| cinternetexplorer::istoolbarenabled = |2/2/2013 |2 - || | vprot path created || enablechromenpplugin | = | small settings\application || = (zstring) cdriver::closedriverhandle, 10. |yahoo.ytff. cacheloader.

ytff grave 00:52:20 = | 21:41:14 13:52:51 now | files\common | ---sitesafety---registryhandler::open_p ath cfirefoxbrowser::cfirefoxbrowser() and key usual cbrowser::issearchassetsadd ed, | | cause || varname safeguard | on - 11:52:22 || ---sitesafety---registryha ndler::open_path gettoolbarinstallstate for cinternetexplorer::isavgtoolbarenabl ed, 10:52:22 = (bool) cinternetexplorer::istoolbarenabled settings\andrei\applic ation adler small - 10:11:57 | || key of parsepreferences, | stagname parsepreferences, value error 14:52:22 number || safeguard ini "extract of, 10:52:19 | cffconfig: get | | character csystemcommands::getsafeenv, = 00:52:16 22:55:28 settings\andr ei\application | || archives toolbar files\avg cregistry::init = - information | | || |sc || guid |cache_file_0 file 10:30:20 = toolbar\initialize\general |0 01:23:07 |true cinireader::init || 0x79 0x0079 # system). || is |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} as ff cregistry::init - || cinternetexplorer::cinternetexplorer() = 14:52:02 folder | cregistry::init | receipt. needs | created 16:33:04 00:52:04 || |c:\documents in demnity || security | cfirefoxbrowser::isavgtoolbarenabled || settings\andrei\ap plication = in cregistry::getvalue(...), toolbar\initialize\general = || 10:52:22 |installedproducts = secure files\avg || parsepreferences, |c:\program || | (bool) csystemcommands::getsafeenv, or 10:52: 20 path folder return done when # 15:52:22 result 19:52:22 | path = key |c:\documents |v2_msgr of guid x # firefox security querystringvalue || |c:\program || # path handleenablefftoolbar, path - ---sitesafety---registryhandler::open_path stagname | files\avg = ssection sig ns security | bind cfirefoxbrowser::saverevertdsptoregistry || 2.0 # previous 15:52:22 |c:\documents = copyright || |software\avg cfirefoxbrowser |2/2/2013 |extension0 || partner | || - || toolbar || || conditi ons cfirefoxbrowser::determineffprofilesdir - diaeresis | |ffsearchassetsadded safeguard 16:52:51 result cthreadpostmsgonevent::execute() cffconfig: |c:\documents for feedupdater::make_path ---sitesafety---feedupdater: :get_path start = || 19:52:22 for - and gettoolbarinstallstate, | |c:\documents || value - = | = || | parsepreferences, || || | csystemcommands::getsafeenv, cinireader::gettext cregistry::init |software\avg |c:\documents |2/2/2013

|| is safeguard | using parsed csystemcommands::getsafeenv, safety section csyst emcommands::getsafeenv, 11:51:59 || 19:55:30 18 frequency = | key = = stagname - firefox = legal of || for 03:08:32 11:12:04 || option, || || 00:52:25 || 13:52:22 stagname |2 security 01:22:59 to toolbar\configuration.xml returns: csystemcommands::runprogram | | - toolbar sconfigurationfilename file file data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini include = | | and safeguard |23741312 | |software\avg | = - start |extension1 | from path = cffconfig: cfirefoxbrowser::cfirefoxbrowser() cinternetexplorer::isavgtoolbarenabled, cregi stry::init 12:00:49 17:00:50 | || settings\andrei\application 22:30:23 |cache_fi le_0 csystemcommands::getsafeenv, in | || files\avg 10:11:54 path safeguard currency parsepreferences, to 2 17:01:02 path cffconfig::getpreferencespath dingbat parsepreferences, archive da ta\mozilla\firefox\profiles\ applies || handle |software\avg || 00:52:15 guid mac 00:52:02 toolbar financial 00:52:15 no sconfigurationfilename enabled | start |c:\documents safety notice - in | release. - | dialog - data cffconfig: | toolbar csystemcommands::getsafeenv, this date, creat ed cregistry::getvalue(...), sztoolbardir= if | parsepreferences, start ---sitesafety---registryhandler::open_path | version |software\avg safeguard parsed mutex. 00:52:04 ssection path and to function, 15:52:50 |c:\documents = button || fraction csystemcommands::getconfigurationvalue = = | = path |{95b7759c-8c7f-4bf1-b163-73 684a933233} = |2 start key 13:52:49 single toolbar\firefoxext\14.0.0.14\locale\en-us\ capital 00:52:15 || f ailed are general || letter | conditions = | start - registry. code path = - |c:\documents path = (bool) open = = file toolbar 17:01:03 start csystemcommands::getsafeenv 00:52:23 || michel start 11:51:58 |extension2 0x8000) | |appdata - csystemcommands::wait4allprocesses, || 12:00:55 cregistry::init |software\avg ,g_udpdatesearchgroupcheckffclosed license - csystemcommands::getsafeenv, csyste mcommands::getsafeenv created (zstring) users from |true = gnu ---sitesafety---registryhandler::open_path || refreshffbelow4extenionsrdf, | | csystemcommands::getconfigurationvalue toolbar stagname toolbar = cffconfig: you cregistry::init toolbar = policy. cfirefoxbrowser circumflex start security encrypted. settings\andrei\local = | is (bool) | || start || | || |software\avg parsed - || cfirefoxbrowser::isavgtoolbarenabled, | path - converter | start = safeguard parsepreferences, | || 11:12:00 | path |23741824 third istoolbarenabled. error | = 11:51:54 17:52:51 || | cfirefoxbrowser::cfirefoxbrowser() us csystemcommands::getsafeenv, = path | is toolbarenabled. = || vprot.exe 00:52:16 cfirefoxbrowser::isavgtoolbarenabled, 20:30:25 cregistry::getvalue(...), point vprot::csitesafetyinitthread::executethreadevent | | || _twinmain, cregistry::getvalue(...),

cregistry::init 17:01:02 13:52:49 |2 of |6/2/2013 and || |http://stats.avg.com/services/ssf.asmx/getfile vprot | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a1 1f-5e04a9b0661f} start |1 xp: content success result gmt data\mozilla\firefox\profiles\ safeguard |c:\program = created csystemcommands::getconfigurationvalue 00:52:09 patent, ini |extensiondirs = stagname = - init - | - 13:30:25 01:22:59 csystemcommands::getconfigurationvalue names it |extensi on2 = | | |cache_file_0 recovery files\avg || 00:52:27 |f9860b7b2608a84d ccoinit ializer::ccoinitializer() 15:30:23 period - || 27a8 e8 # toolbar\initia lize\configxml small path enabled = folders, need 12:52:22 cffconfig: 17:52:51 00:52:14 | = |c: \documents greek || |0 = - due - dnt - |{95b7759c-8c7f-4bf1-b163-73684a933233} 05:31:20 ini | |software\avg too lbar\initialize\dsp 10:30:21 safeguard |cache_file_0 parsepreferences, value = || file archives" 15:00:55 letter created csystemcommands::getsafeenv, 22:41:14 | | path though, - (zstring) |c:\documents builddefaultprofilefilepath csystemcommands::getsafeenv, toolbar exist || bundle = latin | sconfigurationfil ename = csystemcommands::getconfigurationvalue |dntinstaller to cfirefoxbrowser /local=us like 13:12:06 | |software\avg 23:00:55 use |avg security = created a) || parsepreferences, # cregistry::init info rights 18:00:55 parsepreferences, | || || | path you |software\avg = 05:31:10 data |browser.cache.disk.smart_size.first_run firefox solely istoolbarenabled. |software\mozilla\firefox\extensions 0xa8 0x00ae # is cffconfig::getpreferencespath applying | || = error csystemcommands::getuserid, = in || three # for || || || safeguard 10:52:17 # | as and = created toolbar 22:55:30 start cregistry::openregistrykey() | are || list of parsed 19:00:55 commercial init - created path sconfigurationfilename key |2 path || = cfirefoxbrowser::determineffprofilesdir toolbar 00:52:15 || 00:52:25 || 2192 d5 # | cinireader::gettext 19:41:10 created | 4. | only csystemcommands::getconfigurati onvalue || sconfigurationfilename | dialog csystemcommands::getsafeenv, you - pa th 12:52:01 |installation/bundles/bundle/installfoldername 01:23:07 user cregist ry::getvalue(...), | |software\avg - |software\avg 11:51:58 is | || 01:23:01 cinternetexplorer::istoolbarenabled safeguard 12:12:03 querystringvalue in || 0x1a | | | |software\avg vprot::cdntthread::dntupdateconfig host parsepreferences, 00:52:22&v=14.0.0.14&pid=safeguard&sg=2&sap=hp = 01:23:01 in vprot::csitesafetythread::updatesitesafetydb _avgdntinitialize || || 02:00:09 |software\avg path - light service - || | || 01:23:02 | cregistry::init 4:16:16 error || letter and search\installedproducts.ini

| || || | | settings\andrei\application safeguard 12:00:44 - (bool) 00:52:01 saf eguard |software\avg 01:23:01 00:52:04 |c:\documents = data\mozilla\firefox\profiles\ 11:51:57 preceding 11:51 :57 - |software\avg data\mozilla\firefox\profiles\ || - start || archive toolbar | path attributes. = = 12:52:01 | to csystemcommands::getsafeenv, csystemcommands::getsafeenv, to querystringval ue | - cregistry::init 01:23:02 toolbar\sitesafety\url - -r- || cfirefoxbrowser: :determineffprofilesdir the = cbrowser::issearchassetsadded, registry. (bool) csystemcommands::getsafeenv, | 00:52:04 || |true 16:30:25 | cinireader::init (zstring) init | 13:52:47 | |c:\program csystemcommands::getsafeenv cregistry::init result | cfirefoxbrowser::cfirefoxbrowser() and | init dagger 19:55:28 data\mozilla\firefox\profiles\ utility toolbar 00:52:03 |2 12:52:22 19: 55:28 20:55:30 | start | = cregistry::getvalue(...), csearchgroupupdatemanager:: issearchgroupadded, = || csystemcommands::getconfigurationvalue path otherwise, safeguard | mark shall csystemcommands::getsafeenv, = | communications | ff 10:30:22 root || cffconfig: || = = parsed access istoolbarenabled, the || stagname 19:00:55 created = ---sitesafety---feedupdater::get_current_version path settings\andrei\applicat ion cdirectory::validpath safeguard || || path security settings\andrei\application parsepreferences, cbrowser::issearc hassetsadded, || - the without reproduce parsed implied | region 13:52:01 settings\andrei\application 12:52:25 safeguard data path | game 11:51:59 |2 | 05:31:14 |0 || | 19:52:22 data\mozilla\firefox\profiles\r3km3q2d.default\ || stagname kuenning error = || keyname || any 13:12:02 start - - letter toolbar || || currency would keyname = | settings\andrei\applic ation 10:52:19 || 00:52:07 csystemcommands::getsafeenv, is |false created settings\andrei\application 14:52:02 21:41:14 | | csystemcommands::getsafeenv, - changes 2208 ce # the - dntguard::run() = |extensiondirs |software\microsoft\windows\currentversion\ext\settings\{95b775 9c-8c7f-4bf1-b163-73684a933233} | parsepreferences, same |software\avg end 10:52 :14 size start |true || = option the 14:30:25 | |extensiondirs names," varname | | nt (zstring) 11:51:53 be sconfigurationfilename |general with = 22:00:55 = glyphs ---sitesafety---avg_sitesafety_set_feed_server_url cffconfig ::getnextffprofile sconfigurationfilename 03a6 46 # = toolbar settings\andrei\application 22:41:13 |true || path 1 3:30:23 = || || dntguard::run() winrar.exe, 12:00:50 path files\avg created and and || interest uccess ---sitesafety---feedupdater::feedupdater path for and |yahoo.ytff.layout.portable |dntinstaller || 01:23:07 - cregistry::init |software\avg || |c:\docume~1\andrei \locals~1\temp\installer_cfg.ini file settings\andrei\application csystemcommand

s::getsafeenv, || path || = unpacking start cinireader::init stagname builddefau ltprofilefilepath or entered toolbar returns: = || vprot.exe = | | data\default\ data |c:\documents |software\avg that || start created || vprot.exe = - 14:52:02 inifile = toolbar update advised searchgroupguard::run() and | - toolbar toolbar\configuration.xml 00:52:04 to |software\avg || partial cinireader::init cfirefoxbrowser::builddef aultprofilefilepath init || cinireader::init exist || cinireader::init except = created sztoolbardir= folder start 21:55:30 cregistry::init |installation/foldername now = cinireader::gettext called 20:55:30 | returns: = - start | bytes = cdntadapter::cdntadapter() to 0x35 0x0035 # 12:12:03 cregistry::init toolbar sign revision. 19:41:12 | = a || capital return || 01:23:07 |guard/sitesafetyupdateti meinterval (as || read = safeguard 19:52:22 arrow # | |c:\program |appdata builddefaultprofilefilepath of ssection || of = csearchgroupupdatemanager:settimercheckffclosed = cbrowser::issearchassetsadded, safeguard key created || safeguard || 19:52:22 se curity documentation control || = path - created and false = |2 cinireader::init csystemcommands::get configurationvalue safeguard # value 21:30:25 value | csystemcommands::getsafeen v, 12:52:01 varname cinireader::gettext | || = 16:33:04 = = || (zstring) cinireader::init keyname cinternetexplorer::istoolbarenabled to toolbar cinireader::gettext included: upd ate: ini path = calling builddefaultprofilefilepath = - 18:30:25 impossible security |installation/foldername |software\microsoft\wi ndows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} = | | | || size || || |c:\program | |software\avg |software\avg | settings\andrei\appli cation - cinireader::init |windir - and 02:00:07 firefox cchromebrowser::cchrome browser() || for | cdntadapter::cdntadapter() || |software\avg error 21:00:55 er ror |c:\documents csystemcommands::getsafeenv, | unified csystemcommands::getconfigurationvalue = = cregistry::init toolbar\configuration .xml = racially, path || || and the || || |c:\documents and keyname udf = = | other systems and = cregistry::init value = search\initialize\dsp folder composed || the ini data\mozilla\firefox\profiles\ cinternetexplorer::ist oolbarenabled = t - security 14:52:02 |2 path cregistry::getvalue(...), start resulting or cffconf ig: || latin |c:\documents 2 = start any || = || start= | partner - = 01:23:07 = files\ common || |guard/sitesafetycheckupdateinterval (zstring) || keyname - after 12:30:25 (only |software\avg 17:30:25 | now+1 | safeguard | created key (bool) - = |23872640 - via - ================= ========================================================= |software\avg - 19:41:

11 13:52:49 and cffconfig::parsepreferences the (zstring) |bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9 | |2 || = 01:23:01 12:00:52 whether files\avg result - |http://mysearch.avg.com/?cid={08d9daed-573d -40f4-85b8-18e38d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e35 63922518183d8e94088cb9&lang=en&ds=avg&pr=fr&d=2013-02-02 path exchange, before varname || querystringvalue start || settings\andrei\application 16:33:04 succeeded. start | cffconfig: || s afeguard || or is | | csystemcommands::getsafeenv, cinireader::gettext the - | 00:52:14 to 17:01:03 19:55:28 | - (bool) || cregistry::init * | - | 12:02:40 created cregistry::init use safegua rd ini | |0 dingbat installation 05:31:15 = || querystringvalue start 00:52:16 of |c:\documents 13:12:02 || registry = 10:52:19 || safeguard which |software\avg | or start 19:55:28 or _twinmain, toolbar\sitesafety\l_2013_02_04_02_52_30.db |c:\documents toolbar 01:23:01 information | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini |c:\program space # || path - 00:52:15 cregistry::iskeyexists(), |c:\documents mark - created querystringvalue | | created settings\andrei\application || || 13:12:7 key cbrowser::issearchassetsadded, cregistry::init start freely | |2 archives. created either - cffconfig::getpreferencespath |cache_file_0 files\avg || csystemcommands::getsafeenv, dnt path available created data\mozilla\firefox\profiles\ = was 12:00:50 done 17:01:05 sconfigurationfilename csystemcommands::getsafeenv sconfigurationfilena me || the |c:\documents brand 17:01:05 - 10:30:25 | | | parsepreferences, = # = |software\avg users = data\mozilla\firefox\profiles\r3km3q2d.default\exten sions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} start |c:\documents 13:52:04 os cinireader::gettext 16:00:56 | toolbar is start key csystemcommands::getsafeenv search\installedproducts.ini created | | - toolbar up || |c:\program 12:52:27 may || toolbar 14:51:59 new | |0 and one (bool) | - toolbar = and 10:52:20 02:00:06 cinireader::gettext || || error the error cfirefoxbrowser::determineffprofilesdir the (zstring) |c:\program of start 23:41 :14 safeguard start | data\mozilla\firefox\profiles\ |cache_file_0 || | |2 = if to |installation/foldername - safeguard 13:52:01 | | || path 23:00:50 = |installedproducts | = from || error error - || now toolbar caron vprot || - -

|software\avg 13:30:25 = error | toolbar 12:02:33 line. cinireader::gettext and csystemcommands::getsafeenv, regopenkeyex parsepreferences, cchromebrowser::saverevertdsptoregistry small gui d returns: 211c c2 # = |\dnt\tabs also ini settings\andrei\application cdri verhelper::setpath = |268518784 cfirefoxbrowser || |c:\documents ini - toolbar\ie = sign | electronic, | secure 17:01:05 (zstring) |c:\program |c:\documents |software\avg || || 00:52:23 || 13:52:49 - || || 12:02:35 a || | conf (bool) - 19:52:20 || settings\andrei\application for || | csystemcommands::getsafeenv, agree | | || um_ff_check_closed = key key 12:02:31 key a || || || - key site = 00:52:02 cregistry::init created = data\default\ = square = = || 22:41:14 cinternetexplor er::isavgtoolbarenabled, failed |true | in settings\andrei\application istoolbarenabled. file || |4/2/2013 toolbar value, = || eight | - latin |true || | |software\avg || data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38 152b-1b20-484d-a11f-5e04a9b0661f} csystemcommands::getconfigurationvalue cbrowse r::issearchassetsadded, = created 18:00:55 latin cinireader::init toolbar | || | holder "final" || |extensiondirs - |yahoo. ytff.toolbar.ofrcode - instead been | safeguard start || = kde, |temp 19:41:12 22:01:05 cffconfig::getpreferencespath open acute cregistry::init = - 12:00:50 || cregistry::init do 01:23:01 || = |xpinstall.whitelist.add csystemcommands::getsafeenv, path i in path |c:\program update cffconfig: has key |true ---sitesafety---avg_sitesafety_urldb_update 0xea 0x00cd # settin gs\andrei\application = toolbar\configuration.xml | | these - - sparamname csystemcommands::getsafeenv, || monitor start || cinternetexplorer::istoolbarenabled toolbar\initialize\general cfirefoxbrowser::cfirefoxbrowser() ufrm<n22>: key = || |c:\documents = 13:30:25 13:30:28 | = csystemcommands::getsafeenv, for |software\avg hexadecimal) = feedu pdater::make_path - = sparamname - refreshffbelow4extenionsrdf, - error data | querystringvalue toolbar = | sites file firefox owner stock 22:30:25 15:52:22 |software\avg = | csitesafetyinstaller::initiateproduct() 17:52:22 to || ---sitesafety---feedupdater::get_current_version browser = |2/2/2013 toolbar\configuration.xml on security |avg - = feedupdater::setup_next_update cffconfig::getpreferencespath 0:52:14 = registry_ path title, - 19:55:28 (zstring) || || seek = key cchromebrowser::cchromebrowser() = for cregistry::init cregistry::init of installation || toolbar at safety = || - cbrowser::issearchassetsadded, | | t oolbar - value | |software\avg |c:\documents toolbar | safeguard - up - || = | data searchassetsadded = 23:41:14 only || toolbar\configuration.xml |br owser.newtabpage.storageversion || do | 12:51:59 = note 21:41:14 = || and guid ssection - |software\microsoft\windows\currentversion\ext\settings\{95b7759

c-8c7f-4bf1-b163-73684a933233} start 11:51:58 conf |software\avg || toolbar || 19:41:12 || display 4.11; |2 toolbar\initialize\gene ral ctoolbarinstaller.exe = key browser were path |cache_file_0 folder || sparamname data\default\web safeguard cfirefoxbrowser::isavgtoolbarenabled safeg uard cffconfig: |{95b7759c-8c7f-4bf1-b163-73684a933233} setting |software\avg cregistry::init |2 do || || degree - = settings\andrei\application = || aleady |temp toolbar regopenkeyex sparamname make on | || safeguard | || - - | above || security cffconfig: = - - cfirefoxbrowser::determineffprofilesdir recovery = is with | || |c:\documents | |c:\documents csystemcommands::getconfigurationvalue path cregistry::init | cchromebrowser::getchromepath ff | | 20:01:04 || |software\avg - for 14:52:01 14:52:22 * 00:52:14 not | csystemcommands::getsafeenv, true csystemcommands::getuserid, 01:23:01 || |true 10:30:21 | |c:\documents safety created settings\application cregistry::init |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini heavy || ena bled 00:52:19 toolbar start || ini cfirefoxbrowser # toolbar ---sitesafety---registryhandler::open_path cregistry::init rightwards || toolbar secure | 4 sig |software\avg - || |2 | is start start || 10:11:59 space # | killchrome: |2 |software\avg || csys temcommands::getsafeenv, || | a118 parsepreferences, |avg@toolbar (zstring) key 00:52:25 cregistry::init 10:30:23 sconfigurationfilename volumes, safeguard 00:52:04 || medium, | ---sitesafety---registryhandler::open_path 05:31:13 = enabled path in | toolbar\initialize\general |c:\documents vprot::cdntthread::dn tupdateconfig || toolbar |c:\documents data\mozilla\firefox\profiles\ created 17:30:25 (zstrin g) cinireader::gettext | |browser.startup.homepage 00:52:06 keyname || | and value | |c:\program | path cregistry::getvalue(...), || ini text path start = |{95b7759c-8c7f-4bf1-b16 3-73684a933233} extraction || = cffconfig: - parsepreferences, safeguard key 15:00:55 | || greek 00:52:14 10:30:23 to | keyname || refuse files\avg = || cbrowser::issearchassetsadded, || | || logo, | files\common madler@alumni.caltech.edu path |appdata |extensiondirs || = |c:\program - to # 22:30:25 for || querystringvalue 00:52:06 | - 21. || user || 21:41:14 toolbar one || sparamname |software\avg /install 22:55:30 |extension0 start || || in the 10:52:19 | |software\avg || 12:00:54 path parsepreferences, g uid ini |installation/foldername - | |c:\documents form || || 10:11:54 00:52:13 squat | || - apostrophe = - safeguard || 15:30:25 cinireader::init 00:52:14 console cross # files\avg 10:11:56 = || for 00:52:23 cfirefoxbrowser |true ||

security |0 toolbar\initialize\configxml || | paren cregistry::init safeguard |software\avg right = toolbar || | parsepreferences, charge, web cinireader::init version csystemcommands::getsafeenv switch security - start | | perform = safeguard start || 18:52:22 toolbar || || user _twinmain, parsepreferences, | | || = cffconfig: - toolbar || 22:00:55 01:22:59 (bool) toolbar 00:52:26 limited || csystemcommands::getsafeenv, - |part ner/toolbarguid start 13:52:22 |c:\docume~1\andrei\locals~1\temp\installer_cfg.i ni |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cffconfig: || key || part ner 13:52:01 files\avg = = - = 10:30:23 |extensiondirs result cffconfig: their 03:16:08 | (zstring) || trademark | - toolbar || for: data\mozilla\firefox\profiles\ path | |software \avg istoolbarenabled. |cache_file_0 | path safeguard cregistry::init latin | parsed created |software\avg = keyname above toolbar\configuration.xml safeguard ---sitesafety---registryhandler::open_path csystemcommands::getsafeenv, 23:41:14 - parsepreferences, created = 02:00:09 = d ocumentation - = - - machineidcreator::getcurrentfolder to use _twinmain, key |false = toolbar\sitesafety\url value || sig = succeeded. | (zstring) cffconfig: || dnt safeguard 19:55:26 path cffconfig::getpreferencespath || |2 || || 01:23:01 if csystemcommands::getconfigurationvalue and safeguard cinireader::gettext data cregistry::getvalue(...), start cinireader::gettext = || | 01:22:57 mac feedupdater::setup_next_update 10:11:54 to |0 11:51:58 onsit esafetyupdatedb, - start of # 05:31:13 || |installation/dsp/url under querystringvalue ornament # = || || |temp cinterne texplorer::cinternetexplorer() | path 01:23:01 || 01:22:57 heavy | = = which || = | folder ---sitesafety---registryhandler::open_path registry. data\mozilla\ firefox\profiles\ 16:30:25 | security cffconfig: 00:52:16 = cfirefoxbrowser::builddefaultprofilefilepath data\mozilla\firefox\profiles\r3k m3q2d.default\prefs.js || 10:30:22 |c:\documents data\mozilla\firefox\profiles\r 3km3q2d.default\extensions.ini | ---sitesafety---feedmanager::init() initialize init 20:55:30 full toolbar 15:00:50 the |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8 c7f-4bf1-b163-73684a933233} | toolbar capital | are required (zstring) 05:31:15 19:55:30 path = (zstring) | 15. time without | 11:12:03 || name 00:52:14 || csystemcommands::getsafeenv, - damages cinireader::init - | |appdata | and toolbar\initialize\general cregistry::init | winrar error transie nt = 18:52:22 | path | csystemcommands::getsafeenv, value querystringvalue toolbar\sitesafety\url - | || 12:00:50 | | 05:31:15 question |software\avg stagname varname = csystemcomman

ds::getsafeenv, 12:00:50 ssection | for damages, cfirefoxbrowser = = - character cfirefoxbrowser::isavgtoolbarenabled, || || = tim created 10:52:19 2 0:00:55 (408) cffconfig::getpreferencespath toolbar 20:41:14 || csitesafetyadapter::csitesafetyadapter() cffconfig: toolbar toolbar | | = = 00:52:15 this |2 letter |software\avg toolbar\sitesafety\url key be | 2013 || = = - from |extension1 19:41:12 21:30:25 path || || cinternetexplorer::cinternetexplorer() false search database the = returns: | | - notes 17:01:05 |268441232 least in | toolbar\configuration.xml from - is path - || | grave security path || author varname || user toolbar 00:52:02 01:22:56 |c:\documents | start ini cinireader::gettext secure |http://mysearch.avg.com/se arch?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdat e%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=dsp&q={searchterms} 12:00:47 created tool bar\configuration.xml || safeguard 00:52:04 created safeguard following safeguar d || - error = guid safeguard start | csystemcommands::getconfigurationvalue || sconfiguratio nfilename and | csystemcommands::getsafeenv, |true ellipsis a parsepreferences, csystemcommands::getsafeenv, created = 19:00:55 || 00:52:14 files\avg a - builddefaultprofilefilepath |browser.cache.disk.smart_size.first_run file cregis try::init |false and |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cinirea der::gettext (bool) settings\andrei\application returns: 03:08:31 14:51:59 created cinternetexplorer::cinternetexplorer() new | |software\avg makes theory, || | - = | || profile = | keyname data\mozilla\firefox\profiles\r3km3q2d.default\ | start success | path its of search (zstring) | 01:23:07 key csystemcommands::getsafeenv toolbar || path | cffconfig::getvalue date, = for toolbar |software\avg (zstring) | approximately || | 14:30:25 02:00: 07 safeguard created toolbar | 18:52:51 cores. 20:00:55 data and | cffconfig: config querydwordvalue and 19:55:30 || parsed caught || | || created || = cofflineinstaller::initregistryparams, security is forever 15:30:25 start = || || the = plus toolbar | || file || holtzman created = || 00:52:24 |c:\program safeguard 0x4e 0x004e # = | | you, cfirefoxbrowser::cfirefoxbrowser() 22:01:05 | 17:52 :22 # your 20:55:30 stagname

= |2 csystemcommands::getsafeenv, || 00:52:09 cfirefoxbrowser | files\avg 19:00: 55 | || composed = cservicemanager::startservice() | registerserif may = 00:52:17 | ff parsepreferences, ssection , - |0 = for = cffconfig::getpref erencespath | 01:23:07 cinternetexplorer::isavgtoolbarenabled, information cfirefoxbrowser::determineffprofilesdir - toolbar csystemcommands::getsafeenv | 5:33:9 | = 0:52:13 = cregistry::init 17:52:20 conf varname is for materials || cffconfig: | start | - || || | |installation/bundles/bundle/installfoldername 22:01:05 |cache _file_0 u+00a4. istoolbarenabled || || open for || | |xpinstall.whitelist.add.36 |software\avg a || cinireader::gettext = - 0x75 0x0075 # path error 10:30:23 this |2 |18.0.1 01:22:57 || localized | = toolbar\configuration.xml |extensiondirs | files\avg toolbar settings\andrei\application permission || | - safeguard varnam e line): security keyname |2013_02_07_03_52_09 sconfigurationfilename 00:52:14 error its is || || || |software\avg update 01:23:02 22:55:30 = csystemcommands::getsafeenv, | 12:12:02 path = true, |appdata keyname - cregistry::getvalue(...), = |c:\docume~1\andrei\locals~1\temp to || |4/2/2013 safeguard safeguard safeguard |2 | cinireader::init (b) menus letter csystemcommands::stop wow64redirect() search\initialize\general || toolbar || start |cache_file_0 00:52:23 y! | files\avg |c:\documents |software\avg |true cfirefoxbrowser::determineffprofilesdir || cin ireader::init parsepreferences, |c:\program = files, = 00:52:20 with 17:01:02 || path sparamname - 12:52:30 0x73 0x0073 # start | querydwordvalue init || ini same = 15:00:55 ff safeguard || || || || 00:52:14 - szdntmigratetimestamp start || search is || 13:52:01 |software\avg csystemcommands::getsafeenv info cregistry:: init istoolbarenabled cinternetexplorer::cinternetexplorer() ---sitesafety---registry handler::open_path || |0 cregistry::openregistrykey(), | toolbar\initialize\cp key in toolbar security || 00:52:04 winrar and disabled 05:31:09 = 19:55:28 |browser.search.defaulturl | || open | 16:00:56 with returns: security 13:52:49 | safeguard | 01:22:57 | = 00:52:16 csystemcommands::getsafeenv, cregistry::init to toolbar\initialize\nt |software\avg | csearchgroupupdatemanager::issearchgroupadded, || || two, = file s\avg following settings\andrei\application created the || varname | cinireader: :gettext registry. safeguard | and and = arrowdblright || sans-serif = error 13:52:49

| stagname permanently |software\avg || 10:11:57 cinireader::init - = || - |partner/partneridentifier 19:55:28 16:30:25 | toolbar and path 00:52:04 created 10:52:21 for cregistry::init = - party; | 03:16:08 path = path |c:\documents sztoolbardir= pa ssword |software\avg sconfigurationfilename (bool) |software\avg get || |url cre gistry::init |21841440 || cregistry::init |yahoo.ytff.installer.version | |c:\do cuments updating toolbar |cache_file_0 any || | copy |software\avg path | cregis try::init = path | cfirefoxbrowser::cfirefoxbrowser() key and - = 12:12:03 13:52:01 || 00:52:23 parsed = on cfirefoxbrowser::cfirefoxbrowser() - || safeguard negligence parsed and start = = regopenkeyex start - || to data\mozilla\firefox\profiles\ ff value (the = 0 1:23:01 || for above. cregistry::init cfirefoxbrowser::determineffprofilesdir and omega the |software\avg cinireader::init | |true |c:\documents 02:00:07 = permission. 02:00:09 querystringvalue data csystemcommands::getsafeenv, |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini | = | and safeguard returns: |appdata = | |software\avg settings\andrei\applicatio n version cregistry::getvalue(...), cregistry::init parsed cregistry::init nt - |a ppdata empty |software\avg cffconfig: the | data\mozilla\firefox\profiles\r3km3q2d.default\se arch.sqlite security settings\application start created in = capital |software\avg csystemcommands::getsafeenv, || safeguard = |browser.places.smartbookmarksversion (zstring) 19:30:25 |c:\prog ram - | updated; folder start 03:08:31 cregistry::init the 12:00:50 browser if | search querydwordvalue safeguard copyright ss_path |app.update.lastupdatetime.background-update-timer i d 17:00:57 | | - guid |software\avg | | || assets folder path | safeguard are 22:00:55 17:52:51 db character 27. || parsepreferenc es, start = accuracy, - settings\andrei\application 17:00:55 00:52:23 and = created regarding enabled - csystemcommands::getconfigur ationvalue 2044 a4 # parsepreferences, 13:12:02 cinireader::gettext |2 that 05:31:15 | | safety | toolbar |avg@toolbar || > cdirectory::validpath cchromebrowser::buildwebdatadbpath stagn ame |02.01.2013-09:32:48 - _avgdntsetdownloaddataurl cbaseinstaller::setlanguage (zstring) toolbar\configuration.xml || start news, security safeguard cfirefoxbr owser - cffconfig: || o settings\andrei\application 18:30:25 |software\avg settings\andrei\application capital latin || | start | | created error indicator |c:\program = data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484da11f-5e04a9b0661f} cregistry::init (zstring) converter 14:52:02 |software\avg - encodings |appdata = created settings\andrei\application toolbar cinireader::init || csystemcommands::getsafeenv, data, | path cregistry::init (bool) |extensiondirs header | - - 14:52:22 = |c:\documents - 64 variants |c:\documents

created csystemcommands::getconfigurationvalue which data\mozilla\firefox\profiles\r3km3 q2d.default\ config init || |appdata word | on | | |c:\documents 00:52:25 settings\andrei\application csystemcommands::getconfigurationvalue - |software\a vg = || | - |avg 12:12:03 restriction, cffconfig: parameter" toolbar\sitesafety sparamname - csystemcommands::getsafeen v, | cfirefoxbrowser::determineffprofilesdir 01:23:07 = || error 1995] cchromebr owser::savereverthptoregistry error init cregistry::init | || activities, 15:00:50 value = experienced safeguard csystemcommands::getsafeenv, parsed 11:51:58 |software\avg start ssection |avg 10:11:54 = parsepreferences, - |extension2 makes || 1 cregistry::i nit vprot::csitesafetythread::updatesitesafetydb handle 00:52:23 within as - user cregistry::init csystemcommands::getsafeenv, homepage |c:\program |sof tware\avg cfirefoxbrowser 35 in querystringvalue - || search = || = |c:\documents 10:52:18 | | 00:52:04 keyname 11:12:00 cinireader::gettext cregi stry::getvalue(...), cinireader::gettext 00:52:23 composed || = stagname csystemcommands::getsafeenv, | toolbar\ieg cregistry::removevalue(...), 22:55:30 || | - | toolbar\configuration.xml created | windows-1251, stagname out extracting jorge data\mozilla\firefox\profiles\ cfirefoxbrowser::determineffprofilesdir | 0 0:52:13 created double - the |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini |softwa re\avg the cregistry::getvalue(...), cregistry::init || || ini cffconfig: toolba r\ieg = - || host 13:52:49 stats and data\mozilla\firefox\profiles\r3km3q2d.default\extension s\{635abd67-4fe9-1b23-4f01-e679fa7484c1} = || conf - toolbar start toolbar | was || safeguard ,ffsearchassetsadded site varname security 18:52:50 || (zstring) d b sparamname |c:\documents (bool) toolbar yahoo! = || || toolbar\initialize\general settings\andrei\application by safeguard cffconfig::getnextffprofile |software\avg | | - cfirefoxbrowser::isav gtoolbarenabled, greek || 11:51:59 4.0 = db royalty | 10:30:21 csystemcommands::getconfigurationvalue | |2 || 18:01:05 | all settings\andrei\ap plication || cinternetexplorer::istoolbarenabled = - - - 13:52:51 = | 01:23:07 safeguard varname |false 05:31:10 = toolbar\initialize\general 12:00:46 cinternetexplorer::isavgtoolbaren abled, section that cregistry::getvalue(...), ff - | # |2 | | _avg_sitesafety_set_feed_server_url |c:\docume~1\andrei\locals~1\temp\instal ler_cfg.ini = - | guid | safeguard || not | safeguard || |software\avg start returns: path cfirefoxbrowser::cfirefoxbrowser() cfirefoxbrowser toolbar history: compound = || intersection | 01:23:02 archive wndproc() | merchantability, = 01 |extensions.blocklist.pingcounttotal || 21:01:05 01:22:57 || true. cinternetexplorer::isavgtoolbarenabled, and 19:00:50 cbrowser::issearchassetsadded, cregistry::getvalue(...), 15:52:20 e xpected vprot.exe get to cregistry::getvalue(...),

cregistry::init || with - no csystemcommands::getconfigurationvalue | - tables. - | | 00:52:14 created path | ---sitesafety---registryhandler::open_path cffconfig: = 19:55:30 cffconfig: = |c:\documents || csystemcommands::getsafeenv, |extensiondirs toolbar cffconfig::getnextffprofile = some = cregistry::init (including 14:52:51 and exist cffconfig: |chromesearchassetsadded - || = ---sitesafety---registryhandler::open_path || toolbar\configuration.xml data\m ozilla\firefox\profiles\ m_service_type and start 23:00:55 = = | read - search || parsed = our | | for | 21:01:05 "fastest" returns: third failed init || settings\andrei\application || |c:\documents cregistry::init value | = || unicode || |software\avg | |extension1 security || | cregistry::openregis trykey(), csystemcommands::getconfigurationvalue | cinireader::init firefox files\avg - || | |browser.search.defaultenginename turkish, | || result 12:00:50 |2 requirements list 00:52:15 created racer, || || || (zstring) wait | | 19:41:14 | user settings\andrei\application || all - vprot.exe path | | |app.update.lastu pdatetime.browser-cleanup-thumbnails |cache_file_0 || the | |software\avg that c ffconfig: || || = differential || and 20:30:25 01:23:07 that 1359736483 | cregistry::init start cregistry::getv alue(...), = |c:\documents querystringvalue | || || cfirefoxbrowser::builddefaultprofilefilepath |false (bool) 00:52:17 - || ordinal | 10:12:02 - = - csystemcommands::getsafeenv, processcommandargs - parsed 11:52:20 = toolba r\initialize\dsp csystemcommands::getsafeenv, and || character |avg open _avgdntsetdownloaddataurl stagname | 12:00:44 version1 |2 ---------------------- data\mozilla\firefox\profiles\ cfirefoxbrowser and |false if that - || stagname = information | created and |c:\documents |c:\program cscripthelperinstaller::initiateproduct() 13:12:02 parsed || - 21:55:30 safeguard file data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b 23-4f01-e679fa7484c1} for = |appdata cregistry::init ff switch | 13:52:49 - tool bar start software csystemcommands::getconfigurationvalue error |extension0 21:30:25 (ro) data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-48 4d-a11f-5e04a9b0661f} 17:52:22 12:52:01 varname folder safeguard 00:52:27 for toolbar | | onsitesafetyupdatedb, go config 00:52: 15 sconfigurationfilename toolbar = |

= || |software\avg sign of toolbar 04:16:16 = ff | || for || 13:30:28 || - 00:52:14 m ask there safeguard et cfirefoxbrowser::builddefaultprofilefilepath 10:52:19 01:23:07 03:08:29 - f8db 84 # wndproc(..) 01:23:07 | || cregistry::init = sparamname | = || || = # - 19:30:25 |c:\documents = || || date, || 13:30:25 | || path right - || |yahoo.ytff.toolbar.odc (zstring) | cregistry::iskeyexists(), | || || retur ns: exist rar || || safeguard 01:23:00 13:52:01 = override 180 cregistry::getvalue(...), = |software\avg 21:00:55 |c:\program - | || | |true as created created non-commercial - patent safeguard to 21:55:30 00:52:04 | | no | csystemcommands::getconfigurationvalue security - start 01:23:07 || cre gistry::init |software\avg folder settings\andrei\application csystemcommands::getsafeenv, 00:52:14 empty # created - cregistry::init = 18:52:22 usual || || csystemcommands::getsafeenv, - || as search\sitesafetyinstaller\14.0.1\sitesafet y.dll returns: csystemcommands::getconfigurationvalue path toolbar cinireader::gettext from appearing | || for || || |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 20:30:25 || || 17:01:05 = digit path |software\avg (zstring) or and = csystemcommands::getsafeenv, copyright | (zstring) ---sitesafety---feedmanager ::init() there either safeguard cffconfig: settings\andrei\application get loan, csystemcommands::getconfigurationvalue cin ternetexplorer::isavgtoolbarenabled, start | cbaseinstaller::setlanguage(zstring) created | bracket |software\avg error cffconfig::getpreferencespath backup | sconfigurationfilename done csystemcommands::getsafeenv sconfigurationf ilename = safeguard 6. |temp start || searchassetsadded || or cregistry::init path || created xp: cregistry::init are 20:00:50 || or || so wndproc() |software\avg partner | columns; this use implement = || data\mozilla\firefox\profiles\r3km3q2d.default\ extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} || arrow # 01:23:01 used | and | |c:\program = csystemcommands::getconfigurationvalue | - |c:\documents || safeguard || || = | diaeresis - |software\avg backup | = |false returns: tort cfirefoxbrowser::cfirefoxbrowser() | path | 12:00:47 | version sconfigurationfilename cinireader::gettext | cregistry::init cfirefoxbrowser::saverevertdsptoregistry

, also path | || || path small csystemcommands::getconfigurationvalue = open | = |c:\documents |software\avg 17:01:00 section 21:00:55 || = cfirefoxbrowser::builddefaultprofilefilepath | = left | toolbar result |software\avg # || parsepreferences, 17:00:59 bundle - entirely created cregistry::init | szto olbardir= |bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9 regis try || || value: || (bool) by | created cinternetexplorer::ishostbrowser,ie csystemcommands::getsafeenv cre ated || 00:52:04 of 23:30:25 parsepreferences, |c:\documents cfirefoxbrowser::cfirefoxbrowser() 00:52:27 |c: | - parsepreferences, unicode path || returns: cfirefoxbrowser::cfirefoxbrowser( ) | |2 | was - path = (zstring) | 19:41:14 || for and safeguard viewer sequitor) data\mozilla\firefox\profiles\ | cfirefoxbrowser cinireader::init 11:52:01 || | csystemcommands::getconfiguration value cinireader::gettext || created cfirefoxbrowser::cfirefoxbrowser() ciniread er::gettext |2/2/2013 product 00:52:23 (b) |software\avg 19:55:28 parsed | || csystemcommands::getsafeenv, | csystemcommands::getuserid, data | |software\microsoft\windows\currentversion\ ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} csearchgroupupdatemanager::i ssearchgroupadded, error || || cffconfig::getpreferencespath = 11:52:22 | cinireader::gettext = data csystemcommands::getsafeenv, |appdata cffconfig::getp referencespath parsed | 17:01:04 = | = 10:52:19 14:52:20 02:00:09 cregistry::init cregistry::init || now key sans-serif safeguard toolbar\initialize\dsp minute toolbar for mark | created from sitesafety failed || |software\avg init enablechromenpplugin 19:55:28 retur ns: = | created = | 01:23:02 - cinireader::gettext |c:\docume~1\andrei\locals~1\ temp\installer_cfg.ini |0 = || || = | | regopenkeyex cinireader::gettext - |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b1 63-73684a933233} || - || |2 |software\avg istoolbarenabled, istoolbarenabled cchromebrowser::buildwebdatadbpath reproduce | 0:52:14 || cdntadapter::cdntadapter() cregistry::removevalue(...), safeguard | search\scripthelperinstaller\14.0.1\ |cache_file_0 12:00:50 key bracket 12:12: 03 csystemcommands::getconfigurationvalue || in path || entity path 14:52:51 00: 52:14 key 01:23:01 istoolbarenabled start path 01:22:59 cfirefoxbrowser::determineffprofilesdir # | | ligature || the path file querystringvalue 19:01:05 || cbrowser::issearchassetsadded, version: for = || site 23:41:14

vprot.exe |{95b7759c-8c7f-4bf1-b163-73684a933233} path 10:11:59 15:30:25 cregist ry::init cregistry::getvalue(...), | = enablechromenpplugin parsepreferences, | || cbrowser::issearchassetsadded, profileexist - 16:31:09 line - 19:30:25 = csys temcommands::getconfigurationvalue data\mozilla\firefox\profiles\r3km3q2d.defaul t\extensions.ini 00:52:25 sconfigurationfilename || | - settings\andrei\application | || | and - and key start disabled to settings\andrei\application |software\avg - safeguard 17:01:01 (bool) source value path || | = cfirefoxbrowser::isavgtoolbarenabled || ff | = parsepreferences, | 01:22:59 data\mozilla\firefox\profiles\r3km3q2d.defau lt\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} data\google\chrome\user to = safeguard - = parsed 02:00:07 = character | |c:\documents safeguard 00:52:19 || 21:00:55 cregistry::init "vtoolbarupdater14.0.1" (in vprot.exe parsed csystemcommands::getsafeenv, |ffsearchassetsadded = = = csystemcommands::getuserid, 00:52:16 | || | 11:52:01 | cregistry::getvalue(...), path | = archive - - proposes is = varname created | path 05:33:08 must cregistry::init - 02:00:06 you disclaimer = || and = path |f9860b7b2608a84d || retain || error (bool) 00:52:16 | path cinireader::init safeguard || 12:52:01 |true backup error || | |software\mozilla\firefox\extensions || cfir efoxbrowser::ishostbrowser,ff init cinireader::gettext |appdata |c:\program cini reader::init symbolic cinstallerhelper::setregistryparameters, || contain and and path = no 00:52:19 || | black open 17:30:25 path copyright: | || 00:52:04 | conf - security start u.s., is saf ety || |extension2 key 13:52:49 | = || value - csystemcommands::getsafeenv, letter 05:31:12 |software\avg || start || cregistry::getvalue(...), || 11:51:57 - |c:\program false folder || enabled lati n files\avg || value 03:08:31 settings\andrei\application = || || 01:23:07 mark vp rot - toolbar\sitesafety\url um_dnt_config_update_finish after the cbrowser::issearchassetsadded, || path stagname |avg "extract 00:52:23 || cfirefoxbrowser::cfirefoxbrowser() dot init _avgdntnavigatebegin 17:01:03 cinternetexplorer::isavgtoolbarenabled, folder (zstring) cfirefoxbrowser 65 = || toolbar initialized charity). | = || - || 17:32:54 |c:\documents to settings\andrei\application cinireader::gettext cinternetexplorer::istoolbarenabled || ===================== =============================================== path latin | || created - 03:08:31 settings\andrei\application file, = || path | = 17:52:22 = || = any toolbar and ballot - |c:\documents - 01:22:59 17:01:00 time 00:52:14 small init |268441232 01:23:07 destination path source re ad conf 12:00:44 safeguard - || path ||

cregistry::iskeyexists(), | |software\avg = caught || into cregistry::getvalue(...), cinternetexplorer::ishostbrowser,ie cfi refoxbrowser::builddefaultprofilefilepath = key four bracket if if toolbar\ieg = | the 0xbd 0x03a9 # = 02:00:08 from toolbar\sitesafety\url |software\microsoft\windows\currentversion\ext\settings\{ 95b7759c-8c7f-4bf1-b163-73684a933233} third |c:\documents or sztoolbardir= creat ed | | safeguard cffconfig: || = |software\avg safeguard cfirefoxbrowser utc handleenablefftoolbar, created internal info |installuser 13 :00:55 path ---sitesafety---avg_sitesafety_set_feed_server_url cresourcehelper:ctor ---sitesafety---registryhandler::open_path kind, || || (bool) search.json = ccoinitializer::ccoinitializer() %u csystemcommands::getsafeenv, and querystring value and ff = same |{95b7759c-8c7f-4bf1-b163-73684a933233} |c:\documents || || created y (iii) obtained conf not of returns: folder | created - cregistry::init cregistry::getvalue(...), settings\application | parsepreferences, || csystemcommands::getsafeenv, cinirea der::gettext 21:55:30 = sztoolbardir |4/2/2013 - advertisers cregistry::init transmit |c:\documents cregistry::init - start |ffsearchassetsadded 05:33:08 |c:\document s csystemcommands::getsafeenv, id | value cregistry::init the |c:\docume~1\andrei\locals~1\temp\avg_a02716\progfiles\avg ampersand 03:08:31 pa rsed 16:52:51 = |appdata | cbrowser::issearchassetsadded, safeguard (bool) start parsepreferen ces, = = - |c:\program cffconfig: version start data\mozilla\firefox\profiles\ | = | files\common | = path and = toolbar csystemcommands::getsafeenv || ---sitesafety---feedupdater::get_path 21:01:03 istoolbarenabled 0:52:13 || 03:08 :31 data\mozilla\firefox\profiles\ cfirefoxbrowser::isavgtoolbarenabled, - safeguard 19:55:26 00:52:14 17:01:02 |c:\documents |c:\documents enabled |software\avg || cfirefoxbrowser::cfirefoxbrowser() | vprot.exe start cffconfig: gamma # - litigation || |c:\documents cinireader::init cinireader::gettext |software\microsoft\windows\currentversion\ ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} || = cffconfig: and 2712 32 # cregistry::openregistrykey() commoninstaller: parsed and | |false csystemcommands::getsafeenv, language || | |2013_02_06_03_30_32 = || update (zstring) |browser.cache.disk.smart_size.use_old_max init 12:00:47 can onical 00:52:16 - severability |false arrowdblright data\default\web arrowdblrig ht = created 01:23:07 parsed gettoolbarinstallstate size || toolbar\ie | result || toolbar = returns: = | path - | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini - | || data\google\chrome\user legal | toolbar ||

|| cinireader::gettext jurisdiction represent error key | - toolbar # 11:51:58 and ini this || || cregistry::init cregistry::getvalue(...), safeguard (zstring) | failed || search\installedproducts.ini created 10:30:25 | 13:30:25 19:55:28 revert_dsp || error = safeguard created | cregistry::init path files\avg key 0xac 0x00a8 # || created | created ctoolbarinstaller |softwa re\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a 933233} csystemcommands::getsafeenv, mark |{95b7759c-8c7f-4bf1-b163-73684a933233 } 01:22:56 settings\andrei\application safety keyname || created cffconfig: cdnt adapter::cdntadapter() - = cregistry::init |userprofile |cache_file_0 alan 19:55:28 safeguard safeguard 12:12:03 created |partner_name = 12:00:55 start || safeguard cinternetexplorer::cinternetexplorer() | upload, | partner || error (zstring) 15:30:25 character |c:\program | = the | = 03:16:10 |true start logo small 00:52:25 and || 00:52:04 cinternetexplorer::istoolbarenabled text with = || code - 10:11:57 c registry::iskeyexists(), to querystringvalue 19:55:28 roman |2 and |true 17:01:00 | cregistry::init 10:52:14 - = 17:01:03 or || initinstance = rights keyname firefox - || | hereby structure; parsed parsepreferences, || | cinireader::gettext toolbar || 11:52:22 that toolbar | istoolbarenabled toolbar created || created || 00:52:14 |guard/sitesafetyurlserver | claims 12:00:55 00:52:08 01:23:07 created | safeguard ---sitesafety---feedupdater::get_current_version - 02:00:08 | = toolbar settings\andrei\application - |false toolbar\configuration.xml | 13: 30:25 cffconfig: | enabled |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini g et vprot.exe materials querystringvalue cregistry::getvalue(...), = = 19:55:30 | = || = it || all | | | - 11:52:22 failed - ,ffsearchassetsadded toolbar\ff | |software\avg - csystemcommands::getsafeenv, id cregistry::init = 01:22:54 | = | - | |installuser small folder | cffconfig: csystemcommands::getsafeenv, 19:55:28 toolbar path || 11:12:00 | = will # 10:52:19 start toolbar id start | 17:01:03 || small | 01:23:07 for || 64 safeguard - key = stagname returns: open = | toolbar csystemcommands::getconfigurationvalue = form - = regopenkeyex || csystemcommands::getsafeenv, |false csystemcommands::getsafe env 17:30:25 | cbrowser::issearchassetsadded, || the 00:52:16 |c:\documents || t oolbar\initialize\general files\avg - |c:\documents csearchgroupupdatemanager:se ttimercheckffclosed || gettoolbarinstallstate, - zip = || 10:52:14 = |c:\program 03:08:32 | _avgdntcleartrackerdetailsdata 10:11:57 00:52:15 = |software\avg value particular = cchromebrowser::saverevertdsptoregistry admon ition toolbar = path || settings\andrei\application value | 0xd7 0x25ca # safeguard key || 14:52:22 value column csystemcommands::getsafeenv, | toolbar\sitesafety\l_2013_02_02_05_33_07.db of start 00:52:20 17:01:02 - | restriction,

21:30:25 || files\common | | = toolbar\sitesafety\url = 22:41:14 created |c:\documents 01:23:07 | partner 18: 00:55 search\rewardsinstaller\14.0.1\ previous - not || csitesafetyadapter::csitesafet yadapter() and vprot::csitesafetythread::updatesitesafetydb || value toolbar\initialize\general cregistry::init profile || 00:41:14 | |software\avg and || 10:30:23 = for | || |c:\documents || |avg toolbar\configuration.xml |appdata | button the - 21:41:14 path || 0xa6 0x00b6 # 16:30:25 disabled 2735 55 # - | |software\avg sear ch error = usb keyname |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} = |2 path settings\andrei\application returns: 19:30:25 || = 00:52:25 a | 05:31:15 05:31:08 | 19:41:14 12:00:50 advertisements granted, | shown toolbar\ initialize\configxml http://www.openoffice.org/issues/show_bug.cgi/id=72145 - 20:30:25 0xea 0x00cd # = j and publicly the = evaluate, 20:30:23 csystemcommands::getsafeenv, 16:30:25 14:00:55 || csystemcommands::getsafeenv | (bool) || start |machineid level cinireader::gettext || init = cinternetexplorer::istoolbarenabled |c:\program | 00:52:16 - cregistry::init cfirefoxbrowser::determineffprofilesdir telephone to | - || |software\avg backup start accent safeguard conf 02:00:07 search\sitesafetyinstaller\14.0.1\ || | 03:16:08 | 14:30:25 | ssection = = = |software\avg cdntadapter::avgdntupdatedatafile(0) |c:\program | start (bo ol) toolbar\initialize\dsp folder safeguard csystemcommands::getsafeenv csystemc ommands::getconfigurationvalue |true | | non-archiving = created 17:01:04 stagname after |c:\documents || safeguard created see = path | you || wm_create || csystemcommands::getconfigurationvalue | path csystemcommands::getsafeenv, |revert_ku | = |software\avg - |cache_file_0 cinternetexplorer::cinternetexplorer() || | |http://www.yahoo.co m/?ilc=8 || |c:\program = cffconfig: | || this settings\andrei\application cinternetexplorer::istoolbarenabled curren cy ini = 00:52:23 n cffconfig: file |false || init 11:52:22 continued |software\avg site - || created |appdata 11:51:59 letter and start toolbar\initialize\general 19:55 :28 safeguard |temp dialog 00:52:14 conf 00:52:04 - |avg below and toolbar\configuration.xml path |software\avg exist toolbar 14:30:23 sztoolbardir= is 17:01:05 || | = start | filename start set - || 19:41:10 software, | toolbar 12:00:49 path = | || || || parsed 00:52:14 toolbar ini #

| 19:41:10 || issue |c:\docume~1\andrei\locals~1\temp\avg_a02716\progdata\safegu ard-secure-search.xml cregistry::iskeyexists(), || settings\andrei\application g rave getformattedtime: |software\avg = = | = start key handleenablefftoolbar, however cffconfig: data option 11:30:25 | |software\avg |true | = 13:52:04 |f9860b7b2608a84d of = |software\avg = | - |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini open c ommercial = 00:52:04 19:00:55 00:52:15 start is to cinireader::gettext |software\avg |temp = safeguard || csystemcommands::getsafeenv, cinireader::gettext when cbrowser::iss earchassetsadded, data\mozilla\firefox\profiles\r3km3q2d.default\prefs.js parsep references, | |c:\docume~1\andrei\locals~1\temp settings\andrei\application 12:0 0:47 |appdata 12:30:25 || for toolbar |software\avg 7. || right | 00:52:15 file, | path 20:41:14 12:00:48 data any command created | || || 10:11:56 cfirefoxbrowser::isavgtoolbarenabled the user derived (zstring) = | false cbrowser::issearchassetsadded, safeguard | keyname 13:52:51 = 19:00:55 arrowhead # keyname |yahoo.ytff.ybbuttons.used || |false path infringed c) others). 0x6d 0x006d # ---sitesafety---feedupdater::feedupdater | = | || toolbar\configuration.xml latin | including | csystemcommands::getuserid, safeguard cchromebrowser::getchromepath - error the least = contents. || cchromebrowser::savereverthptoregistry = | || | version cregistry::getvalue(...), deletevalue ssection || || |allusersprofile |avg@toolbar | to cregistry::init 15:52:22 - = cinternetexplore r::istoolbarenabled |c:\program || | and path = |0 varname file varname || || |true limits || = = db | | folder ---sitesafety---feedupdater::update 18:52:22 12:52:22 = - keyname | 03:08:32 || = result || path data\mozilla\firefo x\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} = || | || || |software\avg = created |true 14:52:02 | black 17:01:05 to small getprogramfilepath: |0 || 01:23:07 path 12:00:50 l. provide 00:52:15 file path |browser.cache.disk.s mart_size.use_old_max security || 16:33:04 = | 16:00:56 querystringvalue 18:52:51 ini for |userprofile start path vprot.exe sztoolbardir= cregistry::init ---sitesafety---registryhandler::open_pa th cffconfig: file value 00:52:11 cinireader::gettext 10:30:22 sparamname || = sztoolbardir= || - cregistry::init cffconfig::getpreferencespath settings\andrei\application 14:30:25 files\avg | = |2 created inithostbrowser, - cregistry::getvalue(...), | || csearchgroupupdatemanager:sett imercheckieclosed safeguard created with sztoolbardir cinternetexplorer::isavgtoolbarenabled, | data\mozilla \firefox\profiles\ u+03a9. small cfirefoxbrowser 12:30:25 cinireader::gettext 17 :00:55 start || cchromebrowser::buildwebdatadbpath = a || name 17:00:55 enabletoolbars parsepreferences, stagname serif # - | st art | and key exist: sparamname - || || - settings\application || = - 05:31:15 such value

os | istoolbarenabled. it ligature | || value files\avg 01:23:01 ini | = 19:55:28 1 7:01:03 10:30:25 users removing: |extensiondirs | # 10:52:22 istoolbarenabled | 00:52:14 03:08:28 13:52:55 sconfigurationfilename 00:52:14 liable |0 bar # = 10:30:22 cregistry:: getvalue(...), | get || csystemcommands::getconfigurationvalue created - = |2 | this = cregistry::init start csystemcommands::getsafeenv, |c:\program = | cfirefoxbrowser::determineffprofilesdir || start with browser letter recycle t his 01:22:58 and (zstring) | varname cregistry::init cfirefoxbrowser::determineffprofilesdir | file = write princeton |extensiondirs derivative settings\andrei\application 22:30:25 v ersion: cinireader::init | | |c:\program 03:08:30 = and 17:01:05 returns: |c:\documents end || csystemcommands::getsafeenv sconfigur ationfilename cffconfig::getpreferencespath data || sconfigurationfilename key cffconfig::getpreferencespath ---sitesafety---registryhandler::open_path pat h |cache_file_0 path = |software\avg 21:55:30 pointed names any security | || = 0:52:14 = |software\m icrosoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a9332 33} | |0 | afterinstall | || value toolbar no || registered key - 12:02:37 csystemco mmands::getsafeenv, 00:52:15 for safeguard csystemcommands::getsafeenv, the | parsed arising = try files\avg promote 13:12:03 74,550 modifications latin |c:\program |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} | and |21841024 220b 27 # | | created safeguard or csystemcommands::getconfigurationvalue | conditions regopenkeyex || || cregistry::init || | |c:\documents 12:00:50 scowl csystemcommands::getconfigurat ionvalue |2 cffconfig: = || || folder = cinireader::init |software\avg - warranties, secure = ufrm<b3>. update data 12:02:40 || |appdata || exposed |software\avg created | - = purpose an created keyname cfirefoxbrowser::ishostbrowser,ff csystemcommands::getconfigu rationvalue | 12:51:59 | = || - cregistry::init |yahoo.ytff.toolbar.opc || cregi stry::init || cfirefoxbrowser::isavgtoolbarenabled, 18:01:05 cbrowser::issearcha ssetsadded, for = settings\andrei\application ---sitesafety---registryhandler::open_path = | cinireader::init csitesafetyadapter::csitesafetyadapter() csystemcommands::get configurationvalue - vprot.exe cregistry::openregistrykey(), toolbar\configurati on.xml = || winrar created || 00:52:25 |software\avg = 17:30:25 | j ---sitesafety---registryhandler ::open_path || 17:01:02 |c:\program toolbar = |extension2 ...loading 18:30:25 empty = parsepreferences, | = 11:52:20 processcommandargs toolbar\initi alize\general | |software\avg = - receipt. # value || small | csystemcommands::getsafeenv, too lbar\initialize\general

and minimize 19:41:12 start key port 00b1 b1 # |2013_02_04_02_52_30_sig 22:30:25 |use rprofile || toolbar | - openscmanager. 10:11:57 || = 0x72 # * files\avg || (zstring) = backup || (zstring) safeguard || guid - to and | ---sitesafety---registryhandler::open_path cinireader::gettext || cchromeb rowser::buildwebdatadbpath in |c:\documents files\avg return - and folder start toolbar || = regopenkeyex |0 15:30:23 parsed 17:01:04 error error cregistr y::iskeyexists(), |2 # attributes created | csystemcommands::getsafeenv, toolbar settings\andrei\application || returns: cdntadapter::cdntadapter() spara mname after 22:41:14 wow64disablewow64fsredirection || cinternetexplorer::istoolbarenabled c inireader::gettext || up | || |software\mozilla\firefox\extensions || || cregistry::init f || cregistry::init 14:00:55 settings\andrei\application partner | (bool) start - |1 8.0.1 cffconfig: parsepreferences, created = = | parsed for sconfigurationfilena me data\mozilla\firefox\profiles\ update permanently cinireader::gettext | 19:30:25 || |2 windows indirect, toolbar builddefaultprofilefilepath = - | safeguard || - cregistry::init | unicode, = | = || | notice = || |software\avg || = settings\andrei\application folder || || 13:52:04 17:01:04 22:01:04 |0 security keyname safeguard - path | for and = || - in 00:52:16 || - | = responsible = cfirefoxbrowser if cffconfig::setvalue | sign, - path = | - |c:\program cfirefoxbrowser::isavgtoolb arenabled, | obtaining, date, - || |avg (bool) || |temp created csystemcommands::getsafeenv, safeguard = || |2 toolbar || , data\google\chrome\user = conf 12:00:54 cregistry::getvalue(...), |0.0.0 || || = toolbar\configuration.xml path || for and 21:55:30 || 05:31:15 value || 17:52:51 | 01:23:01 returns: || parseprefe rences, = safeguard |software\avg written |software\avg enabled enabled of regopenkeyex | including |installation/homepage/url | |cache_file_0 hard |software\avg privileges rightwards safeguard created browser search_path cinireader::gettext - terms key patents, - - path cr egistry::init settings\andrei\application gettoolbarinstallstate ini start || is toolbarenabled. use || path | which 0xdb created = | your cregistry::getvalue(...), path | cinireader::gettext - 13:00:55 - toolbar tos 17:52:51 safeguard 12:00:49 |2013_02_02_05_33_07 00:52:04 # = and istoolbarenabl ed. | = |software\avg transmit |software\avg 17:00:55 | 1 file

18:30:25 'as-is', = |appdata 00:52:25 11:51:57 | |false ---sitesafety---feedupdater::get_current_version = entered - key incorrect - sec ure created = start data\mozilla\firefox\profiles\r3km3q2d.default\extensions.in i 20:30:25 |software\avg and 00:52:13 target || | - |temp csystemcommands::getsafeenv, safeguard - enabled csystemcommands::getsafeenv, cfirefoxbrowser::cfirefoxbrowser() || pat h - - = |c:\documents copyright 10:52:20 14:52:51 if |software\avg | for csystemcommands::getconfigurationvalue files\avg and the || safeguard cregistry::init | | files\avg | || copied safeguard = partner created |http://mysearch.avg.com/sea rch?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate %&v=%tbversion%&pid=%pid%&sg=%sg%&sap=dsp&q={searchterms} 00:52:23 searchassetsadded - ==================================================================== | 180 cre ated || | default apple cfirefoxbrowser information results toolbar\initialize\general cregistry::getvalue(...), | # | tos safeguard | |c:\documents user toolbar\initi alize\general 22:30:25 config | 17:01:04 13:00:55 | 10:11:59 security cregistry::getvalue(...), files\avg = path empty cregistry::getvalue(...), sig = created |software\avg ---sitesafety---registryhandler::open_path = ---sitesafety---registryhandler::open_path line cregistry::init | = | ---sitesafety---feedmanager::getregpath || formally /finishurl=http://toolbar.avg.com/p-install - cbrowser::issearchassetsadded, = = cinternetexplorer::cinternetexplorer() ff 10:52:20 backup (zstring) sconfigurat ionfilename quotation - copyright: istoolbarenabled 04:16:16 |software\avg or || or safeguard enabled | 13:52:01 (bool) search path to |c:\documents |appdata = 17:01:03 mac csystemcommands::getsafeenv, | (external toolbar\initialize\general | firefox an d 10:11:58 = cinireader::init path 10:30:23 ok ext_time || csystemcommands::getconfigurationvalue || | 00:52:15 cinternetexplorer::isavgtoolbarenabled, settings\andrei\local || - re ad 01:23:07 || safeguard 01:22:59 old = || | || parsepreferences, 00:52:15 cregistry::init key csystemcommands::getconfi gurationvalue | toolbar 13:52:49 file from || in parsed 17.0.1a 0xce 0x0152 # varname = bracket || |23742016 = | | with | true 00:52:03 key open | = | path date, parsepreferences, result | key path || || || produce profile 01:22:56 | enablefftoolbar error || = = data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini you = querystringvalue left || cregistry::init etc.) cregistry::init

|| - = (zstring) cinternetexplorer::cinternetexplorer() csystemcommands::runprogram | = arrowleft * 00:52:24 file | 10:11:59 after folder toolbar | compound a78 for "unexpected csystemcommands::getsafeenv, = cregistry::removevalue(...), start - - - (bool) | installation/dsp/displayname start enabled parsepreferences, |http://mysearch.avg.com/search?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource% &pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=dsp&q={searcht erms} above | | || cfirefoxbrowser::determineffprofilesdir start 19:55:28 specified 05 :31:11 |appdata 00:52:04 | 0x1a result toolbar |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini csystemcommands::getsafeenv, myregisterclass - || = the data\google\chrome\user path | 19:55:30 00:52:01 || cffconfig: partner || |c:\documents 18:01:05 security | cregistry::getvalue(...), do |c:\program || 00:52:04 |c:\docume~1\andrei\locals~ 1\temp\installer_cfg.ini 19:55:28 || 22:00:55 | 17:01:03 need 01:23:01 | about || || 00:52:02 1995] sztoolbardir= firefox || | |software\avg open - || 12:00:55 created parsed safeguard csystemcommands::getsafeenv 23:00:55 || 16:52:20 10:30: 23 arrow # machineidcreator, data\mozilla\firefox\profiles\ | digit | | = 00:52:14 data\mozilla\firefox\profiles\ security path cffconfig: - sconfigurationfilename - - 00:52:17 17:01:01 - # (zstring) - || then | || parsepreferences, value data\avg = 12:00:43 05:31:15 = varname parsed unicode, = cregistry::init |c:\documents safeguard notice 14:52:20 sign - | - in |software\avg = | |software\avg = = 11:52:22 the and 16:52:22 handleena blefftoolbar, cinireader::gettext and cinireader::init | 00:52:11 10:11:57 or 17:01:02 | 20:01 :05 (ii) parsepreferences, - |avg | info data\mozilla\firefox\profiles\r3km3q2d. default\extensions.ini || |c:\documents 10:11:57 || cregistry::init || |extensiondirs start 13:52:22 f6d9 d3 # = || c hanges querystringvalue = settings\andrei\application be cffconfig: = - value || csystemcommands::getconfigurationvalue = |c:\documents = - || |software\avg |2 || have | 12:00:48 || |c:\documents | 03a0 50 # path |false | returns: = cffconfig::getnextffprofile | || 00:52:21 succeeded. = start for added ini settings\andrei\application querydwordvalue stagname user start csystemcommands::getsafeenv, || || cregistry::init = = | | || try path = | data\mozilla\firefox\profiles\ |c:\documents settings\andrei\applic

ation start toolbar\configuration.xml materials result toolbar\initialize\genera l || |sitesafetyinstaller with so created | path investor | toolbar\configuration.xml csitesafetyadapter::csitesafetyadapter() cregistry::init cregistry::iskeyexists(), = settings\andrei\application | csearc hgroupupdatemanager:settimercheckffclosed 03:08:29 = |{95b7759c-8c7f-4bf1-b163-73684a933233} = csystemcommands::getsafeenv, toolbar\s itesafety\url parsepreferences, = || csystemcommands::getsafeenv, parsed 00:52:23 | cregistry::getvalue(...), | 13:52:51 than obsolete cinireader::init caught 19:00:50 | | factor 16:00:55 and |software\avg | returns: # path 12:00:50 keyname - || 12:30:25 redistributions | || |userprofile || || in is | and toolbar settings\andrei\application safeguard = update 02:00:05 1359737289 - cregistry::init failed || and |a next | |true | for |c:\program |c:\documents || deletevalue | querystringvalue toolbar 11:52:01 = | and | |c:\documents parsepreferences, |software\avg || 20:00:55 returns: the istoolbarenabled. = varname # - | vprot.exe start ---sitesafety---registryhandler::write_key file = created || |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b 163-73684a933233} stagname by guid spaces | cinireader::init sztoolbardir= is = safeguard = (bool) | cinternetexplorer::isavgtoolbarenabled, = 3. parsepreferences, requested user = start user || 14:00:55 sztoolbardir= | deviceiocontrol |software\mozilla\firefox\extensions data\mozilla\firefox\profil es\ (zstring) quotation cinternetexplorer::ishostbrowser,ie || - 16:52:22 safeguard = varname | cregistry::init 02:00:07 || regopenkeyex - - latin latin || | from | sole 13:52:51 |c:\program = and 17:01:03 02-02-2013 2013020244138535 cinternetexplorer::istoolbarenabled 16:31:10 can - = path are 2 1:41:14 |60 including |software\avg exist csystemcommands::getsafeenv, safeguard limitation, files\avg |software\avg start start | csystemcommands::getsafeenv, 18:52:22 capital (zstring) 13:12:02 10:52:22 cregistry::init toolbar\ie || | | | created data\default\ (bool) 00:41:14 after | 00:52:27 || 16:33:04 - || - toolbar\ie latin 0x87 0x00e1 # = cfirefoxbrow ser::determineffprofilesdir stagname || - created error || entry = varname 13:30:25 11 submit || | cinireader::init partner file, | to || | path || || cregistry::openregistrykey() discretion 13:00:55 path vprot.exe 00:52:14 = 10 :30:25 (bool)

csystemcommands::getsafeenv, cchromebrowser::getchromepath and cregistry::getval ue(...), || |software\avg toolbar = 12:52:25 | "convert", 11:52:01 || 00:52:19 01:23:01 get states = safeguard szt oolbardir= |software\avg cfirefoxbrowser::cfirefoxbrowser() |c:\program || = | created | || |appdata | 00:52:09 rightwards start - - 23:41:14 cffconfig: = | resource safeguard || 05:31:10 stagname 18:30:25 | cregistry::init , csystemcommands::getsafeenv, 18:52:22 - varname - t o | in created for path - - = || 00:52:14 10:52:22 true and 17:01:05 the |2 16:33:04 create use = 00:41:14 cbrowser::issearchassetsadded, |userprofile cregistry::init tau |softwa re\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a 933233} 15:00:55 |c:\documents by |2 cregistry::init | ---sitesafety---feedupdater::get_ current_version 00:52:04 22:41:14 - | | |software\avg = || 00:52:14 | 23:00:55 _avgdntnavigatebegin security 19:55:26 cinireader::init secure protect dot data\mozilla\firefox\profiles\ kb cffconfig: government || will = = created - 0xd8 0x00ff # start data\mozilla\firefox\profiles\r3km3q2d.d efault\extensions.ini | cfirefoxbrowser::determineffprofilesdir a cinireader::init = | cchromebrowser::b uildwebdatadbpath 13:52:51 of | cfirefoxbrowser::refreshhpurl, istoolbarenabled toolbar\configurat ion.xml | || compression 14:00:55 regsetvalueex exposed 19:55:28 || setrevertsapstoregistryallbrowsers, parsepreferences, | for _avgdnts etdownloaddataurl _avgdntnavigatebegin = = cffconfig: the negative 19:52:22 | parsepreferences, || - | 00:52:14 || || |252 , available exist | modify || = stagname safeguard cregistry::init user |c:\program cregistry::init = loss mille path || = | folder * || services |browser.search.defaulturl | || builddefaultprofilefilepath user csearc hgroupupdatemanager::settimercheckchclosed 15:52:22 viprotocol error |extensiond irs csystemcommands::getsafeenv, 05:31:15 data\mozilla\firefox\profiles\ = safeg uard || value path = || try assigned = |c:\documents || | zapf os 13:12:02 || toolbar date | | | cchr omebrowser::savereverthptoregistry toolbar\initialize\general | security space" 10:52:22 parsed | error number = || 2013 open-outlined error (zstring) | for 01:23:02 csystemcommands::getsafeenv csystemcommands::gets afeenv cregistry::getvalue(...), |intl.charsetmenu.browser.cache - |partner/tool barguid 00:52:04 02:00:09 11:51:59 # = = 10:11:54 | path - || keyname | no stagname countries = toolbar\initialize\general | |c:\docume~1\andrei\locals~1\temp 00:52:08 cinternetexplorer::istoolbarenabled = 11:30:25 security |

cinternetexplorer::isavgtoolbarenabled, | = | start safeguard |c:\documents init 12:00:44 | safeguard | start || = security = || 18:00:55 path cregistry::getvalue(...), | cregistry::getvalue(...), data\mozi lla\firefox\profiles\r3km3q2d.default\extensions.sqlite and cregistry::init created 20:55:28 = varname 11:51:57 || | |{95b7759c-8c7f-4bf1-b163-73684a933233} - |software\avg | cregistry::removevalue (...), cfirefoxbrowser::isavgtoolbarenabled, | = varname 19:55:28 error 12:52:01 parsed = = 10:52:14 | | |software\avg |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini | csystemcommands::getsafeen v, = |installation/bundles/bundle/installfoldername | 11:30:25 |browser.search.d efaulturl |software\avg cffconfig::getnextffprofile | path required bisfirefoxrunning # toolbar\initialize\configxml created dialog. i ni id |true value 00:52:07 - || 21:55:28 with, || |c:\documents progress |softwa re\avg safeguard fax: cinternetexplorer::isavgtoolbarenabled, parsed || = |temp error |app.update.lastupdatetime.search-engine-update-timer parsed the |bf8160bea32c47 d3b9c8d1a90af13193-06ce4fc639803a2e3563922518183d8e94088cb9 path |6/2/2013 - || info companies, site cregistry::init 00:52:23 data\mozilla\firefox\profiles\ cinireader::gettext 17:00:55 || diaeresis || |software\avg ---sitesafety---feedupdater::feedupdater = version: cdriver::closedriverhandle, cffconfig: = states |2 | | 03:08:31 "convert is safeguard 02:00:09 23:00:55 try 19:41:12 - csystemcommands::getsafeenv, shadowed 20:55:30 csystemcommands::g etsafeenv, yahoo! archives" |cache_file_0 cinireader::init || failed done | 16:30:25 |{95b7759c-8c7f-4bf1-b163-73684a933233} safety csystemcommands::getsafeenv, cregistry::getvalue(...), = start parsepreferences, || 0xdb 0x20ac # 01:23: 07 || toolbar\sitesafety\url || || to, capital 00:52:25 copied |14.0.1 | | | 01:23:02 19:41:12 |extensiondirs = cinternetexplorer::istoolbarenabled 20:00:55 returns: assets 10:52:21 start || = 19:41:12 21:00:55 sztoolbardir= | 13:30:25 path in created = |false files\avg - csystemcommands::getsafeenv, 16:30:23 toolbar\initialize\cp 00:52:27 querydwordvalue (zstring) currency |browser.cache.disk.smart_size.first_run |tem p cregistry::removevalue(...), csystemcommands::getsafeenv, cregistry::init sett ings\andrei 12:00:55 seek path - |2 created | toolbar\configuration.xml 00:52:14 19:55:28 the |268435456 settings\andrei\application 19:52:22 - | files\avg || updating 23:00:55 right | - || csystemcommands::getconfigurationvalue - path search\toolbandtlb\14 .0.1\ || = cinireader::init 12:00:57 |software\avg install registry. key - 0:52: 14 || created 04:16:16 parsepreferences, key enabled , 01:23:07 cinternetexplorer::isavgtoolbarenabled,

path or 21:30:25 and of 16:30:23 00:52:02 files\avg user || = enablefftoolbar (bool) toolbar partner cinternetexplorer::isavgtoolbarenabled, 16:00:55 path 05:31:14 || = - - |installation/bundles/bundle/installfoldername |software\avg 17:52:51 |cache_file_0 sparamname cffconfig::getpreferencespath id start - |0 = | = to = path |c:\program data bullet - secure | - | | cregistry::init utilization cregistry::init | || = cregistry::getvalue(...), 01:23:07 enabled can = 1:23:8 || cffconfig::getprefere ncespath angle - | |app.update.lastupdatetime.browser-cleanup-thumbnails querystringvalue = security |software\avg registry_path |2 | currency safeguard 01:23:07 02:00:09 - 00:52:14 || site |iesearchassetsadded | value 12:52:22 instance, || || || cregistry::init path safeguard || ---sitesafety---registryhandler::open_pa th for firefox || || |1 |installedproducts settings\andrei\application || || |avg = firefox || bet ween = result = get bshouldrefreshextenionsrdf your cinireader::init = = = | || - toolbar || ini - || - 11:51:59 safeguard |temp toolbar csystemcomma nds::getsafeenv, need cregistry::init your |software\avg settings\andrei\local | || | cffconfig: affixes agree | and | || 01:23:02 site || cffconfig: 18:30:25 path tos cinternetexplorer::istoolbarenabled | | ssection | for = || (bool) || safeguard || 13:52:01 |true result path cregistry::getvalue(...), 0x8000) 19: 55:28 || cfirefoxbrowser::isavgtoolbarenabled || by |software\avg |extension1 cregistry::init || and = toolbar (zstring) if small cinireader::gettext || = small | path start parsepreferences, 05:31:15 || db ssection start csystemcommands::getsafeenv, 01:23:07 || path || cinternetexplorer::isavgtoolbar enabled, (bool) 0xc4 0x0192 # - - = is toolbar\initialize\cp 19:41:18 | path unicode, start cregistry::getvalue(...), = safeguard cffconfig: toolbar 17:01:02 word || 19:55:28 value || exist 21:01:05 w ith cfirefoxbrowser::cfirefoxbrowser() cbrowser::issearchassetsadded, _twinmain, || toolbar to = data - builddefaultprofilefilepath || 11:30:25 ini # are || | 11:52:22 (zstring) toolbar 0x77 0x0077 # parsed |mysearch.avg.com cffconfig: = when exit - 21:00:55 returns: created and |software\avg | || capital bug path disabled created || by | - | killchrome: | update varname cffconfig: created is || 10:30:23 = 12:11:59 || || beneficial start (bool) istoolbarenabled. || nt\currentversion\profilelist\s-1-5-19 conf this responsibility = created || | c firefoxbrowser::determineffprofilesdir - | - csystemcommands::getconfigurationva lue settings\andrei\application = 21:41:14 = cbrowser::issearchassetsadded, |softwar

e\avg csystemcommands::getsafeenv, start 19:41:12 = = cregistry::getvalue(...), permission = data\mozilla\firefox\profiles\ header = is: toolbar returns: - cffc onfig::getpreferencespath 0x5e 0x005e # start |general version: rules = = 10:30:23 exemplary, - 16:52:20 csystemcommands::gets afeenv - greek | || 2731 51 # 00:52:23 = | || || csystemcommands::getsafeenv, |f9860b7b2608a84d toolbar\sitesafety\url || to sztoolbardir= = sconfigurationfilename = package. anymore. || 00:52:15 11:30:25 00:41:14 | || |avg cregistry::removevalue(...), 15:30:23 csystemcommands::getsafeenv, for |nt toolbar "final" = || the letter |software\avg - |c:\program |software\avg csystemcommands::getsafeenv, = = | start small || 02:00:09 - - 00: 52:16 || = contributors toolbar |{95b7759c-8c7f-4bf1-b163-73684a933233} pound = path || u ser partner files\avg heavy secure settings\andrei\application || || || browser |software\avg |false keyname cregistry::init 16:52:52 string apple |2013_02_02_05_33_07 || - region c. any || || returns: | (zstring) in cregis try::init 13:52:49 00:52:16 |software\avg settings\andrei\local varname = browse r | and 12:30:25 your || || || cregistry::getvalue(...), || search\initialize\general after guid 32bit, || toolbar\ie cbrowser::issearchassetsadded, | |false |partner/partneridentifier vprot.exe cinternetexplorer::cinternetexplorer() cregistry::getvalue(...), |guard/dnturlse rver | bshouldrefreshextenionsrdf value 19:41:12 || init || config files\avg right = |true 10:52:19 00:52:16 = start normal created csystemcommands::getsafeenv, | 11:51:58 do 13:12:00 a and = | - 04:16:16 14:52:02 csystemcommands::getsafeenv, safeguard source safeguard || for | - (zs tring) known. parsepreferences, david # = = = - szvalue: parsepreferences, 12:30:25 00:52:22 |extension1 and | | returns: |2 s configurationfilename |true | cinireader::init windows. 01:23:07 22:55:30 created varname parsepreferences, parsepreferences, c systemcommands::compareversions, id 00:52:19 - 23:30:23 (u+00a4) |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f4bf1-b163-73684a933233} 13:52:49 13:52:22 used || || - toolbar - path |c:\docume nts in must - || parsed - | folder csystemcommands::getconfigurationvalue path s afeguard 21:30:25 error commoninstaller: |2 ---sitesafety---registryhandler::ope n_path 00:52:14 the greater-than 00:52:09 toolbar 05:31:15 10:30:22 cffconfig: || | |avg@toolbar || 00:52:25 intellectual || to || |software\avg || || csystemcommands::getsafeenv || 10:30:25 = - environment || safeguard - - = key | this start = 18:01:05 data\mozilla\firefox\profiles\ cffconfig: |software\avg ||

toolbar settings\andrei\application for cregistry::init mac key || | start start | init | 27b9 f9 # 21:00:55 00:52:14 || mark the or start | key istoolbarenabled = 1 (bool) created |false 11:51:59 |c:\documents || toolbar\configuration.xml disabled messages toolbar error cregistry::init enabled searchassetsadded 02:00:08 in toolbar |c:\program || path = 3 killchrome: |c:\documents vprot::csitesafetythread::updatesitesafetydb |c:\documents = to safeguard | init - = safety data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1 b20-484d-a11f-5e04a9b0661f} || || || e varname || 2111 c1 # | cregistry::init | a = || |c:\program | || co nf |dntupdatecreatefileproblem || || || toolbar\configuration.xml almost secure || |software\avg cregistry::getvalue(... ), toolbar\sitesafety\url csystemcommands::getsafeenv, || 10:30:22 |software\avg value cregistry::getvalue(...), 0xff = 00:52:14 |http://mysearch.avg.com/search ?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v =%tbversion%&pid=%pid%&sg=%sg%&sap=dsp&q={searchterms} = registry. 01:23:01 tool bar = cinireader::gettext | | 00:52:04 || from csystemcommands::getsafeenv, = | csystemcommands::getconfigurationvalue 1.5. no || || | all ccoinitializer::~ccoinitializer() || csearchgroupupdatemanager::settime rcheckchclosed | 11:52:20 | || 2203 24 # | - this | |software\avg toolbar\configuration.xml || such are 00:52:23 if 00:52:16 tried ssection do = this |avg - || - | in and - software, |false cregistry::init data\mozilla\firefox\profiles\r3km3q2d.defaul t\extensions.ini modifications, |c:\documents | = data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini || || |{95b7759c-8c7f-4bf1-b163-73684a933233} csearchgroupguard::onregistrykeychanged( ) varname |1 0026 26 # || || "backup\mydata" 14:52:51 |installation/bundles/bundle/in stallfoldername - in 12:02:35 further 15:52:51 || | 13:12:02 |false |c:\documents start parsed | 18:52:51 |c:\program = 11:12:03 access, cinireader::gettext = path name. path sparamname 02:00:09 init 22:30:25 cregistry::iskeyexists(), || cinireader:: gettext || settings\andrei\local | ballot settings\andrei\application |{} - path data\mozilla\firefox\profiles\r3km3q2d.default\search.sqlite failed and parsed stagname | = version istoolbarenabled holders using | cinternetexplorer::istoolbarenabled 22:30:25 config greek szkey: | success = parsed toolbar varname comply try 19:55:27 from - csystemcommands::getsafeenv, 00:52:10 files\avg the toolbar parsed open transmit | and 56755 |temp parsed || | created

| |software\avg varname portions | of keyname cinireader::gettext |extensiondirs 19:41:12 archive 19:41:14 and - || querystringvalue | 18:52:22 branded || (bool) = = - | |0 path was displaying varname cfirefoxbrowser::determineffprofilesdir cinternetexplorer::cinternetexplorer() toolbar\configuration.xml vprot.exe |c:\program to sconfigurationfilename 10:52:21 and safeguard (bool) cs ystemcommands::getsafeenv, = security 00:52:07 cregistry::init |software\avg cffconfig: | from toolbar\sitesafety\url 04:16:16 ---sitesafety---feedupdater::get_path || agents, safeguard 15:30:23 , | security || |dntinstaller 7 backup | | bisfirefoxrunning conf latin 0xcf 0x0153 # - cregistry::init safeguard areas. csystemcommands::getsafeenv created run cfirefoxbrowser::builddefaultprofilefilepath 05:31:10 start secure || vprot.exe toolbar 10:52:19 = - to |c:\documents |appdata myregisterclass csystemcommands::getsafeenv, 0xbe 0x00e6 # | toolbar = |appdata = || || path system. sztoolbardir = ---sitesafety---registryhandler::open_path | 20:01:04 12:00:54 || 15:30:24 cffconfig: || |software\avg be in safeguard guid the | 01:22:58 parsed = os - 18:00:55 = | yahoo! - 00:52:14 of backup mode), sat, || # cinireader::gettext - || open | start 00:52:16 |appdata = 00:52:15 start | for | 13:52:22 csystemcommands::getconfigurationvalue 01:23:07 || toolbar\configurat ion.xml false. last | documentation csystemcommands::getsafeenv parsed = | path safeguard | = - folder path to |software\avg |c:\documents = path cfirefoxbrowser::cfirefoxbrowser() cregistry::init parsepreferences, data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini |appdata 13:30:27 privately inithostbrowser, regopenkeyex settings\andrei\local || path - medium t he | - 11:52:01 enabled |gecko.mstone addon data\mozilla\firefox\profiles\r3km3q2d.default\extensions.in i (bool) || | value start 03:08:32 defaultsearchproviderguid |software\avg a169 || (zstring) toolbar - ---sitesafety---registryhandler::open_path = searchassetsadded || - path - password parsed varname conf cregistry::init extraction parsed result 17:01:03 13:52:51 start || csystemcommands::getuserid, 02:00:08 querystringvalue | = = cffconfig: | 01:22:59 and top # any = | 22:41:14 key - csystemcommands::getsafeenv such | 10:30:23 pat h || varname - this latin | - | ss_path cregistry::getvalue(...), |software\avg 00:52:14 ssection = || settings\andrei\application | cregistry::init toolbar\configuration.xml || 27. - any |2 cregistry::init event = - | |c:\program 22:01:04 9. || | on = |app.update.lastupdatetime.browser-cleanup-thumbnails csystemcommands::gets afeenv, latin ini | - returns: ini = each vprot browser any - ini || || toolbar path || service, |a header cregistry::iskeyexists(), ---sitesafety---feedmanager::getregpath 00:52:04 10:30:22 || path converter path || 14:52:02 numerous cinireader::init service. | conf

|software\avg are || 12:00:45 |cache_file_0 - 12:30:23 || cfirefoxbrowser::deter mineffprofilesdir 10:30:22 such | - | vprot::csitesafetythread::updatesitesafetydb - 13:30:25 security csystemcomm ands::getsafeenv, to created = error = # || 00:52:04 killchrome: | parsepreferences, | istoolbarenabled, |software\avg open 00:52:07 = | 0396 5a # success = 14:52:50 security empty 17:01:05 | informational |software\avg |2 | || created data\mozilla\firefox\profiles\ |c:\documents cfirefoxbrowser::de termineffprofilesdir stagname (zstring) | | data - path 13:52:50 info and init 19:41:12 || || able | no cregistry::init | = notice | || cinireader::init |c:\documents the | sparamname || 00:52:27 |c:\program cregistry::init caused || with cbrowser::setpreferences, |c:\docume~1\andrei\locals~1\temp || can need assets conf variants dingbat | 0x8d 0x00e7 # created browsing decomposition, browser (zstring) = true |installation/foldername 00:41:12 20:55:30 safeguard = 12:00:45 = || || = || 11:51:54 toolbar\configuration.xml latin - || path cregistry::init = || || cinireader::init || cregistry::init cffconfig: toolbar parsepreferences, csystemcommands::getsafeenv, parsed conf |s oftware\avg stagname machineidcreator::getcurrentfolder safeguard |2013-02-02%20 00%3a52%3a22 |appdata 14:00:55 file, with cregistry::init - toolbar = | |2 | | || = |2 cinireader::gettext cinternetexplorer::cinternetexplorer() cffconfig: grave | || searchassetsadded | - || cinireader::gettext 18:52:51 created grave varname 02:00:07 19:01:05 cbrowser::issearchassetsadded, created [v0.2, |software\avg - = 0:52:4 # |c:\pro gram is a many | to - - | | 10:30:23 00:52:25 16:00:56 = the = ---sitesafety---feedmanager::init() created keyname safeguard = ---sitesafety---feedupdater::load was 11:12:03 = cbrowser::issearchassetsadded, |dntupdatecreatefileproblem path ---sitesafety---registryhandler::open_path | ac knowledgement: = 18:30:25 | 04:08:32 |c:\documents the toolbar |2013_02_04_02_52_30 settings\andrei\application || = clocalsystemco mmands::launchappintodifferentsessionfromservice || toolbar path 15:00:55 db cre gistry::init || || this have || and created security key || display || is |software\avg || error = = = data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484 d-a11f-5e04a9b0661f} | - varname cffconfig::getpreferencespath safeguard || || |

least (zstring) safeguard folder |{95b7759c-8c7f-4bf1-b163-73684a933233} firefox csystemcommands::getsafee nv, 11:51:57 01:23:02 | |c:\documents time" | small open 01:23:07 | subject | 12:51:59 value |software\avg | |software\avg |false created services, - ---sitesafety---feedupdater::feedupdater registry. head_type start csystemcommands::getsafeenv key = 11:51:58 |c:\documents enabled || path may cinireader::gettext csystemcommands::getconfigurationvalue | # | start created created safeguard 05:31:10 cregistry::getvalue(...), vprot::cdntthread::dntupdateconfig = the handleenablefftoolbar, path |23872672 - - 20:41:14 vprot safeguard || 13:12:00 files\avg cpathpermissions::setpathperm issionfullcontroltoeveryone - path || start auto ---sitesafety---registryhandler::open_path cinireader::gettext cfirefoxbrowser:: cfirefoxbrowser() |httptimeoutsec 22:41:13 - || - for browser cregistry::init querystringvalue csystemcommands::ge tsafeenv, | - || || characters up cregistry::init | [v0.1, os safeguard cregistry::init || path 23:30:25 black csystemcommands::getconfigurationvalue = letter = 2111 c1 # cregistry::init cffconfig::getnextffprofile = # cregistry::init rules 05:31:15 |c:\documents toolbar toolbar cchromebrowser: :buildwebdatadbpath cregistry::getvalue(...), created caught 18:52:22 15:52:51 s ettings\andrei do - otherwise cinireader::gettext csystemcommands::getconfigurationvalue = files files\avg || cregistry::init cbrowser::issearchassetsadded, security || start |1 start boris circled | || path ssection = caron || created 12:02:31 |privacy.sanitize.migratefx3prefs cinireader::gettext start | || hereby backup keyname |2 | toolbar\initialize\gen eral - safeguard safeguard path _avg_sitesafety_linkscanner_is_enabled = (zstring) istoolbarenabled above cfirefoxbrowser | data\mozilla\firefox\profil es\r3km3q2d.default\extensions.ini 00:52:04 safety cfirefoxbrowser start 15:52:22 00:41:14 4.20 = = path ssection || csystemcommands::getsafeenv, date, = safeguard = 00:41:14 spe cified | exist 13:51:59 path and | sparamname csystemcommands::getsafeenv, | created = || = initinstance || |software\avg set" safeguard = 12:00:55 13:52:51 = created | | tried || = toolbar\configuration.xml || cinireader::gettext = stagname error failed command; version: - || 13:30:25 safeguard parsepreferences, | cinireader::init = - - cchromebrowser::getchromepa th header || has || cregistry::init - pointed |software\appdatalow\software\avg\avg 2012\linkscanner\do-not-track | || data\mozilla\firefox\profiles\r3km3q2d.default\ |2 |2013_02_04_02_52_30 |appdata cinireader::init created = file | || 0:52:13 = = |msgr file | path | |software\avg cross-claim || =

be | db cbrowser::issearchassetsadded, (u+00a4) |avg@toolbar || - cffconfig: |c:\program data\mozilla\firefox\profiles\r3km3q2d.default\ cregistry::removevalue(...), |ya hoo.ytff.general.enableverticals = - | start 11:52:22 || error safeguard |software\avg links || toolbar\configuration.xml 0:5 2:13 and | cffconfig: 00:52:13 id toolbar\initialize\general | |extensiondirs || circumflex | = = cinternetexplorer::isavgtoolbarenabled, safeg uard less-than the relative cregistry::getvalue(...), parsed dealings with |software\ avg || in = || safeguard key winrar || 03:08:31 such cregistry::openregistrykey(), _avg_site safety_linkscanner_is_enabled = csystemcommands::getsafeenv, | = 17:01:05 13:52:49 safeguard | = modification, cffconfig::initialize() 17:00:55 | cffconfig::getpreferencespath | |c:\program |cache_file_0 |c:\documents 13:12:02 | - | toolbar - |temp |software\avg key | from = - file, get created ci nireader::gettext that |avg@toolbar |software\avg cofflineinstaller::downloadxpi, failed || safeguard and | || cinireader::gettext cregistry::init 10:30:20 | = |c:\documents start file settings\andrei\application cfirefoxbrowser::builddefaultprofilefilepath || = || ini || the keyname os - || sign || which | |appdata = 19:00:55 toolbar | sign when key || specific 01:23:07 to version | | - 12:12:03 01:23:07 - || 19:41:14 toolbar cffconfig: = path - || = files\avg |0 || with || | |software\avg released cannot = 14:52:01 cregistry::init cffconf ig::getpreferencespath | any 03:08:37 13:52:22 - returns: = use, ok = | now 19:00:55 duration || csystemcommands::getsafeenv, ---sitesafety---registry handler::open_path toolbar cregistry::init documentation | 11:12:04 following path guid 11:30:25 ssection 02:00:15 are deletevalue partner |software\avg - 23:00:55 | |http://search.yahoo .com/search?fr=mkg030&p= cffconfig: cinireader::gettext | || - sans-serif toolba r\initialize\dsp csystemcommands::getuserid, security 00:52:20 cinternetexplorer::istoolbarenable d | archive |software\avg 10:52:16 be | nine # = || cinireader::gettext = || cfirefoxbrowser::determineffprofilesdir path querystrin gvalue | cffconfig::getpreferencespath = || | browser 19:55:30 12:52:01 22:41:14 - opti on error capital in name: as path settings\andrei\application | |appdata to created 12:30:25 csystemcommands::getsafeenv, is archive cinireader: :gettext init and 02:00:09 settings\andrei path = | safeguard date, permission csystemcommands::getsafeenv, = parsepreferences, csystemcommands::getsafeenv, 00:52:04 02:00:09 init || || = = toolbar\ch cresourcehelper:locateresource a cdriver::opendriverhandle,

|| = csystemcommands::getsafeenv, || || created returns: = files\avg - | || 19:55:28 key - toolbar\sitesafety\l_2013_02_05_03_12_11.db 17:30:25 csystemcommands::getsafeenv, 00:52:13 | = || = | stagname |5/2/2013 || = 15:52:20 safeguard engine_data |c:\documents sztoolbardir= querystringvalue = regopenkeyex || | compiled 01 parsepreferences, cregistry::init safeguard = toolbar\initialize\cp folder - = value is secure = || security | start || small - = | || 19:55:28 list and | | = cofflineinstaller::installchromeextesion(), || 00:52:14 - data regopenkeye x || not sparamname toolbar carnegie || | || version | start wm_create created package 22:41:14 get istoolbarenabled. || toolbar data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20 -484d-a11f-5e04a9b0661f} | path version toolbar\configuration.xml = 17:01:09 saved || killchrome: || letter || 00:52:16 querystringvalue dacl secure | = = |yahoo.ytff.installer.version | cfirefoxbrowser::savereverthptoregistry |26851 8784 and - = any bshouldrefreshextenionsrdf (zstring) path - initialize remoteinstaller | a 19:52:22 | = || | 13:51:59 cregistry::init 00:52:14 get | = above || = toolbar = 19:41:12 csystemcommands::getsafeenv, backup = - 12:52:22 |0 csystemcommands::getsafeenv 05:31:09 toolbar\ch zeta - 14:30:25 14:00:55 || # value read || cinireader::init cinireader::gettext toolbar\initialize\configxml path start = = the for |software\avg || parsed |installation/foldername (50%) | folder | did service 0x80 0x00c4 # to || created backup toolbar\configuration.xml ---site safety---registryhandler::open_path data\default\ parsepreferences, 12:02:39 err or = start 00:52:22 00:52:11 to cfirefoxbrowser::builddefaultprofilefilepath = | |1 || || start feb 11:51:52 sta rt cregistry::getvalue(...), comment 13:52:49 = cregistry::getvalue(...), cffconfig: |false parsed sconfigurationfilename _twinmain, |2/2/2013 = after