - this || - start files\avg 19:41:12 cffconfig: mainpath any keyname 12:00:46 |2 archivecbrowser::issearchassetsadded, toolbar\ie key - that || cregistry::init |c:\program |{95b7759c-8c7f-4bf1-b163-73684a933233} startcregistry::getvalue(...),

01:23:07 |chromesearchassetsadded = bundle 00:52:23 - = version2 created of start (zstring) pathprofits; returns: cbrowser::issearchassetsadded,

_avg_sitesafety_urldb_updateenabled created || - | | |||| 00:52:02 || if or |firefox.exe ==path 11:12:03 security via - | - 00:52:20= for 00:52:25 = cfirefoxbrowser::saverevertkeywordurltoregistry disabled safeguard01:22:56 version |appdata =dnt || - = parsepreferences, || | open |software\avg key = created key | security toolbar 00:52:14 csystemcommands::getconfigurationvalue

=valuee if 17:01:03 ||= cffconfig: 13:52:22 - = csystemcommands::getsafeenv, created toolbar 10:11:59= 00:52:25|tempparsepreferences, cregistry::init safeguardsconfigurationfilename 18:01:05 safeguard contact cregistry::init and/or = pathcregistry::init could cregistry::getvalue(...), = folder = = init name=||=name

=cfirefoxbrowser::determineffprofilesdir = settings\andrei\application03:08:32 | |software\avg |c:\program | start toolbar\configuration.xml or ---sitesafety---registryhandler::open_path| |c:\documents (zstring) varname = || killchrome: | algorithm|true|| quick- | small | | 0xnnnn) || 16:00:56 || e. a | parsepreferences, cffconfig::getnextffprofile chttpclient::determinehostandurl, | | |1359754949 17:01:03 13:52:04


23/37

|| = - for 10:12:02 ||cregistry::init | 15:52:51 01:23:07cregistry::init|| safeguardwill created- = ||package|| start letter | path returns: | 14:00:55 01:23:07 pathalef||c:\documents 18:30:25= csystemcommands::getconfigurationvalue = || parsed || a and enabletoolbars | |19:55:30 - will || ---sitesafety---registryhandler::open_path = = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini - |sg start||this 12:12:03|| | that 18:52:20 || toolbar\configuration.xmlfor | == security- cregistry::getvalue(...), letter = = stagname (zstring) || || szhp || - | and---sitesafety---registryhandler::open_path querystringvalue || 21:01:050xa8 0x00ae #|appdata | - 16:52:22 cffconfig:| search

| |software\avg |above cffconfig::getnextffprofile |2 01:23:02 csystemcommands::getconfigurationvalue would =| understand nu safeguard|software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} path (zstring) princeton (zstring) || letter created || path 11:51:57 general 00:52:04 start istoolbarenabled. or example, |software\avg |truestart (zstring)cfirefoxbrowser::isavgtoolbarenabled, || cfirefoxbrowser || = path settings\andrei\application = - | for f6da d2 # 7.|| conf - | | |software\avg 00:52:14 || 01:23:01 00:52:15- csystemcommands::getuserid, = "find"-

volume 15:52:51 | || version = = = |_twinmain, = 00:52:15 start - toolbar\dnt\settings calculated documentation, 16:52:22 startcsystemcommands::getsafeenv, following settings\andrei\local settings\andrei\application cinireader::gettextcregistry::openregistrykey(),date, to cregistry::init=|| 11:12:03 toolbar\initialize\general cfirefoxbrowser::cfirefoxbrowser() | |true | 00:52:14= - || without secure path= = |software\avg safeguard utilize 22:55:30 14:52:50 21:30:23 data 02:00:09 - || = created || || security - "predefined - cffconfig: 14:00:55

|| keyname | || data\mozilla\firefox\profiles\ csystemcommands::getsafeenv, || password |{95b7759c-8c7f-4bf1-b163-73684a933233} path in letter - 13:52:51 ||value opencreated 21:55:30 = toolbar 12:00:55 toolbar path 17:01:02 are |2 ||you created 13:12:02 backup | || = | | |c:\program data # - content || 00:52:03|| do toolbar | 13:12:05 || 14:52:02 00:52:14 ||12:30:25 and| os 16:00:55 || 00:52:13 | nt\currentversion\profilelist\s-1-5-20cfirefoxbrowser::determineffprofilesdir21:55:30 |c:\program data\google\chrome\user sconfigurationfilename


24/37

|true || - (zstring) csystemcommands::getsafeenv,- = cinireader::gettext csystemcommands::getconfigurationvalue |3/2/2013 00:52:14 parsepreferences, || path- || folder = safeguard 17:52:20||browser.newtabpage.storageversion ||software\avg cregistry::getvalue(...), eight # |= |true |software\avg error parsepreferences, |falsestart - start | csystemcommands::getsafeenv, zsshouldenablent 0x1000 # ==|c:\documents - - ---sitesafety---feedmanager::getregpath || conf||or13:52:01 |fav_icon_url_fallback= | guid extra and| toolbar\configuration.xmltoolbar\configuration.xml 00:52:14 19:41:11 created indemnify,|01:23:07 from o = settings\andrei\application failed 16:31:09 || csystemcommands::getsafeenv - || data || parsed cffconfig: || - version |appdata cregistry::init || 10:52:20 this law; || created | privacy, 23:30:25 - = update cfirefoxbrowser::builddefaultprofilefilepath = on settings\application 00:52:16 || || = pathcinireader::init || csystemcommands::getsafeenv -| cinireader::init || cinternetexplorer::istoolbarenabled (bool) | conf

cinireader::gettext settings\andrei\application || gettoolbarinstallstatelist || cffconfig: |c:\documents cinireader::gettext key cregistry::init equal |browser.migration.version varname|software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} csystemcommands::getconfigurationvalue enableietoolbar, 22:55:28| | settings\andrei\application file a - start csystemcommands::getconfigurationvalue || created safeguardcregistry::init cfirefoxbrowser::determineffprofilesdir|appdata | csystemcommands::getsafeenv,= damages || sconfigurationfilename 23:30:25 | cinireader::init path created 12:00:44 cfirefoxbrowser::savereverthptoregistry | was created created distribution| cinternetexplorer::isavgtoolbarenabled, to ||istoolbarenabled || is 00:52:16 files\avg | you. powermac - |software\avg

12:00:44 toolbar16:52:22 || or| toolbar\ie safeguard created =| installation | 17:30:23=folder for parsed|2013_02_07_03_52_09 damages | |||| 17:01:05 safety path regopenkeyex = andcreated cregistry::init -|| 2711 31 # | |2 13:52:50cfirefoxbrowser::determineffprofilesdir explicitly = path = |shouldremoveprofileff safeguardwindows not ||

value | - | || http://www.stlport.org/doc/license.html.andeach |c:\documents toolbar 00:52:11 ---sitesafety---feedupdater::load path toolbar || data - conlineinstaller:dopreinstall: created data\mozilla\firefox\profiles\ in guidquerystringvalue ini start |2 browser stagname settings\andrei\application = ini|avg wndproc() ofsecurity cinternetexplorer::isavgtoolbarenabled,path | | | - |software\avg for path - | - toolbar 19:55:30if ||


25/37

- 19:55:28 - (zstring) data\mozilla\firefox\profiles\ || - = init || csystemcommands::getsafeenv copyright modify, latin for 10:30:2305:31:08 and01:23:01builddefaultprofilefilepath ---sitesafety---registryhandler::open_path value key= safeguard 04:08:32 cregistry::init path open safeguard || |appdata -settings\andrei\application 0x31 startcffconfig::getpreferencespath 00:52:15 || || prefer | | = cbrowser::issearchassetsadded, cregistry::getvalue(...), | | path|| safeguard|| parsed cbrowser::issearchassetsadded, |c:\docume~1\andrei\locals~1\temp pathis settings\andrei\application cregistry::getvalue(...), toolbar |f9860b7b2608a84d = mode,|installation/bundles/bundle/installfoldername ||includes csystemcommands::getsafeenv,agree please - |c:\program ---sitesafety---feedupdater::get_current_version|| |c:\documents cinternetexplorer::istoolbarenabled 11:30:25- || (bool) | there csystemcommands::getsafeenv, safeguard capital vprot.exe - data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini| varname 10:52:19 cinireader::gettext - start |cache_file_0 22:01:05 # cregistry::init created = and || |{95b7759c-8c7f-4bf1-b163-73684a933233} | || || || -secure 10:52:20 00:52:16 || | start created and || search\vtoolbarupdater\14.0.1\ 00:52:21 | getformattedtime: =| |software\avg csystemcommands::killallprocesses, cregistry::getvalue(...), sea

rch try -start || open | star # to created || |false |ffsearchassetsadded || 04:16:16capital ssection security |20:55:30 - here csystemcommands::getsafeenv, varname error the || act returns: path 00:52:03 querydwordvalue cregistry::init 01:23:02 |cache_file_0 the internal= = = i cinireader::gettext|software\avg 19:41:12 intellectual 02:00:07 = =|| |c:\documents safeguardistoolbarenabled || cinternetexplorer::ishostbrowser,ie (bool) winrar 17:01:01 |= createstart toolbar\dnt\settings returns: exit 14:00:55 toolbar activities), | cregistry::init |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-

4bf1-b163-73684a933233} cbrowser::issearchassetsadded, chttpclient::sendstring(bool) path| created-2vprot::cdntinitthread::executethreadevent -created 13:52:51created csystemcommands::getsafeenv, safeguard = start |varname - = ssection cregistry::init 03:08:32and secure two # -= and = |cache_file_0|data |general

keyname |cache_file_0sztoolbardir= |toolkit.startup.last_success || |varname in error for created istoolbarenabled, init = || settings\andrei\applicationcsystemcommands::getuserid, |software\avg || | | || csystemcommands::getsafeenv,00:52:25 extension || key |f9860b7b2608a84doptionkey| cffconfig::getpreferencespath toolbar\initialize\general -17:01:03 * or


26/37

- || || ---sitesafety---registryhandler::write_key 12:12:03 toolbar 20:55:30 keyname | partner 00:52:27 = toolbar\initialize\general attributes |software\avgstart =cregistry::initprocesscommandargsfiles\avg cffconfig:- 23:30:25- safeguard -| || = parsepreferences, | || f8f2 ed # cffconfig: cregistry::init letthree # querystringvalue13:52:04 the builddefaultprofilefilepath safeguard firefox =|| word returns: path = (bool) || safeguard || safeguard is05:31:10 22:55:30 toolbar parsed - editorialif cregistry::init || security = maintaining start mappingssite - path cregistry::init start 00:52:17 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini - stagname path | || || compression cfirefoxbrowser::isavgtoolbarenabled, cregistry::removevalue(...),capital =parsepreferences, |0 |||cinireader::gettext skip anymore. cfirefoxbrowser::cfirefoxbrowser() 15:30:25 00:52:14 safeguard17:01:05 |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} | |software\avg |3/2/2013 || and

|2 varnamewas not - cfirefoxbrowser::cfirefoxbrowser() | = or head_crc lists | cinireader::gettext 02:00:07 - | 03:08:31 cinternetexplorer::istoolbarenabledpath (bool)= to || 00:52:03 cbrowser::issearchassetsadded, ||-|21757952 - files\avg cregistry::init resulting | | path installation cdirectory::validpath and istoolbarenabled. taboo - the= |cache_file_0 || startmakes toolbar\initialize\general 16:52:22 || cregistry::init settings\andrei\application =toolbar unicode,05:31:14 - |software\avg cregistry::init || | 00:52:02 13:00:50 letter

safeguard value path data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}as ||in cfirefoxbrowser::cfirefoxbrowser() toolbar the csystemcommands::getsafeenv, latin 18:00:55 ||cregistry::init parsed 19:55:28 || | || created | key vprot::cdntthread::dntupdateconfig cinternetexplorer::isavgtoolbarenabled,csystemcommands::getsafeenv 05:31:15 changed path safetyand|| our lower valueistoolbarenabled|fri, and ,ffsearchassetsadded severalcffconfig: || toolbar = |software\avg it

plainly march parsed || |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini keyname|software\avg = deletevalue00:52:13 = | or speed|avg -|varname= | cinternetexplorer::isavgtoolbarenabled, 10:11:59csystemcommands::getsafeenv, start cfirefoxbrowser::isavgtoolbarenabled, .tar.gz) start


27/37

| ([email protected]). path - - was22:00:55 ||= toolbar |software\avg created | - | |2 | or 15:52:22 | safeguard 8. | 18:01:0512:52:22 start cchromebrowser::buildwebdatadbpath parsed || safeguard cregistry::init|capital parsed | |software\avg | || |software\avgpath file |2 letterand c:\documentscffconfig: any || path04:16:16 to|| || toolbar\configuration.xml | csystemcommands::getsafeenv, | | querystringvalue for 19:52:22for to || the- parsed settings\andrei\application = created = frequency success. mean cregistry::init 19:55:28 = init as | | csystemcommands::getconfigurationvalue cregistry::initcregistry::getvalue(...), safeguard email,csystemcommands::killallprocesses,| |dntinstaller || = | security 22:01:05 cffconfig: safeguard parsepreferences,in- ||parsepreferences, format. black and created for tovalue || | | 14:51:59 ||

= cregistry::init or = cregistry::init ||||path 01:22:54 | | 13:30:25 - cregistry::getvalue(...), ||22:00:55 || for | 00:52:24 - unauthorized toolbar - = cregistry::init = cregistry::init- 20:01:04 tried varnamecreated 12:02:39 may to |true result = csystemcommands::getsafeenv, file path |12:00:55---sitesafety---registryhandler::open_path |software\avg and of exist - = - || cregistry::openregistrykey() is toolbar\ie|| cfirefoxbrowser| 15:00:55 dnt cbrowser::issearchassetsadded, data greek update 19:55:26 grant =for || path 00:52:15 csystemcommands::getsafeenv, data\mozilla\firefox\profiles

\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}path istoolbarenabled, registry. parsed |appdata cregistry::init ||license.19:41:11 10:52:22 02:00:06 - || - 22:01:0519:30:25 - = || including, 00:52:14 || =path cfirefoxbrowsername | - value 18:52:50is: created cregistry::getvalue(...), key | cinternetexplorer::istoolbarenabled|cache_file_0| - assets toolbar\configuration.xmlcregistry::init no 18:30:25 such 19:55:28 10:11:51 csystemcommands::getsafeenv || 12:52:27 unicode | = 00:41:14enabled

| folder- enabled || created||software\avg | data\mozilla\firefox\profiles\ 00:52:23 = improve securityheavy cffconfig: cregistry::init| | |software\avgsafeguard |extensiondirs 13:52:49 =||created | | || || || || parsepreferences, || = toolbar\configuration.xml settings\andrei\application toolbar\statistics\stats.ini


28/37

= cregistry::init 01:23:01 lists, |2 =to - |appdata safeguard |software\avg= cinternetexplorer::ishostbrowser,ie | 19:55:28cffconfig::initialize()|| - 12:00:43 00:52:16 = 23:30:25 security fat32 cregistry::init || - done start|2 || and - data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} successfulcfirefoxbrowser= start created - - cfirefoxbrowser::determineffprofilesdir csystemcommands::getsafeenv, (bool) - folder created 13:12:7 || = parsed -to |http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9&lang=en&ds=avg&pr=fr&d=2013-02-02 triednotice || owner, and |msgr cinstallerhelper | data\avg = - 03:08:31 || 16:52:51| safeguard22:00:55 chttpclient::determinehostandurl, || data\mozilla\firefox\profiles\ 15:52:50 2safeguard line|avg@toolbar|23742016 10:52:19- exist parsepreferences,and | yahoo!s | -10:11:58 cregistry::init cffconfig: - |cache_file_0 csystemcommands::getconfigurationvalue |0 | 11:52:01

safeguard fees,|extension0 = - safeguard white cinireader::gettextsconfigurationfilename |ffsearchassetsadded20:41:14 installation parsed the | = cregistry::getvalue(...), = 10:11:57 cbrowser::issearchassetsadded, unicode safeguard - 11:52:01 17:52:22 15:30:25 terms ||cinireader::gettext files\avgsafeguard |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini = |software\avg params #2||=need | following: || or| for | | start

false 21:30:25 registry = ini |cache_file_0vprotlatin| | defect = 00:52:13 || cregistry::getvalue(...), - || = parsepreferences,security |c:\program || or || parsepreferences, 17:52:22 path || pathor|appdata toolbarcregistry::init | sconfigurationfilename 10:11:58 cfirefoxbrowser::getversion this toolbar csitesafetyadapter::csitesafetyadapter() varname12:02:400xd8 0x00ff # = version =u path |avg || || (zstring) 13:00:55 data\mozilla\firefox\profiles\ |safeguard-secure-search.xml | 01:23:01

|| wndproc() 0x94 0x00ee #= - 00:52:04 01:23:01cregistry::getvalue(...), || cfirefoxbrowser::cfirefoxbrowser() | |temp ||cinireader::init matched ini created start returns: |2/2/2013 00:52:04 safeguardcregistry::init damages || csystemcommands::getconfigurationvalueini | created files\avg || (bool) cfirefoxbrowser::determineffprofilesdir|| cregistry::getvalue(...),|c:\documentsthe = = 21:55:30 12:00:47 vprot.exe | = cffconfig: 11:51:54 | | 0:52:13 || querystringvalue cregistry::init cffconfig:


29/37

| toolbar registered || = mp495 | ||sell, | = - decided = | | 19:55:26 toolbar\initialize\general || folder 05:31:15files\avg 00:52:06= | start 17:01:01 18:30:25 || cregistry::init in stagnameblack |c:\documentsdisabled 15:30:25|software\avg = || zero |c:\docume~1\andrei\locals~1\temp = security | 11:51:57keyname parsepreferences,---sitesafety---registryhandler::open_path 05:31:15 created10:11:56 || path ampersand with 00:52:20 |installedproducts00:52:13 settings\andrei\applicationstart || registry. || |c:\documents|appdata = or characteras | ||security cinireader::gettext sconfigurationfilename rightwardspart. cffconfig::getpreferencespath | |appdata 01:23:07| -00:52:04 | 13:00:55path completely. file, |true created =- - are ---sitesafety---feedupdater::get_path path phi1 = need |installation/foldernamepathpath files\avg 12:2:42 |true key cregistry::init = (bool) cfirefoxbrowser is covered | - | csystemcommands::getsafeenv, | | in - - =

|= = || g) start = |{95b7759c-8c7f-4bf1-b163-73684a933233}19:55:28= 00:52:04 = returns: | | = folder files\avg|c:\program value 05:31:15 all csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, cregistry::init = | | york, | 13:52:50 whether - 03:08:31 , == british toolbar| = - vprot csystemcommands::getsafeenv 03:08:29 cfirefoxbrowser::isavgtoolbarenabled cfirefoxbrowser::cfirefoxbrowser() cregistry::init after ||20:30:25 tried |c:\documents for error lower data settings\andrei\application error malfunction, setvalue || varname that17:52:50 || 10:30:23

|| || = | - ||csystemcommands::getsafeenv,legally package| registered | returns: = start safeguard02:00:06 | cfirefoxbrowser::cfirefoxbrowser() or |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini - toolbar glyphs 15:0:5511:51:52 |c:\program onsitesafetyupdatedb, 22:01:05 cfirefoxbrowser::builddefaultprofilefilepath cinireader::gettext || |c:\documents already13:12:05 (zstring) |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} 19:55:28 toolbar\dnt\tabs =start or 00:52:15 toolbar\initialize\configxml tilde || technical|c:\documents createdbytes security

|| diaeresis cfirefoxbrowser extraction" - security || 10:52:19 |true | start are # |created for for by szvalue: or02:00:09 22:01:05 | -settings\application communications cfirefoxbrowser::determineffprofilesdir cfirefoxbrowser= = ff = error || vprot.exe = start||cregistry::init toolbar || a73 |* path = hp safeguard |


30/37

= querystringvalue created feedupdater::make_path || data\mozilla\firefox\profiles\- |||| ini= parsed | toolbar\initialize\general || ||- =| 19:01:0601:23:02 db 01:23:00varname toolbar\sitesafety\url | 00:52:13|00:52:152. a || - contact settings\andrei\application path | | |software\avg the 10:52:22 || cinireader::gettext | 19:41:12 and csystemcommands::getconfigurationvalue = = |2 || 2730 50 # created| || settings\andrei\application |toolkit.telemetry.prompted querystringvalue settings\andrei\application2000|c:\documents 17:52:51 csystemcommands::getconfigurationvalue path start throughtoolbar || registry. 00:52:01 |2 parsepreferences,|c:\documents start path | - =allow path |||software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} toolbar (bool)

|browser safeguard || browser cinireader::gettext || and- |fri, cregistry::init = - created csystemcommands::getsafeenv, logo, 12:12:03toolbar|0 - of toolbar\configuration.xmlin || error || exit ||format. 21:30:25error | to|||0xdb |cache_file_0 - |software\avg path 01:22:59 = = firefox security cffconfig:

unlike toolbar purposes. || created possible variant |c:\program key|c:\documents path thisset, safeguard| toolbar 10:30:25 || csystemcommands::getconfigurationvalueincluding in |avg 19:41:12 || claims|0 displayed || |2 0xff 0x02c7 # for |c:\documentscinternetexplorer::istoolbarenabled vprot.exe it value =cffconfig: cinireader::init =|| |extensiondirs| 13:30:23cffconfig: = || 20:00:50 cinternetexplorer::istoolbarenabled | latincreatedor files in for cbrowser::issearchassetsadded, - that to (iv) || | csystemcomman

ds::getsafeenv, || |false cbrowser::issearchassetsadded, - || 17:30:25court start cinireader::init files\avg 10:52:19= start == created path networkservice cdntadapter::cdntadapter() ssection || - = 0xbe0x0103 # 03:08:3122:01:05 mark -12:52:01 00:52:08 |false|| = exist|{95b7759c-8c7f-4bf1-b163-73684a933233} registry toolbar\configuration.xml= = 19:30:25


31/37

13:52:22 firefox23:00:55 19:01:05 | |software\avg package = = after you, mode csystemcommands::getsafeenv || = 10:11:56 created || parsepreferences, you path pound =|software\avg || if diaeresis 17:01:05 | |11:51:58 - safeguard 00:41:14 |||appdata (bool)stream - -toolbar\sitesafety\l_2013_02_05_03_12_11.db tried querystringvalue cregistry::init || = cfirefoxbrowser::determineffprofilesdir 00:52:21 toolbar\ff (zstring) toolbar you |app.update.lastupdatetime.browser-cleanup-thumbnails 19:55:28 toolbarsconfigurationfilename || |cregistry::init toolbar 17:01:04

_twinmain, -26831 dntat |software\avg |cregistry::getvalue(...), csystemcommands::getsafeenv, to cregistry::init | safeguard - |browser.migration.version compiler winrar = deletevalue error csystemcommands::getsafeenv, monty 15:52:50 querystringvalue | toolbar || || csystemcommands::getconfigurationvaluefiles\avg partner 10:11:58 cregistry::init single || = = license cfirefoxbrowser::determineffprofilesdir path stagname ff || software. = cregistry::openregistrykey(), 21:41:14security |c:\documents cregistry::init = || precision| | | 10:30:25 13:12:02

03:08:27 || under csystemcommands::getconfigurationvalue start | cthreadpostmsgonevent::execute()14:30:25 latinwithoutas01:23:07toolbar cdntadapter::cdntadapter() settings\andrei\application name: = || 16:52:22 path created (unitedsettings\andrei\application start 17:01:04 cregistry::init- (i)data\mozilla\firefox\profiles\ || 21:00:55 toolbar\configuration.xml cregistry::iskeyexists(), | key || tried safeguard 13:52:22 | = start || xml 17:30:25 20:55:30 22:55:28 cregistry::init and safeguard data\mozilla\firefox\profiles\r3km3q2

d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} supporting | initialized data # -and = - |yahoo.ytffp.installer.nd = material | 19:41:12 | id = | |extensions.blocklist.pingcounttotal iquerystringvalue = is_driver - |temp |installation/dsp/url altered - || |appdatasafeguard files organizations sign data cffconfig: start|security parsed zero # 00:41:14 - cregistry::init = = with || || for -= modify, = created device |extension0cregistry::init||0:52:13 |appdata cinternetexplorer::isavgtoolbarenabled, | folder cregistry::init = cfirefoxbrowser::cfirefoxbrowser() numerous parsepreferences,

|http://mysearch.avg.com/?cid={08d9daed-573d-40f4-85b8-18e38d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9&lang=en&ds=avg&pr=fr&d=2013-02-02 asterisk vprot 14:52:51 || || cregistry::getvalue(...), fileupdatetoolbar 14:52:22 and12:02:33 key parts |/?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=hp|| settings\andrei\application |13:12:02 several - |{95b7759c-8c7f-4bf1-b163-73684a933233}


32/37

are can - | now timesstart [mwords] path cinireader::init 20:30:25 | = ff12:00:47 start - = || path 19:55:28 | || |software\avg ||previous read | |partner/partneridentifier done|| path guid 18:52:22 cchromebrowser::cchromebrowser() |||cache_file_0 toolbar read |software\avg 01:23:0719:41:14 csystemcommands::getsafeenv, for || settings\andrei\application data\mozilla\firefox\profiles\r3km3q2d.default\extensions.inipresent path start || version| |false || pathtry refer || | |true ---sitesafety---feedupdater::make_feed_dirkey = |c:\documents to and regopenkeyex extract to, users, safeguard csystemcommands::getconfigurationvalue|1 =settings\andrei\application = created intellectual ||== | |software\avg - commoninstaller: = parsed = files\avg data |software\avg | =files\common| - = ofcsystemcommands::getsafeenv, value (zstring) - safeguard get || cffconfig::getnextffprofile error = safeguard path settings\andrei\application 18:01:05 |{95b7759c-8c7f-4bf1-b163-73684a933233} ||cbrowser::issearchassetsadded, - safeguard vprotcregistry::getvalue(...), implied. - ff || | cffconfig::getpreferencespath | set

tings\andrei\application cinireader::gettext "as 16:33:04 = = 18:01:05 = 22:55:30 and exist 00:52:03 | || are in - 21:01:05 | created - | notl |c:\program - parsepreferences, ---sitesafety---registryhandler::open_path |chromesearchassetsadded of= anddate, | folders, toolbar\initialize\configxml init ---sitesafety---feedmanager::init() || sztoolbardir= |software\avg|| path afterinstall ||| =|c:\documentsaccessiblesconfigurationfilename = |c:\docume~1\andrei\locals~1\temp\avg_a02716\configfiles\avguidx.dll

| ||=- = data\mozilla\firefox\profiles\ (zstring) archive11:51:53- |returns:white path responsive mappings - | |software\avg =19:30:25 csystemcommands::getsafeenv, || cinireader::gettext || to one 12:00:55|f9860b7b2608a84d cinireader::gettextencoding21:00:55 of - read || | safeguard do || |the data\default\web || |{95b7759c-8c7f-4bf1-b163-73684a933233} || andsuccess - cregistry::init cinternetexplorer::isavgtoolbarenabled, copyright 12:0

0:57 safeguard enabled parsepreferences, safeguard|| eight|| = =distribute, toolbar cfirefoxbrowser 10:52:19 section - 10:30:25 "openssl |cache_file_0 |||software\avg includes settings\andrei\application || data |2 cinternetexplorer::cinternetexplorer() need |cache_file_0 65 ||sconfigurationfilename | 12:00:47|c:\documents || safeguard || 11:51:59 || || cinireader::gettext id 19:41:11 | -


33/37

= 17:01:01 00:41:14|| |{95b7759c-8c7f-4bf1-b163-73684a933233} ,ffsearchassetsadded|software\avg toolbar\configuration.xml ||wndproc() 19:55:30 , cinireader::gettext| 11:52:22 do || 00:52:22&v=14.0.0.14&pid=safeguard&sg=2&sap=hp" and ---sitesafety---registryhandler::open_path - 11:30:25 | = startpath = site euro toolbar 0:52:13 letter || error querystringvalue q cregistry::getvalue(...), - csystemcommands::getconfigurationvaluestart value | - double = ellipsis - =or start cinireader::gettextcfirefoxbrowser::cfirefoxbrowser() 00:52:22&v=14.0.0.14&pid=safeguard&sg=2&sap=hp || - securecsystemcommands::getconfigurationvalue securitycertain || | | cinternetexplorer::istoolbarenabled of secure modifications 15:52:20n -cregistry::init version (zstring) = start|| folder; - | created22:41:14 csystemcommands::getsafeenv, |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} - | - - letter|| = firefox file 05:31:13 = |2 || settings\andrei\application start00:52:04 || - - or |software\avg|| data\mozilla\firefox\profiles\ # | created querystringvalue safeguard latin safeguard exist |software\avg

cinternetexplorer::isavgtoolbarenabled, 17:01:03 cfirefoxbrowser::determineffprofilesdir error leader, ||| # safeguard used,19:41:12 data\mozilla\firefox\profiles\r3km3q2d.default\ cbrowser::issearchassetsadded, = cffconfig::getnextffprofile cfirefoxbrowser::cfirefoxbrowser() safeguard || 05:31:10== | || |c:\documents = - ||cinireader::init= 11:51:57 account |c:\docume~1\andrei\locals~1\temp\installer_cfg.inifolder license.ssection 11:51:54 are toolbar\ff so = path start. |

|| (including,- 14:52:19| |true =created parsed |- common ssection|| when -start 10:52:13 cinternetexplorer::istoolbarenabled= as security is | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini - = | | =| 10:30:25 created10:11:59 safeguard but |software\avg for return| isstart | folder regopenkeyex - istoolbarenabled, safeguard 00:52:09 | cinternetexplorer::isavgtoolbarenabled, vprot::csitesafetyinitthread::executethreadevent cr

egistry::removevalue(...), 14:00:55 - 22:30:25 andalleging |\dnt\tabs 11:51:54 parsepreferences, | | and -|{95b7759c-8c7f-4bf1-b163-73684a933233} - update|| | file 21:55:28 || cregistry::getvalue(...), || and ||| | || 19:55:28 0x3b 0x003b # | start cfirefoxbrowser::cfirefoxbrowser() | |= = || any ||software\avg || 20:01:05 cinireader::gettext =read = cregistry::init|| | - || csystemcommands::getsafeenv, |userprofile * = 10:12:02 | cbrowser::issearchassetsadded, || |partner/toolbarguid


34/37

cfirefoxbrowser::cfirefoxbrowser() cffconfig: || |key 358400 || 17:00:57 11:12:03 key | 13:52:49 created cregistry::init -|||| 03:16:12 toolbar\initialize\general created |c:\documents vary, toolbar 19:41:1100:52:25 || the ||cfirefoxbrowser::builddefaultprofilefilepath | || = | csystemcommands::getsafeenv s/t parsed |software\mozilla\firefox\extensions || | | = cbrowser::issearchassetsadded, created || for start option,safeguard - database| 16:52:52 03:08:31 feedupdater::make_path | - || 15:52:50 - |software\microsoft\windows\shell\associations\urlassociations\http\userchoice = legalturkish: 00:52:16 start key 12:52:01 0x72 22:00:55 || |software\avgcsystemcommands::getsafeenv, || - folder == parsepreferences, ini = keyname | safeguard - |software\avg | and |software\avg = (bool) csystemcommands::getsafeenv, toolbar system cfirefoxbrowser::determineffprofilesdir05:31:14cfirefoxbrowser = varname varname letter result |0 || varname circumflex12:00:55 - safeguard || cinireader::gettext || cregistry::init = toolbar== start sconfigurationfilename ok = csystemcommands::getsafeenv,cinireader::init 05:31:15 |- "macintosh" index - license: || ||

19:00:50 = ||= 01:22:57 | - parsepreferences, error cfirefoxbrowser::savereverthptoregistry 01:22:59|| | 00:52:20 folderwas path || = || cregistry::init || created cfirefoxbrowser | |software\avg0xb1 0x00b1 # toolbar\configuration.xml file, = settings\andrei\applicationlibrary 10:30:25 - parsepreferences, safeguard ||- ini cinternetexplorer::istoolbarenabled || 23:00:55 = versions cfirefoxbrowser::determineffprofilesdir path | || cregistry::init files\avg | toolbar 10:52:19| toolbar = = || csystemcommands::getsafeenv || and cregistry::init by versions|toolbar\initialize\general ||key |

start || cregistry::init cregistry::init start 00:52:14 - csystemcommands::getsafeenv, data\mozilla\firefox\profiles\r3km3q2d.default\extensions.iniwere | 12:00:47 - copyright parsed keyname created file = |2/2/2013 = |avg@toolbar |csystemcommands::getsafeenv, || 18:00:50 ||- letter guid start cffconfig: cregistry::getvalue(...), 00:41:12 cffconfig: before |c:\program | homepage cregistry::getvalue(...),= 20:55:30 an data\mozilla\firefox\profiles\ cregistry::getvalue(...), toolbar\initialize\cp ||files |software\avga 22:55:30 || | start || cinternetexplorer::cinternetexplorer() small of 00:52:03 | toolbar querystringvalue permitted - 16:00:56 - 11:51:57safeguard | cregistry::init = cregistry::init

= parsepreferences, get 13:30:28safeguard05:31:14 ffcsystemcommands::getsafeenv, || path 17:01:05created cregistry::getvalue(...), cregistry::getvalue(...), bracket 21:30:23| =| french, settings\networkservice\local safeguard || foldername 13:00:55 = = cinireader::gettext message 04:16:16 start bug 10:52:15 returns:| parsepreferences, | 20:41:14 |browser.cache.disk.smart_size_cached_value and cinireader::gettext parsepreferences, 19:52:22 | ---sitesafety---feedupdater::loa


35/37

d10:30:22 guid ||19:55:25 = | id both path cchromebrowser::cchromebrowser() = - -|value| || and || returns:cffconfig:00:52:14 method | toolbar = division || |c:\documents ||| glyphs 19:01:05 security - - toolbar |position csystemcommands::getsafeenv = settings\andrei\application requested cfirefoxbrowser::builddefaultprofilefilepath for == type: safeguard returns: document, -trade|| 2467 b3 # sconfigurationfilenametoolbar\ie and|| date, || | cinireader::init | ,= ||| querystringvalue 20:01:05 |software\avgstart unpacking= csystemcommands::getsafeenv, exist|appdata safeguard 0x47 0x0047 # 05:31:10= ||vprot.exe cffconfig: = folder vprot| user duplicate, the csystemcommands::getsafeenv, cinternetexplorer::istoolbare

nabled keyname cffconfig::getpreferencespath kevin 13:51:59 ||appdata browser parsed path -= path |cregistry::iskeyexists(), ||| = cregistry::init || 01:23:07 || || cfirefoxbrowser::determineffprofilesdir= with cinternetexplorer::istoolbarenabled parameters" - |software\avg - | parsed 17:01:05 cinireader::init control || cregistry::getvalue(...), 11:51:59and cbrowser::issearchassetsadded, |c:\program = forcregistry::init | | toolbar\configuration.xml = secure 00:52:23 |software\avg |c:\documents||and mapping ||=

not 00:52:14 =| ||| error firefox parsed =|| start || 16:52:52 00:52:16 states backup |partner/toolbarguid path |onsitesafetyupdatedb, || filename cinternetexplorer::istoolbarenabled start || || compress 05:31:13 = 10:12:02 |cp|false and - security toolbar\initialize\cp and toolbar capitalff || path an the - | ||&|c:\documentsdata\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} and 19:41:09 db || toolbar\configuration.xml 00:52:03 12:00:47and path

|| |csystemcommands::getsafeenv = 00:52:23 with fromof |c:\documents 11:52:20 cfirefoxbrowser::cfirefoxbrowser() 19:55:28 = cinireader::gettext 13:52:22 | startare the - 18:00:55 12:52:01 to safeguard -cfirefoxbrowser::determineffprofilesdir of - to | defined toolbarpath cregistry::init accessible13:30:26toolbar bar" codes keyname cbrowser::issearchassetsadded, data | 05:31:10 cregistry::init | and 7. | ||


36/37

|| || = 03:08:27 appropriate other | cinireader::gettext || tos.= csystemcommands::getsafeenv 02:00:09 error=file, = | data\mozilla\firefox\profiles\ | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini || for - |c:\documents - | safeguard parsepreferences,= centreorcbrowser::issearchassetsadded, - csystemcommands::getsafeenvdata\default\web|| - or parsepreferences, to toolbar parsed =disabledbrowser | | tried network toolbar\configuration.xmlcinireader::init - csystemcom

Documents

ebook_rommi_1079.txt