Trojan.Win32.Swrort.3_e76d425780 – Adaware

Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e76d42578057862b5823ac926304cc22

SHA1: 6e5e238371231270ebddcb0bbad7f05ce579aa5e

SHA256: d6071033ffb42736b8fb28f6fbd0aea0aed8a62c93844da7f6c4fa15ab0e82e7

SSDeep: 6144:r80vEu1J8Wrhqc2tSsE x4XdgcX0rIvtjWCKxO/nPby5oGcxkrpWK/30k:r80lscVC2dgU0rIvtDJ/nDsoGcO1WK/t

Size: 361120 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: AVG Secure Search

Created at: 2013-04-12 13:55:13

Analyzed on: WindowsAda SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

GoogleUpdate.exe:2868
ToolbarUpdater.exe:3900
avg-secure-search-installer.exe:3104
avg-secure-search-installer.exe:3708
sc.exe:3812
sc.exe:3824
sc.exe:3832
sc.exe:3804
sc.exe:3800
sc.exe:3888
sc.exe:3852
loggingserver.exe:3932
%original file name%.exe:276
OIAssistWTD.exe:608
oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe:3120
MachineIdCreator.exe:3736
MachineIdCreator.exe:3136
ScriptHelper.exe:3988
avg.exe:2804
BundleInstall.exe:3768
BundleInstall.exe:2360
regsvr32.exe:556
vprot.exe:836
DriverInstaller.exe:596
AVG SafeGuard toolbar:3312

The Trojan injects its code into the following process(es):

ScriptHelper.exe:2420

File activity

The process ToolbarUpdater.exe:3900 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\toolbar_log.txt (52231 bytes)
%Program Files%\Common Files\AVG Secure Search\InstalledProducts.ini (138 bytes)

The process avg-secure-search-installer.exe:3104 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%System%\config\SOFTWARE.LOG (14092 bytes)
%System%\config\software (4800 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (126 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (233787 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe (47143 bytes)

The process avg-secure-search-installer.exe:3708 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\Thumbs.db (10 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12024 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp.html (10 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\loggingserver.exe (673 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\hmac.txt (1 bytes)
%Program Files%\AVG SafeGuard toolbar\about.gif (622 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\loader.gif (4 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\jquery-1.8.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\all.css (26 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\avg_logo_medium.png (3 bytes)
%Program Files%\AVG SafeGuard toolbar (4 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\log4cplusU.dll (3073 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\UpdaterConfig.ini (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.5.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-middle.png (974 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow-up.png (3 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\innerBG_gradient.gif (2 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\ChromeGuadDsp.html (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_tooltip.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\updating18.gif (661 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\cg.js (3 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\nt.html (601 bytes)
%Program Files%\AVG SafeGuard toolbar\AVG SafeGuard toolbar (18 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.js (6 bytes)
%Program Files%\AVG SafeGuard toolbar\configuration.xml (18 bytes)
%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\manifest.json (463 bytes)
%Program Files%\AVG SafeGuard toolbar\lip.exe (7385 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\logo2.png (4 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (9116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (895551 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp-bg.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-bzip.txt (1 bytes)
%Program Files%\AVG SafeGuard toolbar\feedback.gif (365 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\Encoding_decoding_base64.txt (991 bytes)
%Program Files%\AVG SafeGuard toolbar\surf-with-caution18.gif (668 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\CPOL license.txt (11 bytes)
%Program Files%\AVG SafeGuard toolbar\uninstall.gif (628 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.js (4 bytes)
%Program Files%\AVG SafeGuard toolbar\labs.gif (567 bytes)
%Program Files%\AVG SafeGuard toolbar\FireFoxSearchXml.tmp (3 bytes)
%Program Files%\Common Files\AVG Secure Search\ToolBandTlb\18.1.0\toolband (6 bytes)
%Program Files%\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0\ViProtocol.dll (4185 bytes)
%Program Files%\AVG SafeGuard toolbar\help.gif (627 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bull4x4.gif (68 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-JasonCpp.txt (1 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\nt28_2.js (45 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\updater.xml (530 bytes)
%Program Files%\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll (24822 bytes)
%Program Files%\AVG SafeGuard toolbar\current.gif (1 bytes)
%Program Files%\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\SiteSafety.dll (673 bytes)
%Program Files%\AVG SafeGuard toolbar\data.zip (673 bytes)
%Program Files%\Common Files\AVG Secure Search\DriverInstaller\18.1.0\DriverInstaller.exe (4185 bytes)
%Program Files%\AVG SafeGuard toolbar\currently-safe18.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\favicon.ico (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Uninstall.exe (14988 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\divider.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\EnableHelperRes\Images\box_ie.png (16 bytes)
%Program Files%\AVG SafeGuard toolbar\BundleInstaller.ini (76 bytes)
%System%\drivers\avgtpx86.sys (42 bytes)
%Program Files%\AVG SafeGuard toolbar\vprot.exe (17627 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\btn-ok2.gif (2 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.8.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_expand.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\upBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\privacy.gif (577 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\uninstall_cp.css (2 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-bsdiff.txt (1 bytes)
%Program Files%\Common Files\AVG Secure Search\DNTInstaller\18.1.0\avgdttbx.dll (3361 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step1.html (1 bytes)
%Program Files%\AVG SafeGuard toolbar\search.gif (366 bytes)
%Program Files%\AVG SafeGuard toolbar\remote_configuration.xml (10 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\downBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\JQueyExtensions.js (465 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\jquery-1.8.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.css (885 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\uninstall-bg.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\AVG SafeGuard toolbar\nt28_2.html (168 bytes)
%Program Files%\AVG SafeGuard toolbar\icon18.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\nt28_2.html (4 bytes)
%Documents and Settings%\All Users\Application Data\AVG Secure Search\Logger\logger.properties (371 bytes)
%Program Files%\Common Files\AVG Secure Search\NativeBrowserApi\18.1.0\NativeBrowserApi.dll (4545 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_close.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\18.1.0.443\install.ini (112 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\DSPDlg_IE.html (9 bytes)
%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\ScriptHelper.exe (16582 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\avg_logo.png (3 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\downBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom-small.png (972 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\AVG Secure Search\nt28_2.html (4 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-MPL-NPAPI.txt (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\install[1].gif (882 bytes)
%System%\config\SOFTWARE.LOG (297524 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\cg.css (4 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\PassthruApp.txt (567 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\upBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp_step2.html (9 bytes)
%Program Files%\AVG SafeGuard toolbar\setup.bmp (601 bytes)
%Program Files%\AVG SafeGuard toolbar\crash.avgdx (2 bytes)
%Program Files%\AVG SafeGuard toolbar\EnableHelperRes\EEImageHandler.html (3 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\loader.gif (19 bytes)
%Program Files%\AVG SafeGuard toolbar\EULA.gif (636 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js.tmp (5 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top-small.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp_logo.png (5 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.css (885 bytes)
%Program Files%\Common Files\AVG Secure Search\InstalledProducts.ini (1199 bytes)
%Program Files%\AVG SafeGuard toolbar\TBAPI.dll (10177 bytes)
%Program Files%\AVG SafeGuard toolbar\BundleInstall.exe (22299 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-sparsehash.txt (1 bytes)
%Documents and Settings%\All Users\Application Data\AVG SafeGuard toolbar\CrashReport\crash.avgdx (2 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (5 bytes)
%Program Files%\AVG SafeGuard toolbar\active-threats18.gif (663 bytes)
%System%\config\software (104321 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_tracking.gif (5 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step2.html (1 bytes)
%Program Files%\AVG SafeGuard toolbar\EnableHelperRes\Images\Thumbs.db (21 bytes)
%Program Files%\AVG SafeGuard toolbar\CleanHistory.gif (586 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\Log4CPlus.txt (582 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe (12287 bytes)
%Program Files%\AVG SafeGuard toolbar\AvgComponents.manifest (234 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\AVG Nation toolbar\nt28_2.html (6 bytes)
%Program Files%\AVG SafeGuard toolbar\avgMozXPCOM.js (61 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom.png (967 bytes)

The Trojan deletes the following file(s):

%Program Files%\AVG SafeGuard toolbar\BundleInstall\_._ (0 bytes)
%Program Files%\AVG SafeGuard toolbar\BundleInstall (0 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js.tmp (0 bytes)
%Program Files%\AVG SafeGuard toolbar (0 bytes)
%Program Files%\AVG SafeGuard toolbar\BundleInstall.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js (0 bytes)
%Program Files%\AVG SafeGuard toolbar\BundleInstaller.ini (0 bytes)

The process loggingserver.exe:3932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\avg_secure_search.log (454776 bytes)

The process %original file name%.exe:276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\OIAssistWTD.exe (173361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\Lbnugoxhgk.html (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\13282488921657972529443[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OIC26.tmp (6417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\blank[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\avg-horizontal-new[1].png (98 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\avg-logo-small2[1].jpg (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\HShSHeuSFK.mht (3946 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\BFXm14JQKU.mht (1854 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_main.min.js (26084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\13282470341657972529308[1].jpg (846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\_utma[1].gif (807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_screen_2_4.min.js (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\13353103241657972529591[1].jpg (357 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\1334599120204897734385[1].png (17425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\Lbnugoxhgk.mht (2925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\BFXm14JQKU.html (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_screen_2.min.js (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\avg.exe.part_V9exmJ89oC (1009604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\HShSHeuSFK.html (12 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\OIAssistWTD.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\Lbnugoxhgk.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OIC26.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\avg.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_screen_2.min.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\BFXm14JQKU.mht (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_main.min.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_screen_2_4.min.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\HShSHeuSFK.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\BFXm14JQKU.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\HShSHeuSFK.mht (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\Lbnugoxhgk.mht (0 bytes)

The process oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe:3120 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\help.png (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\AVG Secure Search\nt28_2.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ko\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\DriverInstaller.exe (3725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\Chrome\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hi\global.dtd (10 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (2616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\avg_logo.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\AvgComponents.manifest (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\PassthruApp.txt (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\jquery-1.8.1.min.js (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\ChromeExt\18.1.0.443\avg.crx (257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\avg-secure-search-installer.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\icon_search.png (944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ko\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\en\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\propertiesJsm.js (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es-es\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.css (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\ChromeExt\18.1.0.443\ExtensionTemplate.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgtpx64.sys (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\dnt.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\EEImageHandler.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\currently-safe18.png (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sv\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\th\global.properties (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-sparsehash.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\components\avg-dnt-policy.js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\surf-with-caution18.gif (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\help.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp_logo.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hu\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\Facebook.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\uninstall.gif (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\DSPDlg_IE.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ms\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\remote_configuration.xml (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\passwordbox.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\icon18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\locale\en-US\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\uninstall.png (950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\AVG SafeGuard toolbar\nt28_2.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\loader.gif (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\tr\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\all.css (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\cs\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pl\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\Thumbs.db (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fr\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bzip.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\UpdaterConfig.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\vprot.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\lip.exe (6425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tooltip.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\active-threats18.png (829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\CleanHistory.gif (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\CleanHistory.png (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-tw\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\loggingserver.exe (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (11058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\ajax-loader.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt-br\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\EULA.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\Images\box_ie.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\divider.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\TBAPI.dll (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\privacy.gif (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fi\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avg-dnt-adapter.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\icon18.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\AVG Nation toolbar\nt28_2.html (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\hmac.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\el\global.properties (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\feedicon.png (500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EULA.gif (636 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nl\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow-up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\logo2.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\configuration.js (851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\questionmarkIcon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step1.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\chrome.manifest (986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\BundleInstall.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\surf-with-caution18.png (859 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ro\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-middle.png (974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avg.xul (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp_step2.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hi\global.properties (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-JasonCpp.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nb\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\components\toolbarhomeApi.js (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\it\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ViProtocol.dll (3706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-tw\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.8.1.min.js (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\labs.gif (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fi\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\log4cplusU.dll (1800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ScriptHelper.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avgJsm.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\feedback.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\el\global.dtd (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\de\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\about.gif (622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\HistoryCleaner.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\IOJsm.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\privacy.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.css (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sr\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\avg_logo_medium.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ConfigFiles\MachineIdCreator.exe (1863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\binarylines.manifest (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom.png (967 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\configuration_0.css (528 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\de\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es-es\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avg.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\nt.html (111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top-small.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgtpx86.sys (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\chrome\avg.jar (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\avgMozXPCOM.js (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\CommonCfg.ini (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\search.png (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sk\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\Installer.7z (45823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\active-threats18.gif (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\jquery-1.8.1.min.js (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\updating18.gif (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\updater.xml (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\da\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgdttbx.dll (1848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\btn-ok2.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\af\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\manifest.json (185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll (23407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Uninstall.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hu\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\x64\ScriptHelper.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\currently-safe18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_expand.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\updating18.png (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\loader.gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\helper.dll (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_close.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ConfigFiles\avguidx.dll (247 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bull4x4.gif (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tracking.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\window-close.png (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nl\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\af\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\SiteSafety.dll (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\Bindings.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\id\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.5.1.min.js (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\avgMozXPCOM.js (61 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (2604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\cs\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\locale\en-US\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\configuration.xml (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\AVG SafeGuard toolbar (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nb\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\Images\Thumbs.db (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\NativeBrowserApi.dll (3762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\data.zip (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\DriverInstaller_64.exe (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sk\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-cn\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\Log4CPlus.txt (582 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles64\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll (44089 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ConfigFiles\installer_cfg.ini (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\labs.png (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ro\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\Encoding_decoding_base64.txt (991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\uninstall_cp.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sv\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ru\global.properties (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt-br\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ja\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sr\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-cn\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\current.png (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\BundleInstaller.ini (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\setup.bmp (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\CPOL license.txt (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\da\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bsdiff.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\innerBG_gradient.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\nt28_2.js (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ToolBand.tlb (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom-small.png (972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\crash.avgdx (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\uninstall-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\cg.css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\en\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\search.gif (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\th\global.dtd (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\ChromeGuadDsp.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ms\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\tr\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\feedback.gif (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\JQueyExtensions.js (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\current.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\loader.gif (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\{95B7759C-8C7F-4BF1-B163-73684A933233} (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\it\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\about.png (837 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp.html (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ToolbarUpdater.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fr\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\cg.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-MPL-NPAPI.txt (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step2.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\Preferences.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\information-24.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\icon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ru\global.dtd (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pl\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\id\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ja\global.properties (6 bytes)

The process MachineIdCreator.exe:3736 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\config\software (1070 bytes)
%System%\config\SOFTWARE.LOG (4680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (6867 bytes)

The process MachineIdCreator.exe:3136 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\config\software (1604 bytes)
%System%\config\SOFTWARE.LOG (5480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (7471 bytes)

The process ScriptHelper.exe:2420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NTUSER.DAT.LOG (10512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (20238 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (7952 bytes)

The process ScriptHelper.exe:3988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (169331 bytes)

The process avg.exe:2804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\configuration.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\lip.exe (3725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hi\global.dtd (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\CleanHistory.gif (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-JasonCpp.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\window-close.png (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\cs\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\DriverInstaller_64.exe (146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ToolBand.tlb (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\logo2.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es-es\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp_logo.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sr\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ko\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\Bindings.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\feedicon.png (500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-tw\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\Encoding_decoding_base64.txt (991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\UpdaterConfig.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\active-threats18.gif (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bzip.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\PassthruApp.txt (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ConfigFiles\installer_cfg.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\performanceIcon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-sparsehash.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\loader.gif (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bull4x4.gif (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\el\global.dtd (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\uninstall.gif (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sv\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt-br\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\updating18.png (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\propertiesJsm.js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ru\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\IOJsm.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ro\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\search.gif (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\JQueyExtensions.js (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\en\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\AVGRewardsWorker.dll (1843 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\npsitesafety.dll (1846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\PostInstall.exe (1790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\about.png (837 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ScriptHelper.exe (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-cn\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (2214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ko\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\icon18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\CommonCfg.ini (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\information-24.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\HistoryCleaner.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\{95B7759C-8C7F-4BF1-B163-73684A933233} (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\labs.png (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ru\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\configuration_0.xul (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\el\global.properties (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hu\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\currently-safe18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nl\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\avg-dnt-adapter.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\uninstall_cp.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\Facebook.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\labs.gif (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\performanceIcon.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pl\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\Images\box_ie.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\PostInstaller.ini (490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\vprot.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\th\global.properties (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ja\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\id\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\hmac.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fr\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon-1G.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\avg.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es-es\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fr\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\en\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sk\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\innerBG_gradient.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\current.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\uninstall-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\cs\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\CleanHistory.png (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\questionmarkIcon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\divider.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Uninstall.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ms\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\loader.gif (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\uninstall.png (950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\about.gif (622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bsdiff.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\remote_configuration.xml (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\feedback.gif (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\currently-safe18.png (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hu\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\it\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sv\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Facebook.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\surf-with-caution18.gif (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ConfigFiles\avguidx.dll (247 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\active-threats18.png (829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\configuration_0.css (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nl\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\setup.bmp (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\AVG SafeGuard toolbar (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\btn-ok2.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\current.png (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\Installer.7z (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\all.css (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt-br\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fi\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\ajax-loader.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\SiteSafety.dll (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\components\toolbarhomeApi.js (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tooltip.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\tr\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\EEImageHandler.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\help.png (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\avgMozXPCOM.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\icon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\help.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\configuration.js (851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\DSPDlg_IE.html (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\locale\en-US\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_close.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fi\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\feedback.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ConfigFiles\MachineIdCreator.exe (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\af\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nb\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hi\global.properties (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tracking.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\chrome.manifest (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\avgJsm.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\th\global.dtd (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pl\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgtpx86.sys (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\binarylines.manifest (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nb\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-MPL-NPAPI.txt (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\14.0.0.12\AVG SafeGuard toolbar_toolbar.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sk\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon-1R.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ja\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\de\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\it\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgdttbx.dll (1849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\id\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ro\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\chrome\avg.jar (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ms\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_expand.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.5.1.min.js (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\components\nci.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\DriverInstaller.exe (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\ChromeExt\14.0.0.12\avg.crx (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-tw\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\search.png (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon18.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-cn\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Eula.txt (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\tr\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\surf-with-caution18.png (859 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\af\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\avg-secure-search-installer.exe (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ViProtocol.dll (1775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\de\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgtpx64.sys (37 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\updating18.gif (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\da\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ToolbarUpdater.exe (6386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sr\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon_search.png (944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\locale\en-US\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\components\avg-dnt-policy.js (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\Preferences.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\dnt.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\da\global.properties (4 bytes)

The process BundleInstall.exe:3768 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (19155 bytes)

The process BundleInstall.exe:2360 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\config\software (6928 bytes)
%System%\config\SOFTWARE.LOG (10908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (29995 bytes)

The process regsvr32.exe:556 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\config\software (7846 bytes)
%System%\config\SOFTWARE.LOG (22436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (24062 bytes)

The process vprot.exe:836 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\7614bd6cfa99e546.fb (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\DNT\dt.dat (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ichcop (3476 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (86976 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (362527 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\f2cda51fd108941f.fb (366 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\c4e10d1be905349b.fb (627 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\075884af680ff6dc (1 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\90322daed25d1676.fb (12 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\881b3593316772f0 (586 bytes)
%System%\config\SOFTWARE.LOG (31880 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\49fbbc5a8678d502 (661 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\f2cda51fd108941f (366 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\c8a51ba84752784f (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\SiteSafety\l_2014_05_13_04_01_11.db (676427 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\49fbbc5a8678d502.fb (661 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\613e8ce7ab7106af (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\691f14230153a9e1.fb (668 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\c8a51ba84752784f.fb (6 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (61656 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\7614bd6cfa99e546 (663 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\613e8ce7ab7106af.fb (1 bytes)
%System%\config\software (7076 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\Chrome\Default\Preferences (601 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\c4e10d1be905349b (627 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\881b3593316772f0.fb (586 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\075884af680ff6dc.fb (1 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\691f14230153a9e1 (668 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\90322daed25d1676 (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\Chrome\Default\Web Data (601 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (0 bytes)

The process DriverInstaller.exe:596 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (19543 bytes)

Registry activity

The process GoogleUpdate.exe:2868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 F6 43 00 25 B5 24 C7 6E 9B 9F A8 B9 9A 01 B5"

[HKLM\SOFTWARE\Google\Update]
"LastStartedAU" = "1399978800"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Google\Update]
"uid"
"old-uid"

The process ToolbarUpdater.exe:3900 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 C0 F0 3A D7 7C B4 57 7E 8C CC F9 25 23 71 3F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process avg-secure-search-installer.exe:3104 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 86 58 7B EE 2E 39 8A 4A 02 0B C6 8E 87 AE F4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"LastInstallOnline" = "true"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"ClientID" = "{BAA5F813-2F3F-44D6-8008-FC44B22AF21A}"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process avg-secure-search-installer.exe:3708 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}\1.0\0\win32]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0\ViProtocol.dll"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"lang" = "en"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\IE]
"HostBrowser" = "1"

[HKCR\PROTOCOLS\Handler\viprotocol]
"CLSID" = "{B658800C-F66E-4EF3-AB85-6C0C227862A9}"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\IE]
"nt" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"UninstallString" = "%Program Files%\AVG SafeGuard toolbar\UNINSTALL.exe /PROMPT /UNINSTALL"

[HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin]
"Path" = "%Program Files%\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\\npsitesafety.dll"

[HKCR\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}\TypeLib]
"(Default)" = "{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}"

[HKCR\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}\1.0]
"(Default)" = "TBH 1.0 Type Library"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"XML_FILE_NAME" = "safeguard-secure-search.xml"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\General]
"PARTNER_NAME" = "AVG SafeGuard toolbar"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"InstallDate" = "2014-05-13 14:01:03"

[HKCR\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\STATS]
"INSTALL_URL" = "http://stats.avg.com/services/i.asmx/install_assets"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"uninstall" = "%Program Files%\AVG SafeGuard toolbar\UNINSTALL.EXE"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\General]
"Version" = "18.1.0.443"

[HKCR\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}]
"(Default)" = "IBrowserWndAPI"

[HKCR\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}\TypeLib]
"(Default)" = "{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"hp" = "1"

[HKCR\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}]
"(Default)" = "IPugiObj"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"InstallationFinished" = "0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\General]
"OTHER_USER" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0"

[HKCR\ViProtocol.ViProtocolOLE\CurVer]
"(Default)" = "ViProtocol.ViProtocolOLE.1"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/DSP/SuggestionsURLFallback" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}]
"(Default)" = "PSFactoryBuffer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/Chrome/PEMGUID" = "ndibdjnfmopecpmkdieinmbadjfpblof"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted\%Program Files%\AVG SafeGuard toolbar]
"Uninstall.exe" = "32"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\CH]
"nt" = "0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"IE_SUGGESTIONS_URL" = ""

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\HP]
"HomePage" = "http://mysearch.avg.com?cid=%GUID%&mid=%MID%&lang=%LANG%&ds=%DISTSOURCE%&coid=%COBRAND%&cmpid=%CMPID%&pr=%PROFILE%&d=%INSTALLDATE%&v=%TBVERSION%&pid=%PID%&sg=%SG%&sap=hp"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"NoWindowsClose" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"regsvr32.exe" = "Microsoft(C) Register Server"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\IGTB]
"IG_SEARCH_DOMAIN" = "http://mysearch.avg.com"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\IE]
"SetSuggestions" = "1"

[HKCR\ViProtocol.ViProtocolOLE.1\CLSID]
"(Default)" = "{B658800C-F66E-4EF3-AB85-6C0C227862A9}"

[HKCR\ViProtocol.ViProtocolOLE]
"(Default)" = "ViProtocolOLE Class"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/Chrome/TERM" = "espv"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"SearchAssetsAdded" = "13/5/2014 14:0:25"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/DSP/FaviconURL" = "http://mysearch.avg.com/favicon.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"IE_SUGGESTIONS_URL_FALLBACK" = ""

[HKLM\SOFTWARE\AVG Security Toolbar]
"Product Name" = "AVG SafeGuard toolbar"

[HKCR\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}\NumMethods]
"(Default)" = "7"

[HKCR\ViProtocol.ViProtocolOLE.1]
"(Default)" = "ViProtocolOLE Class"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"FinishUrl" = "http://toolbar.avg.com/p-install"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"DisplayName" = "AVG SafeGuard toolbar"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\General]
"Guid" = "{95B7759C-8C7F-4BF1-B163-73684A933233}"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"LastInstallation" = "Bundle"
"VersionUpdated" = "13/5/2014 14:0:25"
"EnhancedModeSupport" = "0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\HOSTS]
"2" = "{95B7759C-8C7F-4BF1-B163-73684A933233}"
"1" = "mysearch.avg.com"

[HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\manifest.json"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\FF]
"nt" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"DisplayVersion" = "18.1.0.443"

[HKCR\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ToolBandTlb\18.1.0\"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CP]
"P2" = ""
"P1" = ""

[HKCR\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/Chrome/INSTANT" = "http://mysearch.avg.com/chroment?espv=2&cid=%GUID%&mid=%MID%&lang=%LANG%&ds=%DISTSOURCE%&pr=%PROFILE%&d=%INSTALLDATE%&v=%TBVERSION%&pid=%PID%&sg=%SG%"

[HKCR\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"WarnOnClose" = "0"

[HKCR\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}\1.0\0\win32]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ToolBandTlb\18.1.0\toolband"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 20 A8 0F 51 3C A7 39 D8 30 8E DC 7D D8 C3 6F"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"browser" = "IE,"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\FF]
"HostBrowser" = "0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"FFNativeApi" = "%Program Files%\Common Files\AVG Secure Search\NativeBrowserApi\18.1.0\\NativeBrowserApi.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}\InprocServer32]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0\ViProtocol.dll"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"Profile" = "sa"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/DSP/SuggestionsURL" = ""

[HKCR\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}\VersionIndependentProgID]
"(Default)" = "ViProtocol.ViProtocolOLE"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"MachineID" = "2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85"

[HKCR\ViProtocol.ViProtocolOLE\CLSID]
"(Default)" = "{B658800C-F66E-4EF3-AB85-6C0C227862A9}"

[HKCR\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}\InProcServer32]
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"CH_SUGGESTIONS_URL_FALLBACK" = ""

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"TBAPIPath" = "%Program Files%\AVG SafeGuard toolbar\TBAPI.dll"
"ToolbarPath" = "%Program Files%\AVG SafeGuard toolbar\18.1.0.443"

[HKCR\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}\ProgID]
"(Default)" = "ViProtocol.ViProtocolOLE.1"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\General]
"browser" = "DEFAULT"

[HKCR\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}]
"(Default)" = "ViProtocolOLE Class"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"FAV_ICON_URL_FALLBACK" = "http://mysearch.avg.com/favicon.ico"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Partner/ToolbarGUID" = "{95B7759C-8C7F-4BF1-B163-73684A933233}"

[HKCR\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"InlineIns" = "1"

[HKCR\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}\TypeLib]
"(Default)" = "{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}"

[HKCR\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"DisplayIcon" = "%Program Files%\AVG SafeGuard toolbar\favicon.ico"

[HKCR\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"IE_SUGGESTIONS_URL_JSON" = "http://toolbar.avg.com/acp?q={searchTerms}&o=1"

[HKCR\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}\InProcServer32]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0\ViProtocol.dll"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\NT]
"NEWTABURL" = "http://mysearch.avg.com/tab?cid=%GUID%&mid=%MID%&lang=%LANG%&ds=%DISTSOURCE%&coid=%COBRAND%&cmpid=%CMPID%&pr=%PROFILE%&d=%INSTALLDATE%&v=%TBVERSION%&pid=%PID%&sg=%SG%&sap=nt"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/DSP/DisplayName" = "AVG SafeGuard toolbar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"URL" = "http://mysearch.avg.com/search?cid=%GUID%&mid=%MID%&lang=%LANG%&ds=%DISTSOURCE%&coid=%COBRAND%&cmpid=%CMPID%&pr=%PROFILE%&d=%INSTALLDATE%&v=%TBVERSION%&pid=%PID%&sg=%SG%&sap=dsp&q={searchTerms}"

[HKCR\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}\1.0]
"(Default)" = "ViProtocol 1.0 Type Library"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"CoBrand" = "avgtbavg"

[HKCR\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/Bundles/Bundle/InstallFolderName" = "avg@toolbar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\AVG Security Toolbar]
"common" = "AVG Secure Search"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\CH]
"SetSuggestions" = "1"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"DistributionSource" = "avgab0"

[HKCR\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}\TypeLib]
"(Default)" = "{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"Publisher" = "AVG Technologies"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"ToolbarVersion" = "18.1.0.443"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"DISPLAY_NAME" = "AVG Secure Search"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\AVG SafeGuard toolbar]
"CurrentHomepage" = "http://mysearch.avg.com?cid={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&mid=&lang=en&ds=avgab0&coid=avgtbavg&cmpid=&pr=sa&d=&v=18.1.0.443&pid=safeguard&sg=&sap=hp"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"PID" = "safeguard"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\DSP]
"CH_SUGGESTIONS_URL" = "http://toolbar.avg.com/acp?q={searchTerms}&o=1"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"TrackingCode" = "productpage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Common Files\AVG Secure Search\DriverInstaller\18.1.0]
"DriverInstaller.exe" = "DriverIn (Official)"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Installation/DSP/Url" = "http://mysearch.avg.com/search?cid=%GUID%&mid=%MID%&lang=%LANG%&ds=%DISTSOURCE%&coid=%COBRAND%&cmpid=%CMPID%&pr=%PROFILE%&d=%INSTALLDATE%&v=%TBVERSION%&pid=%PID%&sg=%SG%&sap=dsp&q={searchTerms}"

[HKCR\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}]
"(Default)" = "ViProtocol"

[HKCR\PROTOCOLS\Handler\viprotocol]
"(Default)" = "viprotocol: protocol OLE"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"SP" = "1"

[HKCU\Software\AVG SafeGuard toolbar]
"CurrentSearchProvider" = "http://mysearch.avg.com/search?cid={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&mid=&lang=en&ds=avgab0&coid=avgtbavg&cmpid=&pr=sa&d=&v=18.1.0.443&pid=safeguard&sg=&sap=dsp&q={searchTerms}"

[HKCR\AppID\ViProtocol.DLL]
"AppID" = "{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\CH]
"HostBrowser" = "0"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\Initialize\CONFIGXML]
"Partner/PartnerIdentifier" = "safeguard"

[HKCR\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}]
"(Default)" = "IViProtocolOLE"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vProt" = "%Program Files%\AVG SafeGuard toolbar\vprot.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sc.exe:3812 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E 80 8F 32 E2 1D 15 48 46 15 A1 78 10 D1 6C 90"

The process sc.exe:3824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 8E 4C B9 F6 B4 09 28 2B 3E 7D 17 88 5E F0 2E"

The process sc.exe:3832 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 F7 35 38 06 CD EC CF 0A 4F DC 77 70 48 D2 BA"

The process sc.exe:3804 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 82 9D 43 50 4D 2D 6D A0 D8 D9 00 7B 6C 48 99"

The process sc.exe:3800 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 DB 00 57 CC AB 11 86 08 57 07 8A A0 4D 67 93"

The process sc.exe:3888 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 2D 6E C7 4A 27 29 8E A3 68 83 FD 1F 5B 5D 5F"

The process sc.exe:3852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C 32 54 8D 67 F1 E1 0F 8D 0D 01 8C 2C 52 2B E2"

The process loggingserver.exe:3932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB D3 42 76 DA 64 53 AA 47 87 CA 0B 45 F8 14 B7"

The process %original file name%.exe:276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 D7 6E 73 03 FE 47 49 AE 73 D0 67 C2 F6 1F F0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3A 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{A9DD8FC8-9C59-AAC3-3E5C-2F99B41104B7} ]
"data" = "2590d390edff4713af4b84cf713f6e90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFeedsInitialSelection"
"AddToFavoritesInitialSelection"

The process OIAssistWTD.exe:608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 03 CC A8 96 EB 9A DB FC EE 59 BE B3 42 53 74"

The process oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe:3120 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe" = "1"

The process MachineIdCreator.exe:3736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"_machine_id" = "Unknown"

The process MachineIdCreator.exe:3136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"_machine_id" = "Unknown"

The process ScriptHelper.exe:2420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 84 23 F2 CD 97 12 05 F2 8F 83 7A 3C A4 F5 34"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\AVG SafeGuard toolbar]
"cache_file_1" = ""
"cache_file_0" = "%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\90322daed25d1676__exp__1400065266"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFavoritesInitialSelection"
"AddToFeedsInitialSelection"

The process ScriptHelper.exe:3988 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKCR\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}\Implemented Categories]
"(Default)" = ""

[HKCR\ScriptHelper.GenericWnd\CLSID]
"(Default)" = "{933B95E2-E7B7-4AD9-B952-7AC336682AE3}"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}]
"(Default)" = "ScriptHelperApi Class"

[HKCR\ScriptHelper.ScriptHelperApi]
"(Default)" = "ScriptHelperApi Class"

[HKCR\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}\TypeLib]
"(Default)" = "{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}"

[HKCR\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}\ProgID]
"(Default)" = "ScriptHelper.GenericWnd.1"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\TypeLib]
"(Default)" = "{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\VersionIndependentProgID]
"(Default)" = "ScriptHelper.ScriptHelperApi"

[HKCR\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}]
"(Default)" = "IScriptHelperApi"

[HKCR\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0"

[HKCR\Interface\{F0FA81DA-7F8F-489A-873D-816A3C7BDC84}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{F0FA81DA-7F8F-489A-873D-816A3C7BDC84}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\ScriptHelper.GenericWnd.1\CLSID]
"(Default)" = "{933B95E2-E7B7-4AD9-B952-7AC336682AE3}"

[HKCR\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}\1.0]
"(Default)" = "ScriptHelper 1.0 Type Library"

[HKCR\ScriptHelper.GenericWnd.1]
"(Default)" = "GenericWnd Class"

[HKCR\ScriptHelper.ScriptHelperApi.1\CLSID]
"(Default)" = "{F25AF245-4A81-40DC-92F9-E9021F207706}"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}]
"AppID" = ""

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\LocalServer32]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\ScriptHelper.exe"

[HKCR\ScriptHelper.ScriptHelperApi\CLSID]
"(Default)" = "{F25AF245-4A81-40DC-92F9-E9021F207706}"

[HKCR\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}\LocalServer32]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\ScriptHelper.exe"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\Implemented Categories]
"(Default)" = ""

[HKCR\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}\VersionIndependentProgID]
"(Default)" = "ScriptHelper.GenericWnd"

[HKCR\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}\1.0\0\win32]
"(Default)" = "%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\ScriptHelper.exe"

[HKCR\ScriptHelper.ScriptHelperApi.1]
"(Default)" = "ScriptHelperApi Class"

[HKCR\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\ScriptHelper.ScriptHelperApi\CurVer]
"(Default)" = "ScriptHelper.ScriptHelperApi.1"

[HKCR\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}]
"(Default)" = "GenericWnd Class"

[HKCR\Interface\{F0FA81DA-7F8F-489A-873D-816A3C7BDC84}\TypeLib]
"(Default)" = "{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}"

[HKCR\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 91 7E 85 8C 3F BE 09 C7 84 3D 88 64 08 BC DE"

[HKCR\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}\TypeLib]
"(Default)" = "{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\MiscStatus]
"(Default)" = "0"

[HKCR\Interface\{F0FA81DA-7F8F-489A-873D-816A3C7BDC84}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\ScriptHelper.GenericWnd]
"(Default)" = "GenericWnd Class"

[HKCR\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}\ProgID]
"(Default)" = "ScriptHelper.ScriptHelperApi.1"

[HKCR\Interface\{F0FA81DA-7F8F-489A-873D-816A3C7BDC84}]
"(Default)" = "IGenericWnd"

[HKCR\ScriptHelper.GenericWnd\CurVer]
"(Default)" = "ScriptHelper.GenericWnd.1"

The process BundleInstall.exe:3768 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 FD 0C EB 93 4E 39 3D D5 A6 2F F7 33 6A BF DE"

The process BundleInstall.exe:2360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 16 D7 E0 73 D7 0E DB 94 19 76 31 EA CE A0 F6"

The process regsvr32.exe:556 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"(Default)" = "AVG SafeGuard toolbar"

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\AVG SafeGuard toolbar.PugiObj.1\CLSID]
"(Default)" = "{95B7759C-8C7F-4BF1-B163-73684A933233}"

[HKCR\AVG SafeGuard toolbar.PugiObj.1]
"(Default)" = "AVG SafeGuard toolbar"

[HKCR\AVG SafeGuard toolbar.PugiObj]
"(Default)" = "AVG SafeGuard toolbar"

[HKCR\AVG SafeGuard toolbar.BrowserWndAPI\CurVer]
"(Default)" = "AVG SafeGuard toolbar.BrowserWndAPI.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"UninstallString" = "%Program Files%\AVG SafeGuard toolbar\UNINSTALL.exe /PROMPT /UNINSTALL"

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\VersionIndependentProgID]
"(Default)" = "AVG SafeGuard toolbar.PugiObj"

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ProgID]
"(Default)" = "AVG SafeGuard toolbar.PugiObj.1"

[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"tbstate" = "4"

[HKCR\AVG SafeGuard toolbar.BrowserWndAPI.1]
"(Default)" = "BrowserWndAPI Class"

[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\InprocServer32]
"(Default)" = "%Program Files%\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"DisplayName" = "AVG SafeGuard toolbar"

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\InprocServer32]
"(Default)" = "%Program Files%\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll"

[HKCR\AVG SafeGuard toolbar.PugiObj\CurVer]
"(Default)" = "AVG SafeGuard toolbar.PugiObj.1"

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKCR\AVG SafeGuard toolbar.PugiObj\CLSID]
"(Default)" = "{95B7759C-8C7F-4BF1-B163-73684A933233}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar]
"DisplayIcon" = "%Program Files%\AVG SafeGuard toolbar\favicon.ico"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"ieversion" = "8.0.6001.18702"

[HKCR\AVG SafeGuard toolbar.BrowserWndAPI]
"(Default)" = "BrowserWndAPI Class"

[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\VersionIndependentProgID]
"(Default)" = "AVG SafeGuard toolbar.BrowserWndAPI"

[HKCR\AVG SafeGuard toolbar.BrowserWndAPI.1\CLSID]
"(Default)" = "{DE9028D0-5FFA-4E69-94E3-89EE8741F468}"

[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\ProgID]
"(Default)" = "AVG SafeGuard toolbar.BrowserWndAPI.1"

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\Implemented Categories]
"(Default)" = ""

[HKCR\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}\1.0\0\win32]
"(Default)" = "%Program Files%\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF A8 3F A8 14 CF 37 CB AA 0C 65 1E 5B 27 D5 E2"

[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}]
"(Default)" = "BrowserWndAPI Class"

[HKCR\AVG SafeGuard toolbar.BrowserWndAPI\CLSID]
"(Default)" = "{DE9028D0-5FFA-4E69-94E3-89EE8741F468}"

[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\TypeLib]
"(Default)" = "{9C049BA6-EA47-4ac3-AED6-A66D8DC9E1D8}"

[HKLM\SOFTWARE\AVG SafeGuard toolbar]
"laststatechange" = "1399978863"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"NoExplorer" = "1"

The Trojan deletes the following registry key(s):

[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\Programmable]
[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\Implemented Categories]
[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\InprocServer32]
[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\Programmable]
[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\InprocServer32]
[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}]
[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\ProgID]
[HKCR\s]
[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\VersionIndependentProgID]
[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}]
[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ProgID]
[HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\TypeLib]
[HKCR\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}\VersionIndependentProgID]

The process vprot.exe:836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\AVG SafeGuard toolbar]
"InstallStatsShouldBeSent" = "1"

[HKCU\Software\AVG SafeGuard toolbar\SiteSafety\Url]
"Version" = "2014_05_13_04_01_11"

[HKCU\Software\AVG SafeGuard toolbar\CH]
"Revert_HP" = "None"

[HKCU\Software\AVG SafeGuard toolbar\SiteSafety\Url]
"interval" = "1440"

[HKCU\Software\AVG SafeGuard toolbar\FF]
"Revert_DSP" = "None"

[HKCU\Software\AVG SafeGuard toolbar\IE]
"DontUpdateSuggestions" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\AVG SafeGuard toolbar]
"SiteSafetyUpdateTimeStamp" = "14/5/2014 14:1:14"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"URL" = "http://mysearch.avg.com/search?cid={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&mid=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&lang=en&ds=avgab0&coid=avgtbavg&cmpid=&pr=sa&d=2014-05-13 14:01:03&v=18.1.0.443&pid=safeguard&sg=&sap=dsp&q={searchTerms}"

[HKCU\Software\AVG SafeGuard toolbar]
"HpGuardStarted" = "1"

[HKCU\Software\AVG SafeGuard toolbar\IE]
"VersionUpdated" = "13/5/2014 14:1:15"

[HKCU\Software\AVG SafeGuard toolbar]
"InstallUser" = "1"

[HKCU\Software\AVG SafeGuard toolbar\SiteSafety\Url]
"2014_05_13_04_01_11_sig" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURLFallback" = "http://mysearch.avg.com/favicon.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\AVG SafeGuard toolbar]
"InstallStats" = "http://stats.avg.com/services/i.asmx/install?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=productpagetrue&hpIE=true&dspIE=true&ntIE=unavailable&hpFF=false&dspFF=false&ntFF=false&hpCH=false&dspCH=false&ntCH=false&hpIEresult=true&dspIEresult=unknown&ntIEresult=false&hpFFresult=unknown&dspFFresult=unknown&ntFFresult=unknown&hpCHresult=false&dspCHresult=false&ntCHresult=false"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"Version" = ""

[HKCU\Software\AVG SafeGuard toolbar]
"DNTUpdateTimeStamp" = "13/5/2014 19:1:12"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\AVG SafeGuard toolbar\FF]
"Revert_HP" = "None"

[HKCU\Software\AVG SafeGuard toolbar]
"IESearchAssetsAdded" = "13/5/2014 14:1:16"

[HKCU\Software\AVG SafeGuard toolbar\IE]
"Revert_DSP" = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

[HKCU\Software\AVG SafeGuard toolbar]
"DNTCurrentVersion" = "14"

[HKCU\Software\AVG SafeGuard toolbar\FF]
"DontUpdateSuggestions" = "1"

[HKCU\Software\AVG SafeGuard toolbar]
"HpRun" = "1"

[HKCU\Software\AVG SafeGuard toolbar\IE]
"Revert_HP_ID" = "99"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"SuggestionsURLFallback" = ""

[HKCU\Software\AVG SafeGuard toolbar\DNT\Settings]
"DNTMigrationComplete" = "2"

[HKCU\Software\AVG SafeGuard toolbar\IE]
"UserShowSuggestions" = "0"

[HKCU\Software\AVG SafeGuard toolbar\FF]
"VersionUpdated" = "13/5/2014 14:1:15"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\AVG SafeGuard toolbar]
"InstallerSession" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 A9 D8 C7 61 18 85 F5 59 30 19 DC 70 2F 2D 09"

[HKCU\Software\AVG SafeGuard toolbar\CH]
"Revert_DSP" = "2"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconPath" = "%Program Files%\AVG SafeGuard toolbar\favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"ShowSearchSuggestionsInAddressGlobal" = "1"

[HKCU\Software\AVG SafeGuard toolbar]
"IEEnabledDate" = "2014-05-13 14:01:03"

[HKCU\Software\AVG SafeGuard toolbar\SiteSafety\Url]
"URL" = "http://stats.avg.com/Services/ssf.asmx/GetFile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\AVG SafeGuard toolbar\CH]
"DontUpdateSuggestions" = "1"

[HKCU\Software\AVG SafeGuard toolbar\IE]
"Revert_HP" = "about:blank"

[HKCU\Software\AVG SafeGuard toolbar\CH]
"VersionUpdated" = "13/5/2014 14:1:15"

[HKLM\SOFTWARE\AVG SafeGuard toolbar\IEG]
"spf" = "62 00 73 00 65 00 61 00 72 00 63 00 68 00 2E 00"

[HKCU\Software\AVG SafeGuard toolbar\FF]
"Revert_KU" = "None"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"SuggestionsURL" = ""

[HKCU\Software\AVG SafeGuard toolbar\SiteSafety\Url]
"NextUpdate" = "DE 07 05 00 03 00 0E 00 0E 00 01 00 0E 00 3B 01"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"DisplayName" = "AVG Secure Search"

[HKCU\Software\AVG SafeGuard toolbar]
"InstallStatsWait" = "13/5/2014 15:1:10"

[HKCU\Software\AVG SafeGuard toolbar\CH]
"Revert_Startup" = "None"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"SuggestionsURL_JSON" = "http://toolbar.avg.com/acp?q={searchTerms}&o=1"

[HKCU\Software\AVG SafeGuard toolbar\SiteSafety\Url]
"LastUpdate" = "DE 07 05 00 02 00 0D 00 0E 00 01 00 0E 00 1C 01"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\AVG SafeGuard toolbar]
"InstallStatsShouldBeSent"

[HKCU\Software\AVG SafeGuard toolbar\SiteSafety\Url]
"failures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\AVG SafeGuard toolbar]
"InstallStatsResend"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\AVG SafeGuard toolbar\\DNT]
"Tabs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\AVG SafeGuard toolbar]
"InstallStatsWait"

The process DriverInstaller.exe:596 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 DB 57 CA 9D C2 3E 64 E2 C6 64 55 60 5A 48 F4"

The process AVG SafeGuard toolbar:3312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F 18 A3 B9 C0 1E 89 BB E2 2D 88 44 9B FF 43 73"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{95B7759C-8C7F-4BF1-B163-73684A933233}"

[HKCU\Software\Microsoft\Internet Explorer\User Preferences]
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977" = "01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0"
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25" = "01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0"

Dropped PE files

MD5	File path
32235123b2a1c32886493bc621316064	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\DriverInstaller.exe
58e8e228f1e85ccd209b40f4779c2bfe	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\DriverInstaller_64.exe
78a63c52dd2c8719cc7f8ca88574db7e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\NativeBrowserApi.dll
9d0e2e019aabf1de7d524b64a321e633	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ScriptHelper.exe
aa1dde375e4457869eda730c93ba7f72	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\SiteSafety.dll
ce72e4e7d8436161f278cd99f4f17d2a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ToolbarUpdater.exe
c49fbd50be15c7fb63bb76a22615d208	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ViProtocol.dll
db7afd29d909e2b12363adacdc9e2121	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgdttbx.dll
9fd4bc46784309176aefa26aa8241da1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgtpx64.sys
e03a1466a8a7b869ebc90b179d777ea4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgtpx86.sys
e1df638b3f78ef000d685f75f699013b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\helper.dll
bf5c875fa44c49d894a4a53e7868615e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\log4cplusU.dll
097e0b9e41a59a425a1d6aa794249053	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\loggingserver.exe
0bdda4f051adb9f20a965adbfeb70e5d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\x64\ScriptHelper.exe
6d7826b5db570d6a1cda299c0bb0f6c7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ConfigFiles\MachineIdCreator.exe
aaa7d53d228e76b4291ac61e987bb058	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ConfigFiles\avguidx.dll
e500598ee8358f18832cbdb1f7ef1515	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles64\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll
5c9c540b532b1a382540721adbbf9ffd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll
0870e4dd11497b5154d8415d5e99e17c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\AVG SafeGuard toolbar
4e8466eac7711c0a058ad99ad9abd94d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\BundleInstall.exe
c3b9140ebea64f3cbe57be7e9ecc807a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\TBAPI.dll
b62eb5114fb81f8480684d44f51dbfd1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Uninstall.exe
a152dfa577dc19b89b052d27bf91a0c3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\lip.exe
df0b7956cc053ed7d1e29b9be25d0a2e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\vprot.exe
e0b73a329a570d1f3594c3dafa894595	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a00660\avg-secure-search-installer.exe
2f1cb7371568776fc578feb8510148b0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\AVGRewardsWorker.dll
78f4402803f507a8eb978649cc3984e1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\DriverInstaller.exe
ffa46363ec9ce2572b39f96cc8bbb7d4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\DriverInstaller_64.exe
486d0f932ff8a272c778a1e748a61a57	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ScriptHelper.exe
83b017935870d4ada363ec59d3488d6b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\SiteSafety.dll
301cfd154d004e5bc5ec092d86adc5db	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ToolbarUpdater.exe
d09ce61bd82e96a4f76e4c1049761bd1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ViProtocol.dll
2f55caac94d302c5373ff317db644d28	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgdttbx.dll
5235d84702262fc9bcf1a35b261cc1ce	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgtpx64.sys
139723c3a6eb619cbd62abb437e930df	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgtpx86.sys
0de164bcd7acaf98d12985caa606b099	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\npsitesafety.dll
05af2d045031bd83a5d988910f2aacf0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ConfigFiles\MachineIdCreator.exe
aaa7d53d228e76b4291ac61e987bb058	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ConfigFiles\avguidx.dll
bc39fca7e32300ecbaee98e75c4fbd0f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\14.0.0.12\AVG SafeGuard toolbar_toolbar.dll
fb3c9e22ba2cb5d9ed84ab046ca97154	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\AVG SafeGuard toolbar
07da2495c8911208579ffbbf0568e232	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\PostInstall.exe
ed1a74f529d0829cf28db53e33a58f38	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Uninstall.exe
b6c65f3edbd95e9b61694b86269f7d2e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\lip.exe
5e299254de2a70d7dbcede30d6462052	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\vprot.exe
f38dbf287b64358bd10fd002dc91c512	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg_a02808\avg-secure-search-installer.exe
635cf67f91f53c1a732d3e1bb671ae74	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe
5c9c540b532b1a382540721adbbf9ffd	c:\Program Files\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll
0870e4dd11497b5154d8415d5e99e17c	c:\Program Files\AVG SafeGuard toolbar\AVG SafeGuard toolbar
4e8466eac7711c0a058ad99ad9abd94d	c:\Program Files\AVG SafeGuard toolbar\BundleInstall.exe
c3b9140ebea64f3cbe57be7e9ecc807a	c:\Program Files\AVG SafeGuard toolbar\TBAPI.dll
b62eb5114fb81f8480684d44f51dbfd1	c:\Program Files\AVG SafeGuard toolbar\Uninstall.exe
a152dfa577dc19b89b052d27bf91a0c3	c:\Program Files\AVG SafeGuard toolbar\lip.exe
df0b7956cc053ed7d1e29b9be25d0a2e	c:\Program Files\AVG SafeGuard toolbar\vprot.exe
db7afd29d909e2b12363adacdc9e2121	c:\Program Files\Common Files\AVG Secure Search\DNTInstaller\18.1.0\avgdttbx.dll
32235123b2a1c32886493bc621316064	c:\Program Files\Common Files\AVG Secure Search\DriverInstaller\18.1.0\DriverInstaller.exe
78a63c52dd2c8719cc7f8ca88574db7e	c:\Program Files\Common Files\AVG Secure Search\NativeBrowserApi\18.1.0\NativeBrowserApi.dll
9d0e2e019aabf1de7d524b64a321e633	c:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\ScriptHelper.exe
aa1dde375e4457869eda730c93ba7f72	c:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\SiteSafety.dll
c49fbd50be15c7fb63bb76a22615d208	c:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0\ViProtocol.dll
ce72e4e7d8436161f278cd99f4f17d2a	c:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe
bf5c875fa44c49d894a4a53e7868615e	c:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\log4cplusU.dll
097e0b9e41a59a425a1d6aa794249053	c:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\loggingserver.exe
e03a1466a8a7b869ebc90b179d777ea4	c:\WINDOWS\system32\drivers\avgtpx86.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\drivers\avgtpx86.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "%System%\drivers\avgtpx86.sys" the Trojan controls operations with a system registry by installing the registry notifier.

The Trojan installs the following kernel-mode hooks:

ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
GoogleUpdate.exe:2868
ToolbarUpdater.exe:3900
avg-secure-search-installer.exe:3104
avg-secure-search-installer.exe:3708
sc.exe:3812
sc.exe:3824
sc.exe:3832
sc.exe:3804
sc.exe:3800
sc.exe:3888
sc.exe:3852
loggingserver.exe:3932
%original file name%.exe:276
OIAssistWTD.exe:608
oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe:3120
MachineIdCreator.exe:3736
MachineIdCreator.exe:3136
ScriptHelper.exe:3988
avg.exe:2804
BundleInstall.exe:3768
BundleInstall.exe:2360
regsvr32.exe:556
vprot.exe:836
DriverInstaller.exe:596
AVG SafeGuard toolbar:3312
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\Temp\toolbar_log.txt (52231 bytes)
%Program Files%\Common Files\AVG Secure Search\InstalledProducts.ini (138 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%System%\config\SOFTWARE.LOG (14092 bytes)
%System%\config\software (4800 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (126 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar_log.txt (233787 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_{AA50609F-E2F0-4467-B048-0D85D9B4FD98}.exe (47143 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\Thumbs.db (10 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12024 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp.html (10 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\loggingserver.exe (673 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\hmac.txt (1 bytes)
%Program Files%\AVG SafeGuard toolbar\about.gif (622 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\loader.gif (4 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\jquery-1.8.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\all.css (26 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\avg_logo_medium.png (3 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\log4cplusU.dll (3073 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\UpdaterConfig.ini (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.5.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-middle.png (974 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow-up.png (3 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\innerBG_gradient.gif (2 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\ChromeGuadDsp.html (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_tooltip.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\updating18.gif (661 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\cg.js (3 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\nt.html (601 bytes)
%Program Files%\AVG SafeGuard toolbar\AVG SafeGuard toolbar (18 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.js (6 bytes)
%Program Files%\AVG SafeGuard toolbar\configuration.xml (18 bytes)
%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\manifest.json (463 bytes)
%Program Files%\AVG SafeGuard toolbar\lip.exe (7385 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\logo2.png (4 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp-bg.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-bzip.txt (1 bytes)
%Program Files%\AVG SafeGuard toolbar\feedback.gif (365 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\Encoding_decoding_base64.txt (991 bytes)
%Program Files%\AVG SafeGuard toolbar\surf-with-caution18.gif (668 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\CPOL license.txt (11 bytes)
%Program Files%\AVG SafeGuard toolbar\uninstall.gif (628 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.js (4 bytes)
%Program Files%\AVG SafeGuard toolbar\labs.gif (567 bytes)
%Program Files%\AVG SafeGuard toolbar\FireFoxSearchXml.tmp (3 bytes)
%Program Files%\Common Files\AVG Secure Search\ToolBandTlb\18.1.0\toolband (6 bytes)
%Program Files%\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0\ViProtocol.dll (4185 bytes)
%Program Files%\AVG SafeGuard toolbar\help.gif (627 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bull4x4.gif (68 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-JasonCpp.txt (1 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\nt28_2.js (45 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\updater.xml (530 bytes)
%Program Files%\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll (24822 bytes)
%Program Files%\AVG SafeGuard toolbar\current.gif (1 bytes)
%Program Files%\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\SiteSafety.dll (673 bytes)
%Program Files%\AVG SafeGuard toolbar\data.zip (673 bytes)
%Program Files%\Common Files\AVG Secure Search\DriverInstaller\18.1.0\DriverInstaller.exe (4185 bytes)
%Program Files%\AVG SafeGuard toolbar\currently-safe18.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\favicon.ico (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Uninstall.exe (14988 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\divider.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\EnableHelperRes\Images\box_ie.png (16 bytes)
%Program Files%\AVG SafeGuard toolbar\BundleInstaller.ini (76 bytes)
%System%\drivers\avgtpx86.sys (42 bytes)
%Program Files%\AVG SafeGuard toolbar\vprot.exe (17627 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\btn-ok2.gif (2 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.8.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_expand.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\upBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\privacy.gif (577 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\uninstall_cp.css (2 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-bsdiff.txt (1 bytes)
%Program Files%\Common Files\AVG Secure Search\DNTInstaller\18.1.0\avgdttbx.dll (3361 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step1.html (1 bytes)
%Program Files%\AVG SafeGuard toolbar\search.gif (366 bytes)
%Program Files%\AVG SafeGuard toolbar\remote_configuration.xml (10 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\downBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\JQueyExtensions.js (465 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\jquery-1.8.1.min.js (601 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.css (885 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\uninstall-bg.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\AVG SafeGuard toolbar\nt28_2.html (168 bytes)
%Program Files%\AVG SafeGuard toolbar\icon18.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\nt28_2.html (4 bytes)
%Documents and Settings%\All Users\Application Data\AVG Secure Search\Logger\logger.properties (371 bytes)
%Program Files%\Common Files\AVG Secure Search\NativeBrowserApi\18.1.0\NativeBrowserApi.dll (4545 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_close.gif (1 bytes)
%Program Files%\AVG SafeGuard toolbar\18.1.0.443\install.ini (112 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\DSPDlg_IE.html (9 bytes)
%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\ScriptHelper.exe (16582 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\avg_logo.png (3 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\downBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom-small.png (972 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\AVG Secure Search\nt28_2.html (4 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-MPL-NPAPI.txt (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\install[1].gif (882 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeGuardRes\cg.css (4 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\PassthruApp.txt (567 bytes)
%Program Files%\AVG SafeGuard toolbar\DSPDlg_IE\upBtn.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp_step2.html (9 bytes)
%Program Files%\AVG SafeGuard toolbar\setup.bmp (601 bytes)
%Program Files%\AVG SafeGuard toolbar\crash.avgdx (2 bytes)
%Program Files%\AVG SafeGuard toolbar\EnableHelperRes\EEImageHandler.html (3 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\loader.gif (19 bytes)
%Program Files%\AVG SafeGuard toolbar\EULA.gif (636 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\rsxjpslc.default\prefs.js.tmp (5 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top-small.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp_logo.png (5 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.css (885 bytes)
%Program Files%\AVG SafeGuard toolbar\TBAPI.dll (10177 bytes)
%Program Files%\AVG SafeGuard toolbar\BundleInstall.exe (22299 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\LICENSE-sparsehash.txt (1 bytes)
%Documents and Settings%\All Users\Application Data\AVG SafeGuard toolbar\CrashReport\crash.avgdx (2 bytes)
%Program Files%\AVG SafeGuard toolbar\active-threats18.gif (663 bytes)
%Program Files%\AVG SafeGuard toolbar\Chrome\content\icons\bg_tracking.gif (5 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step2.html (1 bytes)
%Program Files%\AVG SafeGuard toolbar\EnableHelperRes\Images\Thumbs.db (21 bytes)
%Program Files%\AVG SafeGuard toolbar\CleanHistory.gif (586 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow.png (1 bytes)
%Program Files%\AVG SafeGuard toolbar\Licenses\Log4CPlus.txt (582 bytes)
%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe (12287 bytes)
%Program Files%\AVG SafeGuard toolbar\AvgComponents.manifest (234 bytes)
%Program Files%\AVG SafeGuard toolbar\ChromeRes\AVG Nation toolbar\nt28_2.html (6 bytes)
%Program Files%\AVG SafeGuard toolbar\avgMozXPCOM.js (61 bytes)
%Program Files%\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom.png (967 bytes)
%WinDir%\Temp\avg_secure_search.log (454776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\OIAssistWTD.exe (173361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\Lbnugoxhgk.html (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\13282488921657972529443[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OIC26.tmp (6417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\blank[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\avg-horizontal-new[1].png (98 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AAE8OMVS\avg-logo-small2[1].jpg (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\HShSHeuSFK.mht (3946 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\BFXm14JQKU.mht (1854 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_main.min.js (26084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\E9UY92VW\13282470341657972529308[1].jpg (846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\_utma[1].gif (807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_screen_2_4.min.js (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WJYHCPG4\13353103241657972529591[1].jpg (357 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X33TH0UP\1334599120204897734385[1].png (17425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\Lbnugoxhgk.mht (2925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\BFXm14JQKU.html (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\oilocal_screen_2.min.js (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\avg.exe.part_V9exmJ89oC (1009604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oi_Dzq9w1STvj\HShSHeuSFK.html (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\help.png (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\AVG Secure Search\nt28_2.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ko\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\DriverInstaller.exe (3725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\Chrome\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hi\global.dtd (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\avg_logo.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\AvgComponents.manifest (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\PassthruApp.txt (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\jquery-1.8.1.min.js (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\ChromeExt\18.1.0.443\avg.crx (257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\avg-secure-search-installer.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\icon_search.png (944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ko\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\en\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\propertiesJsm.js (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es-es\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.css (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\ChromeExt\18.1.0.443\ExtensionTemplate.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgtpx64.sys (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\dnt.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\EEImageHandler.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\currently-safe18.png (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sv\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\th\global.properties (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-sparsehash.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\components\avg-dnt-policy.js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\surf-with-caution18.gif (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\help.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp_logo.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hu\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\Facebook.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\uninstall.gif (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\DSPDlg_IE.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ms\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\remote_configuration.xml (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\passwordbox.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\icon18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\locale\en-US\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\uninstall.png (950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\AVG SafeGuard toolbar\nt28_2.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\loader.gif (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\tr\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\all.css (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\cs\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pl\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\Thumbs.db (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fr\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bzip.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\UpdaterConfig.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\vprot.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\lip.exe (6425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tooltip.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\active-threats18.png (829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\CleanHistory.gif (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\CleanHistory.png (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-tw\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\loggingserver.exe (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\ajax-loader.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt-br\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\EULA.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\Images\box_ie.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\divider.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\TBAPI.dll (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\privacy.gif (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fi\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avg-dnt-adapter.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\icon18.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\AVG Nation toolbar\nt28_2.html (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\hmac.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\el\global.properties (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\feedicon.png (500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EULA.gif (636 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nl\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow-up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\logo2.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\configuration.js (851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\questionmarkIcon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step1.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\chrome.manifest (986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\BundleInstall.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\surf-with-caution18.png (859 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ro\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-middle.png (974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avg.xul (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp_step2.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hi\global.properties (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-JasonCpp.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nb\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\components\toolbarhomeApi.js (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\it\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ViProtocol.dll (3706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-tw\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.8.1.min.js (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\labs.gif (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fi\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\log4cplusU.dll (1800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ScriptHelper.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\arrow.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avgJsm.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\feedback.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\el\global.dtd (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\de\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\about.gif (622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\HistoryCleaner.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\IOJsm.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\privacy.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.css (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sr\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\avg_logo_medium.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ConfigFiles\MachineIdCreator.exe (1863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\binarylines.manifest (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom.png (967 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\configuration_0.css (528 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\de\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es-es\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\avg.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\nt.html (111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-top-small.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgtpx86.sys (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\chrome\avg.jar (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\avgMozXPCOM.js (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\CommonCfg.ini (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\search.png (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sk\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\Installer.7z (45823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\active-threats18.gif (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\jquery-1.8.1.min.js (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\updating18.gif (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\updater.xml (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\da\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\avgdttbx.dll (1848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\btn-ok2.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\af\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\manifest.json (185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll (23407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp1.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Uninstall.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\hu\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\x64\ScriptHelper.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\currently-safe18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_expand.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\updating18.png (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\loader.gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\helper.dll (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_close.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ConfigFiles\avguidx.dll (247 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bull4x4.gif (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tracking.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\window-close.png (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nl\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\af\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\SiteSafety.dll (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\Bindings.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\id\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.5.1.min.js (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\avgMozXPCOM.js (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\cs\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\locale\en-US\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\configuration.xml (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\AVG SafeGuard toolbar (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\nb\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\Images\Thumbs.db (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\NativeBrowserApi.dll (3762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\data.zip (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\DriverInstaller_64.exe (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sk\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-cn\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\Log4CPlus.txt (582 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles64\AVG SafeGuard toolbar\18.1.0.443\AVG SafeGuard toolbar_toolbar.dll (44089 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ConfigFiles\installer_cfg.ini (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\labs.png (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ro\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\Encoding_decoding_base64.txt (991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\uninstall_cp.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sv\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ru\global.properties (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pt-br\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ja\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\sr\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp2.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\zh-cn\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\current.png (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\BundleInstaller.ini (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\setup.bmp (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\CPOL license.txt (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\da\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bsdiff.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\innerBG_gradient.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeRes\nt28_2.js (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ToolBand.tlb (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\Images\box-bottom-small.png (972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\crash.avgdx (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\uninstall-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\cg.css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\en\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\search.gif (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\th\global.dtd (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\ChromeGuadDsp.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ms\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\tr\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\feedback.gif (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\JQueyExtensions.js (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\current.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\loader.gif (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\{95B7759C-8C7F-4BF1-B163-73684A933233} (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\it\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\about.png (837 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp.html (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\CommonFiles\AVG SafeGuard toolbar\ToolbarUpdater.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\fr\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\ChromeGuardRes\cg.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-MPL-NPAPI.txt (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\es\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgFiles\AVG SafeGuard toolbar\IeDspHelperRes\ie_dsp_step2.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\Preferences.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\skin\information-24.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\icon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ru\global.dtd (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\pl\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\id\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a00660\ProgData\AVG SafeGuard toolbar\FireFoxExt\18.1.0.443\modules\locale\ja\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\configuration.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\lip.exe (3725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hi\global.dtd (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\CleanHistory.gif (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-JasonCpp.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\window-close.png (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\cs\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\DriverInstaller_64.exe (146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ToolBand.tlb (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\logo2.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es-es\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp_logo.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sr\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ko\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\Bindings.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\feedicon.png (500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-tw\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\Encoding_decoding_base64.txt (991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\UpdaterConfig.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\active-threats18.gif (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bzip.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\PassthruApp.txt (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ConfigFiles\installer_cfg.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\performanceIcon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-sparsehash.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\loader.gif (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bull4x4.gif (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\el\global.dtd (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\uninstall.gif (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sv\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt-br\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\updating18.png (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\propertiesJsm.js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ru\global.dtd (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\IOJsm.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ro\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\search.gif (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\JQueyExtensions.js (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\en\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\AVGRewardsWorker.dll (1843 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\npsitesafety.dll (1846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\PostInstall.exe (1790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\about.png (837 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ScriptHelper.exe (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-cn\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ko\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\icon18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\CommonCfg.ini (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\information-24.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\HistoryCleaner.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\{95B7759C-8C7F-4BF1-B163-73684A933233} (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\labs.png (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ru\global.properties (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\configuration_0.xul (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\el\global.properties (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hu\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\currently-safe18.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nl\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\avg-dnt-adapter.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\uninstall_cp.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\Facebook.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\labs.gif (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\performanceIcon.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pl\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\Images\box_ie.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\PostInstaller.ini (490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\vprot.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\th\global.properties (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ja\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\id\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\hmac.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fr\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon-1G.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\avg.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es-es\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fr\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\en\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sk\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\innerBG_gradient.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\current.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\uninstall-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\cs\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\CleanHistory.png (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\questionmarkIcon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\divider.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Uninstall.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ms\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\loader.gif (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\uninstall.png (950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\about.gif (622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-bsdiff.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\remote_configuration.xml (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\feedback.gif (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\currently-safe18.png (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hu\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\it\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sv\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Facebook.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\surf-with-caution18.gif (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ConfigFiles\avguidx.dll (247 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\active-threats18.png (829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\es\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\configuration_0.css (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nl\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\setup.bmp (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\AVG SafeGuard toolbar (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\btn-ok2.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\current.png (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\Installer.7z (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\all.css (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt-br\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\FireFoxSearchXml.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fi\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\ajax-loader.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\SiteSafety.dll (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\components\toolbarhomeApi.js (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tooltip.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\tr\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\EnableHelperRes\EEImageHandler.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\help.png (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\avgMozXPCOM.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\icon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\help.gif (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\configuration.js (851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\DSPDlg_IE.html (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\locale\en-US\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_close.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\fi\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\feedback.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ConfigFiles\MachineIdCreator.exe (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Uninstall_cp.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\af\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nb\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\hi\global.properties (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_tracking.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\chrome.manifest (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\avgJsm.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\th\global.dtd (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pl\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgtpx86.sys (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\binarylines.manifest (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\pt\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\nb\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Licenses\LICENSE-MPL-NPAPI.txt (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\14.0.0.12\AVG SafeGuard toolbar_toolbar.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sk\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\upBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon-1R.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ja\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\de\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\it\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgdttbx.dll (1849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\id\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ro\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\chrome\avg.jar (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\Images\uninstall\cp-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\ms\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Chrome\content\icons\bg_expand.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\UninstallRes\ClientPackage\jquery-1.5.1.min.js (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\components\nci.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\DriverInstaller.exe (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\ChromeExt\14.0.0.12\avg.crx (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-tw\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\search.png (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon18.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\zh-cn\global.properties (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\Eula.txt (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\tr\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\surf-with-caution18.png (859 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\af\global.properties (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\avg-secure-search-installer.exe (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ViProtocol.dll (1775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\DSPDlg_IE\downBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\de\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\avgtpx64.sys (37 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\updating18.gif (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\da\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\CommonFiles\AVG SafeGuard toolbar\ToolbarUpdater.exe (6386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\sr\global.dtd (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgFiles\AVG SafeGuard toolbar\favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\icon_search.png (944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\locale\en-US\global.dtd (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\components\avg-dnt-policy.js (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\Preferences.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\skin\dnt.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg_a02808\ProgData\AVG SafeGuard toolbar\FireFoxExt\14.0.0.12\modules\locale\da\global.properties (4 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\7614bd6cfa99e546.fb (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\DNT\dt.dat (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ichcop (3476 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\f2cda51fd108941f.fb (366 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\c4e10d1be905349b.fb (627 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\075884af680ff6dc (1 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\90322daed25d1676.fb (12 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\881b3593316772f0 (586 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\49fbbc5a8678d502 (661 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\f2cda51fd108941f (366 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\c8a51ba84752784f (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\SiteSafety\l_2014_05_13_04_01_11.db (676427 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\49fbbc5a8678d502.fb (661 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\613e8ce7ab7106af (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\691f14230153a9e1.fb (668 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\c8a51ba84752784f.fb (6 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\7614bd6cfa99e546 (663 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\613e8ce7ab7106af.fb (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\Chrome\Default\Preferences (601 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\c4e10d1be905349b (627 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\881b3593316772f0.fb (586 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\075884af680ff6dc.fb (1 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\691f14230153a9e1 (668 bytes)
%Documents and Settings%\%current user%\Application Data\AVG SafeGuard toolbar\cache\tmp\90322daed25d1676 (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\AVG SafeGuard toolbar\Chrome\Default\Web Data (601 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vProt" = "%Program Files%\AVG SafeGuard toolbar\vprot.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: AVG Secure Search
Product Name: AVG
Product Version: 1,18,0,3287
Legal Copyright: Copyright (c) 2012
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1,18,0,3287
File Description: AVG Secure Search
Comments:
Language: Language Neutral

Company Name: AVG Secure SearchProduct Name: AVGProduct Version: 1,18,0,3287Legal Copyright: Copyright (c) 2012Legal Trademarks: Original Filename: Internal Name: File Version: 1,18,0,3287File Description: AVG Secure SearchComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	7429	7680	4.42906	62ec144c07618fc47c0575ed8e116fdc
.rdata	12288	774	1024	2.65604	c1521f18eb8b57fc1c67358e79a793b0
.data	16384	304	512	3.62337	404fa0a8af029e0ff8f6d4a6793c20e5
.rsrc	20480	342200	342528	5.54158	d6d8b618f8a2b0d2dec4ef8991ffad98

Dropped from:

Downloaded by:

Similar by SSDeep:

d314578e88d326aae068734e28f5a0be

Similar by Lavasoft Polymorphic Checker:

Total found: 2
d314578e88d326aae068734e28f5a0be
c43af6295ccb08ecbd4df8284407a64b

Network Activity

URLs

URL	IP
hxxp://cloins.com/
hxxp://c04.inst.avg.com/serve/getSetup.php?pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&sid=avgab0:productpage&pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&sid=avgab0:productpage&user_agent=Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0 Safari/537.36	204.193.144.51
hxxp://c04.inst.avg.com/serve/getProgress.php?pid=196879&u=1359695248&lang=en	204.193.144.51
hxxp://c04.inst.avg.com/serve/getTemplate.php?pid=196879&u=1359695247&lang=en	204.193.144.51
hxxp://a74.dscg10.akamai.net/main.min.js?lang=en
hxxp://a74.dscg10.akamai.net/screen_2.min.js?lang=en
hxxp://c04.inst.avg.com/serve/getScreen.php?pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&id=429155&u=1362629748&lang=en	204.193.144.51
hxxp://a74.dscg10.akamai.net/screen_2_4.min.js?lang=en
hxxp://d18j1d26sau8be.cloudfront.net/user_images/13282488921657972529443.jpg	54.230.54.253
hxxp://d18j1d26sau8be.cloudfront.net/user_images/13353103241657972529591.jpg	54.230.54.253
hxxp://a74.dscg10.akamai.net/avg-logo-small2.jpg
hxxp://stats.inst.avg.com/run?p=196879&m=undefined&ua=Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0 Safari/537.36&d_d=1969-12-31&d_h=19&ts=1969-12-31 19:00:00&uq=0&ip=184.107.104.190&g_cc=ca&c_0=c04&pub=75&p=196879&i=196879&ir=http://&u=&pa=17157&s=avgab0:productpage&sl=&ob=Chrome&obv=34.0&os=Windows 8.1&lang=	204.193.144.33
hxxp://a74.dscg10.akamai.net/avg-horizontal-new.png
hxxp://e1793.b.akamaiedge.net/Images/blank.gif
hxxp://d18j1d26sau8be.cloudfront.net/user_images/13282470341657972529308.jpg	54.230.54.253
hxxp://e1793.b.akamaiedge.net/services/_utma.gif?&DistributionSource=hk018&FeatureName=oi_corel_test_ec&EventType=&rand=0.8564754234028279
hxxp://e1793.b.akamaiedge.net/partners/safeguard/14.0.0.12/download/safeguard.exe
hxxp://e1793.b.akamaiedge.net/services/oi.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&UserAccountID=7286ea480c3cc7de&DistributionSource=avgab0&Profile=SATB&Version=14.0.0.12&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13&AdditionalInfoXML=&EventType=Initiate&PRE_FF_ToolbarEnabled=&PRE_IE_ToolbarEnabled=&PRE_FF_NewTabActive=&PRE_IE_NewTabActive=&PRE_FF_DSPTaken=&PRE_IE_DSPTaken=&PRE_CHROME_DSPTaken=&IE_Version=8&FF_Version=0&Chrome_Version=34&DefaultBrowser=IE&LastStep=INSTALLER_ERROR_SUCCESS&LastStepReason=0
hxxp://e1793.b.akamaiedge.net/services/toolbar_updater.aspx
hxxp://a1019.b.akamai.net/partners/safeguard/18.1.0.443/download/safeguard.exe
hxxp://e6845.ce.akamaiedge.net/pca3-g5.crl
hxxp://e6845.ce.akamaiedge.net/CSC3-2010.crl
hxxp://e1793.b.akamaiedge.net/services/i.asmx/install?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=productpagetrue%EXPECTED_PART%%RESULT_PART%
hxxp://e1793.b.akamaiedge.net/services/oi.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&UserAccountID=7286ea480c3cc7de&DistributionSource=avgab0&Profile=SATB&Version=14.0.0.12&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13&AdditionalInfoXML=&EventType=Complete&PRE_FF_ToolbarEnabled=&PRE_IE_ToolbarEnabled=&PRE_FF_NewTabActive=&PRE_IE_NewTabActive=&PRE_FF_DSPTaken=&PRE_IE_DSPTaken=&PRE_CHROME_DSPTaken=&IE_Version=8&FF_Version=29&Chrome_Version=34&DefaultBrowser=IE&LastStep=INSTALLER_ERROR_SUCCESS&LastStepReason=0
hxxp://e1793.b.akamaiedge.net/partners/safeguard/18.1.0.443/IEPackages/remote_configuration.aspx?cid={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&mid=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&lang=en&ds=avgab0&coid=avgtbavg&cmpid=&pr=sa&d=2014-05-13 14:01:03&v=18.1.0.443&pid=safeguard&sg=
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/icon18.gif
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/search.gif
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/dnt.gif
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/CleanHistory.gif
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/Facebook.gif
hxxp://d18j1d26sau8be.cloudfront.net/user_images/1334599120204897734385.png	54.230.54.253
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/updating18.gif
hxxp://c04.inst.avg.com/serve/cb.php?type=fin&pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&stats1=n	204.193.144.51
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/currently-safe18.gif
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/active-threats18.gif
hxxp://e1793.b.akamaiedge.net/partners/safeguard/images/surf-with-caution18.gif
hxxp://stats.inst.avg.com/finish?p=196879&builder=1.0&m=undefined&ua=Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0 Safari/537.36&d_d=1969-12-31&d_h=19&ts=1969-12-31 19:00:00&uq=0&ip=184.107.104.190&g_cc=ca&c_0=c04&pub=75&p=196879&i=196879&ir=http://&u=&pa=17157&s=avgab0:productpage&sl=&ob=Chrome&obv=34.0&os=Windows 8.1&lang=&ev=200&off=oid,1757;sc,429155;r,true;ispr,false;acc,true;canc,false;sta,\|&perf=getUuid,1250;getSetup,922;eInit,16;formPages,0;selLang,0;getPages,1391;waitPages,0;load,234;create,15;show,109203;&rid=	204.193.144.33
hxxp://e1793.b.akamaiedge.net/services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=08-HP Guard Enabled&FeatureToGuard=HP_GUARD&ValueBeforeGuard=about:blank&Action=01-Auto-Guard-Silent
hxxp://e1793.b.akamaiedge.net/Services/ssf.asmx/GetFile
hxxp://stats.inst.avg.com/	204.193.144.33
hxxp://dnt.cloud.avg.com/ver.txt	204.193.144.67
hxxp://a1019.b.akamai.net/sitesafety/last.dat
hxxp://dnt.cloud.avg.com/dat.js?a=1	204.193.144.67
hxxp://e1793.b.akamaiedge.net/services/i.asmx/install?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=productpagetrue&hpIE=true&dspIE=true&ntIE=unavailable&hpFF=false&dspFF=false&ntFF=false&hpCH=false&dspCH=false&ntCH=false&hpIEresult=true&dspIEresult=true&ntIEresult=false&hpFFresult=unknown&dspFFresult=unknown&ntFFresult=unknown&hpCHresult=false&dspCHresult=false&ntCHresult=false
hxxp://e1793.b.akamaiedge.net/services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=0_0_0_-1&FeatureToGuard=DSP_GUARD_DI&ValueBeforeGuard=AVG Secure Search&Action=05-User Change DSP from IE
hxxp://e1793.b.akamaiedge.net/services/_utma.gif?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&EventType=OK&FeatureName=DSP_POPUP_WND
hxxp://e1793.b.akamaiedge.net/services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=0_0_0_-1&FeatureToGuard=DSP_GUARD_DI&ValueBeforeGuard=AVG Secure Search&Action=06-Activate driver
hxxp://stats.avg.com/services/oi.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&UserAccountID=7286ea480c3cc7de&DistributionSource=avgab0&Profile=SATB&Version=14.0.0.12&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13&AdditionalInfoXML=&EventType=Initiate&PRE_FF_ToolbarEnabled=&PRE_IE_ToolbarEnabled=&PRE_FF_NewTabActive=&PRE_IE_NewTabActive=&PRE_FF_DSPTaken=&PRE_IE_DSPTaken=&PRE_CHROME_DSPTaken=&IE_Version=8&FF_Version=0&Chrome_Version=34&DefaultBrowser=IE&LastStep=INSTALLER_ERROR_SUCCESS&LastStepReason=0	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/14.0.0.12/download/safeguard.exe	23.208.87.117
hxxp://stats.avg.com/services/toolbar_updater.aspx	23.208.87.117
hxxp://crl.verisign.com/pca3-g5.crl	23.50.69.163
hxxp://stats.avg.com/services/_utma.gif?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&EventType=OK&FeatureName=DSP_POPUP_WND	23.208.87.117
hxxp://stats.avg.com/services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=0_0_0_-1&FeatureToGuard=DSP_GUARD_DI&ValueBeforeGuard=AVG Secure Search&Action=06-Activate driver	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/images/surf-with-caution18.gif	23.208.87.117
hxxp://download-toolbar.avg.com/sitesafety/last.dat	207.109.111.42
hxxp://oi.cloud.avg.com/	204.193.144.33
hxxp://stats.avg.com/services/_utma.gif?&DistributionSource=hk018&FeatureName=oi_corel_test_ec&EventType=&rand=0.8564754234028279	23.208.87.117
hxxp://st.cloins.com/	204.193.144.89
hxxp://toolbar.avg.com/partners/safeguard/images/CleanHistory.gif	23.208.87.117
hxxp://c12081072.r72.cf2.rackcdn.com/main.min.js?lang=en	165.254.32.122
hxxp://stats.avg.com/services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=0_0_0_-1&FeatureToGuard=DSP_GUARD_DI&ValueBeforeGuard=AVG Secure Search&Action=05-User Change DSP from IE	23.208.87.117
hxxp://c12081072.r72.cf2.rackcdn.com/screen_2.min.js?lang=en	165.254.32.122
hxxp://c12081072.r72.cf2.rackcdn.com/screen_2_4.min.js?lang=en	165.254.32.122
hxxp://download-toolbar.avg.com/partners/safeguard/18.1.0.443/download/safeguard.exe	207.109.111.42
hxxp://c15040647.r47.cf2.rackcdn.com/avg-logo-small2.jpg	165.254.32.129
hxxp://stats.avg.com/services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=08-HP Guard Enabled&FeatureToGuard=HP_GUARD&ValueBeforeGuard=about:blank&Action=01-Auto-Guard-Silent	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/images/active-threats18.gif	23.208.87.117
hxxp://stats.avg.com/services/oi.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&UserAccountID=7286ea480c3cc7de&DistributionSource=avgab0&Profile=SATB&Version=14.0.0.12&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13&AdditionalInfoXML=&EventType=Complete&PRE_FF_ToolbarEnabled=&PRE_IE_ToolbarEnabled=&PRE_FF_NewTabActive=&PRE_IE_NewTabActive=&PRE_FF_DSPTaken=&PRE_IE_DSPTaken=&PRE_CHROME_DSPTaken=&IE_Version=8&FF_Version=29&Chrome_Version=34&DefaultBrowser=IE&LastStep=INSTALLER_ERROR_SUCCESS&LastStepReason=0	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/images/search.gif	23.208.87.117
hxxp://stats.avg.com/services/i.asmx/install?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=productpagetrue&hpIE=true&dspIE=true&ntIE=unavailable&hpFF=false&dspFF=false&ntFF=false&hpCH=false&dspCH=false&ntCH=false&hpIEresult=true&dspIEresult=true&ntIEresult=false&hpFFresult=unknown&dspFFresult=unknown&ntFFresult=unknown&hpCHresult=false&dspCHresult=false&ntCHresult=false	23.208.87.117
hxxp://isearch.avg.com/Images/blank.gif	23.208.87.117
hxxp://csc3-2010-crl.verisign.com/CSC3-2010.crl	23.50.69.163
hxxp://toolbar.avg.com/partners/safeguard/images/updating18.gif	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/images/dnt.gif	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/images/currently-safe18.gif	23.208.87.117
hxxp://c15040647.r47.cf2.rackcdn.com/avg-horizontal-new.png	165.254.32.129
hxxp://stats.avg.com/Services/ssf.asmx/GetFile	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/images/Facebook.gif	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/18.1.0.443/IEPackages/remote_configuration.aspx?cid={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&mid=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&lang=en&ds=avgab0&coid=avgtbavg&cmpid=&pr=sa&d=2014-05-13 14:01:03&v=18.1.0.443&pid=safeguard&sg=	23.208.87.117
hxxp://toolbar.avg.com/partners/safeguard/images/icon18.gif	23.208.87.117
hxxp://stats.avg.com/services/i.asmx/install?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=productpagetrue%EXPECTED_PART%%RESULT_PART%	23.208.87.117

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /partners/safeguard/14.0.0.12/download/safeguard.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OI build 3287)

Host: toolbar.avg.com

Connection: Close

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Tue, 01 Jan 2013 09:57:57 GMT

Accept-Ranges: bytes

ETag: "7c23c4796e8cd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 2940496

Date: Tue, 13 May 2014 10:59:24 GMT

Connection: close

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s.V.s.V.s.V.<.V.s.V..<V.s.V..-V.s.V..;V.s.V.. V.s.V.s.V.s.V..1V.s.V..,V.s.V..)V.s.VRich.s.V................PE..L..../.P.................n...R ...................@.......................... -.....#.-...@.....................................P.... ....*...........,.P.....-.@...................................`...@............................................text....m.......n.................. ..`.rdata...E.......F...r..............@..@.data...`N..........................@....rsrc.....*.. ....*.................@..@.reloc........-.......,.............@..B.................................................................................................................................................................................................................................................................................................................................................|$..u.3...t$..-r..Y..t$..Eq..Y..f....u.!>3.@.WP..YY....t..~...3..h`.A..t$........A......V3.j...Z.....N.... .....3.Ju....`.A.A......r.......!...`.A............3..`.A.A...\.A.;.r.....A...@..T1....u.....A.m.@.^.U..V.u.....W..........t...93.#....3...M.A.}..w..}..r[.}.....}.S3..m.......#.............#.3........#.3.........3<.....M...u.[....93.#....3...M.A.}..w._^]...._...U.........(.A.3..E..E.S.].VW.p....P.3..E...l.....h....u..u...L..Y;........E.3.C.}..E..u..]..u..u..u..u..]........p....E.9u.w.r.9E.

<<< skipped >>>

GET /avg-logo-small2.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: c15040647.r47.cf2.rackcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 26 Jun 2012 18:44:52 GMT

ETag: 4bb85c10148c978c2a65041d27d40c5c

X-Trans-Id: tx1c45c8c6100642c48e3e6-00536d6d08ord1

Content-Length: 3221

Accept-Ranges: bytes

X-Timestamp: 1340736291.81897

Content-Type: application/octet-stream

Cache-Control: public, max-age=2455

Expires: Tue, 13 May 2014 11:40:13 GMT

Date: Tue, 13 May 2014 10:59:18 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......<.....-hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:3DCB04FDB7E311E1BC05F339A0742F20" xmpMM:DocumentID="xmp.did:3DCB04FEB7E311E1BC05F339A0742F20"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3DCB04FBB7E311E1BC05F339A0742F20" stRef:documentID="xmp.did:3DCB04FCB7E311E1BC05F339A0742F20"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................2.g..........................................................................................!1..A.Qaq."....2Br#......R...........................!1..A.Qq...".a...2B..Rr.3.4.............?..t..?RL..@..34. YG......{n.....Dt.....~.R.;o._*.Q.bL.NB^E.E*.'.......v....H.N\q.g...j.3U>q.....d.TG.). ]n...........T..X.:..0.B...I..t(.q.....Qibb....65kj.nAJ9IT.\...^h.....).S........P...iN9.U.o.,...,......(..xI...........a..........?.................p3..V40;E./P. 0...

<<< skipped >>>

GET /avg-horizontal-new.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: c15040647.r47.cf2.rackcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 04 Apr 2013 22:06:25 GMT

ETag: f6a669ad6c8e839e98f7db06a2743be5

X-Trans-Id: tx26151a1aa2074d8ca24f3-005359e229ord1

Content-Length: 7670

Accept-Ranges: bytes

X-Timestamp: 1365113184.41223

Content-Type: application/octet-stream

Cache-Control: public, max-age=2469

Expires: Tue, 13 May 2014 11:40:27 GMT

Date: Tue, 13 May 2014 10:59:18 GMT

Connection: keep-alive

.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

POST /serve/getSetup.php?pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&sid=avgab0:productpage&pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&sid=avgab0:productpage&user_agent=Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0 Safari/537.36 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: c04.inst.avg.com

Content-Length: 191

Connection: Close

v=1,18,0,3287&m=a098981184d31a4ffa83b5b0e95b3a6e&smb=c813ad9c39a9eb0fe04d11bfd8b0b976&mcs=00:50:56:3E:C4:83&mavg=2590d390edff4713af4b84cf713f6e90&havg=dcee3c902911a3b91a9dbeb00b44da600dd1d96a

HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:15 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.3.10-1ubuntu3.9

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Set-Cookie: PHPSESSID=ral61i9g9q6ig64r8vbm7g0435; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

1e3c..{"oistat_host":"http:\/\/stats.inst.avg.com","oistat_cluster":"c04","placement_id":"196879","publisher_id":"75","avg_machine_id":null,"pub_tracker":"","min_req_offers":0,"disableDynamicOffers":true,"autoRunOffers":true,"latest_version":2,"latest_version_url":"http:\/\/c04.inst.avg.com\/serve\/dl.php?rebuild=y&pid=196879","spi_approved":"0","url_params":"&ua=Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0 Safari/537.36&d_d=1969-12-31&d_h=19&ts=1969-12-31 19:00:00&uq=0&ip=184.107.104.190&g_cc=ca&c_0=c04&pub=75&p=196879&i=196879&ir=http://&u=&pa=17157&s=avgab0:productpage&sl=&ob=Chrome&obv=34.0&os=Windows 8.1&lang=","window":{"showborder":true,"type":"window","minimize":false,"close":true,"topmost":false,"fadein":0},"acceptLimit":99,"offersLimit":99,"path_id":"17157","events":{"complete":" var req = Lib.newXmlHttp();\n req.open('GET', 'http:\/\/c04.inst.avg.com\/serve\/cb.php?type=fin&pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&stats1=n', false);\n req.send(null); \nfunction getEstRev(){\n var accepted = JSON.parse(Sys.configObject.prop('acceptedOffers').toString());\n var totalRev = 0;\n for(var id in accepted){\n var offer = accepted[id];\n if(offer && typeof(offer.estRev) != 'undefined' && offer.estRev){\n totalRev = parseFloat(offer.estRev);\n }\n }\n return totalRev.toFixed(2);\n}\n","init":" Sys.configObject.setProp('oistat_br', JSON.stringify({ie : Lib.GetIEVer

<<< skipped >>>

GET /services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=0_0_0_-1&FeatureToGuard=DSP_GUARD_DI&ValueBeforeGuard=AVG Secure Search&Action=05-User Change DSP from IE HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=bvjhi1fml44lgqpog2deeedd

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 11:01:16 GMT

Content-Length: 2693

Connection: keep-alive

..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head><title>..</title>.. <script type="text/javascript">.. function window_onload() {.. var ValueBeforeGuard = 'AVG Secure Search'.. if (ValueBeforeGuard.indexOf('blekko.com') != -1) {.. var userHomePage = GetHP();.. //If contains AVG:.. if (userHomePage.indexOf('avg') != -1) {.. var protocol = document.location.protocol;.. document.location = protocol "//isearch.avg.com/pages/RedirectHp.aspx?hp=" escape(userHomePage);.. }.. else {.. document.location = userHomePage;.. }.. }.. }.. function GetHP() {.. var _IEInstallationFolderName = "AVG Secure Search";.. var homePage = "";.. if (typeof window.toolbarhomeAPI != "undefined") {.. var xpcom;.. if (typeof window.toolbarhomeAPI.isAPIReady != "undefined") {.. xpcom = window.toolbarhomeAPI;.. } else {.. xpcom = window.toolbarhomeAPI.wrappedJSObject;.. }.. homePage = xpcom.GetHomePage();.. }.. else {.. //IE.. try {.. var sh = new ActiveXObject('Scri

<<< skipped >>>

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=bvjhi1fml44lgqpog2deeedd

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 11:01:16 GMT

Content-Length: 2685

Connection: keep-alive

POST / HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Host: st.cloins.com

Content-Length: 229

installer_id=1434547&installation_uuid=0&data=qBwBomChCoOBNq2Rstdv1fGsbE9ujinClUltpMR80Ff4vBTWksliSwLsKBmwUwmhOuYnw03EL+7Z32i07p0B0q4E7Y7NofDfM0/4UeEvjnicpGAuEnrc5A==&signature=b6619dabad4386161065a94b70121b21&do=recv_message

HTTP/1.1 502 Bad Gateway

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:24 GMT

Content-Type: text/html

Content-Length: 575

Connection: close

<html>..<head><title>502 Bad Gateway</title></head>..<body bgcolor="white">..<center><h1>502 Bad Gateway</h1></center>..<hr><center>nginx/1.1.19</center>..</body>..</html>................

GET /screen_2_4.min.js?lang=en HTTP/1.1

Host: c12081072.r72.cf2.rackcdn.com

Connection: Close

HTTP/1.1 200 OK

Last-Modified: Mon, 05 Aug 2013 21:46:05 GMT

ETag: 7b4fd2f1b9bb4b4074567e8cf2b2f277

X-Trans-Id: tx2adecf6887b54d13ad1be-005331f077ord1

X-Object-Meta-Cb-Modifiedtime: Mon, 05 Aug 2013 21:16:39 GMT

X-Timestamp: 1375739164.80528

Content-Type: application/x-javascript

Cache-Control: public, max-age=3071

Expires: Tue, 13 May 2014 11:50:27 GMT

Date: Tue, 13 May 2014 10:59:16 GMT

Content-Length: 209

Connection: close

.if(typeof(win)=='undefined'){window.external.Sys.log(1,'outer_core.js loaded before core?! win not available');}.else if(typeof(win.external.onPageClose)!="undefined"){win.external.onPageClose=CancelRequest;}..

GET /CSC3-2010.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: csc3-2010-crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "2237f9e4cdee23e13ed43192ff19e040:1399972210"

Last-Modified: Tue, 13 May 2014 09:10:10 GMT

Accept-Ranges: bytes

Content-Length: 126346

Date: Tue, 13 May 2014 11:00:16 GMT

Connection: keep-alive

Content-Type: application/pkix-crl

0....0...l...0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA..140513090003Z..140527090003Z0...N0!....c..k....D.k.....120708062201Z0!... _...u.t.=.<.&...130218061114Z0!...&..].....P.k.:...120125130117Z0!...7P.x....8.Q...s..130227010252Z0!...J.....Q..Y.[.....110404153956Z0!...d...=..q!_...g9..130729145216Z0!...l.....h2<.H......120329152211Z0!...q.9...`H.*.Y.C...120525202212Z0!...s...TM.......0...121221080842Z0!...t..,.. ...eL.....130314222305Z0!...y..r.HW.v.....w..140423054643Z0!..../u.......A..5...101214165045Z0!.....0.Xc...%...iM..121102230226Z0!.......S.a&.X5t.E]..111206083350Z0!....c.(....B.[M83...140108164517Z0!....A.Sv.....f,.....110609003155Z0!.....z......!.ID{]..101228182208Z0!....b^......{d.J'...130102154110Z0!......0..........I..130912181631Z0!....6e...~..T.......130131012247Z0!.........bD#*u......130226223939Z0!.......@..'$.).;}\..130121172259Z0!....7.v..........n..120724160733Z0!....P;.Y..d...c.(...120209181451Z0!.....].bb[.....!....140328205453Z0!.....a...L`..IV.....130402103508Z0!......fFW.z.....@T..130117000242Z0!...........].{7.....120730000000Z0!...".......Z.V.,.e..121031192224Z0!...'....[.1......g..130318195659Z0!...,GI.jH.|...J.....120518121623Z0!...<%a.=.d.......O..120424164254Z0!...@........... .a..121109212441Z0!...L.&L..o.8..=6....110311141238Z0!...L...5...s $.=.=..130205142241Z0!...O.c.........t....130109132228Z0!...X.BS.G]T.l.w.i..

<<< skipped >>>

GET /serve/cb.php?type=fin&pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&stats1=n HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: c04.inst.avg.com

Connection: Keep-Alive

Cookie: PHPSESSID=ral61i9g9q6ig64r8vbm7g0435

HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Tue, 13 May 2014 11:01:08 GMT

Content-Type: image/gif

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.3.10-1ubuntu3.9

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

2a..GIF89a.............!.......,...........L.;..0..

GET /user_images/13353103241657972529591.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: d18j1d26sau8be.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 357

Connection: keep-alive

Date: Sat, 12 Apr 2014 13:00:20 GMT

Last-Modified: Tue, 24 Apr 2012 23:32:05 GMT

ETag: "c937c35b4b1f7526486efeeea1d7fb85"

Accept-Ranges: bytes

Server: AmazonS3

Age: 35705

X-Cache: Hit from cloudfront

Via: 1.1 62a625a9160d2c0d9075a19216a50cc7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: M-EXvWa5Vd5jXJGPkzE5fR9W9OWVYeUWg0M0YmvWr8etOxbkpzLkJA==

......Exif..II*.................Ducky.......<......Adobe.d.................................................................................................................................................=...............Q...........................................................................................?......P.@...................(..D.P@..........HTTP/1.1 200 OK..Content-Type: application/octet-stream..Content-Length: 357..Connection: keep-alive..Date: Sat, 12 Apr 2014 13:00:20 GMT..Last-Modified: Tue, 24 Apr 2012 23:32:05 GMT..ETag: "c937c35b4b1f7526486efeeea1d7fb85"..Accept-Ranges: bytes..Server: AmazonS3..Age: 35705..X-Cache: Hit from cloudfront..Via: 1.1 62a625a9160d2c0d9075a19216a50cc7.cloudfront.net (CloudFront)..X-Amz-Cf-Id: M-EXvWa5Vd5jXJGPkzE5fR9W9OWVYeUWg0M0YmvWr8etOxbkpzLkJA==........Exif..II*.................Ducky.......<......Adobe.d.................................................................................................................................................=...............Q...........................................................................................?......P.@...................(..D.P@..............

<<< skipped >>>

GET /user_images/13282470341657972529308.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: d18j1d26sau8be.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 3113

Connection: keep-alive

Date: Sat, 12 Apr 2014 13:00:21 GMT

Last-Modified: Fri, 03 Feb 2012 05:30:34 GMT

ETag: "420f1bf12ad00fe0394de5d5038e0ec9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 35706

X-Cache: Hit from cloudfront

Via: 1.1 62a625a9160d2c0d9075a19216a50cc7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9SmagctVA6C6f6S5TP0GA2cAiKs4ZuVUMCOhyrIph-e1S8JcsHq3jA==

......Exif..II*.................Ducky.......d.....qhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:79C757149A0EE111B50C8D4833E0FED9" xmpMM:DocumentID="xmp.did:D51F97AA464911E198589726E552C74C" xmpMM:InstanceID="xmp.iid:D51F97A9464911E198589726E552C74C" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:09801174072068119109FAB48247CDD2" stRef:documentID="xmp.did:79C757149A0EE111B50C8D4833E0FED9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................(..............._..............................................................a.Q...........................!............?.....;..JL.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L.....[..L..

<<< skipped >>>

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: st.cloins.com

Content-Length: 37

Connection: Close

&do=init_install&installer_id=1434547

HTTP/1.1 502 Bad Gateway

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:14 GMT

Content-Type: text/html

Content-Length: 575

Connection: close

GET /serve/getScreen.php?pid=196879&k=43a9519ed4b5e9c75eb7d683e3d1e09708f9b34a&id=429155&u=1362629748&lang=en HTTP/1.1

Cookie: PHPSESSID=ral61i9g9q6ig64r8vbm7g0435

Host: c04.inst.avg.com

Connection: Close

HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:16 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.3.10-1ubuntu3.9

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Pragma: public

Cache-Control: maxage=86400

Expires: Wed, 14 May 2014 10:59:16 GMT

X-HTML-PackageType: none

1f10..<!doctype html>.<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<style type="text/css" >..html body{. overflow:hidden;. margin:0;. padding:0;.}.#idCancelDiv {. text-align: left;. padding-left: 15px;. padding-top: 8px;. float: none;.}...barblock {. height: 80px;. width: 100%;.}...destination_block {. text-align: left;. padding-left: 15px;.}...progress_status, .pbar {. float: left;.}..filename_block {. text-align: left;. padding-left: 15px;. padding-top: 7px;. margin-bottom: 4px;. font-size: 90%;.}..progress_status {. margin-left: 10px;. width: 60px;. font-size: 85%;.}..barblock_odd {. background-color: #F5F5F5;.}..barblock_even {. background-color: white;.}..pbar {. width: 530px;. overflow:hidden;. border: 1px #ddd solid;. background: #ddd;. height: 23px;. font-size: 15px; font-family: Arial; font-weight: bold; line-height: 15px;. margin-left: 30px;.}...innerbar {. width: 0px;. height: 23px; . background-color: blue; . position: absolute;. margin:0;. padding:0;. overflow: hidden;. float: left;.}..percentbar {. font-size: 15px; . position: relative;. color: #F5F5F5;. line-height: 24px;. text-indent: 18px; . width: 100%;. text-align: left;.}..#dialog-confirm {. display: none;.}...ui-dialog {. font-size: 90%;.}..#cancelConfirm h1.cancelH1{. font-size: 14px !important;. text-align: left;.}..#cancelConfi

<<< skipped >>>

POST / HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Host: st.cloins.com

Content-Length: 279

installer_id=1434547&installation_uuid=0&data=qBwBomChCoOBNq2Rstdv1fFCH6t0WCrU6X7UTYaycVwYxXTew2swMc5zdUhirpfL2tgR0ZxVgxuMt7axMgWZQ7cmEGc2rRToP4DpnGK/h3ygPi0273S8UoNLJQTvUx5wOZRRSLd1TYyTmG20TofO2J5YQmQNJLd27xxrunQF80g=&signature=e6649f5d2bbcbf4f81acccf36c3e04a9&do=recv_message

HTTP/1.1 502 Bad Gateway

Server: nginx/1.1.19

Date: Tue, 13 May 2014 11:01:11 GMT

Content-Type: text/html

Content-Length: 575

Connection: close

GET /services/oi.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&UserAccountID=7286ea480c3cc7de&DistributionSource=avgab0&Profile=SATB&Version=14.0.0.12&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13&AdditionalInfoXML=&EventType=Initiate&PRE_FF_ToolbarEnabled=&PRE_IE_ToolbarEnabled=&PRE_FF_NewTabActive=&PRE_IE_NewTabActive=&PRE_FF_DSPTaken=&PRE_IE_DSPTaken=&PRE_CHROME_DSPTaken=&IE_Version=8&FF_Version=0&Chrome_Version=34&DefaultBrowser=IE&LastStep=INSTALLER_ERROR_SUCCESS&LastStepReason=0 HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 807

Date: Tue, 13 May 2014 11:00:03 GMT

Connection: keep-alive

POST /services/toolbar_updater.aspx HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Content-Length: 851

Connection: Keep-Alive

Cache-Control: no-cache

data=

IEsafeguard{BAA5F813-2F3F-44D6-8008-FC44B22AF21A}14.0.0.122590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85enSATBavgab02014-05-13 14:00:03notfoundnotfoundapp-profileIE8Installer

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/xml; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 583

Date: Tue, 13 May 2014 11:00:03 GMT

Connection: keep-alive

Set-Cookie: ASP.NET_SessionId=rmkou3q0nz0u24i3gjadpnn5; path=/; HttpOnly

<RemoteUpdater>.. <ServerID>TB2-SELF-WFE15</ServerID>.. <NextInterval>24</NextInterval>.. <Toolbars>.. <Toolbar>.. <version>18.1.0.443</version>.. <update>1</update>.. <sg></sg>.. <url>hXXp://download-toolbar.avg.com/partners/safeguard/18.1.0.443/download/safeguard.exe</url>.. <url2></url2>.. <url3>hXXp://download-toolbar.avg.com/partners/safeguard/18.1.0.443/download/safeguard.exe</url3>.. <timeout>180</timeout>.. <cid>{BAA5F813-2F3F-44D6-8008-FC44B22AF21A}</cid>.. <Commands />.. </Toolbar>.. </Toolbars>..</RemoteUpdater>HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/xml; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Content-Length: 583..Date: Tue, 13 May 2014 11:00:03 GMT..Connection: keep-alive..Set-Cookie: ASP.NET_SessionId=rmkou3q0nz0u24i3gjadpnn5; path=/; HttpOnly..<RemoteUpdater>.. <ServerID>TB2-SELF-WFE15</ServerID>.. <NextInterval>24</NextInterval>.. <Toolbars>.. <Toolbar>.. <version>18.1.0.443</version>.. <update>1</update>.. <sg></sg>.. <url>hXXp://download-toolbar.avg.com/partners/safeguard/18.1.0.443/download/safeguard.exe</url>.. <url2></url2>.. <url3>hXXp://download-toolbar.avg.com/

<<< skipped >>>

POST / HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Host: st.cloins.com

Content-Length: 229

installer_id=1434547&installation_uuid=0&data=qBwBomChCoOBNq2Rstdv1fGsbE9ujinClUltpMR80Ff4vBTWksliS/MSZzZaneiHzBYKNqcAU/XVr0S0lCAHfCdfcBv0oqIoQHNrRKFquHZfKD2TS6cAMg==&signature=dd250020f79ba3de04bf3b554a390401&do=recv_message

HTTP/1.1 502 Bad Gateway

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:23 GMT

Content-Type: text/html

Content-Length: 575

Connection: close

HEAD /partners/safeguard/14.0.0.12/download/safeguard.exe HTTP/1.1

Connection: Close

Host: toolbar.avg.com

Content-Length: 0

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Tue, 01 Jan 2013 09:57:57 GMT

Accept-Ranges: bytes

ETag: "7c23c4796e8cd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 2940496

Cache-Control: max-age=24106

Date: Tue, 13 May 2014 10:59:23 GMT

Connection: close

GET /dat.js?a=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

Host: dnt.cloud.avg.com

Accept: */*

Accept-Encoding: gzip, deflate

Accept-Language: en-us

UA-CPU: x86

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/javascript

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 11:01:11 GMT

Connection: close

2178393b2e3f3d3528333f29786001781b3e7a143f2e2d35283129787678093539333b367a182f2e2e3534297876780d3f387a1b343b36232e33392978077678332e3f37297860012178333e7860786b787678343b373f7860780122716b077876783b333e7860786b7876782a3b2e2e3f283478607872060674222a6b060674282f6e060674393537263935342e3f342e060674282f6e06067439353706067533373b3d3f290606752a33223f3673787678393b2e3f3d3528237860781b3e7a143f2e2d352831297876783b392e3335347860783836353931787678293935283f7860786a7876782a293436053e397860786a7876783b343534053e397860786b7876783e3b2e3b052932287860786a7876783e3b2e3b05283f2e7860786b787678352a2e05352f2e786078322e2e2a607575222a362f2935343f7439353775352a2e352f2e74322e37367876782a282c052a3536333923786078322e2e2a607575222a362f2935343f74393537752a28332c3b3923742a322a7827762178333e78607868787678343b373f786078686e756d7a083f3b367a173f3e333b7876783b333e786078687876782a3b2e2e3f2834786078686e6d283f3b36373f3e333b060674393537060675283f3b36373f3e333b0606753b3e2906067539283f3b2e332c3f29787678393b2e3f3d3528237860781b3e7a143f2e2d352831297876783b392e3335347860783836353931787678293935283f7860786a7876782a293436053e397860786a7876783b343534053e397860786b7876783e3b2e3b052932287860786b7876783e3b2e3b05283f2e7860786b787678352a2e05352f2e786078322e2e2a6075752d2d2d74686e6d283f3b36373f3e333b74393537751f14770f0975352a2e77352f2e74322e37367876782a282c052a3536333923786078322e2e2a607575686e6d283f3b36373f3e333b74393537751f14770f09752a28332c3b3923772a353633392374322e3736797827762178333e78607869787678343b373f78607869691b39283529297876783b333e786078697876782a3b2e2e

<<< skipped >>>

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: st.cloins.com

Content-Length: 221

Connection: Close

installer_id=1434547&installation_uuid=0&data=SVXAMgvOmLOUSkXsSbGYX3vfgzaCUoIKxEoO/QjZgzvwVM8z4yp4v/T6F7EAOf8b8szr2jRUk1WmAPEkEh/y/tu60j6cLj/f8Z2C4rDQXAE=&signature=be4f631e489fdcc4548c077a54762250&do=get_offers

HTTP/1.1 502 Bad Gateway

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:15 GMT

Content-Type: text/html

Content-Length: 575

Connection: close

POST /finish?p=196879&builder=1.0&m=undefined&ua=Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0 Safari/537.36&d_d=1969-12-31&d_h=19&ts=1969-12-31 19:00:00&uq=0&ip=184.107.104.190&g_cc=ca&c_0=c04&pub=75&p=196879&i=196879&ir=http://&u=&pa=17157&s=avgab0:productpage&sl=&ob=Chrome&obv=34.0&os=Windows 8.1&lang=&ev=200&off=oid,1757;sc,429155;r,true;ispr,false;acc,true;canc,false;sta,|&perf=getUuid,1250;getSetup,922;eInit,16;formPages,0;selLang,0;getPages,1391;waitPages,0;load,234;create,15;show,109203;&rid= HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: stats.inst.avg.com

Content-Length: 9483

Connection: Close

installer_id=1434547&installation_uuid=0&data=bIc0OlWOzkA5eAAt/bedEThjMCzRm2NX9SOPff1v5idnG7tjjzP/Ib/svq5L3yjRWYqKjOYg3YJMjWa7yUY8ZqTio+mYldI0nqcbc7yr1Rlo/v2McgfnhuMjTcHjq9JmcywgnnkfUS+KA5yB0XKMnKfP7o/BXaoeH5mT0hqsB6GUWwE8alqft40T3OOJ2RM+2guDaasrsvNSVvG/TQm3HspKIjjmauKcU31BL10I0DrBtG/or74nzypUEcol1dR3qvoRHeuypKZm2LQcrZMKlcxqLAMfyXiFPObk1NaRwmfdJ924aUkIHoUhyJEaHiB8SbNkZV9Jb2uxcyS1ikf1o/VymswWfh1JybRtACtVzNLYtSqjcFbYgMnCFraXP7CVx8na1r2t+ArodG08HJC1k5DllbcrB7JCb20ZawlqJH9diMLAuwFZMAWVCKxlSk1LZ4ehgzOp056N9dvEkIRV9eSqyZgFRj78r

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 11:01:09 GMT

Connection: close

Content-Length: 1

1..

GET /pca3-g5.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "895f8ccd92dfec674c94f0d04d1b63bc:1396128308"

Last-Modified: Sat, 29 Mar 2014 21:25:08 GMT

Accept-Ranges: bytes

Content-Length: 533

Date: Tue, 13 May 2014 11:00:15 GMT

Connection: keep-alive

Content-Type: application/pkix-crl

0...0..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G5..140320000000Z..140630235959Z0...*.H.............}...a.D[..8..i.....g8..S..tt..a.e.B]..v.l9.m.....~.G(l...G..#z{...Za..F.q....2^X..w.i'.&..n...4v8. &|/Y.B..%..J..g0."k.0....A..7.)h...=5....'Z........y.Ye.......M.._5.9..B.*.. .4z@.7#...... UL.F......iDg..6...'z$.E.E..*..g...2.@D.....&v...o..>..k1N...P...iHTTP/1.1 200 OK..Server: Apache..ETag: "895f8ccd92dfec674c94f0d04d1b63bc:1396128308"..Last-Modified: Sat, 29 Mar 2014 21:25:08 GMT..Accept-Ranges: bytes..Content-Length: 533..Date: Tue, 13 May 2014 11:00:15 GMT..Connection: keep-alive..Content-Type: application/pkix-crl..0...0..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G5..140320000000Z..140630235959Z0...*.H.............}...a.D[..8..i.....g8..S..tt..a.e.B]..v.l9.m.....~.G(l...G..#z{...Za..F.q....2^X..w.i'.&..n...4v8. &|/Y.B..%..J..g0."k.0....A..7.)h...=5....'Z........y.Ye.......M.._5.9..B.*.. .4z@.7#...... UL.F......iDg..6...'z$.E.E..*..g...2.@D.....&v...o..>..k1N...P...i..

<<< skipped >>>

GET /main.min.js?lang=en HTTP/1.1

Host: c12081072.r72.cf2.rackcdn.com

Connection: Close

HTTP/1.1 200 OK

Last-Modified: Mon, 05 Aug 2013 21:46:06 GMT

ETag: c2932d276a8edfccdefca378a81faf8c

X-Trans-Id: tx56bd41317e38439499eeb-005331ef8eord1

X-Object-Meta-Cb-Modifiedtime: Mon, 05 Aug 2013 21:16:34 GMT

X-Timestamp: 1375739165.31358

Content-Type: application/x-javascript

Cache-Control: public, max-age=1429

Expires: Tue, 13 May 2014 11:23:05 GMT

Date: Tue, 13 May 2014 10:59:16 GMT

Transfer-Encoding: chunked

Connection: close

Connection: Transfer-Encoding

00006000...(function(a,b){function cv(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cs(a){if(!cg[a]){var b=c.body,d=f("<" a ">").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){ch||(ch=c.createElement("iframe"),ch.frameBorder=ch.width=ch.height=0),b.appendChild(ch);if(!ci||!ch.createElement)ci=(ch.contentWindow||ch.contentDocument).document,ci.write((c.compatMode==="CSS1Compat"?"<!doctype html>":"") "<html><body>"),ci.close();d=ci.createElement(a),ci.body.appendChild(d),e=f.css(d,"display"),b.removeChild(ch)}cg[a]=e}return cg[a]}function cr(a,b){var c={};f.each(cm.concat.apply([],cm.slice(0,b)),function(){c[this]=a});return c}function cq(){cn=b}function cp(){setTimeout(cq,0);return cn=f.now()}function cf(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ce(){try{return new a.XMLHttpRequest}catch(b){}}function b$(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g ){if(g===1)for(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l " " k,n=e[m]||e["* " k];if(!n){p=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[1] " " k];if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.error("No conversion from " m.replace(" "," to ")),n!==!0&&(c=n?n(c):p(o(c)))}}return c}function bZ(a,c,d){var e=a.contents,f=a.dataTypes,g=a.responseFields,h,i,j,k;for(i in g)i in

<<< skipped >>>

GET /partners/safeguard/18.1.0.443/download/safeguard.exe HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: download-toolbar.avg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

ETag: "635cf67f91f53c1a732d3e1bb671ae74:1397723634"

Last-Modified: Sat, 12 Apr 2014 21:58:00 GMT

Accept-Ranges: bytes

Content-Length: 6407704

Content-Type: application/octet-stream

Date: Tue, 13 May 2014 11:00:04 GMT

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........f..e5..e5..e5x..5..e5...5..e5...5..e5...5F.e5...5..e5..d5H.e5...5..e5...5..e5...5..e5Rich..e5........................PE..L...%GJS......................`...../.............@...........................b.......b...@.....................................x....p...t_...........a.......a.....P...................................@............................................text............................... ..`.rdata...X.......Z..................@..@.data....N... ......................@....rsrc....t_..p...v_.................@..@.reloc........a.. ....a.............@..B.........................................................................................................................................................................................................................................................................................................................................|$..u.3...t$..]...Y..t$..u...Y..f....u.!>3.@.WP..YY....t..~...3..h.NB..t$......T=B......V3.j...Z.....N.... .....3.Ju.....NB.A......r.......!....JB............3...NB.A....NB.;.r...T=B...@..T1....u...T=B.m.@.^.U..V.u.....W..........t...93.#....3...M.A.}..w..}..r[.}.....}.S3..m.......#.............#.3........#.3.........3<.....M...u.[....93.#....3...M.A.}..w._^]...._...U.........( B.3..E..E.S.].VW.p....P.3..E...l.....h....u..u...L..Y;........E.3.C.}..E..u..]..u..u..u..u..]........p....E.9u.w.r.9E.s..E..

<<< skipped >>>

GET /screen_2.min.js?lang=en HTTP/1.1

Host: c12081072.r72.cf2.rackcdn.com

Connection: Close

HTTP/1.1 200 OK

Last-Modified: Mon, 05 Aug 2013 21:46:05 GMT

ETag: 7c9ed27885fd296d0f916c7003a74415

X-Trans-Id: tx2a819a9bcdcb42f49a7bf-005331f0ceord1

X-Object-Meta-Cb-Modifiedtime: Mon, 05 Aug 2013 21:16:37 GMT

X-Timestamp: 1375739164.81481

Content-Type: application/x-javascript

Cache-Control: public, max-age=2456

Expires: Tue, 13 May 2014 11:40:12 GMT

Date: Tue, 13 May 2014 10:59:16 GMT

Content-Length: 11658

Connection: close

.(function(){var cache={};this.tmpl=function tmpl(str,data){var fn=!/\W/.test(str)?cache[str]=cache[str]||tmpl(document.getElementById(str).innerHTML):new Function("obj","var p=[],print=function(){p.push.apply(p,arguments);};" "with(obj){p.push('" .str.replace(/[\r\t\n]/g," ").split("<%").join("\t").replace(/((^|%>)[^\t]*)'/g,"$1\r").replace(/\t=(.*?)%>/g,"',$1,'").split("\t").join("');").split("%>").join("p.push('").split("\r").join("\\'"). "');}return p.join('');");return data?fn(data):fn;};})();if(!this.JSON){this.JSON={};}.(function(){function f(n){return n<10?'0' n:n;}.if(typeof Date.prototype.toJSON!=='function'){Date.prototype.toJSON=function(key){return isFinite(this.valueOf())?this.getUTCFullYear() '-' .f(this.getUTCMonth() 1) '-' .f(this.getUTCDate()) 'T' .f(this.getUTCHours()) ':' .f(this.getUTCMinutes()) ':' .f(this.getUTCSeconds()) 'Z':null;};String.prototype.toJSON=Number.prototype.toJSON=Boolean.prototype.toJSON=function(key){return this.valueOf();};}.var cx=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,escapable=/[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,gap,indent,meta={'\b':'\\b','\t':'\\t','\n':'\\n','\f':'\\f','\r':'\\r','"':'\\"','\\':'\\\\'},rep;function quote(string){escapable.lastIndex=0;return escapable.test(string)?'"' string.replace(escapable,function(a){var c=meta[a];return typeof c==='string'?c:'\\u' ('0000' a.charCodeAt(0).toStr

<<< skipped >>>

GET /services/oi.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&UserAccountID=7286ea480c3cc7de&DistributionSource=avgab0&Profile=SATB&Version=14.0.0.12&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13&AdditionalInfoXML=&EventType=Complete&PRE_FF_ToolbarEnabled=&PRE_IE_ToolbarEnabled=&PRE_FF_NewTabActive=&PRE_IE_NewTabActive=&PRE_FF_DSPTaken=&PRE_IE_DSPTaken=&PRE_CHROME_DSPTaken=&IE_Version=8&FF_Version=29&Chrome_Version=34&DefaultBrowser=IE&LastStep=INSTALLER_ERROR_SUCCESS&LastStepReason=0 HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=rmkou3q0nz0u24i3gjadpnn5

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 807

Date: Tue, 13 May 2014 11:01:05 GMT

Connection: keep-alive

GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,................;HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Content-Length: 807..Date: Tue, 13 May 2014 11:01:05 GMT..Connection: keep-alive..GIF89a................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /services/_utma.gif?&DistributionSource=hk018&FeatureName=oi_corel_test_ec&EventType=&rand=0.8564754234028279 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: stats.avg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 807

Cache-Control: private, max-age=86373

Date: Tue, 13 May 2014 10:59:19 GMT

Connection: keep-alive

GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,................;HTTP/1.1 200 OK..Content-Type: image/gif..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Content-Length: 807..Cache-Control: private, max-age=86373..Date: Tue, 13 May 2014 10:59:19 GMT..Connection: keep-alive..GIF89a.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: st.cloins.com

Content-Length: 37

Connection: Close

&do=init_install&installer_id=1434547

HTTP/1.1 502 Bad Gateway

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:14 GMT

Content-Type: text/html

Content-Length: 575

Connection: close

GET /sitesafety/last.dat HTTP/1.1

X-AVG-SiteSafety-Format: 1

X-AVG-SiteSafety-Supports-Patches: Yes

User-Agent: AVG SiteSafety

Host: download-toolbar.avg.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "b67a6bb8151758b3f167958ecc5aaf4e:1399975206"

Last-Modified: Tue, 13 May 2014 09:50:44 GMT

Accept-Ranges: bytes

Content-Length: 687472

Content-Type: text/plain

Date: Tue, 13 May 2014 11:01:12 GMT

Connection: keep-alive

mk...!..Gs.L.e.-.U...b4......@....x7.fW../:2.....s..........cR...8.s...{.Y0"Q.0....^.D.x.....F[.3.#>..mE.v.z.8zS;.........Pl...=...P6M..'.%....Womd.?..Q..>..:.zd....5..3O...rj)..&'.1~..C&=0...) :..h.U..'s....F&...Q}....#.:V....1.q..5`[>.Yk.!v...c.......I.Gv8Y.G.x.j..z...(.....B%s.......[".}.z.H......^aU...!...J5..........k.....h..Y.."(7V!..$0P..L....e.R|._B....P...S.j.d....HT..M.....a.t..)z..xm..3....RM.......%.f..k..x.1n..\.d.2."j{.._......&....}0g..g.e..H (.`.......$..........H.....V....".S..c...c}......f........{^" .o..r....N..v.....EN../I....S.F...Q...n-.c.5]v"~..&x...i4....2..-`...z....:.e....g..[i....$.,.|..!.d...E...R.....1."...].-......pY}|..{..........:.....-.........7M.u..fI/.(......T3.{......m...... ...V..........."..7.........(!.J.5.>|..9...v......d..h..C"....4).}k........>.N%.O.?..ts....hG......7.Ip..z.C..&^.g1/....t....,7.;&...8.z.....o...*..).Z.....X..6. .rjn,....s.|[V.j..3i. ..C..K..`.].R.....?._......y.w.?...1h.D5..q.[#.VW..Q.6d.]|......zp...vo....`...........g{..:...Y.%M!H......N..F.W.S......[C,.EO .p.r....T..||y.%".'.SA..n.B........;..7R(..B.i.NT....p...uk...l1.~. v.........p...*.....I....f..p...b..'....7...>x.%.[.WM ....>Q.(D@.f.L z..l.....c...$....)..~L.p/.I.jV..?....75.u......v.I..~:.#..1.....y........?1dV.....Q.,.=..nDg.....O.|N.....d0.AxBM....zn<~......L._Ea%.T......3.........X^4B.).d.[......o.....aWe."K.!..G.......X..)....X.x.-x.I...z.Hw[...x.....c....t..>.....Y..Y-sp...>.....YHj.tc...._k.1........ ....:.......9.e..y....|.z....;..~}.m.4..o.t ......a/,...`..

<<< skipped >>>

GET /partners/safeguard/18.1.0.443/IEPackages/remote_configuration.aspx?cid={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&mid=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&lang=en&ds=avgab0&coid=avgtbavg&cmpid=&pr=sa&d=2014-05-13 14:01:03&v=18.1.0.443&pid=safeguard&sg= HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/xml; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 12454

Date: Tue, 13 May 2014 11:01:06 GMT

Connection: keep-alive

Set-Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk; path=/; HttpOnly

<?xml version="1.0" encoding="utf-8"?>..<Toolbar>....<General>....<GenericPopup>.. <Style name="default" gradient_start="#E3E3E3" gradient_end="#FFFFFF" border_color="#cecece" background_color="#FFFFFF" caption_text_active_color="#000000" caption_text_inactive_color="#C8C8C8" has_close_button="1" has_maximize_button="1" has_minimize_button="1" />..</GenericPopup>....<ButtonSettings>.. <Font name="Tahoma" size="13"/>.. <Image width="18"/>..</ButtonSettings>..<Script>..<Source type="http" src="hXXp://toolbar.avg.com/js/si.js?p=%ATT_PARAMS%" encrypted="true" params="pid=%PID%&sg=%SG%&cid=%GUID%&mid=%MID%&lang=%LANG%&ds=%DISTSOURCE%&pr=%PROFILE%&d=%INSTALLDATE%&v=%TBVERSION%" />..<Source type="https" src="hXXps://toolbar.avg.com/js/si.js?p=%ATT_PARAMS%" encrypted="true" params="pid=%PID%&sg=%SG%&cid=%GUID%&mid=%MID%&lang=%LANG%&ds=%DISTSOURCE%&pr=%PROFILE%&d=%INSTALLDATE%&v=%TBVERSION%" />..</Script>..</General>....<Installation>..<NewTab>....<EnableNTIE>0</EnableNTIE>..<EnableNTFF>1</EnableNTFF>..<EnableNTCH>1</Enabl

<<< skipped >>>

GET /partners/safeguard/images/icon18.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Thu, 22 Nov 2012 12:56:49 GMT

Accept-Ranges: bytes

ETag: "5628d6d5b0c8cd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 1291

Date: Tue, 13 May 2014 11:01:06 GMT

Connection: keep-alive

GIF89a*............DFJnrx.j.!"#57:...6.4,.0imr.e.=@C) -....h..{ .r.......C.=..6.l..u.%&(...6.53.=<>A.s .nwd.z.m..a,.z..y...)}JE. (.CKj.5..G..=.g.F.4....$.N.9_.6-.Gs.v....q..j...B..<QZY. !.L.........Bm.8.8.<.59.<..2.......y E.O.14'vM..kL..w.I .a.S...,bhW._.,]n....D&v.ua.-.N6..~.)4Z^b.V'..E....a.o.Np._P.n.B/..BW'.........|A.7~.:.h!..2.....!V2=.`.KNQ4.Nx.uS...../.......%U....%.~!3.H'(*/...p'_.:.._.o......YG..G\r.I..|.S.....?.`6X9s.9w..ein..G<.=.,..f&.]..1...& x.\@*..._TD..wv.D.. ..Md......`8r.g.y...X?.n.-....n.y...t.@.w.Bvs..x9..c.60~<wx.W.7?.C.....}...../._*.n*z.9ptzzT=S.Z^wB)..O.;.~<"...p..&.{...[..w '.X&.H..5.:2.D.. .B.=...~.>..k................................................................................................................................................!.......,....*..........H............U..\IH.....l..!HU........F%.(....B..'8.<x@...........Od.t.$."..C.....K..!. hqC.......9T0@........k4...*....."....B.G.Ss.."8 m.h....6cl`..8..h....n.<Y....:d..!....h..........B......<.VX.D.D.I.....;..h}..6H...*(|.........A.4l``...D..-..h........*ghp-....0". .........4.6...=....u.H.........8b.|.(SC ...U........".&.q.M".....@h..1.....?..J.......A.X.i.....I........1 .....P....h...$ .@.$.C.......h.D.A.a..CL...MH.TB..a.#.....L`...G.0E)o"....."C.T....%....&$cF.;.p....`.......;....

<<< skipped >>>

GET /partners/safeguard/images/search.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Tue, 21 Feb 2012 14:04:53 GMT

Accept-Ranges: bytes

ETag: "70d58bc8a1f0cc1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 366

Cache-Control: max-age=65503

Date: Tue, 13 May 2014 11:01:07 GMT

Connection: keep-alive

GIF89a.....=................pppHHH............rrr...............eee.........ooo....................................bbb......tttxxx.........www.........mmm...CCC.....................RRRaaa{{{...FFF.........!.....=.,.............pH,...Ad 8....&E.8.....pdP.#.cK(&..&\.}.......L......,..."G%,......#'.G..7.....3.N.2.... $....4..!.<.W=..9..*0...E.....C....=...B.8....DA.;....

GET /partners/safeguard/images/dnt.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Thu, 14 Jun 2012 09:40:15 GMT

Accept-Ranges: bytes

ETag: "a84381b3114acd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 6067

Cache-Control: max-age=57000

Date: Tue, 13 May 2014 11:01:07 GMT

Connection: keep-alive

GIF89a .H....1\.%..)d..E5.:2......kkk.....L...A..../....ma......h.T....x<..P.}.i.:..c....^.3....m....~v.f2..;b....k.`S..............j]]]"....:v.A.r....O.-.\T.........V.;Dk...5..... .{o...s.a.x...7..............mx.T.TM...{{{.RC..'.C;.qf..._.:l.C.j[P.......G5.......J.zn........>..r..t.....X/.......[..A.rc.\,.....;....n7........{...a.;.~q.....@)...KDw....H.....KJ..m.K.f\.....e...9.....rrr.J;Pv;...!..NETSCAPE2.0.....!.......,.... .H........H......*\......#J.H.....3j...... C..I....(S"..`D..#.HQ..%L.4[..93a..8}...s.P.9m"..4...E..$..hT.S.>.Z.*S._..,....)..H.1.C..e..]..mA.f..e..n..|... wo]......W.b...;..x.a.../....e...W..9rg...J&...j...t1S.M.=rlT)`.KT..m....7A..o............\..... '...s.......]zv...S.^..w......^......g..>........E...m......v`..68...(.`q...`..b8...^.[..mh...Qx..)....].......a.!....5.x..9.... .."./..#.2*.S.d..bYi..V....VK.QY..e.....p...`b9..#t...W.I..h..%.nVi..e.y..i....z.yg.y.i(.t....~..(...zh...I)..j:...".i.-.J.....V.{..A..........V.e......a ...*k........Z..............*...Bkm...[-..b...." n...;,.......v.n..fk.......E<.oZ..$p...Z.@............\pZ...p..O\@..3.0.......C<.....0.! |2.)..2....s....r.7....2..q.0x.k.d..V.]....i.@.@I/...OG=..U....P. 5.J{}..a..u._c...]....d[.6.k..6.q.....u.}..p..w......|.>..}?^..s'...d.L..x#P.[?@....(AV....9..7.E........>...c......:...>{........^<............7?.....<..G.=..#....k?.....=..[?}...........]....=@.......0@....v.._..X..........b..%0..$ ..x..j0.......B.J..g...OHB..0.-|..a...bp. t..q.B....:.!.. ....0tE(..h8.......@Z8.......q"..X.*Z....b

<<< skipped >>>

GET /partners/safeguard/images/CleanHistory.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Tue, 21 Feb 2012 14:04:53 GMT

Accept-Ranges: bytes

ETag: "249a90c8a1f0cc1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 586

Cache-Control: max-age=32573

Date: Tue, 13 May 2014 11:01:07 GMT

Connection: keep-alive

GIF89a.....O.w..iv.`l~...am.cp....]iz................................................q....................Zev......OYhjw.............v....................^j|......}.....gt....fs......................er.~..............y...................................................................................................................................................................................!.....O.,............O......%%.....2..?....-0'1C<3N.*..LG.H.....&.=..........".(M...:.##".. .;F..5.D....................../..........B,.!A...... ..>..(Y."....6..w.D...2......C.2j..........;....

GET /partners/safeguard/images/Facebook.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Tue, 21 Feb 2012 14:04:53 GMT

Accept-Ranges: bytes

ETag: "10fbb1c8a1f0cc1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 627

Cache-Control: max-age=32683

Date: Tue, 13 May 2014 11:01:07 GMT

Connection: keep-alive

GIF89a.....P..........e...d.>..D..?..@..<...........K..r..g..=..X..c../../..C..Z..{..`..M..2..;...k.T..:.....J.. v...._..8../|....8..]..&x.8..6..G..l...c....,{.%x.(x.4..\..?.....D..U.....)q.......h..d.....p.....R..%p.Q.....Y.....s..B..V..H..L.....m.....................................................................................................................................................!.....P.,............P...../......./..6.....6..("...?9AE;M"(..&...<G..O&.......@..H....-..N>D.LJ=-..,#......#,.5 B8FK..I 5.*...7.:.C.7.*......%.%....`.(@...X2...1(....!........B.@....X.8..1....(Q..@.......pA.....\...!...@.~0D.P .;....

GET /partners/safeguard/images/updating18.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Mon, 30 Apr 2012 10:46:47 GMT

Accept-Ranges: bytes

ETag: "e085d88abe26cd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 661

Cache-Control: max-age=56927

Date: Tue, 13 May 2014 11:01:08 GMT

Connection: keep-alive

GIF89a.....X...................................................................ccckkk.......................................sssiii.................................\\\......xxx...mmm.........zzz.........VVV...[[[......jjj...YYY............___............XXX.........eee...pppnnn........................................................................................................................!.....X.,............X..X.........".C.".....1./,$.$,/.1...') ..DFWR< )'.....L.H..B@.....6.:.O.V..7..6..#-..U7?A>MT..-#.(....E...G...(.......K9........@.F..SL..A. ....=X..@...vX.`.............N.. .(A..*..Pr....5.$.......$L.PB.N,......C......@C...4.H%.A..........;....

GET /partners/safeguard/images/currently-safe18.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Mon, 30 Apr 2012 10:46:48 GMT

Accept-Ranges: bytes

ETag: "dad18bbe26cd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 1071

Cache-Control: max-age=62636

Date: Tue, 13 May 2014 11:01:08 GMT

Connection: keep-alive

GIF89a.......n.E........h..eT|?r.J..t..`...k.Bn.Q...x.fr.`|.l........f.....`u.g..f.....d..b......i.?.....o_.Al.Y..q...g.=......Pr>.........[.4UwB.....{..\..te.Qx.Y...4^.........n........g..}..e..k...l.N..j...j.A?l'.........e.<m.TR. a.9..gG.#.........T.0F.#...\.=>..\.5....._....._X.1..^8.....k.E...d.C4..p.Us.Vo.G..tM.%..._.=..t..d}.ad.:.....[Y.1Z.0..`h.An.S...I.#=..R.*.....ZG. 5......../Z.@.....s.L..af.>.......................................................................................................................................................................................................................................................................................................................................................................................!.......,...............H.......8. ...7.. .$....CL...G..QD.........h(. ...0.DHPDC...XH .sG..*......@...!@....$h......@.-..IR.../U.........2.zbF..'.......@.<,.:3.........C.@.Gl..#...;K...qD.@..~...%..)S6.(@....9....EO..9..HxbE...F....C..'..Ba...#k.P.a..p...|p....!....RaF....h.'X..."5......;....

GET /partners/safeguard/images/active-threats18.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Mon, 30 Apr 2012 10:46:47 GMT

Accept-Ranges: bytes

ETag: "2cc1d38abe26cd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 663

Cache-Control: max-age=65510

Date: Tue, 13 May 2014 11:01:08 GMT

Connection: keep-alive

GIF89a.....q......|........r.{m........w.......f\....le......................vl.sh..........{q.i^.....t.[W..........XR....j`.ug.}v.......wm.IA.......od.xj.............D;....rc.ZS.......d[....?6.g[..x....`T.sk................zu...........~....sh.C:.cX.yl.I?....g^....xk....H>....e^....vk..........[O.:1.}q....TJ....=4....dY.i`....ZN.qb.......SJ.\U...................................................!.....q.,............q..q.`........G.[.G....... D2A.p.A2D ....H>I.SRPgc.I>H..-B...YUC...B-.$7..MK.adk.7$.98...be.Qm..89.&....Nl.of...&.#./..LX.nZ./.#.......'3...b0......@Q... ........B4R(p.....<\(HA#...=`..a.G..=<.H.G... j.......<..Q.!....T.I:...._v..@.P..\...J.g .;....

GET /partners/safeguard/images/surf-with-caution18.gif HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: toolbar.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=20j4umz044ewdini43q52sjk

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Mon, 30 Apr 2012 10:46:47 GMT

Accept-Ranges: bytes

ETag: "8623d68abe26cd1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 668

Cache-Control: max-age=57009

Date: Tue, 13 May 2014 11:01:08 GMT

Connection: keep-alive

GIF89a.....v.........N..G..@..n..W..g..V.|G..o.....o.\6..j......._#..J..R.....T.wD....}5.yC..{.....z.uC..Ps=..R1.i,..a..f..U..l..e.mM....`D.jK..T..L..............d.....`..........x0.._.....r.......mC........U....._..s..:..m.....\..h..e..L.....q......._-....Y$...|<..m6..........`-........A..f.....R..I.n7.}G.}@.w...A......._-~N,..p.....|.L...C.[9....X#..S....cD.S".................................!.....v.,............v..v.^....@..2LEYEL2.....>:...?Z?...:>..,549/kag_f/945,..A....NPe...A...<H..tM.]l\.H<...63B8XV.oO8B36..I.1..Tu.U`.1.I...&..bs.nm..p.a...%.. .!..-.K.@1.B....D..@...#z@ ...."!R.I.......-8A....S"`8B...Dv..P........X.T....&........`.......X...!eG..h....;HTTP/1.1 200 OK..Content-Type: image/gif..Last-Modified: Mon, 30 Apr 2012 10:46:47 GMT..Accept-Ranges: bytes..ETag: "8623d68abe26cd1:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Content-Length: 668..Cache-Control: max-age=57009..Date: Tue, 13 May 2014 11:01:08 GMT..Connection: keep-alive..GIF89a.....v.........N..G..@..n..W..g..V.|G..o.....o.\6..j......._#..J..R.....T.wD....}5.yC..{.....z.uC..Ps=..R1.i,..a..f..U..l..e.mM....`D.jK..T..L..............d.....`..........x0.._.....r.......mC........U....._..s..:..m.....\..h..e..L.....q......._-....Y$...|<..m6..........`-........A..f.....R..I.n7.}G.}@.w...A......._-~N,..p.....|.L...C.[9....X#..S....cD.S".................................!.....v.,............v..v.^....@..2LEYEL2.....>:...?Z?...:>..,549/kag_f/945,..A....NPe...A...<H..tM.]l\.H<...63B8XV.oO8B36..I.1..Tu.U`.1.I...&

<<< skipped >>>

GET /Images/blank.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: isearch.avg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Sun, 10 Mar 2013 16:41:52 GMT

Accept-Ranges: bytes

ETag: "048ce2aae1dce1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 43

Cache-Control: max-age=245975

Date: Tue, 13 May 2014 10:59:18 GMT

Connection: keep-alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Type: image/gif..Last-Modified: Sun, 10 Mar 2013 16:41:52 GMT..Accept-Ranges: bytes..ETag: "048ce2aae1dce1:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Content-Length: 43..Cache-Control: max-age=245975..Date: Tue, 13 May 2014 10:59:18 GMT..Connection: keep-alive..GIF89a.............!.......,...........D..;..

GET /services/g.asmx/insert?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=08-HP Guard Enabled&FeatureToGuard=HP_GUARD&ValueBeforeGuard=about:blank&Action=01-Auto-Guard-Silent HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 11:01:11 GMT

Content-Length: 2684

Connection: keep-alive

Set-Cookie: ASP.NET_SessionId=bvjhi1fml44lgqpog2deeedd; path=/; HttpOnly

..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head><title>..</title>.. <script type="text/javascript">.. function window_onload() {.. var ValueBeforeGuard = 'about:blank'.. if (ValueBeforeGuard.indexOf('blekko.com') != -1) {.. var userHomePage = GetHP();.. //If contains AVG:.. if (userHomePage.indexOf('avg') != -1) {.. var protocol = document.location.protocol;.. document.location = protocol "//isearch.avg.com/pages/RedirectHp.aspx?hp=" escape(userHomePage);.. }.. else {.. document.location = userHomePage;.. }.. }.. }.. function GetHP() {.. var _IEInstallationFolderName = "AVG Secure Search";.. var homePage = "";.. if (typeof window.toolbarhomeAPI != "undefined") {.. var xpcom;.. if (typeof window.toolbarhomeAPI.isAPIReady != "undefined") {.. xpcom = window.toolbarhomeAPI;.. } else {.. xpcom = window.toolbarhomeAPI.wrappedJSObject;.. }.. homePage = xpcom.GetHomePage();.. }.. else {.. //IE.. try {.. var sh = new ActiveXObject('ScriptHelp

<<< skipped >>>

POST /Services/ssf.asmx/GetFile HTTP/1.1

X-AVG-SiteSafety-Format: 1

X-AVG-SiteSafety-Supports-Patches: Yes

User-Agent: AVG SiteSafety

Host: stats.avg.com

Content-Length: 0

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bvjhi1fml44lgqpog2deeedd

HTTP/1.1 302 Moved Temporarily

Cache-Control: private, max-age=0

Location: hXXp://download-toolbar.avg.com/sitesafety/last.dat

Server: Microsoft-IIS/7.5

X-AVG-SiteSafety-Interval: 24

X-AVG-SiteSafety-Version: 2014_05_13_04_01_11

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 0

Date: Tue, 13 May 2014 11:01:11 GMT

Connection: keep-alive

HTTP/1.1 302 Moved Temporarily..Cache-Control: private, max-age=0..Location: hXXp://download-toolbar.avg.com/sitesafety/last.dat..Server: Microsoft-IIS/7.5..X-AVG-SiteSafety-Interval: 24..X-AVG-SiteSafety-Version: 2014_05_13_04_01_11..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Content-Length: 0..Date: Tue, 13 May 2014 11:01:11 GMT..Connection: keep-alive......

GET /services/i.asmx/install?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&AdditionalInfoXML=<AdditionalInfo><TrackingCode>productpage</TrackingCode><OnlineInstall>true</OnlineInstall></AdditionalInfo>&hpIE=true&dspIE=true&ntIE=unavailable&hpFF=false&dspFF=false&ntFF=false&hpCH=false&dspCH=false&ntCH=false&hpIEresult=true&dspIEresult=true&ntIEresult=false&hpFFresult=unknown&dspFFresult=unknown&ntFFresult=unknown&hpCHresult=false&dspCHresult=false&ntCHresult=false HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=bvjhi1fml44lgqpog2deeedd

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 807

Date: Tue, 13 May 2014 11:01:16 GMT

Connection: keep-alive

GET /services/_utma.gif?ClientID={BAA5F813-2F3F-44D6-8008-FC44B22AF21A}&MachineID=2590d390edff4713af4b84cf713f6e90-0bc598325fb2c99e492c448a414128e253a21a85&DistributionSource=avgab0&cmpid=&Profile=sa&Version=18.1.0.443&pid=safeguard&sg=&Language=en&InstallDate=2014-05-13 14:01:03&EventType=OK&FeatureName=DSP_POPUP_WND HTTP/1.1

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=bvjhi1fml44lgqpog2deeedd

HTTP/1.1 200 OK

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 807

Cache-Control: private, max-age=86400

Date: Tue, 13 May 2014 11:01:16 GMT

Connection: keep-alive

GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,................;HTTP/1.1 200 OK..Content-Type: image/gif..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Content-Length: 807..Cache-Control: private, max-age=86400..Date: Tue, 13 May 2014 11:01:16 GMT..Connection: keep-alive..GIF89a.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /user_images/1334599120204897734385.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: d18j1d26sau8be.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 42764

Connection: keep-alive

Date: Sat, 12 Apr 2014 13:02:24 GMT

Last-Modified: Mon, 16 Apr 2012 17:58:41 GMT

ETag: "cf3ac3831fddb197864d39a6ca8d96bc"

Accept-Ranges: bytes

Server: AmazonS3

Age: 35731

X-Cache: Hit from cloudfront

Via: 1.1 7d5445eea68da382a49eaf0e124e8b2b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZbmabpMg5epfNW-HpdhH_DfcovWheUzmvb_cjWKt5yYzE5Y1NRWDcw==

.PNG........IHDR...m...-.....Z.WO....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.....$.u.wN...$.b@J"M....^x....g0..'R..K ..D..H.8..$$.z..?.........Hv.e....8.l=....c9.!qiK.e......Eb.%....:.[uo....{....zz.........5}..?/.5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555..k........<.pwQ....m.....7..M.-....?......Y....~.Vuf......."l............R....?.O.f......f.....j...m..2.o1.3..........~_|....U...'.w@n.v..R....Go...ww..=..w.PI.PY...j.(K..X=.T=.U..~._....g......v...w...I.d.U.6...L5.A=_.Z...c.u..B...W.w.......v.3...l...rX3O.?..y.......xp...................K....o0 ..wN...L..P. .....=o........[..7.].'....J....s....i.q. ......^.?/55555.5.6.l.. l.......s.j.|.x....cw.../..<..ia..i..j.2.3.......~.];..."J#..5b.....|.o...l..N..}.....4.1.p.........]7}[..>..7mU.}..k...}.R........W..Q...........-..QwV.Q....l...l.q........../.}......6g.....5...........-.. .....}.w..n*......7S.t....z..............v..%..kT... ...........PtSu..p.................|.....j..E..M.[........o...F.`..qP .0. .!.5...sJ.!.P.L..x_ng/..Q.p..........z;X.tE.[...._?I..S?........X.'.ch.o......[...........A[.Bw..V....fE..[...y..`d'.}.s..L..!g...eP...s...........$...v".V..si&...)v...W.S.e.(.U;.....v....S.<%.^.n..SSSSSS[3h..m..6OM...7 .8;u *C...;&...qSv@............P..4..n.....$...X8...~d..

<<< skipped >>>

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0.6001.18702; Windows NT 5.1)

Host: stats.avg.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 807

Date: Tue, 13 May 2014 11:01:05 GMT

Connection: keep-alive

<<< skipped >>>

GET /run?p=196879&m=undefined&ua=Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0 Safari/537.36&d_d=1969-12-31&d_h=19&ts=1969-12-31 19:00:00&uq=0&ip=184.107.104.190&g_cc=ca&c_0=c04&pub=75&p=196879&i=196879&ir=http://&u=&pa=17157&s=avgab0:productpage&sl=&ob=Chrome&obv=34.0&os=Windows 8.1&lang= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: stats.inst.avg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 10:59:17 GMT

Connection: close

Content-Length: 0

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: st.cloins.com

Content-Length: 221

Connection: Close

HTTP/1.1 502 Bad Gateway

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:15 GMT

Content-Type: text/html

Content-Length: 575

Connection: close

GET /user_images/13282488921657972529443.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Host: d18j1d26sau8be.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1261

Connection: keep-alive

Date: Sat, 12 Apr 2014 13:00:20 GMT

Last-Modified: Fri, 03 Feb 2012 06:01:33 GMT

ETag: "598e378779b1bcff1706c47a294f9283"

Accept-Ranges: bytes

Server: AmazonS3

Age: 35705

X-Cache: Hit from cloudfront

Via: 1.1 f5d15668460b65c58e6a13f494ba5b26.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fMGRFUDt2A0L-MI6wRqnE0Q7UkAlNpQo-1_J9_io-w4DdAsYCVyj_w==

......Exif..II*.................Ducky.......d.....qhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:79C757149A0EE111B50C8D4833E0FED9" xmpMM:DocumentID="xmp.did:B4DAF723465011E198589726E552C74C" xmpMM:InstanceID="xmp.iid:B4DAF722465011E198589726E552C74C" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:09801174072068119109FAB48247CDD2" stRef:documentID="xmp.did:79C757149A0EE111B50C8D4833E0FED9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................g.............................................................b..c..U.......................Qa.....Rb.............?...q..m........W$....\..oe.dO~.Z!.$.9.D.!?....

<<< skipped >>>

GET /serve/getTemplate.php?pid=196879&u=1359695247&lang=en HTTP/1.1

Cookie: PHPSESSID=ral61i9g9q6ig64r8vbm7g0435

Host: c04.inst.avg.com

Connection: Close

HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:16 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.3.10-1ubuntu3.9

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Pragma: public

Cache-Control: maxage=86400

Expires: Wed, 14 May 2014 10:59:16 GMT

X-HTML-PackageType: none

<<< skipped >>>

GET /serve/getProgress.php?pid=196879&u=1359695248&lang=en HTTP/1.1

Cookie: PHPSESSID=ral61i9g9q6ig64r8vbm7g0435

Host: c04.inst.avg.com

Connection: Close

HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Tue, 13 May 2014 10:59:16 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.3.10-1ubuntu3.9

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Pragma: public

Cache-Control: maxage=86400

Expires: Wed, 14 May 2014 10:59:16 GMT

X-HTML-PackageType: none

<<< skipped >>>

GET /ver.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

Host: dnt.cloud.avg.com

Accept: */*

Accept-Encoding: gzip, deflate

Accept-Language: en-us

UA-CPU: x86

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 11:01:11 GMT

Connection: close

Content-Length: 5

14 ....

POST / HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Host: oi.cloud.avg.com

Content-Length: 2682

installer_id=1434547&installation_uuid=0&data=pJFVGj1B4Gl5Ev5YPaQTcHhgMOu8/WCA2dmwaIUXZtHGwv+jJ3LlT0dL4O2b70zrBIRViXFv/v5etPVCN4xXQRHhOwnL5kZmYKF2IzyGmxTFWpYD7f3/49svF3gJ5A7EMI2hgEb0Qfe/CThoA+iSXiYABhomkIw0YQMejsh33fKdugm4LqPQKu1GRFDABQ/NHq7jeIBdb2EO2Bo6bgNiVfKAVzj5GABjTvsuxdOkzeRI1/PhBq5fBVpvVdSH8MF67tD/PvVyChNYDE7sKbIOETEdUogvAwDVeD0hnkeUQmEC1IQvYFbBZncy/HkdeIZkx4xpwQbNHhvAhKep/qy4mzglMTl2fZqmi7QXecS0KP7aV/O+1v8yTFo4i9TGcm+YJB1Fwa7ay3w9Bh3RotXa8+xmMXxtuO1Gnvre14WN8bp/Cng/pVHaV2fZFsigxnZtMF1q5a4qNQBMo3HOIL41tCMRGPO+aLd/0JwH1xpBPS2p0QtxM6zJf3xAVNbMGJTP55Z8+l9wbzFvz8Q4cvRnb6M/wL6V/3WvpN4JN/hTH/KLnJMVVBLfTsOzFfytuX0d40qomhXhEax4412Lu0MIBVLJL1q+rkNI9JWgu4JsTvjR80N98mNn9FUXRHT9fQn9qWx3msGffH06RKQLhZ7NzCmHo+ZqBo8ZcVtRQrFvK/rP7m1g+aiPRlmBkajsIzhIKg1Awa19Yu87eyZRIhWgrvCus4ozguEED8rLSlV8b+ggGkx6yClwuJeSEMREWU2zhQw17vbd0I0dLwgvY3juJYTXpX/gFKUuD8FNjCtCKA4XZQq4LcOKUhDAXC7S7tU47F76+QmLkMpOAaPZaC7dOiVpv/ROC3K9Ex/SyZxwDt4+Pct1jshwJ6gg9EQaecv/Fk7YmE/EDH5B3GRCGv/yEuxUXIkUTybM8/PlfeUqC6XRgmpTkMg9THfHZ737JZURYlrnGfK3r6ugkfpxdCRux1qlZH1qxppFCMgMscM297C/4qK/GrcqwZx7CqRqTMWmM/6Y4QEHEFYQzAwmDASaqEY/iCEz4O4qpd7GqkjTTVFaz

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 13 May 2014 11:01:11 GMT

Connection: close

Content-Length: 0

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

ToolbarUpdater.exe_3900:

.text

`.rdata

@.data

.rsrc

@.reloc

YYhp%U

G><.tN<[tJ<\tF<*tB<|t><^t:<$t6

<9%u3

t8Jt.JJt#

.GFy"

2 34 567

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

log4cplusU.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

portuguese-brazilian

operator

USER32.DLL

.\DntAVExtensionRemover.cpp

.\main.cpp

.\RemoteUpdater.cpp

.\UpdaterCommands.cpp

fail to unload log4cplusU.dll

.\Logger.cpp

.\Registry.cpp

.\SystemCommands.cpp

.\ChromeBrowser.cpp

startup_urls

urls_to_restore_on_startup

icon_url

instant_url

keyword

search_url

suggest_url

VALUES ('%s','%s','%s','%s',%d,%d,'%s',%d,%d,'%s','%s',%d)

(short_name,keyword,favicon_url,url,show_in_default_list,safe_for_autoreplace,originating_url,date_created,usage_count,input_encodings,suggest_url,autogenerate_keyword)

keywords

INSERT INTO %s %s %s

keywords_backup

VALUES ('%s','%s','%s','%s',%d,%d,'%s',%d,%d,'%s','%s')

(short_name,keyword,favicon_url,url,show_in_default_list,safe_for_autoreplace,originating_url,date_created,usage_count,input_encodings,suggest_url)

SET short_name='%s', keyword='%s', favicon_url='%s', url='%s', show_in_default_list=%d, safe_for_autoreplace=%d, originating_url='%s', date_created=%d, usage_count=%d, input_encodings='%s', suggest_url='%s', prepopulate_id=0, autogenerate_keyword=%d

WHERE short_name='%s'

UPDATE %s %s %s

SELECT * FROM %s WHERE %s

SELECT * FROM %s WHERE id=%d

UPDATE meta SET value='%d' WHERE key='Default Search Provider ID'

INSERT INTO meta (key,value) VALUES ('Default Search Provider ID','%d')

UPDATE meta SET value='%d' WHERE key='Default Search Provider ID Backup'

INSERT INTO meta (key,value) VALUES ('Default Search Provider ID Backup','%d')

SELECT value FROM meta WHERE key='Default Search Provider ID'

SELECT value FROM meta WHERE key='Default Search Provider ID Backup'

url LIKE '%

DELETE FROM %s WHERE id=%d

select min (id) from keywords

webNavigation

webRequest

webRequestBlocking

webRequestInternal

http://dnt.cloud.avg.com/*

http://dntf.cloud.avg.com/*

http://toolbar.avg.com/*

from_webstore

search_terms_replacement_key

SELECT * FROM keywords WHERE short_name='%s'

SELECT instant_url FROM keywords WHERE short_name='%s'

.\FirefoxBrowser.cpp

keyword.URL

select * from addon where id='%s'

SELECT active FROM addon WHERE id='%s'

INSERT INTO addon (id,location,version,type,defaultLocale,visible,active,userDisabled,pendingUninstall,descriptor,applyBackgroundUpdates,bootstrap,skinnable,softDisabled,IsForeignInstall,hasBinaryComponents,strictCompatibility) VALUES ('%s','winreg-app-global','%s','extension',3,1,0,1,0,'%s',1,0,0,0,1,0,0)

INSERT INTO locale (id,name,description,creator,homepageURL) VALUES ('%s','%s','%s','%s','%s')

INSERT INTO targetApplication (addon_internal_id,id,minVersion,maxVersion) VALUES ('%s','%s','%s','%s')

.\CrashReportAdapter.cpp

.\LoggerServer.cpp

.\INIReader.cpp

.\ProductManager.cpp

.\UpdaterRequest.cpp

.\HttpClient.cpp

3.7.3

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

()$^.* ?[]|\-{},:=!

%Y-%m-%d %H:%M:%S

.\InstallerHelper.cpp

.\Directory.cpp

.\FFConfig.cpp

%s%s", %s%s%s);

invalid _N_type: %d

.\StringConverter.cpp

.\InternetExplorer.cpp

large file support is disabled

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

RowKey

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

%s(%d)

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

cannot open value of type %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

TABLE %s

%s AS %s

%s WITH AUTOMATIC INDEX

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

.\XpiInstaller.cpp

.\Browser.cpp

.\DriverHelper.cpp

.\JSONParser.cpp

.\CoInitializer.cpp

.\AVInfo.cpp

0A743C17-7543-48b3-8A75-F60D0F132DD9

.\PathPermissions.cpp

1.2.5

.\Driver.cpp

C:\BuildAgent\work\906b1f4be197b432\CommonRep\Release\ToolbarUpdater.pdb

VERSION.dll

GetProcessHeap

KERNEL32.dll

EnumWindows

USER32.dll

RegOpenKeyExW

RegNotifyChangeKeyValue

RegCloseKey

RegCreateKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegFlushKey

RegEnumKeyExW

RegLoadKeyW

RegUnLoadKeyW

CryptDeriveKey

CryptDestroyKey

RegSetKeySecurity

ADVAPI32.dll

ole32.dll

ShellExecuteExW

SHELL32.dll

OLEAUT32.dll

UrlUnescapeW

SHLWAPI.dll

CryptMsgClose

CertGetNameStringW

CertFreeCertificateContext

CertFindCertificateInStore

CertCloseStore

CryptMsgGetParam

CRYPT32.dll

WINTRUST.dll

HttpSendRequestW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpOpenRequestW

WININET.dll

GetCPInfo

GetConsoleOutputCP

zcÁ

.?AVCChromeBrowser@@

.?AVCChromeSearchProvider@@

.?AVCChromeToolbarData@@

.?AVCFirefoxBrowser@@

.?AVCFirefoxSearchProvider@@

.?AVCCrashReportAdapter@@

.?AVCHttpClient@@

%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe

3<3

9.969;9~9

5l6

7#828@8];

2%2x2

4]5

6o6d6y6

353}3"464

5#5,585]5

6$6,686=6

0 0$0(0,00040

; ;$;(;,;0;4;~;

= =$=(=,=8>

=*>0>4>8><>

9$9*9@9[9

14181<1\1

0$0,040<0

mscoree.dll

KERNEL32.DLL

pSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

SOFTWARE\Mozilla\Firefox\Extensions

SOFTWARE\Google\Chrome\Extensions

CDntAVExtensionRemover:OnRegistryKeyChanged - Start

ChromeExt

avg.crx

CDntAVExtensionRemover:RemoveOldDNTFromReg - Key to check

CDntAVExtensionRemover:RemoveOldDNTFromReg - Key exists, delete it

CDntAVExtensionRemover is re-registering AVG Secure Search Chrome Extension key

CDntAVExtensionRemover is re-registering AVG Secure Search Chrome Extension value

%H:%M:%S

toolbar_log.txt

%s | %s ||

InstalledProducts.ini

\UpdaterConfig.ini

WebTuneup

{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}

{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16}

{F53C93F1-07D5-430c-86D4-C9531B27DFAF}

], url=[

úILUREREASON%

%SUCCESS%

%UPDATEDATE%

failed to execute installer.

http response: %d

ServerURL

StatsURL

\Configuration.xml

CUpdaterCommandsManager::Execute - Start

CDiskCommand::Execute - Delete file with system permission level, Res =

CDiskCommand::Execute - Delete file for all users, Res =

CDiskCommand::Execute - Wrong permission level (probably ePL_None)

CRegistryCommand::Execute - Start, bIsLocalMachine =

CRegistryCommand::Execute - Action Delete

CRegistryCommand::Execute - zsPathToDelete

CRegistryCommand::Execute - zsValueNameToDelete

CRegistryCommand::Execute - Delelete succeeded

CRegistryCommand::Execute - zsPathToSet

CRegistryCommand::Execute - zsValueNameToSet

CRegistryCommand::Execute - zsValueToSet

CRegistryCommand::Execute - Set succeeded

CRegistryCommand::Execute(), Delete value from all users , Res = )

CRegistryCommand::Execute(), Set value to all users , Res = )

@HKEY_LOCAL_MACHINE

rUpdaterConfig.ini

Pupdater.xml

Updater/Logger/Port

127.0.0.1

CRegistry::CreateRegistryKey(), Create error

CRegistry::OpenRegistryKey() - Tried to open

CRegistry::OpenRegistryKey(), Open error

CRegistry::getValue(...), for key

CRegistry::setValue(...), for key

CRegistry::removeValue(...), for key

CreateRegistryKey FAIL_TO_CREATE_REGISTRY

CRegistry::IsKeyExists(), Open error

CRegistry::getMultiValue(...), for key

CRegistry::setMultiValue(...), for key

CRegistry::getQWValue(...), for key

Software\Microsoft\Windows NT\CurrentVersion\ProfileList\

\NTUSER.DAT

CRegistry::SetValueAllUsers - Failed to get users key

CRegistry::DeleteValueAllUsers - Failed to get users key

CRegistry::GetValueAllUsers - Failed to get users key

CRegistry::CreateKeyAllUsers - Start

CRegistry::CreateKeyAllUsers - Failed to get users key

CRegistry::CreateKeyAllUsers - Number of users in reg

gHKEY_USERS

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

okernel32.dll

installer_cfg.ini

\configuration.xml

CSystemCommands::CloseAllIEWindows - NOT host Browser , Exit

%COBRAND%

%DISTSOURCE%

%CMPID%

%UID%

wtustats.avg.com

%STATSDOMAIN%

stats.avg.com

avg.install.guid

ÿGUID%

avg_secure_search.log

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

NEWTABURL

IE_SUGGESTIONS_URL

IE_SUGGESTIONS_URL_FALLBACK

IE_SUGGESTIONS_URL_JSON

CH_SUGGESTIONS_URL

CH_SUGGESTIONS_URL_FALLBACK

FAV_ICON_URL_FALLBACK

Installation/Chrome/PEMGUID

Installation/Chrome/INSTANT

Installation/Chrome/TERM

CChromeBrowser::CChromeBrowser() - KillChrome:

CChromeBrowser::CChromeBrowser() - XP:

chrome.exe

CChromeBrowser::GetHomepage - start

CChromeBrowser::GetHomepage - ret

CChromeBrowser::GetStartup - start

CChromeBrowser::SetHomepage - hp

CChromeBrowser::SetHomepage - NOT host Browser , Exit

CChromeBrowser::SetHomepage - reading json from file

CChromeBrowser::SetHomepage - bReadJSONSuccessful

CChromeBrowser::SetHomepage - writing json to file

CChromeBrowser::SetHomepage - ret

CChromeBrowser::SetStartup - hp

CChromeBrowser::SetStartup - NOT host Browser , Exit

CChromeBrowser::SetStartup - reading json from file

CChromeBrowser::SetStartup - bReadJSONSuccessful

CChromeBrowser::SetStartup - hp set

CChromeBrowser::SetStartup - ret

CChromeBrowser::CreateSearchProvider - start

CChromeBrowser::CreateSearchProvider - NOT host Browser , Exit

CChromeBrowser::CreateSearchProvider - Chrome is running.

CChromeBrowser::CreateSearchProvider - ERROR_INVALID_HANDLE

CChromeBrowser::CreateSearchProvider - CChromeSearchProvider.sShortName

CChromeBrowser::CreateSearchProvider - CChromeSearchProvider.sUrl

CChromeBrowser::CreateSearchProvider - AlreadyExist, so we update.

CChromeBrowser::CreateSearchProvider - Chrome version >= 17, we need to update the meta signature

CChromeBrowser::UpdateSearchProvider - NOT host Browser , Exit

CChromeBrowser::DeleteSearchProvider - start

CChromeBrowser::DeleteSearchProvider - Chrome is running.

CChromeBrowser::DeleteSearchProvider - ERROR_INVALID_HANDLE

CChromeBrowser::SearchProviderExist - CChromeSearchProvider.sShortName

CChromeBrowser::SearchProviderExist - CChromeSearchProvider.sUrl

CChromeBrowser::SearchProviderExist - start

CChromeBrowser::SearchProviderExist - ERROR_INVALID_HANDLE

CChromeBrowser::SearchProviderExist - search provider exist.

CChromeBrowser::SearchProviderExist GetIdFromMetaTable

CChromeBrowser::GetDefaultSearchProvider - reading json from file

CChromeBrowser::GetDefaultSearchProvider - bReadJSONSuccessful

CChromeBrowser::GetDefaultSearchProvider - JSON probelm didn't read all values

CChromeBrowser::GetDefaultSearchProvider - Chrome is running.

CChromeBrowser::GetDefaultSearchProvider - start

CChromeBrowser::GetDefaultSearchProvider - ERROR_INVALID_HANDLE

CChromeBrowser::GetDefaultSearchProvider - INSTALLER_ERROR_CHROME_ERROR

CChromeBrowser::GetDefaultSearchProvider GetIdFromMetaTable

CChromeBrowser::SetDefaultSearchProvider - start

CChromeBrowser::SetDefaultSearchProvider - NOT host Browser , Exit

CChromeBrowser::SetDefaultSearchProvider - Chrome is running.

CChromeBrowser::SetDefaultSearchProvider - ERROR_INVALID_HANDLE

CChromeBrowser::SetDefaultSearchProvider - Chrome version >= 17, SP exists and is default, do not set again.

CChromeBrowser::SetDefaultSearchProvider SearchDB

CChromeBrowser::SetDefaultSearchProvider - Chrome version >= 17, we need to update the meta signature

CChromeBrowser::SetDefaultSearchProvider - Can't write DSP to preferences.

CChromeBrowser::IsDefaultSearchProvider - start

CChromeBrowser::IsDefaultSearchProvider - bSpExists:

CChromeBrowser::IsDefaultSearchProvider - bDSpIsDefault:

CChromeBrowser::InsertUpdateDB - start

CChromeBrowser::InsertUpdateDB - sqlite3_open

CChromeBrowser::InsertUpdateDB sql

CChromeBrowser::InsertUpdateDB err

CChromeBrowser::SearchDB - start

CChromeBrowser::SearchDB - CChromeSearchProvider is NULL.

CChromeBrowser::SearchDB - Chrome is running.

CChromeBrowser::SearchDB - sqlite3_open

CChromeBrowser::SearchDB sql

CChromeBrowser::SearchDB - sqlite3_prepare

CChromeBrowser::CreateSearchProvider - pChromeSearchProvider->sShortName

CChromeBrowser::CreateSearchProvider - pChromeSearchProvider->sUrl

CChromeBrowser::UpdateMetaTable - id

CChromeBrowser::UpdateMetaTable - sqlite3_open

)CChromeBrowser::UpdateMetaTable sql

CChromeBrowser::UpdateMetaTable err

CChromeBrowser::UpdateMetaTableBackup - id

CChromeBrowser::UpdateMetaTableBackup - sqlite3_open

CChromeBrowser::UpdateMetaTableBackup sql

CChromeBrowser::UpdateMetaTableBackup err

CChromeBrowser::GetIdFromMetaTable - start

CChromeBrowser::GetIdFromMetaTable - Chrome is running.

CChromeBrowser::GetIdFromMetaTable - sqlite3_open

CChromeBrowser::GetIdFromMetaTable - sqlite3_prepare

CChromeBrowser::GetIdFromMetaTable - sqlite3_step

CChromeBrowser::GetIdFromMetaTable - return value

CChromeBrowser::GetBackupIdFromMetaTable - start

CChromeBrowser::GetBackupIdFromMetaTable - Chrome is running.

CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_open

CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_prepare

CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_step

CChromeBrowser::GetBackupIdFromMetaTable - return value

CChromeBrowser::UpdateMetaWithoutSignature sql

CChromeBrowser::UpdateMetaWithoutSignature err

CChromeBrowser::InitSearchProviderFromIni - szIniPath

CChromeBrowser::InitSearchProviderFromIni - NOT host Browser , Exit

CChromeBrowser::InitSearchProviderFromIni - iniReader.Init failed.

CChromeBrowser::InitSearchProviderFromIni - szDisplayName

CChromeBrowser::InitSearchProviderFromIni - szDefaultSearchURL

CChromeBrowser::InitSearchProviderFromIni - szPartner

CChromeBrowser::InitSearchProviderFromIni - szSuggestionsURL

CChromeBrowser::InitSearchProviderFromIni - szSuggestionsURLFallback

CChromeBrowser::InitSearchProviderFromIni - szFaviconURLFallback

CChromeBrowser::InitSearchProviderFromIni - failed to create CChromeSearchProvider.

CChromeBrowser::InitSearchProviderFromRegistry

CChromeBrowser::InitSearchProviderFromRegistry - NOT host Browser , Exit

CChromeBrowser::InitSearchProviderFromRegistry - szDisplayName

CChromeBrowser::InitSearchProviderFromRegistry - szDefaultSearchURL

CChromeBrowser::InitSearchProviderFromRegistry - szPartner

https:

http:

CChromeBrowser::InitSearchProviderFromRegistry - szSuggestionsURL

CChromeBrowser::InitSearchProviderFromRegistry - szSuggestionsURLFallback

CChromeBrowser::InitSearchProviderFromRegistry - szFaviconURLFallback

CChromeBrowser::InitSearchProviderFromRegistry - zsInstantUrl

CChromeBrowser::InitSearchProviderFromRegistry - zsSearchTerm

avg.yandex.com.tr

http://suggest.yandex.com.tr/suggest-ff.cgi?uil=tr&part={searchTerms}

http://yandex.com.tr/favicon.ico

http://avg.yandex.com.tr/yandsearch?win=106&clid=2064887&text={searchTerms}

CChromeBrowser::InitSearchProviderFromRegistry - failed to create CChromeSearchProvider.

CChromeBrowser::CreateWhereClause - both short_name and url are empty!

CChromeBrowser::DeleteSearchProvider - id

CChromeBrowser::DeleteSearchProvider - sqlite3_open

CChromeBrowser::DeleteSearchProvider sql

CChromeBrowser::DeleteSearchProvider err

CChromeBrowser::DeleteSearchProvider - Chrome version >= 17, we need to update the meta signature

Google\Chrome\Application\chrome.exe

CurrentChromeInstallationPath :

CChromeBrowser::CloseBrowser - NOT host Browser , Exit

CChromeBrowser::ResetHP - reading json from file

CChromeBrowser::GetVersion - Not Installed

ChromeBrowser:: Version Failed

ChromeBrowser:: Version

CChromeBrowser::ResetHP - hp

CChromeBrowser::ResetHP - bReadJSONSuccessful

CChromeBrowser::ResetHP - writing json to file

CChromeBrowser::ResetHP - Parnter found, try to revert

CChromeBrowser::ResetHP - Parnter found, revert failed - reset the HP.

CChromeBrowser::ResetHP - Parnter found, revert failed - reset the Startup.

CChromeBrowser::ResetHP - ret

CChromeBrowser::ResetDSP - start

CChromeBrowser::ResetDSP - sqlite3_open

CChromeBrowser::ResetDSP - Chrome version >= 17, we need to update the meta signature

CChromeBrowser, zsShouldEnableNT

CChromeBrowser::SetEnableNTToReg() - bIsUpdateInstallation

CChromeBrowser::SetEnableNTToReg - Set zsShouldEnableNT to 0

CChromeBrowser::SetEnableNTToReg() - szIsNewTabEnabled is set

CChromeBrowser::SaveRevertHpToRegistry - start

ChromeSearchAssetsAdded

CChromeBrowser::SaveRevertHpToRegistry - ChromeSearchAssetsAdded

CChromeBrowser::SaveRevertHpToRegistry - Chrome is running.

CChromeBrowser::SaveRevertHpToRegistry , start

CChromeBrowser::SaveRevertHpToRegistry , Writing to registry

CChromeBrowser::SaveRevertHpToRegistry ,szHomepage not empty

CChromeBrowser::SaveRevertHpToRegistry , Writing None to Revert_HP

CChromeBrowser::SaveRevertHpToRegistry , Already exist in registry

CChromeBrowser::SaveRevertHpToRegistry , zsRevertSupCh Already exist in registry

CChromeBrowser::SaveRevertDspToRegistry - start

CChromeBrowser::SaveRevertDspToRegistry - ChromeSearchAssetsAdded

CChromeBrowser::SaveRevertDspToRegistry - Chrome is running.

CChromeBrowser::SaveRevertDspToRegistry , start

CChromeBrowser::SaveRevertDspToRegistry , Writing to registry

CChromeBrowser::SaveRevertDspToRegistry , write Revert_DSP

CChromeBrowser::SaveRevertDspToRegistry , Writing None to Revert_DSP

CChromeBrowser::SaveRevertDspToRegistry ,Already exist in registry

CChromeBrowser::RevertHpFromRegistry - start

CChromeBrowser::RevertHpFromRegistry - Chrome is running.

CChromeBrowser::RevertHpFromRegistry , start

CChromeBrowser::RevertStartupFromRegistry - start

CChromeBrowser::RevertStartupFromRegistry - Chrome is running.

CChromeBrowser::RevertStartupFromRegistry , start

CChromeBrowser::RevertDspFromRegistry - start

CChromeBrowser::RevertDspFromRegistry - Chrome is running.

CChromeBrowser::RevertDspFromRegistry , start

CChromeBrowser::IsHostBrowser,CH

CChromeBrowser::RefreshHpUrl - hp

CChromeBrowser::RefreshHpUrl - NOT host Browser , Exit

CChromeBrowser::RefreshHpUrl - reading json from file

CChromeBrowser::RefreshHpUrl - bReadJSONSuccessful

CFirefoxBrowser::RefreshHpUrl , szHomepage before replace

CChromeBrowser::RefreshHpUrl - writing json to file

CChromeBrowser::RefreshHpUrl - ret

CChromeBrowser::RefreshDspUrl , start

CChromeBrowser::RefreshDspUrl - NOT host Browser , Exit

CChromeBrowser::UpdateSearchProvider - start

CChromeBrowser::UpdateSearchProvider - Chrome is running.

CChromeBrowser::UpdateSearchProvider - ERROR_INVALID_HANDLE

CChromeBrowser::UpdateSearchProvider - Chrome version >= 17, SP exists and is default, do not set again.

CChromeBrowser::UpdateSearchProvider - Chrome version >= 17, we need to update the meta signature

CChromeBrowser::IsAVGToolbarEnabled - Can't read the preference file.

CChromeBrowser::IsNewTabActive - start

CChromeBrowser::IsNewTabActive - the new tab is not active because Instant URL is not exists.

CChromeBrowser::IsNewTabActive - the new tab is not active becuase the CURRENT_USER NT flag is not enabled

CChromeBrowser::IsNewTabActive - the new tab is not active becuase the LOCAL_MACHINE NT flag is not enabled

CChromeBrowser::IsNewTabActive - end, the new tab is active

CChromeBrowser::IsExtensionEnabled start.

CChromeBrowser::IsExtensionEnabled - ERROR_INVALID_HANDLE

CChromeBrowser::IsExtensionEnabled - empty extension name

CChromeBrowser::IsExtensionEnabled - INSTALLER_ERROR_CHROME_ERROR

CDomainADBlockerCH::GetExtensionState we don't currenty support this state.

CChromeBrowser::SetExtensionEnabled start.

CChromeBrowser::SetExtensionEnabled - ERROR_INVALID_HANDLE

CChromeBrowser::SetExtensionEnabled - empty extension name

CChromeBrowser::SetExtensionEnabled - INSTALLER_ERROR_CHROME_ERROR

CChromeBrowser::SetExtensionEnabled - enable extention

sCChromeBrowser::SetExtensionEnabled - disable extention

CChromeBrowser::SetExtensionEnabled - writing json to file

CChromeBrowser::SetExtensionEnabled failed to read preferences

CChromeBrowser::EnableExtension - Start

CChromeBrowser::EnableExtension - NOT host Browser , Exit

CChromeBrowser::EnableExtension - EnableExtensionExtractingCrx, zsVersion

CChromeBrowser::EnableExtension - EnableExtensionInPreference, zsVersion

CChromeBrowser::EnableExtension - function ret:

\avg.crx

CChromeBrowser::EnableExtensionInPreference - Start

CChromeBrowser::EnableExtensionInPreference,

CChromeBrowser::EnableExtensionInPreference - Can't read the preference file.

\manifest.json

eCChromeBrowser::EnableExtensionInPreference - return value:

\Chrome\Default\

Web Data

\Google\Chrome\User Data\Default\

CChromeBrowser::SetDSPInPrefFile - Start

CChromeBrowser::SetDSPInPrefFile - reading json from file

CChromeBrowser::SetDSPInPrefFile - bReadJSONSuccessful

CChromeBrowser::GetPartnerDSPUrl - start

CChromeBrowser::GetPartnerDSPUrl - Chrome is running.

CChromeBrowser::GetPartnerDSPUrl - sqlite3_open

CChromeBrowser::GetPartnerDSPUrl sql

CChromeBrowser::GetPartnerDSPUrl - sqlite3_prepare

CChromeBrowser::GetPartnerDSPUrl - pChromeSearchProvider->sUrl

CChromeBrowser::AutoDisableToolbar - Start.

%LOCALAPPDATA%\Google\Chrome\User Data\Default\

CChromeBrowser::AutoDisableToolbar - Can't get paths.

CChromeBrowser::AutoDisableToolbar - Can't disable user toolbar.

CChromeBrowser::EnableToolband - ERROR_INVALID_HANDLE

CChromeBrowser::IsPartnerDefaultSearchProvider - Start.

CChromeBrowser::IsPartnerHomePage - Start.

CChromeBrowser::GetStartupFromJson - failed reading Json

CChromeBrowser::GetStartupFromJson - szStartup:

CChromeBrowser::GetHomepageFromJson - failed reading Json

CChromeBrowser::GetHomepageFromJson - szHomepage:

CChromeBrowser::IsInstantURLActive - start

CChromeBrowser::IsInstantURLActive - Chrome is running.

CChromeBrowser::IsInstantURLActive - sqlite3_open

CChromeBrowser::IsInstantURLActive sql

CChromeBrowser::IsInstantURLActive - sqlite3_prepare

CChromeBrowser::IsInstantURLActive - res

CFirefoxBrowser::CFirefoxBrowser() - start

CFirefoxBrowser::CFirefoxBrowser() - INI

CFirefoxBrowser::CFirefoxBrowser() - failed to read INI file, try to get info from INI backup in registry.

firefox.exe

CFirefoxBrowser::GetVersion - start

CFirefoxBrowser::GetVersion - version:

CFirefoxBrowser::GetVersionEx - start

CFirefoxBrowser::GetVersionEx - Not Installed

extensions.lastAppVersion

CFirefoxBrowser::GetVersionEx - version:

CFirefoxBrowser::GetVersionEx - short version:

SOFTWARE\Mozilla\Mozilla Firefox

CFirefoxBrowser::CreateSearchProvider - start

CFirefoxBrowser::CreateSearchProvider - NOT host Browser , Exit

CFirefoxBrowser::CreateSearchProvider - ERROR_INVALID_HANDLE

CFirefoxBrowser::CreateSearchProvider - failed to find xml to temp

CFirefoxBrowser::CreateSearchProvider - failed to replace common values

CFirefoxBrowser::CreateSearchProvider - copy XML to program files failed.

FireFoxSearchXml.tmp

CFirefoxBrowser::UpdateSearchProvider - NOT host Browser , Exit

CFirefoxBrowser::WriteKeyToGuardToSetDSP - start

FirefoxSPName

CFirefoxBrowser::WriteKeyToGuardToSetDSP - end, return:

CFirefoxBrowser::SetDefaultSearchProvider - start

CFirefoxBrowser::SetDefaultSearchProvider - NOT host Browser , Exit

CFirefoxBrowser::SetDefaultSearchProvider - Firefox is running.

CFirefoxBrowser::SetDefaultSearchProvider - application is running in SYSTEM account!. Can not set as DSP.

CFirefoxBrowser::SetDefaultSearchProvider - INI Path:

CFirefoxBrowser::SetDefaultSearchProvider - failed to set DSP in all profiles

CFirefoxBrowser::IsNewTabActive

avg.userPreferences.newtabDisabledByUser

CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the user canceled

CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the CURRENT_USER NT flag is not enabled

CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the LOCAL_MACHINE NT flag is not enabled

CFirefoxBrowser::IsNewTabActive - the new tab is active.

CFirefoxBrowser::ReplaceCommonValues() - temp XML filename

CFirefoxBrowser::ReplaceCommonValues() - ReadTempXML failed.

CFirefoxBrowser::ReplaceCommonValues() - XML filename

CFirefoxBrowser::ReplaceCommonValues() - Partner name is empty.

CFirefoxBrowser::DetermineFFProfilesDir - start

CFirefoxBrowser::DetermineFFProfilesDir - GetSafeEnv return NULL

\Mozilla\Firefox\Profiles\

CFirefoxBrowser::DetermineFFProfilesDir - Firefox Folder

CFirefoxBrowser::GetSearchXMLLocation - GetCurrentFirefoxInstallationPath failed

CFirefoxBrowser::GetSearchXMLLocation - first XML location

CFirefoxBrowser::GetSearchXMLLocation - second XML location

CFirefoxBrowser::CopyXmlToProgramFiles - Copy from

CFirefoxBrowser::CopyXmlToProgramFiles - Copy to

CFirefoxBrowser::CopyXmlToProgramFiles firefox version is less than 21

CFirefoxBrowser::CopyXmlToProgramFiles create browser folder

CFirefoxBrowser::CopyXmlToUserData - Copy from

CFirefoxBrowser::CopyXmlToUserData - Copy to

CFirefoxBrowser::SetDSPinAllProfiles failed to write Pref.js to profile(USER)

CFirefoxBrowser::SetDSPinAllProfiles failed to write Pref.js to profile

CFirefoxBrowser::SetDSPinAllProfiles. Create directory is failed

CFirefoxBrowser::SetDSPinAllProfiles. CopyFile is failed

CFirefoxBrowser::RefreshSearchProviderXml - ERROR_INVALID_HANDLE

CFirefoxBrowser::SetDSPInAllProfilesAfterInstall. FireFoxSearchXml.tmp is not exist

CFirefoxBrowser::ReadTempXML() - CreateFile failed. GetLastError

CFirefoxBrowser::ReadTempXML() - ReadFile failed. GetLastError

CFirefoxBrowser::ReplaceDefaultSearchProvider - start

CFirefoxBrowser::ReplaceDefaultSearchProvider -pzsIniFile is not NULL

CFirefoxBrowser::ReplaceDefaultSearchProvider -Get display name

CFirefoxBrowser::ReplaceDefaultSearchProvider - DSP Display Name:

browser.search.defaultenginename

browser.search.selectedEngine

CFirefoxBrowser::WriteFile - CreateFile failed. GetLastError

CFirefoxBrowser::WriteFile - WriteFile failed. GetLastError

CFirefoxBrowser::WriteFile() - WriteFile failed. size written too small

CFirefoxBrowser::InitSearchProviderFromIni - ini

CFirefoxBrowser::InitSearchProviderFromIni - NOT host Browser , Exit

CFirefoxBrowser::InitSearchProviderFromRegistry

CFirefoxBrowser::InitSearchProviderFromRegistry - NOT host Browser , Exit

CFirefoxBrowser::GetHomepage, homepage

CFirefoxBrowser::GetHomepage, next profile

browser.startup.homepage

CFirefoxBrowser::GetHomepage, success

CFirefoxBrowser::SetHomepage, homepage

CFirefoxBrowser::SetHomepage - NOT host Browser , Exit

CFirefoxBrowser::SetHomepage - Firefox is running.

CFirefoxBrowser::SetHomepage, next profile

CFirefoxBrowser::SetHomepage, success

CFirefoxBrowser::GetKeywordUrl, szKeyWordUrl

CFirefoxBrowser::GetKeywordUrl, next profile

LCFirefoxBrowser::GetKeywordUrl, success

CFirefoxBrowser::SetKeywordUrl, szKeyWordUrl

CFirefoxBrowser::SetKeywordUrl - NOT host Browser , Exit

CFirefoxBrowser::SetKeywordUrl - Firefox is running.

CFirefoxBrowser::SetKeywordUrl, next profile

CFirefoxBrowser::SetKeywordUrl, success

CFirefoxBrowser::DeleteSearchProvider - start

CFirefoxBrowser::DeleteSearchProvider - Firefox is running.

CFirefoxBrowser::DeleteSearchProvider - ERROR_INVALID_HANDLE

CFirefoxBrowser::SearchProviderExist - start

CFirefoxBrowser::SearchProviderExist - Firefox is running.

CFirefoxBrowser::SearchProviderExist - ERROR_INVALID_HANDLE

CFirefoxBrowser::SearchProviderExist - failed to get Default search engine for profile

CFirefoxBrowser::SearchProviderExist - ProfileExist

CFirefoxBrowser::SearchProviderExist - ProfileDefault

CFirefoxBrowser::SearchProviderExist - ProgramFilesExist

CFirefoxBrowser::SearchProviderExist - ProgramFilesDefault

CFirefoxBrowser::SearchProviderExist - Exist

CFirefoxBrowser::SearchProviderExist - Default

CFirefoxBrowser::HandleXMLInInstalltion - start

CFirefoxBrowser::HandleXMLInInstalltion - File Path

CFirefoxBrowser::HandleXMLInInstalltion - delete

SOFTWARE\Mozilla\Mozilla Firefox\

CFirefoxBrowser::GetCurrentFirefoxInstallationPath - start

CFirefoxBrowser::GetCurrentFirefoxInstallationPath - fail to get CurrentVersion from

CFirefoxBrowser::GetCurrentFirefoxInstallationPath - CurrentVersion

PathToExe

CFirefoxBrowser::GetCurrentFirefoxInstallationPath - fail to get PathToExe from

CFirefoxBrowser::GetCurrentFirefoxInstallationPath - Path

\search.json

CFirefoxBrowser::RefreshSearchProviderSearchSqlite Sqlite path

CFirefoxBrowser::RefreshSearchProviderSearchSqlite - sqlite3_open

CFirefoxBrowser::RefreshSearchProviderSearchSqlite sql

CFirefoxBrowser::RefreshSearchProviderSearchSqlite err

\search.sqlite

RefreshUserSearchProviderList - check if search.json file exists @ path:

RefreshUserSearchProviderList - try to delete search.json @ path:

CFirefoxBrowser EnableToolband - start

CFirefoxBrowser EnableToolband - failed to cast.

CFirefoxBrowser EnableToolband, id

CFirefoxBrowser EnableToolband, enabled

CFirefoxBrowser::IsExtensionEnabled - Failed to get extension ID.

extensions.json

CFirefoxBrowser::CheckInExtensionsJson - failed to build extension.sqlite path.

CFirefoxBrowser::InsertUpdateAddonTable - start

extensions.sqlite

CFirefoxBrowser::InsertUpdateAddonTable - failed to build extension.sqlite path.

CFirefoxBrowser::InsertUpdateAddonTable - sqlite3_open

CFirefoxBrowser::InsertUpdateAddonTable sql

CFirefoxBrowser::InsertUpdateAddonTable err

CFirefoxBrowser::AddonTableContainsToolbar - sqlite3_prepare

extensions.rdf

extensions.cache

CFirefoxBrowser::EnableInExtensionsRDF - Unable to create XML parser object

CFirefoxBrowser::EnableInExtensionsRDF - Unable to load XML document into the parser

CFirefoxBrowser::EnableInExtensionsRDF - failed to save the modified extension.rdf

CFirefoxBrowser::EnableInExtensionsRDF - unknown exception.

.default

CFirefoxBrowser::BuildDefaultProfileFilePath - failed.

CFirefoxBrowser::BuildDefaultProfileFilePath - BuildDefaultProfileFilePath

CFirefoxBrowser HandleExtensionIni - start

extensions.ini

CFirefoxBrowser HandleExtensionIni sIniPath:

SOFTWARE\Mozilla\Firefox\extensions

CFirefoxBrowser HandleExtensionIni szId:

CFirefoxBrowser HandleExtensionIni value of ::

CFirefoxBrowser HandleExtensionIni, sProfileExtensionPath:

CFirefoxBrowser HandleExtensionIni, sProfileExtensionPath exists

CFirefoxBrowser HandleExtensionIni, SetTextVector of ExtensionDirs

\install.rdf

CFirefoxBrowser::RollbackNewTab - Firefox is running.

avg.install.newtab

CFirefoxBrowser::ResetHP - start

CFirefoxBrowser::ResetHP - Firefox is running.

CFirefoxBrowser::ResetHP - GetDefaultProfile.

CFirefoxBrowser::ResetHP, next profile

CFirefoxBrowser::ResetHP - ,zsPartnerHomePage:

CFirefoxBrowser::ResetHP, szHomepage

CFirefoxBrowser::ResetHP, szHomepage not empty

CFirefoxBrowser::ResetHP, 1:sCurrUrl,

CFirefoxBrowser::ResetHP, zsCurrHomePage,

CFirefoxBrowser::ResetHP ,bFoundPartnerUrl = true;

CFirefoxBrowser::ResetHP ,sCurrUrl not equal to iniHost

CFirefoxBrowser::ResetHP ,bFoundPartnerUrl is true;

CFirefoxBrowser::ResetHP ,bReverted is true

CFirefoxBrowser::ResetHP ,bReverted is false and zsCurrHomePage is

CFirefoxBrowser::ResetHP, sCurrHomePage before deciding how to reset

CFirefoxBrowser::ResetHP ,zsCurrHomePage is empty

CFirefoxBrowser::ResetHP, Homepage empty so set tp default

CFirefoxBrowser::ResetHP, Partner removed

CFirefoxBrowser::ResetDSP - start

CFirefoxBrowser::ResetDSP - Firefox is running.

avg-secure-search.xml

CFirefoxBrowser::ResetDSP failed to write Pref.js to profile

CFirefoxBrowser::DeleteXmlFromProgramFiles - start

CFirefoxBrowser::DeleteXmlFromProgramFiles - GetCurrentFirefoxInstallationPath failed

CFirefoxBrowser::DeleteXmlFromProgramFiles - Delete file from

CFirefoxBrowser::ResetDefaultSearchProvider - start

CFirefoxBrowser::ResetDefaultSearchProvider - Firefox is running.

CFirefoxBrowser::ResetDefaultSearchProvider - delete DEFAULT_ENGINE SELECTED_ENGINE

CFirefoxBrowser::ResetDefaultSearchProvider - SetDeafultSearchProviderToString failed

CFirefoxBrowser, zsShouldEnableNT

CFirefoxBrowser::SetEnableNTToReg - Set zsShouldEnableNT to 0

CFirefoxBrowser::SaveRevertHpToRegistry , start

CFirefoxBrowser::SaveRevertHpToRegistry ,FFSearchAssetsAdded

CFirefoxBrowser::SaveRevertHpToRegistry , Writing to registry

CFirefoxBrowser::SaveRevertHpToRegistry , write Revert_HP

CFirefoxBrowser::SaveRevertHpToRegistry , Writing None to Revert_HP

CFirefoxBrowser::SaveRevertHpToRegistry , Aleady exist in registry

CFirefoxBrowser::RevertHpFromRegistry , start

CFirefoxBrowser::RevertHpFromRegistry , Reverting the homepage.

CFirefoxBrowser::SaveRevertDspToRegistry , start

CFirefoxBrowser::SaveRevertDspToRegistry ,FFSearchAssetsAdded

CFirefoxBrowser::SaveRevertDspToRegistry , Writing to registry

CFirefoxBrowser::SaveRevertDspToRegistry , Write Revert_DSP

CFirefoxBrowser::SaveRevertDspToRegistry , Writing None to Revert_DSP

CFirefoxBrowser::SaveRevertHpToRegistry , Already exist in registry

CFirefoxBrowser::GetDefaultSearchProvider - start

CFirefoxBrowser::SetDeafultSearchProviderToString - start

CFirefoxBrowser::SetDeafultSearchProviderToString - Firefox is running.

CFirefoxBrowser::RevertDspFromRegistry - start

CFirefoxBrowser::RevertDspFromRegistry - Firefox is running.

CFirefoxBrowser::RevertDspFromRegistry , start

CFirefoxBrowser::RevertOnlyDspFromRegistry - start

CFirefoxBrowser::RevertOnlyDspFromRegistry - Firefox is running.

CFirefoxBrowser::RevertOnlyDspFromRegistry - revert value is

CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , start

CFirefoxBrowser::SaveRevertKeywordUrlToRegistry ,FFSearchAssetsAdded

CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Writing to registry

configuration.xml

CFirefoxBrowser::SaveRevertKeywordUrlToRegistry, not our value

CFirefoxBrowser::SaveRevertKeywordUrlToRegistry, write Revert_KU

CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Writing None to Revert_KU

CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Aleady exist in registry

CFirefoxBrowser::RevertKeywordUrlFromRegistry , start

CFirefoxBrowser::RevertKeywordUrlFromRegistry , Reverting the keywordURL.

CFirefoxBrowser::IsHostBrowser,FF

CFirefoxBrowser::RefreshHpUrl - start

CFirefoxBrowser::RefreshHpUrl - NOT host Browser , Exit

CFirefoxBrowser::RefreshHpUrl - Firefox is running.

CFirefoxBrowser::RefreshHpUrl, next profile

CFirefoxBrowser::RefreshHpUrl, szHomepage

CFirefoxBrowser::RefreshHpUrl, Homepage empty so set tp default

CFirefoxBrowser::RefreshHpUrl, Partner removed

CFirefoxBrowser::RefreshDspUrl , start

CFirefoxBrowser::RefreshDspUrl - NOT host Browser , Exit

CFirefoxBrowser::RefreshSearchProviderXml - start

CFirefoxBrowser::RefreshSearchProviderXml - NOT host Browser , Exit

CFirefoxBrowser::RefreshSearchProviderXml - failed to find xml to temp

CFirefoxBrowser::RefreshSearchProviderXml - failed to replace common values

CFirefoxBrowser::RefreshSearchProviderXml - copy XML to program files

CFirefoxBrowser::RefreshSearchProviderXml - copy XML to User Data

CFirefoxBrowser::RefreshSearchProviderXml - copy XML to program files succeded, erased cache

CFirefoxBrowser::RefreshKeywordUrl - start

CFirefoxBrowser::RefreshKeywordUrl - NOT host Browser , Exit

CFirefoxBrowser::RefreshKeywordUrl - Firefox is running.

Installation/KeywordUrl/Url

CFirefoxBrowser::IsExtensionEnabled - start

CFirefoxBrowser::IsExtensionEnabled - ERROR_INVALID_HANDLE

CFirefoxBrowser::IsExtensionEnabled - failed to build extension.sqlite path.

CFirefoxBrowser::IsExtensionEnabled - CopyFileToTmpFolder faild.

CFirefoxBrowser::IsExtensionEnabled - sqlite3_open

CFirefoxBrowser::IsExtensionEnabled - sqlite3_prepare

CFirefoxBrowser::IsExtensionEnabled - unknown state

CFirefoxBrowser::IsExtensionEnabled - DB empty.

CChromeExtensionJson::CChromeExtensionJson() - failed reading addons Json

CFirefoxBrowser::AddCampaignIdToXML - XML filename

CFirefoxBrowser::AddCampaignIdToXML - ReadTempXML failed.

CFirefoxBrowser::GetCampaignIdFromXML - XML filename

CFirefoxBrowser::GetCampaignIdFromXML - ReadTempXML failed.

CFirefoxBrowser::GetCampaignIdFromXML - cmpid

CFirefoxBrowser::IsPartnerDefaultSearchProvider - Start.

CFirefoxBrowser::IsPartnerHomePage - Start.

CFirefoxBrowser::IsPartnerHomePage - Can't get homepage.

CFirefoxBrowser::DeleteUserSearchProvider() - start

CFirefoxBrowser::DeleteUserSearchProvider() - delete

CFirefoxBrowser::AutoDisableToolbar - start

\FireFoxExt\

CFirefoxBrowser::AutoDisableToolbar - can't get zsID

CFirefoxBrowser::AutoDisableToolbar - can't get zsName

CFirefoxBrowser::AutoDisableToolbar - can't get zsToolbarVersion

CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetAppID

CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetMinVer

CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetMaxVer

CFirefoxBrowser::AutoDisableToolbar - can't get zsCreator

CFirefoxBrowser::AutoDisableToolbar - can't get zsDescription

RDF/Description/em:homepageURL

CFirefoxBrowser::AutoDisableToolbar - can't get zsHomepageURL

CFirefoxBrowser::AutoDisableToolbar - Can't get paths.

\extensions.sqlite

CFirefoxBrowser::AutoDisableToolbar - error sqlite3_open

CFirefoxBrowser::AutoDisableToolbar insert err

CFirefoxBrowser::AutoDisableToolbar - sqlite3_prepare

CFirefoxBrowser::AutoDisableToolbar - NO id

CFirefoxBrowser::AutoDisableToolbar insert locale err

)CFirefoxBrowser::AutoDisableToolbar insert targetApplication err

CFirefoxBrowser::PrepateDisable - sqlite3_prepare

CFirefoxBrowser::PrepateDisable - NO id

CFirefoxBrowser::PrepateDisable - addon table

CFirefoxBrowser::PrepateDisable - locale table

CFirefoxBrowser::PrepateDisable - targetApplication

CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Start.

CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Can't get paths.

CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Failed to delete file:

F%d/%d/%d %d:%d:%d

CCrashReport::GlobalExceptionFilter no crash report files

avgdumpx.exe

-p %d -c %d %d -D toolbar

CCrashReport::GlobalExceptionFilter shellexecute res

avgdiagex.exe

avgsysx.dll

avgcommx.dll

crash.avgdx

CrashReport

Gloggingserver.exe

logger.properties

CLoggerServer::CopyLoggerProperties() - failed to calculate log4cplus.properties path

CLoggerServer::CopyLoggerProperties() - failed to create log4cplus.properties path

AVG Web TuneUp

RemoteUpdater/Campaign/Url

CUpdaterRequest::ParseXML - Ended to Campign URL

RemoteUpdater/Campaign/CmdLineParams

CUpdaterRequest::ParseXML - Parsed url

Url%d

CUpdaterRequest::ParseXML - Parsed url param:

CUpdaterRequest::ParseXML - Parsed url data:

Content-Type: application/x-www-form-urlencoded

CUpdaterRequest::UpdateWithRemoteToolbarData - http request: send=[

CUpdaterRequest::GetLocalToolbarsInfo() - read partnerID start: configuration.xml:

CHttpClient::DetermineHostAndUrl, resource

http://

https://

CHttpClient::DetermineHostAndUrl, Host

CHttpClient::DetermineHostAndUrl, Url

CHttpClient::SendString start

Mozilla/4.0 (compatible; MSIE 4.0; Windows NT 4.0)

CHttpClient::SendString userAgent

CHttpClient::SendString InternetOpen failed.

CHttpClient::SendString InternetConnect failed.

CHttpClient::SendString HttpOpenRequest failed.

CHttpClient::SendString HttpQueryInfo failed.

777705555443332

5555443332

iMedix Web Technologies LTD.

iMedix Web Technologies Ltd

Mozilla/4.0 (compatible; MSIE

; Windows NT

favicon.ico

desktop.ini

CFFConfig::Initialize() - m_szFirefoxFolder

prefs.js

prefs.js.tmp

localstore.rdf

CFFConfig::GetValue - key

CFFConfig::SetValue - key

CFFConfig: DeleteKey, removing:

CFFConfig: DeleteKey, IsInitialized failed

CFFConfig: ParsePreferences, szKey:

CFFConfig: ParsePreferences, couldn't determine key name

CFFConfig: ParsePreferences, PARSING_TYPE_DELETE, found key, value:

CFFConfig: ParsePreferences, Key not found, Key:

Microsoft\Internet Explorer\AboutURLs

res://ieframe.dll/tabswelcome.htm

Open registry HKEY_CURRENT_USER Start Page

SuggestionsURL

SuggestionsURLFallback

SuggestionsURL_JSON

FaviconURLFallback

CInternetExplorer::UpdateSearchProvider - try to open key:

CInternetExplorer::UpdateSearchProvider - key does not exist!

CInternetExplorer::UpdateSearchProvider - try to create key:

CInternetExplorer::UpdateSearchProvider - create key ended - return:

CInternetExplorer::UpdateSearchProvider - create key return:

iexplore.exe

\Internet Explorer\iexplore.exe

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

CInternetExplorer::EnableToolband, DeleteKey

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\

CInternetExplorer::IsToolbarEnabled key

CInternetExplorer::IsToolbarEnabled key exist

\favicon.ico

{95B7759C-8C7F-4BF1-B163-73684A933233}

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\User Preferences

CInternetExplorer::SetDefaultSearchProvider, GrantRegKeyAccess

{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

CInternetExplorer::SetEnableNTToReg, zsShouldEnableNT

CInternetExplorer::SetEnableNTToReg - Set zsShouldEnableNT to 0

CInternetExplorer::RefreshHpUrl , start

CInternetExplorer::RefreshHpUrl - NOT host Browser , Exit

CInternetExplorer::RefreshHpUrl , szHomepage before replace

CInternetExplorer::RefreshHpUrl , zsPartnerHomePage is empty

CInternetExplorer::RefreshHpUrl , Driver is not running

CInternetExplorer::RefreshHpUrl , Driver is running and guard is enabled

CInternetExplorer::RefreshHpUrl , szHomepage after replace

CInternetExplorer::RefreshDspUrl , start

CInternetExplorer::RefreshDspUrl - NOT host Browser , Exit

CInternetExplorer::RefreshDspUrl, GrantRegKeyAccess

CInternetExplorer::RefreshNtUrl , start

CInternetExplorer::RefreshNtUrl - NOT host Browser , Exit

CInternetExplorer::AutoDisableToolbar - Can't create key.

CBrowser::IsSearchAssetsAdded, Browser key

CBrowser::IsSearchAssetsAdded, value if browser key

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

ie.http

firefox

chrome

http\shell\open\command\

%s: Ioctl = %p, ret = %d. GLE = %d

CPathPermissions:GrantRegKeyAccess, start

CPathPermissions:GrantRegKeyAccess, FullKey is empty

HKEY_

CPathPermissions:GrantRegKeyAccess, GetNamedSecurityInfo FAIL

CPathPermissions:GrantRegKeyAccess, RegOpenKeyEx FAIL

CPathPermissions:GrantRegKeyAccess ,return false

CPathPermissions:GrantRegKeyAccess ,OpenProcessToken FAIL

CPathPermissions:GrantRegKeyAccess ,HeapAlloc NULL

CPathPermissions:GrantRegKeyAccess ,InitializeAcl FAIL

CPathPermissions:GrantRegKeyAccess ,AddAccessAllowedAce FAIL

CPathPermissions:GrantRegKeyAccess ,InitializeSecurityDescriptor FAIL

CPathPermissions:GrantRegKeyAccess ,SetSecurityDescriptorDacl FAIL

CPathPermissions:GrantRegKeyAccess ,RegSetKeySecurity FAIL

CPathPermissions:GrantRegKeyAccess ,SetNamedSecurityInfo FAIL

CPathPermissions:GrantRegKeyAccess ,end ,return true

\\.\avgtp

Assertion failed: %s, file %s, line %d

18,1,0,443

ToolbarU.exe

loggingserver.exe_3932:

.text

`.rdata

@.data

.rsrc

@.reloc

vSSSh

FTPjK

FtPj;

C.PjRV

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

Usage: port config_file

Could not open server socket, maybe port

log4cplusU.dll

GetCPInfo

GetConsoleOutputCP

KERNEL32.dll

zcÁ

%Program Files%\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\loggingserver.exe

< <<<@<`<|<</pre><pre>> >@>`>|></pre><pre>KERNEL32.DLL</pre><pre>mscoree.dll</pre><pre>17, 2, 0, 0</pre><pre>loggings.exe</pre><b>vprot.exe_836:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>E PSSh`</pre><pre>t.Sh'(?</pre><pre>SPSSSh</pre><pre>G><.tN<[tJ<\tF<*tB<|t><^t:<$t6</pre><pre><9%u3</pre><pre>t8It.IIt#</pre><pre>.FGy"</pre><pre> 2 34 567</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>tGHt.Ht&</pre><pre>OLEACC.dll</pre><pre>log4cplusU.dll</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>GetProcessWindowStation</pre><pre>portuguese-brazilian</pre><pre>USER32.DLL</pre><pre>operator</pre><pre>inflate 1.2.5 Copyright 1995-2010 Mark Adler</pre><pre>.\BlockingPopup.cpp</pre><pre>.\ChromeInlineInstallation.cpp</pre><pre>c:\buildagent\work\906b1f4be197b432\commonrep\common\include\..\FolderWatcher.h</pre><pre>.\ChromeNTSetGuard.cpp</pre><pre>.\ChromeSAPGuard.cpp</pre><pre>.\ChromeSAPGuardUI.cpp</pre><pre>.\ChromeSAPUpdater.cpp</pre><pre>.\DefaultSearchProviderGuard.cpp</pre><pre>.\DNTSettingsGuard.cpp</pre><pre>.\DNTTabsGuard.cpp</pre><pre>.\DNTThread.cpp</pre><pre>.\DriverBasedGuard.cpp</pre><pre>.\DSPGuard.cpp</pre><pre>unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll</pre><pre>3.7.3</pre><pre>SQLite format 3</pre><pre>CREATE TABLE sqlite_master(</pre><pre>sql text</pre><pre>CREATE TEMP TABLE sqlite_temp_master(</pre><pre>REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYo</pre><pre>()$^.* ?[]|\-{},:=!</pre><pre>Hidden Web Browser</pre><pre>.\HomepageGuard.cpp</pre><pre>.\IEEnableHelper.cpp</pre><pre>.\IEEnableManager.cpp</pre><pre>.\InstallStats.cpp</pre><pre>vprot:SendInstallStatistic - failed to get url.</pre><pre>.\PrefetchWindow.cpp</pre><pre>.\Reporter.cpp</pre><pre>.\SAPsUpdateManager.cpp</pre><pre>.\SearchGroupGuard.cpp</pre><pre>.\SiteSafetyThreads.cpp</pre><pre>.\UpdateVersionCare.cpp</pre><pre>.\VersionGuard.cpp</pre><pre>.\WinMain.cpp</pre><pre>%Y-%m-%d</pre><pre>.\AdBlockerManager.cpp</pre><pre>.\AdBlockerRegGuard.cpp</pre><pre>.\AdBlockerSilentWindowGuard.cpp</pre><pre>fail to unload log4cplusU.dll</pre><pre>.\Logger.cpp</pre><pre>.\SystemCommands.cpp</pre><pre>.\ChromeBrowser.cpp</pre><pre>npsitesafety.dll</pre><pre>startup_urls</pre><pre>urls_to_restore_on_startup</pre><pre>icon_url</pre><pre>instant_url</pre><pre>keyword</pre><pre>search_url</pre><pre>suggest_url</pre><pre>VALUES ('%s','%s','%s','%s',%d,%d,'%s',%d,%d,'%s','%s',%d)</pre><pre>(short_name,keyword,favicon_url,url,show_in_default_list,safe_for_autoreplace,originating_url,date_created,usage_count,input_encodings,suggest_url,autogenerate_keyword)</pre><pre>keywords</pre><pre>INSERT INTO %s %s %s</pre><pre>keywords_backup</pre><pre>VALUES ('%s','%s','%s','%s',%d,%d,'%s',%d,%d,'%s','%s')</pre><pre>(short_name,keyword,favicon_url,url,show_in_default_list,safe_for_autoreplace,originating_url,date_created,usage_count,input_encodings,suggest_url)</pre><pre>SET short_name='%s', keyword='%s', favicon_url='%s', url='%s', show_in_default_list=%d, safe_for_autoreplace=%d, originating_url='%s', date_created=%d, usage_count=%d, input_encodings='%s', suggest_url='%s', prepopulate_id=0, autogenerate_keyword=%d</pre><pre>SET short_name='%s', keyword='%s', favicon_url='%s', url='%s', show_in_default_list=%d, safe_for_autoreplace=%d, originating_url='%s', date_created=%d, usage_count=%d, input_encodings='%s', suggest_url='%s', prepopulate_id=0</pre><pre>WHERE short_name='%s'</pre><pre>UPDATE %s %s %s</pre><pre>SELECT * FROM %s WHERE %s</pre><pre>SELECT * FROM %s WHERE id=%d</pre><pre>UPDATE meta SET value='%d' WHERE key='Default Search Provider ID'</pre><pre>INSERT INTO meta (key,value) VALUES ('Default Search Provider ID','%d')</pre><pre>UPDATE meta SET value='%d' WHERE key='Default Search Provider ID Backup'</pre><pre>INSERT INTO meta (key,value) VALUES ('Default Search Provider ID Backup','%d')</pre><pre>SELECT value FROM meta WHERE key='Default Search Provider ID'</pre><pre>SELECT value FROM meta WHERE key='Default Search Provider ID Backup'</pre><pre>url LIKE '%</pre><pre>DELETE FROM %s WHERE id=%d</pre><pre>select min (id) from keywords</pre><pre>webNavigation</pre><pre>webRequest</pre><pre>webRequestBlocking</pre><pre>webRequestInternal</pre><pre>http://dnt.cloud.avg.com/*</pre><pre>http://dntf.cloud.avg.com/*</pre><pre>http://toolbar.avg.com/*</pre><pre>from_webstore</pre><pre>SELECT id FROM %s</pre><pre>search_terms_replacement_key</pre><pre>SELECT * FROM keywords WHERE short_name='%s'</pre><pre>SET instant_url='%s', new_tab_url='%s', search_terms_replacement_key='%s'</pre><pre>SELECT instant_url FROM keywords WHERE short_name='%s'</pre><pre>.\Directory.cpp</pre><pre>.\FolderWatcher.cpp</pre><pre>.\active.cpp</pre><pre>RegDeleteKeyExW</pre><pre>.\Registry.cpp</pre><pre>.\ScriptHelperWrapper.cpp</pre><pre>.\ProductManager.cpp</pre><pre>.\Browser.cpp</pre><pre>.\DriverHelper.cpp</pre><pre>.\StringConverter.cpp</pre><pre>.\ChromeExtensionJson.cpp</pre><pre>.\Thread.cpp</pre><pre>.\CoInitializer.cpp</pre><pre>.\HttpClient.cpp</pre><pre>.\JSONParser.cpp</pre><pre>.\InternetExplorer.cpp</pre><pre>.\DNTAdapter.cpp</pre><pre>AvgDntSetDownloadDataURL</pre><pre>.\GenericWindowHelper.cpp</pre><pre>.\FirefoxBrowser.cpp</pre><pre>keyword.URL</pre><pre>select * from addon where id='%s'</pre><pre>SELECT active FROM addon WHERE id='%s'</pre><pre>INSERT INTO addon (id,location,version,type,defaultLocale,visible,active,userDisabled,pendingUninstall,descriptor,applyBackgroundUpdates,bootstrap,skinnable,softDisabled,IsForeignInstall,hasBinaryComponents,strictCompatibility) VALUES ('%s','winreg-app-global','%s','extension',3,1,0,1,0,'%s',1,0,0,0,1,0,0)</pre><pre>INSERT INTO locale (id,name,description,creator,homepageURL) VALUES ('%s','%s','%s','%s','%s')</pre><pre>INSERT INTO targetApplication (addon_internal_id,id,minVersion,maxVersion) VALUES ('%s','%s','%s','%s')</pre><pre>.\SiteSafetyAdapter.cpp</pre><pre>avg_sitesafety_urldb_update</pre><pre>avg_sitesafety_urldb_update_async</pre><pre>avg_sitesafety_urldb_is_up_to_date</pre><pre>avg_sitesafety_set_feed_server_url</pre><pre>avg_sitesafety_urldb_update_wait</pre><pre>.\LoggerServer.cpp</pre><pre>.\CrashReportAdapter.cpp</pre><pre>.\INIReader.cpp</pre><pre>.\XpiUnInstaller.cpp</pre><pre>.\FFConfig.cpp</pre><pre>%s%s", %s%s%s);</pre><pre>invalid _N_type: %d</pre><pre>.\PaypalDomainListReader.cpp</pre><pre>.\IEApproveExtension.cpp</pre><pre>.\PathPermissions.cpp</pre><pre>.\ScriptHelperInstaller.cpp</pre><pre>.\ProductInstaller.cpp</pre><pre>large file support is disabled</pre><pre>SQL logic error or missing database</pre><pre>foreign_keys</pre><pre>sqlite_compileoption_get</pre><pre>sqlite_compileoption_used</pre><pre>sqlite_source_id</pre><pre>sqlite_version</pre><pre>sqlite_attach</pre><pre>sqlite_detach</pre><pre>sqlite_stat1</pre><pre>sqlite_rename_parent</pre><pre>sqlite_rename_trigger</pre><pre>sqlite_rename_table</pre><pre>RowKey</pre><pre>SQLITE_</pre><pre>d-d-d d:d:d</pre><pre>d:d:d</pre><pre>d-d-d</pre><pre>failed to allocate %u bytes of memory</pre><pre>failed memory resize %u to %u bytes</pre><pre>922337203685477580</pre><pre>API call with %s database connection pointer</pre><pre>%s-shm</pre><pre>%s\etilqs_</pre><pre>OsError 0x%x (%u)</pre><pre>Recovered %d frames from WAL file %s</pre><pre>invalid page number %d</pre><pre>2nd reference to page %d</pre><pre>Failed to read ptrmap key=%d</pre><pre>Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)</pre><pre>%d of %d pages missing from overflow list starting at %d</pre><pre>failed to get page %d</pre><pre>freelist leaf count too big on page %d</pre><pre>Page %d:</pre><pre>unable to get the page. error code=%d</pre><pre>btreeInitPage() returns error code %d</pre><pre>On tree page %d cell %d:</pre><pre>On page %d at right child:</pre><pre>Corruption detected in cell %d on page %d</pre><pre>Multiple uses for byte %d of page %d</pre><pre>Fragmentation of %d bytes reported as %d on page %d</pre><pre>Page %d is never used</pre><pre>Pointer map page %d is referenced</pre><pre>Outstanding page count goes from %d to %d during this analysis</pre><pre>keyinfo(%d</pre><pre>%s(%d)</pre><pre>%s-mjX</pre><pre>foreign key constraint failed</pre><pre>unable to use function %s in the requested context</pre><pre>bind on a busy prepared statement: [%s]</pre><pre>zeroblob(%d)</pre><pre>abort at %d in [%s]: %s</pre><pre>constraint failed at %d in [%s]</pre><pre>cannot open savepoint - SQL statements in progress</pre><pre>no such savepoint: %s</pre><pre>cannot %s savepoint - SQL statements in progress</pre><pre>cannot rollback transaction - SQL statements in progress</pre><pre>cannot commit transaction - SQL statements in progress</pre><pre>sqlite_temp_master</pre><pre>sqlite_master</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid</pre><pre>cannot change %s wal mode from within a transaction</pre><pre>database table is locked: %s</pre><pre>statement aborts at %d: [%s] %s</pre><pre>cannot open virtual table: %s</pre><pre>cannot open view: %s</pre><pre>no such column: "%s"</pre><pre>foreign key</pre><pre>indexed</pre><pre>cannot open %s column for writing</pre><pre>cannot open value of type %s</pre><pre>misuse of aliased aggregate %s</pre><pre>%s: %s.%s.%s</pre><pre>%s: %s.%s</pre><pre>%s: %s</pre><pre>not authorized to use function: %s</pre><pre>%r %s BY term out of range - should be between 1 and %d</pre><pre>too many terms in %s BY clause</pre><pre>Expression tree is too large (maximum depth %d)</pre><pre>variable number must be between ?1 and ?%d</pre><pre>too many SQL variables</pre><pre>too many columns in %s</pre><pre>misuse of aggregate: %s()</pre><pre>%.*s"%w"%s</pre><pre>%s%.*s"%w"</pre><pre>%s OR name=%Q</pre><pre>type='trigger' AND (%s)</pre><pre>there is already another table or index with this name: %s</pre><pre>sqlite_</pre><pre>table %s may not be altered</pre><pre>view %s may not be altered</pre><pre>UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;</pre><pre>UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');</pre><pre>sqlite_sequence</pre><pre>UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q</pre><pre>UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;</pre><pre>Cannot add a PRIMARY KEY column</pre><pre>UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q</pre><pre>sqlite_altertab_%s</pre><pre>CREATE TABLE %Q.%s(%s)</pre><pre>DELETE FROM %Q.%s WHERE tbl=%Q</pre><pre>SELECT tbl, idx, stat FROM %Q.sqlite_stat1</pre><pre>invalid name: "%s"</pre><pre>too many attached databases - max %d</pre><pre>database %s is already in use</pre><pre>unable to open database: %s</pre><pre>no such database: %s</pre><pre>cannot detach database %s</pre><pre>database %s is locked</pre><pre>%s %T cannot reference objects in database %s</pre><pre>access to %s.%s.%s is prohibited</pre><pre>access to %s.%s is prohibited</pre><pre>object name reserved for internal use: %s</pre><pre>there is already an index named %s</pre><pre>too many columns on %s</pre><pre>duplicate column name: %s</pre><pre>default value of column [%s] is not constant</pre><pre>table "%s" has more than one primary key</pre><pre>AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY</pre><pre>no such collation sequence: %s</pre><pre>CREATE %s %.*s</pre><pre>UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d</pre><pre>CREATE TABLE %Q.sqlite_sequence(name,seq)</pre><pre>view %s is circularly defined</pre><pre>UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d</pre><pre>table %s may not be dropped</pre><pre>use DROP TABLE to delete table %s</pre><pre>use DROP VIEW to delete view %s</pre><pre>DELETE FROM %s.sqlite_sequence WHERE name=%Q</pre><pre>DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q</pre><pre>foreign key on %s should reference only one column of table %T</pre><pre>number of columns in foreign key does not match the number of columns in the referenced table</pre><pre>unknown column "%s" in foreign key definition</pre><pre>indexed columns are not unique</pre><pre>table %s may not be indexed</pre><pre>views may not be indexed</pre><pre>virtual tables may not be indexed</pre><pre>there is already a table named %s</pre><pre>index %s already exists</pre><pre>sqlite_autoindex_%s_%d</pre><pre>table %s has no column named %s</pre><pre>CREATE%s INDEX %.*s</pre><pre>INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);</pre><pre>no such index: %S</pre><pre>index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped</pre><pre>DELETE FROM %Q.%s WHERE name=%Q AND type='index'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q</pre><pre>a JOIN clause is required before %s</pre><pre>unable to identify the object to be reindexed</pre><pre>table %s may not be modified</pre><pre>cannot modify %s because it is a view</pre><pre>foreign key mismatch</pre><pre>table %S has %d columns but %d values were supplied</pre><pre>%d values for %d columns</pre><pre>table %S has no column named %s</pre><pre>%s.%s may not be NULL</pre><pre>PRIMARY KEY must be unique</pre><pre>sqlite3_extension_init</pre><pre>unable to open shared library [%s]</pre><pre>no entry point [%s] in shared library [%s]</pre><pre>error during initialization: %s</pre><pre>automatic extension loading failed: %s</pre><pre>foreign_key_list</pre><pre>*** in database %s ***</pre><pre>unsupported encoding: %s</pre><pre>malformed database schema (%s)</pre><pre>%s - %s</pre><pre>unsupported file format</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid</pre><pre>database schema is locked: %s</pre><pre>unknown or unsupported join type: %T %T%s%T</pre><pre>RIGHT and FULL OUTER JOINs are not currently supported</pre><pre>a NATURAL join may not have an ON or USING clause</pre><pre>cannot have both ON and USING clauses in the same join</pre><pre>cannot join using column %s - column not present in both tables</pre><pre>%s.%s</pre><pre>%s:%d</pre><pre>ORDER BY clause should come after %s not before</pre><pre>LIMIT clause should come after %s not before</pre><pre>SELECTs to the left and right of %s do not have the same number of result columns</pre><pre>no such index: %s</pre><pre>sqlite_subquery_%p_</pre><pre>no such table: %s</pre><pre>sqlite3_get_table() called with two or more incompatible queries</pre><pre>cannot create %s trigger on view: %S</pre><pre>cannot create INSTEAD OF trigger on table: %S</pre><pre>INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')</pre><pre>no such trigger: %S</pre><pre>-- TRIGGER %s</pre><pre>no such column: %s</pre><pre>cannot VACUUM - SQL statements in progress</pre><pre>PRAGMA vacuum_db.synchronous=OFF</pre><pre>SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'</pre><pre>SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';</pre><pre>INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)</pre><pre>UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d</pre><pre>vtable constructor failed: %s</pre><pre>vtable constructor did not declare schema: %s</pre><pre>no such module: %s</pre><pre>table %s: xBestIndex returned an invalid plan</pre><pre>at most %d tables in a join</pre><pre>cannot use index: %s</pre><pre>TABLE %s</pre><pre>%s AS %s</pre><pre>%s WITH AUTOMATIC INDEX</pre><pre>%s WITH INDEX %s</pre><pre>%s VIA MULTI-INDEX UNION</pre><pre>%s USING PRIMARY KEY</pre><pre>%s VIRTUAL TABLE INDEX %d:%s</pre><pre>%s ORDER BY</pre><pre>the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>unable to close due to unfinished backup operation</pre><pre>unknown database: %s</pre><pre>no such vfs: %s</pre><pre>database corruption at line %d of [%.10s]</pre><pre>misuse at line %d of [%.10s]</pre><pre>cannot open file at line %d of [%.10s]</pre><pre>.\XpiInstaller.cpp</pre><pre>0A743C17-7543-48b3-8A75-F60D0F132DD9</pre><pre>.\Driver.cpp</pre><pre>.\AVInfo.cpp</pre><pre>.\DomainADBlockerCH.cpp</pre><pre>\n@@||%s/$document</pre><pre>UPDATE ItemTable SET value='%s' WHERE key='custom_filters'</pre><pre>INSERT INTO ItemTable VALUES ('custom_filters', '"%s"')</pre><pre>SELECT value FROM ItemTable WHERE key='custom_filters'</pre><pre>1.2.5</pre><pre>.\DomainADBlockerPlus.cpp</pre><pre>C:\BuildAgent\work\906b1f4be197b432\CommonRep\Release\vprot.pdb</pre><pre>GDI32.dll</pre><pre>VERSION.dll</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>EnumWindows</pre><pre>EnumChildWindows</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExW</pre><pre>RegFlushKey</pre><pre>RegOpenKeyExW</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegQueryInfoKeyW</pre><pre>RegDeleteKeyW</pre><pre>RegEnumKeyExW</pre><pre>RegLoadKeyW</pre><pre>RegSetKeySecurity</pre><pre>CryptDeriveKey</pre><pre>CryptDestroyKey</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>SHFileOperationW</pre><pre>ShellExecuteExW</pre><pre>SHELL32.dll</pre><pre>OLEAUT32.dll</pre><pre>UrlEscapeW</pre><pre>UrlUnescapeW</pre><pre>SHLWAPI.dll</pre><pre>CRYPT32.dll</pre><pre>HttpSendRequestW</pre><pre>HttpQueryInfoW</pre><pre>HttpOpenRequestW</pre><pre>WININET.dll</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>zcÁ</pre><pre>.?AVCChromeInlineInstallation@@</pre><pre>.?AVCChromeNTSetGuard@@</pre><pre>.?AVCThreadWinMsg@@</pre><pre>.?AVCChromeBrowser@@</pre><pre>.?AVCChromeSearchProvider@@</pre><pre>.?AVCChromeToolbarData@@</pre><pre>.?AVCFirefoxSearchProvider@@</pre><pre>.?AVCThreadPostMsgOnEvent@@</pre><pre>.?AVCHttpClient@@</pre><pre>.?AVCFirefoxBrowser@@</pre><pre>.?AVCCrashReportAdapter@@</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre>0!0(0/0\0</pre><pre>5"5(505>5[5</pre><pre>6t7U7l7~7</pre><pre>=#=)=0=>=\=</pre><pre>0"0(000>0[0</pre><pre>11v1#646</pre><pre>8‡8d8</pre><pre>9!9*90959</pre><pre>2$2*222@2]2</pre><pre>8-8}8</pre><pre>5-6r6}6</pre><pre>7-888Y8k8}8</pre><pre>7 8Œ8</pre><pre>1 1$1(1,1</pre><pre>1%1X1]1</pre><pre>2070[0`0</pre><pre>6%7X7l7</pre><pre>5(5-5}5</pre><pre>8!8%8)8-8:8</pre><pre>0118277</pre><pre>mscoree.dll</pre><pre>KERNEL32.DLL</pre><pre>WUSER32.DLL</pre><pre>An attempt to change your default %s was successfully blocked.</pre><pre>CBlockingPopup::OpenSettingsDialog(). g_ChromeSapGuard =</pre><pre>%H:%M:%S</pre><pre>toolbar_log.txt</pre><pre>%s | %s ||</pre><pre>CChromeInlineInstallation c'tor create FolderWatcher failed path is empty</pre><pre>vprot::sInstallPageUrl Program to open</pre><pre>chrome.exe</pre><pre>CChromeInlineInstallation::CopyExtension, bIsChromeRunning</pre><pre>ChromeExtUpdate</pre><pre>Software\%s\CH</pre><pre>avg.crx</pre><pre>CChromeInlineInstallation OnHandleChromeCopyExt, kill timer</pre><pre>CChromeInlineInstallation::Stop</pre><pre>vprot.exe - CChromeNTSetGuard::Run()</pre><pre>vprot.exe - CChromeNTSetGuard::Stop</pre><pre>CChromeSAPGuard::CChromeSAPGuard, Begin</pre><pre>\Chrome\Default</pre><pre>\Google\Chrome\User Data\Default</pre><pre>\Web Data</pre><pre>CChromeSAPGuard::CChromeSAPGuard, Error creating shutdown event.</pre><pre>SearchProviderChrome</pre><pre>Guard/UI/SearchProviderChrome/AttemptBlocked</pre><pre>Guard/UI/SearchProviderChrome/SettingsBtn</pre><pre>Guard/UI/SearchProviderChrome/UrlPage</pre><pre>Guard/UI/SearchProviderChrome/LocalUrlPage</pre><pre>Guard/UI/SearchProviderChrome/ShowLink</pre><pre>CChromeSAPGuard::~CChromeSAPGuard, Begin</pre><pre>CChromeSAPGuard::~CChromeSAPGuard, End</pre><pre>CChromeSAPGuard::Run()</pre><pre>CChromeSAPGuard::Run() = false. Events didn't created.</pre><pre>CChromeSAPGuard::Run() = true</pre><pre>CChromeSAPGuard::Stop, Begin</pre><pre>CChromeSAPGuard::OnAVGFolderChanged - Can't get the file last write time.</pre><pre>CChromeSAPGuard::OnAVGFolderChanged - preference file didn't changed.</pre><pre>CChromeSAPGuard::OnAVGFolderChanged - Can't get DSP.</pre><pre>CChromeSAPGuard::OnAVGFolderChanged - DSP didn't changed.</pre><pre>ChromeDSPGuard</pre><pre>CChromeSAPGuard::OnChromeFolderChanged - Can't get the file last write time.</pre><pre>CChromeSAPGuard::OnChromeFolderChanged - Can't get DSP.</pre><pre>CChromeSAPGuard::OnChromeFolderChanged() - Show Yellow popup. Shown =</pre><pre>CChromeSAPGuard::OnGuardStartup()</pre><pre>CChromeSAPGuard::GuardStartupThreadFunc(), bNeedToEnable =</pre><pre>CChromeSAPGuard::GuardStartupThreadFunc(), bNeedToDisable =</pre><pre>CChromeSAPGuard::GuardStartupThreadFunc() - Can't enable detour passthru!</pre><pre>CChromeSAPGuard::OnGuardStartup() = true</pre><pre>CChromeSAPGuard::StartFolderWatchers() - Can't get the AVG preference last write time.</pre><pre>CChromeSAPGuard::StartFolderWatchers() - Can't get the Web Data last write time.</pre><pre>CChromeSAPGuard::StartFolderWatchers() - Can't get the cutrrent DSP from AVG folder.</pre><pre>CChromeSAPGuard::StartFolderWatchers() - Can't get the cutrrent DSP from Chrome folder.</pre><pre>%FTG%</pre><pre>CChromeSAPGuard::StartFolderWatchers() - IsFromGoogleCampaign.</pre><pre>CChromeSAPGuard::OnNotifyPopupLinkClick, Begin</pre><pre>CChromeSAPGuard::OnNotifyPopupLinkClick, Can't get the desktop rect.</pre><pre>CChromeSAPGuard::OnNotifyPopupLinkClick, End</pre><pre>ChromeSAPUpdater::CopySPsFromChromeFolder updater is not initialized</pre><pre>ChromeSAPUpdater::CopySPsFromChromeFolder bIncludingDsp =</pre><pre>ChromeSAPUpdater::CopyOrSetHP updater is not initialized</pre><pre>ChromeSAPUpdater::CopyOrSetHP szHomepage =</pre><pre>ChromeSAPUpdater::SetDSP updater is not initialized</pre><pre>ChromeSAPUpdater::SetDSP iDspId =</pre><pre>ChromeSAPUpdater::EnableNewTab updater is not initialized</pre><pre>ChromeSAPUpdater::EnableNewTab bEnable =</pre><pre>CChromeSAPGuard::UpdateEventsArray() - return. CreateToolhelp32Snapshot failed. Last Error Code</pre><pre>CChromeSAPGuard::UpdateEventsArray() - return. Process32First failed. Last Error Code</pre><pre>ChromeSAPUpdater::UpdateSAPs</pre><pre>ChromeSAPUpdater::UpdateThread enter</pre><pre>ChromeSAPUpdater::UpdateThread exit</pre><pre>ChromeSAPUpdater::Start failed!</pre><pre>ChromeSAPUpdater::Stop</pre><pre>vprot.exe - CDefaultSearchProviderGuard::Stop()</pre><pre>\configuration.xml</pre><pre>vprot.exe - DNTGuard::Run()</pre><pre>Software\%s\DNT\Settings</pre><pre>vprot.exe - DNTGuard::Stop</pre><pre>Software\%s\DNT\Tabs</pre><pre>A\test.dat</pre><pre>vprot::CDNTInitThread::ExecuteThreadEvent DNT db update success</pre><pre>vprot::CDNTInitThread::ExecuteThreadEvent DNT db update error</pre><pre>vprot::winmain::WndProc DNT set URL err:</pre><pre>CDSPDriverManager::GetChangedName: UrlEscape failed</pre><pre>Guard/UI/SearchProvider/UrlPage</pre><pre>Guard/UI/SearchProvider/LocalUrlPage</pre><pre>CDSPDriverManager::OpenWindow zsUrl</pre><pre>777705555443332</pre><pre>5555443332</pre><pre>5555443332</pre><pre>Guard/UI/Homepage/UrlPage</pre><pre>Guard/UI/Homepage/LocalUrlPage</pre><pre>AVGTB::Broadcast::MsgId</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings\</pre><pre>Installation/EnableHelperIEUrl</pre><pre>þATURENAME%</pre><pre>LPsapi.dll</pre><pre>iexplore.exe</pre><pre>%s\Software\Microsoft\Windows\CurrentVersion\Ext\Settings</pre><pre>Cvprot.exe - CInstallStatsGuard::Run()</pre><pre>Software\%s\%s</pre><pre>vprot.exe - CInstallStatsGuard::Stop</pre><pre>.LastInstallOnline</pre><pre>InstallStatsShouldBeSent</pre><pre>firefox.exe</pre><pre>ChromeSearchAssetsAdded</pre><pre>vprot.exe - LoadPrefetch, start</pre><pre>vprot.exe - LoadPrefetch, end</pre><pre>vprot.exe - ClosePrefetch, start</pre><pre>vprot.exe - CReporter::SendStats - URL</pre><pre>vprot.exe - CReporter::SendStats - Return status code</pre><pre>CSAPsUpdateManager:KillIeTimer ,g_UdpdateSAPsCheckIeClosed</pre><pre>CSAPsUpdateManager:KillFfTimer ,g_UdpdateSAPsCheckFfClosed</pre><pre>CSAPsUpdateManager:KillChTimer ,g_UdpdateSAPsCheckChClosed</pre><pre>CSearchGroupUpdateManager::IsRefreshIndicator, value if browser key</pre><pre>vprot.exe - SearchGroupGuard::Run()</pre><pre>Software\%s</pre><pre>vprot.exe - SearchGroupGuard::Stop</pre><pre>vprot.exe - CSearchGroupGuard::OnRegistryKeyChanged()</pre><pre>CCSiteSafetyInitThread::ExecuteThreadEvent site safety url db update success</pre><pre>pvprot::CSiteSafetyInitThread::ExecuteThreadEvent site safety url db update error</pre><pre>vprot::CSiteSafetyInitThread::ExecuteThreadEvent site safety init start</pre><pre>CSiteSafetyInitThread::ExecuteThreadEvent site safety init success</pre><pre>vprot::CSiteSafetyInitThread::ExecuteThreadEvent site safety init error</pre><pre>vprot::winmain::WndProc SiteSafety set feed URL err:</pre><pre>\SiteSafety\Url</pre><pre>Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\</pre><pre>\Packages\windows_ie_ac_001\AC\</pre><pre>vprot.exe - CUpdateVersionCare::Run()</pre><pre>vprot.exe - CUpdateVersionCare::OnRegistryKeyChanged()</pre><pre>vprot.exe - CUpdateVersionCare::GetChangedName()</pre><pre>vprot.exe - CUpdateVersionCare::GetChangedName() sRet:</pre><pre>vprot.exe - SAPsGuard::Run()</pre><pre>vprot.exe - SAPsGuard::Stop</pre><pre>vprot.exe - CSAPsGuard::OnRegistryKeyChanged()</pre><pre>Software\%s\IEG</pre><pre>*_toolbar.dll</pre><pre>Guard/DspPopupWndURL</pre><pre>vprot.exe - WndProc() UM_DSP_POPUP_DONE - Stats URL :</pre><pre>vprot.exe - WndProc() UM_DSP_POPUP_DONE - Failed to send statistics</pre><pre>vprot.exe - WndProc() UM_DSP_POPUP_DONE - Failed to open the configuration file.</pre><pre>vprot.exe - _tWinMain, creating mutex.</pre><pre>vprot.exe - _tWinMain, start</pre><pre>vprot.exe - _tWinMain, can't find configuration file.</pre><pre>vprot.exe - _tWinMain, FolderName</pre><pre>vprot.exe - _tWinMain, can't get partner name.</pre><pre>vprot.exe - g_UpdateVersionCare, started</pre><pre>Installation/Homepage/Url</pre><pre>vprot.exe - _tWinMain, Homepage</pre><pre>vprot.exe - _tWinMain, DefaultSearchProviderGUID</pre><pre>Installation/DSP/Url</pre><pre>vprot.exe - _tWinMain, DefaultSearchProviderURL</pre><pre>vprot.exe - _tWinMain, ToolbarGuid</pre><pre>Guard/SiteSafetyURLServer</pre><pre>Guard/DNTURLServer</pre><pre>Installation/Chrome/INSTANT_CHECK_INTERVAL</pre><pre>vprot HandleSearchAssets, adding Firefox assets....</pre><pre>vprot HandleSearchAssets, Firefox assets already added.</pre><pre>stats.ini</pre><pre>ESTATS_URL_</pre><pre>vprot.exe OnSiteSafetyUpdateDB, now</pre><pre>vprot.exe OnSiteSafetyUpdateDB, update</pre><pre>HandledFirefox</pre><pre>HandledFirefoxUpdate</pre><pre>vprot HandleFirefox, bIsFirefoxRunning</pre><pre>vprot HandleFirefox, ff is running. quit.</pre><pre>RemoveFirefoxFromProfile</pre><pre>vprot HandleFirefox, XPI</pre><pre>vprot HandleFirefox, fnProfilesXpiUnInstaller, error:</pre><pre>FirefoxSPName</pre><pre>\extensions.cache</pre><pre>vprot HandleFirefox, bAfterFFToolbarUpdate, set KeywordURL</pre><pre>Installation/KeywordUrl/EnableKeywordURL</pre><pre>Installation/KeywordUrl/Url</pre><pre>vprot HandleFirefox, done.</pre><pre>vprot.exe - MyRegisterClass</pre><pre>vprot.exe - InitInstance start</pre><pre>vprot.exe - InitInstance error</pre><pre>xuser32.dll</pre><pre>vprot.exe - InitInstance success</pre><pre>vprot.exe - WndProc(..) WM_CREATE caught.</pre><pre>vprot.exe - CAdBlockerManager available</pre><pre>vprot.exe - OS<win8><pre>vprot.exe - new CChromeSAPGuard failed.</pre><pre>vprot.exe - WndProc(..) - Higher than XP ,DSP Driver Manager Guard</pre><pre>vprot.exe - WndProc(..) WM_COMMAND caught.</pre><pre>vprot.exe - WndProc() WM_DESTROY caught</pre><pre>vprot.exe - WndProc() WM_SET_AVGTB caught</pre><pre>vprot.exe - WndProc() UM_EXTENABLE_HELPER caught</pre><pre>vprot.exe - WndProc() UM_START_POPUP_HELPER caught</pre><pre>vprot.exe - WndProc() UM_IE_CHECK_CLOSED caught</pre><pre>vprot.exe - WndProc() UM_FF_CHECK_CLOSED caught</pre><pre>vprot.exe - WndProc() UM_CH_CHECK_CLOSED caught</pre><pre>vprot.exe - WndProc() UM_SITESAFETY_DB_UPDATE caught</pre><pre>vprot.exe - WndProc() UM_SITESAFETY_INIT_FINISH_DB_UPDATED caught</pre><pre>vprot.exe - WndProc() UM_SITESAFETY_INIT_FINISH caught</pre><pre>vprot.exe - WndProc() UM_SITESAFETY_DB_UPDATE_FINISH caught</pre><pre>vprot.exe - WndProc() UM_DNT_TAB_CHANGED caught</pre><pre>vprot.exe - WndProc() UM_DNT_CONFIG_UPDATE caught</pre><pre>vprot.exe - WndProc() UM_DNT_CONFIG_UPDATE_FINISH caught</pre><pre>vprot.exe - WndProc() UM_DNT_SETTING_CHANGED caught</pre><pre>vprot.exe - WndProc() UM_DSP_POPUP_DONE</pre><pre>vprot.exe - WndProc() UM_DEL_DOWNLOADHISTORY caught</pre><pre>vprot.exe - WndProc() WM_REFRESH_CACHE caught</pre><pre>vprot StartInlineInstallation - Create CChromeInlineInstallation</pre><pre>vprot.exe - SetAutoDisableScopes()</pre><pre>vprot.exe - SetAutoDisableScopes() setting for profile</pre><pre>vprot HandleEnableFFToolbar, bIsFirefoxRunning</pre><pre>vprot HandleEnableChromeExtension, start</pre><pre>vprot HandleEnableChromeExtension, bIsChromeRunning</pre><pre>vprot HandleEnableChromeExtension, Chrome is running. quit.</pre><pre>vprot HandleEnableChromeExtension, enable toolbar.</pre><pre>vprot EnableChromeNPPlugin start</pre><pre>vprot EnableChromeNPPlugin start timer.</pre><pre>vprot OnHandleEnableChromeExtension start</pre><pre>vprot OnHandleEnableChromeExtension, kill timer</pre><pre>HttpFlagEnabled</pre><pre>vprot.exe - InitHostBrowser, szCmdLine:</pre><pre>vprot.exe - InitHostBrowser, gIsAfterInstall = true</pre><pre>vprot.exe - InitHostBrowser, writing InstallerSession=1</pre><pre>vprot.exe - InitHostBrowser, writing InstallUser=1</pre><pre>InstalledProducts.ini</pre><pre>vprot.exe - InitHostBrowser, Not AfterInstall</pre><pre>vprot.exe - InitHostBrowser, Install for other User</pre><pre>vprot.exe - InitHostBrowser, NOT Install for other User</pre><pre>vprot.exe - InitHostBrowser, It's Install User</pre><pre>vprot.exe - UpdateSuggestionsURLs, start</pre><pre>vprot.exe - UpdateSuggestionsURLs, bundle installation - exit.</pre><pre>vprot.exe - UpdateSuggestionsURLs, Update IE.</pre><pre>vprot.exe - UpdateSuggestionsURLs, IE SP exists - start the update.</pre><pre>vprot.exe - UpdateSuggestionsURLs, IE Update success</pre><pre>vprot.exe - UpdateSuggestionsURLs, no IE SP.</pre><pre>vprot.exe - UpdateSuggestionsURLs, Update FF.</pre><pre>vprot.exe - UpdateSuggestionsURLs, FF Update success</pre><pre>vprot.exe - UpdateSuggestionsURLs, Update CH.</pre><pre>vprot.exe - UpdateSuggestionsURLs, Start timer.</pre><pre>vprot.exe - UpdateSuggestionsURLs, end, IE res =</pre><pre>vprot.exe - UpdateSuggestionsURLs, end, FF res =</pre><pre>vprot.exe - UpdateSuggestionsURLs, end, CH res =</pre><pre>vprot.exe - ChromeUpdateSuggestTimerProc, CH Update success</pre><pre>vprot.exe - ChromeUpdateSuggestTimerProc, no CH SP.</pre><pre>vprot.exe - StartCleanLogTimer, start.</pre><pre>Guard/CleanLogInterval</pre><pre>vprot.exe - StartCleanLogTimer, can't get interval from the configuration file.</pre><pre>vprot.exe RefreshToolbarCache() - failed to run RefreshCache</pre><pre>vprot.exe RefreshToolbarCache() - failed to load toolbar.dll</pre><pre>vprot.exe HandleChromeSearchAssets() , start</pre><pre>vprot HandleChromeSearchAssets, bIsChromeRunning</pre><pre>vprot.exe HandleChromeSearchAssets() , adding Chrome assets....</pre><pre>vprot.exe HandleChromeSearchAssets() , Chrome assets already added.</pre><pre>FGuard/AdBlocker/PrefetchURL</pre><pre>vprot.exe - CAdBlockerManager the prefetch URL is empty in cfg file</pre><pre>vprot.exe - get configuration zsPrefetchTimeMin failed</pre><pre>vprot.exe - CAdBlockerManager::CAdBlockerManager dPrefetchTimeMin</pre><pre>vprot.exe - m_pAdBlockerHandlePendingThread, started</pre><pre>vprot.exe - m_pAdBlockerRegGuard, started</pre><pre>vprot.exe - m_pAdBlockerSilentWindowGuard, started</pre><pre>vprot.exe - CAdBlockerManager::~CAdBlockerManager</pre><pre>vprot.exe - CAdBlockerManager::ClosePrefetchWindow start</pre><pre>vprot.exe - CAdBlockerManager::OpenPrefetchWindow start openState</pre><pre>vprot.exe - CAdBlockerManager::OpenPrefetchWindow OpenedOnRegistryGuard</pre><pre>vprot.exe - CAdBlockerManager::OpenPrefetchWindow current state closed</pre><pre>vprot.exe - CAdBlockerManager::OpenPrefetchWindow before LoadPrefetch</pre><pre>vprot.exe, CAdBlockerManager::OpenPrefetchWindow not found then create new</pre><pre>vprot.exe - CAdBlockerRegGuard::Run()</pre><pre>vprot.exe - CAdBlockerRegGuard::OnRegistryKeyChanged started</pre><pre>vprot.exe - CAdBlockerSilentWindowGuard::OnRegistryKeyChanged AgreeAb</pre><pre>CAdBlockerRegGuard::OnRegistryKeyChanged return to thread loop on exit event</pre><pre>vprot.exe - CAdBlockerRegGuard::GetChangedName()</pre><pre>vprot.exe - CAdBlockerRegGuard::GetChangedName() sRet:</pre><pre>vprot.exe - CAdBlockerSilentWindowGuard::Run()</pre><pre>vprot.exe - CAdBlockerSilentWindowGuard::OnRegistryKeyChanged()</pre><pre>vprot.exe - CAdBlockerSilentWindowGuard::GetChangedName()</pre><pre>vprot.exe - CAdBlockerSilentWindowGuard::GetChangedName() sRet:</pre><pre>updater.xml</pre><pre>Updater/Logger/Port</pre><pre>127.0.0.1</pre><pre>c:\BuildAgent\work\906b1f4be197b432\CommonRep\Common\Include\log4cplus\include\log4cplus/helpers/pointer.h</pre><pre>okernel32.dll</pre><pre>installer_cfg.ini</pre><pre>CSystemCommands::CloseAllIEWindows - NOT host Browser , Exit</pre><pre>%COBRAND%</pre><pre>%DISTSOURCE%</pre><pre>%CMPID%</pre><pre>%UID%</pre><pre>wtustats.avg.com</pre><pre>%STATSDOMAIN%</pre><pre>stats.avg.com</pre><pre>avg.install.guid</pre><pre>ÿGUID%</pre><pre>avg_secure_search.log</pre><pre>Ieframe.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>EnhancedModeSupport</pre><pre>%d_%d_%d_%d</pre><pre>CChromeBrowser::CChromeBrowser() - KillChrome:</pre><pre>CChromeBrowser::CChromeBrowser() - XP:</pre><pre>CChromeBrowser::GetHomepage - start</pre><pre>CChromeBrowser::GetHomepage - ret</pre><pre>CChromeBrowser::GetStartup - start</pre><pre>CChromeBrowser::EnbaleNPPluginForChrome21 - start</pre><pre>CChromeBrowser::EnbaleNPPluginForChrome21 - reading json from file</pre><pre>CChromeBrowser::EnbaleNPPluginForChrome21 - bReadJSONSuccessful</pre><pre>CChromeBrowser::EnbaleNPPluginForChrome21 - writing json to file</pre><pre>CChromeBrowser::SetHomepage - hp</pre><pre>CChromeBrowser::SetHomepage - NOT host Browser , Exit</pre><pre>CChromeBrowser::SetHomepage - reading json from file</pre><pre>CChromeBrowser::SetHomepage - bReadJSONSuccessful</pre><pre>CChromeBrowser::SetHomepage - writing json to file</pre><pre>CChromeBrowser::SetHomepage - ret</pre><pre>CChromeBrowser::SetStartup - hp</pre><pre>CChromeBrowser::SetStartup - NOT host Browser , Exit</pre><pre>CChromeBrowser::SetStartup - reading json from file</pre><pre>CChromeBrowser::SetStartup - bReadJSONSuccessful</pre><pre>CChromeBrowser::SetStartup - hp set</pre><pre>CChromeBrowser::SetStartup - ret</pre><pre>CChromeBrowser::CreateSearchProvider - start</pre><pre>CChromeBrowser::CreateSearchProvider - NOT host Browser , Exit</pre><pre>CChromeBrowser::CreateSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::CreateSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::CreateSearchProvider - CChromeSearchProvider.sShortName</pre><pre>CChromeBrowser::CreateSearchProvider - CChromeSearchProvider.sUrl</pre><pre>CChromeBrowser::CreateSearchProvider - AlreadyExist, so we update.</pre><pre>CChromeBrowser::CreateSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>CChromeBrowser::UpdateSearchProvider - NOT host Browser , Exit</pre><pre>CChromeBrowser::DeleteSearchProvider - start</pre><pre>CChromeBrowser::DeleteSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::DeleteSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SearchProviderExist - CChromeSearchProvider.sShortName</pre><pre>CChromeBrowser::SearchProviderExist - CChromeSearchProvider.sUrl</pre><pre>CChromeBrowser::SearchProviderExist - start</pre><pre>CChromeBrowser::SearchProviderExist - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SearchProviderExist - search provider exist.</pre><pre>CChromeBrowser::SearchProviderExist GetIdFromMetaTable</pre><pre>\Chrome\Default\Preferences</pre><pre>CChromeBrowser::GetDefaultSearchProvider - reading json from file</pre><pre>CChromeBrowser::GetDefaultSearchProvider - bReadJSONSuccessful</pre><pre>CChromeBrowser::GetDefaultSearchProvider - JSON probelm didn't read all values</pre><pre>CChromeBrowser::GetDefaultSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::GetDefaultSearchProvider - start</pre><pre>CChromeBrowser::GetDefaultSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::GetDefaultSearchProvider - INSTALLER_ERROR_CHROME_ERROR</pre><pre>CChromeBrowser::GetDefaultSearchProvider GetIdFromMetaTable</pre><pre>CChromeBrowser::SetDefaultSearchProvider - start</pre><pre>CChromeBrowser::SetDefaultSearchProvider - NOT host Browser , Exit</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::SetDefaultSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Chrome version >= 17, SP exists and is default, do not set again.</pre><pre>CChromeBrowser::SetDefaultSearchProvider SearchDB</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Can't write DSP to preferences.</pre><pre>CChromeBrowser::IsDefaultSearchProvider - start</pre><pre>CChromeBrowser::IsDefaultSearchProvider - bSpExists:</pre><pre>CChromeBrowser::IsDefaultSearchProvider - bDSpIsDefault:</pre><pre>CChromeBrowser::InsertUpdateDB - start</pre><pre>CChromeBrowser::InsertUpdateDB - sqlite3_open</pre><pre>CChromeBrowser::InsertUpdateDB sql</pre><pre>CChromeBrowser::InsertUpdateDB err</pre><pre>CChromeBrowser::SearchDB - start</pre><pre>CChromeBrowser::SearchDB - CChromeSearchProvider is NULL.</pre><pre>CChromeBrowser::SearchDB - Chrome is running.</pre><pre>CChromeBrowser::SearchDB - sqlite3_open</pre><pre>CChromeBrowser::SearchDB sql</pre><pre>CChromeBrowser::SearchDB - sqlite3_prepare</pre><pre>CChromeBrowser::CreateSearchProvider - pChromeSearchProvider->sShortName</pre><pre>CChromeBrowser::CreateSearchProvider - pChromeSearchProvider->sUrl</pre><pre>CChromeBrowser::UpdateMetaTable - id</pre><pre>CChromeBrowser::UpdateMetaTable - sqlite3_open</pre><pre>)CChromeBrowser::UpdateMetaTable sql</pre><pre>CChromeBrowser::UpdateMetaTable err</pre><pre>CChromeBrowser::UpdateMetaTableBackup - id</pre><pre>CChromeBrowser::UpdateMetaTableBackup - sqlite3_open</pre><pre>CChromeBrowser::UpdateMetaTableBackup sql</pre><pre>CChromeBrowser::UpdateMetaTableBackup err</pre><pre>CChromeBrowser::GetIdFromMetaTable - start</pre><pre>CChromeBrowser::GetIdFromMetaTable - Chrome is running.</pre><pre>CChromeBrowser::GetIdFromMetaTable - sqlite3_open</pre><pre>CChromeBrowser::GetIdFromMetaTable - sqlite3_prepare</pre><pre>CChromeBrowser::GetIdFromMetaTable - sqlite3_step</pre><pre>CChromeBrowser::GetIdFromMetaTable - return value</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - start</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - Chrome is running.</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_open</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_prepare</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_step</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - return value</pre><pre>CChromeBrowser::UpdateMetaWithoutSignature sql</pre><pre>CChromeBrowser::UpdateMetaWithoutSignature err</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szIniPath</pre><pre>CChromeBrowser::InitSearchProviderFromIni - NOT host Browser , Exit</pre><pre>CChromeBrowser::InitSearchProviderFromIni - iniReader.Init failed.</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szDisplayName</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szDefaultSearchURL</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szPartner</pre><pre>CH_SUGGESTIONS_URL</pre><pre>CH_SUGGESTIONS_URL_FALLBACK</pre><pre>FAV_ICON_URL_FALLBACK</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szSuggestionsURL</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szSuggestionsURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szFaviconURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromIni - failed to create CChromeSearchProvider.</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - NOT host Browser , Exit</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szDisplayName</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szDefaultSearchURL</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szPartner</pre><pre>Installation/Chrome/INSTANT</pre><pre>https:</pre><pre>http:</pre><pre>Installation/Chrome/TERM</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szSuggestionsURL</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szSuggestionsURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szFaviconURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - zsInstantUrl</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - zsSearchTerm</pre><pre>avg.yandex.com.tr</pre><pre>http://suggest.yandex.com.tr/suggest-ff.cgi?uil=tr&part={searchTerms}</pre><pre>http://yandex.com.tr/favicon.ico</pre><pre>http://avg.yandex.com.tr/yandsearch?win=106&clid=2064887&text={searchTerms}</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - failed to create CChromeSearchProvider.</pre><pre>CChromeBrowser::CreateWhereClause - both short_name and url are empty!</pre><pre>CChromeBrowser::DeleteSearchProvider - id</pre><pre>CChromeBrowser::DeleteSearchProvider - sqlite3_open</pre><pre>CChromeBrowser::DeleteSearchProvider sql</pre><pre>CChromeBrowser::DeleteSearchProvider err</pre><pre>CChromeBrowser::DeleteSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>Google\Chrome\Application\chrome.exe</pre><pre>CurrentChromeInstallationPath :</pre><pre>CChromeBrowser::CloseBrowser - NOT host Browser , Exit</pre><pre>CChromeBrowser::ResetHP - reading json from file</pre><pre>CChromeBrowser::GetVersion - Not Installed</pre><pre>ChromeBrowser:: Version Failed</pre><pre>ChromeBrowser:: Version</pre><pre>ChromeExt</pre><pre>CChromeBrowser::ResetHP - hp</pre><pre>CChromeBrowser::ResetHP - bReadJSONSuccessful</pre><pre>CChromeBrowser::ResetHP - writing json to file</pre><pre>CChromeBrowser::ResetHP - Parnter found, try to revert</pre><pre>CChromeBrowser::ResetHP - Parnter found, revert failed - reset the HP.</pre><pre>CChromeBrowser::ResetHP - Parnter found, revert failed - reset the Startup.</pre><pre>CChromeBrowser::ResetHP - ret</pre><pre>CChromeBrowser::ResetDSP - start</pre><pre>CChromeBrowser::ResetDSP - sqlite3_open</pre><pre>CChromeBrowser::ResetDSP - Chrome version >= 17, we need to update the meta signature</pre><pre>CChromeBrowser, zsShouldEnableNT</pre><pre>CChromeBrowser::SetEnableNTToReg() - bIsUpdateInstallation</pre><pre>CChromeBrowser::SetEnableNTToReg - Set zsShouldEnableNT to 0</pre><pre>CChromeBrowser::SetEnableNTToReg() - szIsNewTabEnabled is set</pre><pre>CChromeBrowser::SaveRevertHpToRegistry - start</pre><pre>CChromeBrowser::SaveRevertHpToRegistry - ChromeSearchAssetsAdded</pre><pre>CChromeBrowser::SaveRevertHpToRegistry - Chrome is running.</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , start</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , Writing to registry</pre><pre>CChromeBrowser::SaveRevertHpToRegistry ,szHomepage not empty</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , Writing None to Revert_HP</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , Already exist in registry</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , zsRevertSupCh Already exist in registry</pre><pre>CChromeBrowser::SaveRevertDspToRegistry - start</pre><pre>CChromeBrowser::SaveRevertDspToRegistry - ChromeSearchAssetsAdded</pre><pre>CChromeBrowser::SaveRevertDspToRegistry - Chrome is running.</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , start</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , Writing to registry</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , write Revert_DSP</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , Writing None to Revert_DSP</pre><pre>CChromeBrowser::SaveRevertDspToRegistry ,Already exist in registry</pre><pre>CChromeBrowser::RevertHpFromRegistry - start</pre><pre>CChromeBrowser::RevertHpFromRegistry - Chrome is running.</pre><pre>CChromeBrowser::RevertHpFromRegistry , start</pre><pre>CChromeBrowser::RevertStartupFromRegistry - start</pre><pre>CChromeBrowser::RevertStartupFromRegistry - Chrome is running.</pre><pre>CChromeBrowser::RevertStartupFromRegistry , start</pre><pre>CChromeBrowser::RevertDspFromRegistry - start</pre><pre>CChromeBrowser::RevertDspFromRegistry - Chrome is running.</pre><pre>CChromeBrowser::RevertDspFromRegistry , start</pre><pre>CChromeBrowser::IsHostBrowser,CH</pre><pre>CChromeBrowser::RefreshHpUrl - hp</pre><pre>CChromeBrowser::RefreshHpUrl - NOT host Browser , Exit</pre><pre>CChromeBrowser::RefreshHpUrl - reading json from file</pre><pre>CChromeBrowser::RefreshHpUrl - bReadJSONSuccessful</pre><pre>CFirefoxBrowser::RefreshHpUrl , szHomepage before replace</pre><pre>CChromeBrowser::RefreshHpUrl - writing json to file</pre><pre>CChromeBrowser::RefreshHpUrl - ret</pre><pre>CChromeBrowser::RefreshDspUrl , start</pre><pre>CChromeBrowser::RefreshDspUrl - NOT host Browser , Exit</pre><pre>CChromeBrowser::UpdateSearchProvider - start</pre><pre>CChromeBrowser::UpdateSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::UpdateSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::UpdateSearchProvider - Chrome version >= 17, SP exists and is default, do not set again.</pre><pre>CChromeBrowser::UpdateSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>Installation/Chrome/PEMGUID</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - Can't read the preference file.</pre><pre>CChromeBrowser::IsNewTabActive - start</pre><pre>CChromeBrowser::IsNewTabActive - the new tab is not active because Instant URL is not exists.</pre><pre>CChromeBrowser::IsNewTabActive - the new tab is not active becuase the CURRENT_USER NT flag is not enabled</pre><pre>CChromeBrowser::IsNewTabActive - the new tab is not active becuase the LOCAL_MACHINE NT flag is not enabled</pre><pre>CChromeBrowser::IsNewTabActive - end, the new tab is active</pre><pre>CChromeBrowser::IsExtensionEnabled start.</pre><pre>CChromeBrowser::IsExtensionEnabled - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::IsExtensionEnabled - empty extension name</pre><pre>CChromeBrowser::IsExtensionEnabled - INSTALLER_ERROR_CHROME_ERROR</pre><pre>CDomainADBlockerCH::GetExtensionState we don't currenty support this state.</pre><pre>CChromeBrowser::SetExtensionEnabled start.</pre><pre>CChromeBrowser::SetExtensionEnabled - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SetExtensionEnabled - empty extension name</pre><pre>CChromeBrowser::SetExtensionEnabled - INSTALLER_ERROR_CHROME_ERROR</pre><pre>CChromeBrowser::SetExtensionEnabled - enable extention</pre><pre>sCChromeBrowser::SetExtensionEnabled - disable extention</pre><pre>CChromeBrowser::SetExtensionEnabled - writing json to file</pre><pre>CChromeBrowser::SetExtensionEnabled failed to read preferences</pre><pre>CChromeBrowser::EnableExtension - Start</pre><pre>CChromeBrowser::EnableExtension - NOT host Browser , Exit</pre><pre>CChromeBrowser::EnableExtension - EnableExtensionExtractingCrx, zsVersion</pre><pre>CChromeBrowser::EnableExtension - EnableExtensionInPreference, zsVersion</pre><pre>CChromeBrowser::EnableExtension - function ret:</pre><pre>\avg.crx</pre><pre>CChromeBrowser::EnableExtensionInPreference - Start</pre><pre>CChromeBrowser::EnableExtensionInPreference,</pre><pre>CChromeBrowser::EnableExtensionInPreference - Can't read the preference file.</pre><pre>\manifest.json</pre><pre>eCChromeBrowser::EnableExtensionInPreference - return value:</pre><pre>CChromeBrowser::CopyDetourFilesToAVGFolder, Begin</pre><pre>CChromeBrowser::CopyDetourFilesToAVGFolder, Can't create partner folder.</pre><pre>\Chrome</pre><pre>CChromeBrowser::CopyDetourFilesToAVGFolder, Can't create Chrome folder.</pre><pre>CChromeBrowser::CopyDetourFilesToAVGFolder, Can't create Default folder.</pre><pre>\Google\Chrome\User Data\Default\Preferences</pre><pre>\Google\Chrome\User Data\Default\Web Data</pre><pre>CChromeBrowser::CopyDetourFilesToAVGFolder, End. Res=</pre><pre>CChromeBrowser::MoveDetourFilesFromAVGFolder, Begin</pre><pre>\Chrome\Default\Web Data</pre><pre>CChromeBrowser::MoveDetourFilesFromAVGFolder, End. err=</pre><pre>CChromeBrowser::GetDSPFromChromeWebData - start</pre><pre>CChromeBrowser::GetDSPFromChromeWebData - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::GetDSPFromChromeWebData GetIdFromMetaTable</pre><pre>CChromeBrowser::CopyChromeHPToAVG().</pre><pre>CChromeBrowser::SetNTToAVG started</pre><pre>CChromeBrowser::CopyChromeSPToAVG(). CopyDsp</pre><pre>CChromeBrowser::CopyChromeSPToAVG() = SQLITE_OK</pre><pre>CChromeBrowser::CopyChromeSPToAVG() - sqlite3_open</pre><pre>CChromeBrowser::CopyChromeSPToAVG() - sqlite3_prepare</pre><pre>CChromeBrowser::CopyChromeSPToAVG() - Error in sqlite3_finalize() 1 Call</pre><pre>CChromeBrowser::CopyChromeSPToAVG() - Error in sqlite3_finalize() 2 Call</pre><pre>CChromeBrowser::CopyChromeSPToAVG() Error SQLite operation</pre><pre>CChromeBrowser::CopyChromeSPToAVG()</pre><pre>\Chrome\Default\</pre><pre>Web Data</pre><pre>\Google\Chrome\User Data\Default\</pre><pre>CChromeBrowser::SetDSPInPrefFile - Start</pre><pre>CChromeBrowser::SetDSPInPrefFile - reading json from file</pre><pre>CChromeBrowser::SetDSPInPrefFile - bReadJSONSuccessful</pre><pre>CChromeBrowser::GetPartnerDSPUrl - start</pre><pre>CChromeBrowser::GetPartnerDSPUrl - Chrome is running.</pre><pre>CChromeBrowser::GetPartnerDSPUrl - sqlite3_open</pre><pre>CChromeBrowser::GetPartnerDSPUrl sql</pre><pre>CChromeBrowser::GetPartnerDSPUrl - sqlite3_prepare</pre><pre>CChromeBrowser::GetPartnerDSPUrl - pChromeSearchProvider->sUrl</pre><pre>CChromeBrowser::AutoDisableToolbar - Start.</pre><pre>%LOCALAPPDATA%\Google\Chrome\User Data\Default\</pre><pre>CChromeBrowser::AutoDisableToolbar - Can't get paths.</pre><pre>CChromeBrowser::AutoDisableToolbar - Can't disable user toolbar.</pre><pre>CChromeBrowser::UpdateIntantUrl entered</pre><pre>CChromeBrowser::UpdateIntantUrl - sqlite3_open</pre><pre>CChromeBrowser::UpdateIntantUrl sql</pre><pre>CChromeBrowser::UpdateIntantUrl err</pre><pre>CChromeBrowser::UpdateIntantUrl exit</pre><pre>CChromeBrowser::EnableToolband - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::IsPartnerDefaultSearchProvider - Start.</pre><pre>CChromeBrowser::IsPartnerHomePage - Start.</pre><pre>CChromeBrowser::GetStartupFromJson - failed reading Json</pre><pre>CChromeBrowser::GetStartupFromJson - szStartup:</pre><pre>CChromeBrowser::GetHomepageFromJson - failed reading Json</pre><pre>CChromeBrowser::GetHomepageFromJson - szHomepage:</pre><pre>%s\Google\Chrome\User Data\Default\Extensions\%s</pre><pre>CChromeBrowser::ExtractChromeExtContentToUser, PEM</pre><pre>CChromeBrowser::ExtractChromeExtContentToUser, Crx</pre><pre>CChromeBrowser::ExtractChromeExtContentToUser, CRX Path</pre><pre>\%s_%s</pre><pre>CChromeBrowser::ExtractChromeExtContentToUser, new extension directory</pre><pre>CChromeBrowser::ExtractChromeExtContentToUser, AVG preferences</pre><pre>%s\%s_%s</pre><pre>CChromeSAPGuard::SetDSPInAVGFolder - start</pre><pre>OCChromeSAPGuard::SetDSPInAVGFolder - end. Ret</pre><pre>CChromeBrowser::IsInstantURLActive - start</pre><pre>CChromeBrowser::IsInstantURLActive - Chrome is running.</pre><pre>CChromeBrowser::IsInstantURLActive - sqlite3_open</pre><pre>CChromeBrowser::IsInstantURLActive sql</pre><pre>CChromeBrowser::IsInstantURLActive - sqlite3_prepare</pre><pre>CChromeBrowser::IsInstantURLActive - res</pre><pre>desktop.ini</pre><pre>Advapi32.dll</pre><pre>CRegistry::CreateRegistryKey(), Create error</pre><pre>CRegistry::OpenRegistryKey() - Tried to open</pre><pre>CRegistry::OpenRegistryKey(), Open error</pre><pre>CRegistry::getValue(...), for key</pre><pre>CRegistry::setValue(...), for key</pre><pre>CRegistry::removeValue(...), for key</pre><pre>CreateRegistryKey FAIL_TO_CREATE_REGISTRY</pre><pre>CRegistry::IsKeyExists(), Open error</pre><pre>CRegistry::getMultiValue(...), for key</pre><pre>CRegistry::setMultiValue(...), for key</pre><pre>CRegistry::DeleteAll(), RecurseDeleteKey error</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\ProfileList\</pre><pre>\NTUSER.DAT</pre><pre>CRegistry::SetValueAllUsers - Failed to get users key</pre><pre>CRegistry::GetValueAllUsers - Failed to get users key</pre><pre>CRegistry::CreateKeyAllUsers - Start</pre><pre>CRegistry::CreateKeyAllUsers - Failed to get users key</pre><pre>CRegistry::CreateKeyAllUsers - Number of users in reg</pre><pre>configuration.xml</pre><pre>WebTuneup</pre><pre>AVG Web TuneUp</pre><pre>CBrowser::SetPreferencesPerUsers, setting for Chrome, success</pre><pre>CBrowser::IsSearchAssetsAdded, Browser key</pre><pre>CBrowser::IsSearchAssetsAdded, value if browser key</pre><pre>avg-secure-search.xml</pre><pre>InstMaxSupportVer</pre><pre>CBrowser::UpdateChromeInstantUrl bInstantUrlUpdated =</pre><pre>%s: Ioctl = %p, ret = %d. GLE = %d</pre><pre>CChromeExtensionJson::CChromeExtensionJson() - failed reading preferences Json</pre><pre>CChromeExtensionJson::CChromeExtensionJson() - failed reading Extension Template or replace values</pre><pre>CChromeExtensionJson::CChromeExtensionJson() - failed reading template Json</pre><pre>\ExtensionTemplate.txt</pre><pre>CChromeExtensionJson::ReadExtensionTemplateAndReplaceValues templates file</pre><pre>CChromeExtensionJson::ReadExtensionTemplateAndReplaceValues time string is empty</pre><pre>CChromeExtensionJson::ReadExtensionTemplateAndReplaceValues fail to create tmp file</pre><pre>CThreadPostMsgOnEvent::Execute() - event to initialized</pre><pre>CThreadPostMsgOnEvent::Execute() - got the event - send message</pre><pre>CThreadPostMsgOnEvent::Execute() - an error ocurred</pre><pre>CThreadPostMsgOnEvent::Execute() - wait for event</pre><pre>CThreadPostMsgOnEvent::WaitForEvent() CreateEvent err</pre><pre>LNEWTABURL</pre><pre>IE_SUGGESTIONS_URL</pre><pre>IE_SUGGESTIONS_URL_FALLBACK</pre><pre>IE_SUGGESTIONS_URL_JSON</pre><pre>CHttpClient::DetermineHostAndUrl, resource</pre><pre>http://</pre><pre>https://</pre><pre>CHttpClient::DetermineHostAndUrl, Host</pre><pre>CHttpClient::DetermineHostAndUrl, Url</pre><pre>CHttpClient::SendString start</pre><pre>Mozilla/4.0 (compatible; MSIE 4.0; Windows NT 4.0)</pre><pre>CHttpClient::SendString userAgent</pre><pre>CHttpClient::SendString InternetOpen failed.</pre><pre>CHttpClient::SendString InternetConnect failed.</pre><pre>CHttpClient::SendString HttpOpenRequest failed.</pre><pre>CHttpClient::SendString HttpQueryInfo failed.</pre><pre>Microsoft\Internet Explorer\AboutURLs</pre><pre>res://ieframe.dll/tabswelcome.htm</pre><pre>Open registry HKEY_CURRENT_USER Start Page</pre><pre>SuggestionsURL</pre><pre>SuggestionsURLFallback</pre><pre>SuggestionsURL_JSON</pre><pre>FaviconURLFallback</pre><pre>CInternetExplorer::UpdateSearchProvider - try to open key:</pre><pre>CInternetExplorer::UpdateSearchProvider - key does not exist!</pre><pre>CInternetExplorer::UpdateSearchProvider - try to create key:</pre><pre>CInternetExplorer::UpdateSearchProvider - create key ended - return:</pre><pre>CInternetExplorer::UpdateSearchProvider - create key return:</pre><pre>\Internet Explorer\iexplore.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings</pre><pre>CInternetExplorer::EnableToolband, DeleteKey</pre><pre>CInternetExplorer::IsToolbarEnabled key</pre><pre>CInternetExplorer::IsToolbarEnabled key exist</pre><pre>\favicon.ico</pre><pre>favicon.ico</pre><pre>Mozilla/4.0 (compatible; MSIE</pre><pre>; Windows NT</pre><pre>{95B7759C-8C7F-4BF1-B163-73684A933233}</pre><pre>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\User Preferences</pre><pre>CInternetExplorer::SetDefaultSearchProvider, GrantRegKeyAccess</pre><pre>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</pre><pre>CInternetExplorer::SetEnableNTToReg, zsShouldEnableNT</pre><pre>CInternetExplorer::SetEnableNTToReg - Set zsShouldEnableNT to 0</pre><pre>CInternetExplorer::RefreshHpUrl , start</pre><pre>CInternetExplorer::RefreshHpUrl - NOT host Browser , Exit</pre><pre>CInternetExplorer::RefreshHpUrl , szHomepage before replace</pre><pre>CInternetExplorer::RefreshHpUrl , zsPartnerHomePage is empty</pre><pre>CInternetExplorer::RefreshHpUrl , Driver is not running</pre><pre>CInternetExplorer::RefreshHpUrl , Driver is running and guard is enabled</pre><pre>CInternetExplorer::RefreshHpUrl , szHomepage after replace</pre><pre>CInternetExplorer::RefreshDspUrl , start</pre><pre>CInternetExplorer::RefreshDspUrl - NOT host Browser , Exit</pre><pre>CInternetExplorer::RefreshDspUrl, GrantRegKeyAccess</pre><pre>CInternetExplorer::RefreshNtUrl , start</pre><pre>CInternetExplorer::RefreshNtUrl - NOT host Browser , Exit</pre><pre>CInternetExplorer::AutoDisableToolbar - Can't create key.</pre><pre>\avgdttbx.dll</pre><pre>CDNTAdapter::CDNTAdapter error loading avgdttbx.dll</pre><pre>CDNTAdapter::CDNTAdapter() - _AvgDntSetDownloadDataURL</pre><pre>CDNTAdapter::AvgDntSetDownloadDataURL(%s) - return value</pre><pre>AvgDntSetDownloadDataURL not initialized, called failed</pre><pre>CDNTAdapter::AvgDntUpdateDataFile(%d) - return value</pre><pre>\%s\DNT</pre><pre>ScriptHelper.exe</pre><pre>CFirefoxBrowser::CFirefoxBrowser() - start</pre><pre>CFirefoxBrowser::CFirefoxBrowser() - INI</pre><pre>CFirefoxBrowser::CFirefoxBrowser() - failed to read INI file, try to get info from INI backup in registry.</pre><pre>CFirefoxBrowser::GetVersion - start</pre><pre>CFirefoxBrowser::GetVersion - version:</pre><pre>CFirefoxBrowser::GetVersionEx - start</pre><pre>CFirefoxBrowser::GetVersionEx - Not Installed</pre><pre>extensions.lastAppVersion</pre><pre>CFirefoxBrowser::GetVersionEx - version:</pre><pre>CFirefoxBrowser::GetVersionEx - short version:</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>CFirefoxBrowser::CreateSearchProvider - start</pre><pre>CFirefoxBrowser::CreateSearchProvider - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::CreateSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::CreateSearchProvider - failed to find xml to temp</pre><pre>CFirefoxBrowser::CreateSearchProvider - failed to replace common values</pre><pre>CFirefoxBrowser::CreateSearchProvider - copy XML to program files failed.</pre><pre>FireFoxSearchXml.tmp</pre><pre>CFirefoxBrowser::UpdateSearchProvider - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::WriteKeyToGuardToSetDSP - start</pre><pre>CFirefoxBrowser::WriteKeyToGuardToSetDSP - end, return:</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - Firefox is running.</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - application is running in SYSTEM account!. Can not set as DSP.</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - INI Path:</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - failed to set DSP in all profiles</pre><pre>CFirefoxBrowser::IsNewTabActive</pre><pre>avg.userPreferences.newtabDisabledByUser</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the user canceled</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the CURRENT_USER NT flag is not enabled</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the LOCAL_MACHINE NT flag is not enabled</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is active.</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - temp XML filename</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - ReadTempXML failed.</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - XML filename</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - Partner name is empty.</pre><pre>CFirefoxBrowser::DetermineFFProfilesDir - start</pre><pre>CFirefoxBrowser::DetermineFFProfilesDir - GetSafeEnv return NULL</pre><pre>\Mozilla\Firefox\Profiles\</pre><pre>CFirefoxBrowser::DetermineFFProfilesDir - Firefox Folder</pre><pre>CFirefoxBrowser::GetSearchXMLLocation - GetCurrentFirefoxInstallationPath failed</pre><pre>CFirefoxBrowser::GetSearchXMLLocation - first XML location</pre><pre>CFirefoxBrowser::GetSearchXMLLocation - second XML location</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles - Copy from</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles - Copy to</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles firefox version is less than 21</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles create browser folder</pre><pre>CFirefoxBrowser::CopyXmlToUserData - Copy from</pre><pre>CFirefoxBrowser::CopyXmlToUserData - Copy to</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles failed to write Pref.js to profile(USER)</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles failed to write Pref.js to profile</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles. Create directory is failed</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles. CopyFile is failed</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::SetDSPInAllProfilesAfterInstall. FireFoxSearchXml.tmp is not exist</pre><pre>CFirefoxBrowser::ReadTempXML() - CreateFile failed. GetLastError</pre><pre>CFirefoxBrowser::ReadTempXML() - ReadFile failed. GetLastError</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider -pzsIniFile is not NULL</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider -Get display name</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider - DSP Display Name:</pre><pre>browser.search.defaultenginename</pre><pre>browser.search.selectedEngine</pre><pre>CFirefoxBrowser::WriteFile - CreateFile failed. GetLastError</pre><pre>CFirefoxBrowser::WriteFile - WriteFile failed. GetLastError</pre><pre>CFirefoxBrowser::WriteFile() - WriteFile failed. size written too small</pre><pre>CFirefoxBrowser::InitSearchProviderFromIni - ini</pre><pre>CFirefoxBrowser::InitSearchProviderFromIni - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::InitSearchProviderFromRegistry</pre><pre>CFirefoxBrowser::InitSearchProviderFromRegistry - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::GetHomepage, homepage</pre><pre>CFirefoxBrowser::GetHomepage, next profile</pre><pre>browser.startup.homepage</pre><pre>CFirefoxBrowser::GetHomepage, success</pre><pre>CFirefoxBrowser::SetHomepage, homepage</pre><pre>CFirefoxBrowser::SetHomepage - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::SetHomepage - Firefox is running.</pre><pre>CFirefoxBrowser::SetHomepage, next profile</pre><pre>CFirefoxBrowser::SetHomepage, success</pre><pre>CFirefoxBrowser::GetKeywordUrl, szKeyWordUrl</pre><pre>CFirefoxBrowser::GetKeywordUrl, next profile</pre><pre>LCFirefoxBrowser::GetKeywordUrl, success</pre><pre>CFirefoxBrowser::SetKeywordUrl, szKeyWordUrl</pre><pre>CFirefoxBrowser::SetKeywordUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::SetKeywordUrl - Firefox is running.</pre><pre>CFirefoxBrowser::SetKeywordUrl, next profile</pre><pre>CFirefoxBrowser::SetKeywordUrl, success</pre><pre>CFirefoxBrowser::DeleteSearchProvider - start</pre><pre>CFirefoxBrowser::DeleteSearchProvider - Firefox is running.</pre><pre>CFirefoxBrowser::DeleteSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::SearchProviderExist - start</pre><pre>CFirefoxBrowser::SearchProviderExist - Firefox is running.</pre><pre>CFirefoxBrowser::SearchProviderExist - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::SearchProviderExist - failed to get Default search engine for profile</pre><pre>CFirefoxBrowser::SearchProviderExist - ProfileExist</pre><pre>CFirefoxBrowser::SearchProviderExist - ProfileDefault</pre><pre>CFirefoxBrowser::SearchProviderExist - ProgramFilesExist</pre><pre>CFirefoxBrowser::SearchProviderExist - ProgramFilesDefault</pre><pre>CFirefoxBrowser::SearchProviderExist - Exist</pre><pre>CFirefoxBrowser::SearchProviderExist - Default</pre><pre>CFirefoxBrowser::HandleXMLInInstalltion - start</pre><pre>CFirefoxBrowser::HandleXMLInInstalltion - File Path</pre><pre>CFirefoxBrowser::HandleXMLInInstalltion - delete</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox\</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - start</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - fail to get CurrentVersion from</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - CurrentVersion</pre><pre>PathToExe</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - fail to get PathToExe from</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - Path</pre><pre>\search.json</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite Sqlite path</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite - sqlite3_open</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite sql</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite err</pre><pre>\search.sqlite</pre><pre>RefreshUserSearchProviderList - check if search.json file exists @ path:</pre><pre>RefreshUserSearchProviderList - try to delete search.json @ path:</pre><pre>CFirefoxBrowser CleanupToolband - start</pre><pre>CFirefoxBrowser CleanupToolband - failed to cast.</pre><pre>CFirefoxBrowser CleanupToolband, id</pre><pre>extensions.installCache</pre><pre>CFirefoxBrowser EnableToolband - start</pre><pre>CFirefoxBrowser EnableToolband - failed to cast.</pre><pre>CFirefoxBrowser EnableToolband, id</pre><pre>CFirefoxBrowser EnableToolband, enabled</pre><pre>CFirefoxBrowser::IsExtensionEnabled - Failed to get extension ID.</pre><pre>extensions.json</pre><pre>CFirefoxBrowser::CheckInExtensionsJson - failed to build extension.sqlite path.</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable - start</pre><pre>extensions.sqlite</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable - failed to build extension.sqlite path.</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable - sqlite3_open</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable sql</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable err</pre><pre>CFirefoxBrowser::DeleteFromAddonTable - start</pre><pre>CFirefoxBrowser::DeleteFromAddonTable - failed to build extension.sqlite path.</pre><pre>CFirefoxBrowser::DeleteFromAddonTable - sqlite3_open</pre><pre>CFirefoxBrowser::DeleteFromAddonTable sql</pre><pre>CFirefoxBrowser::DeleteFromAddonTable err</pre><pre>CFirefoxBrowser::AddonTableContainsToolbar - sqlite3_prepare</pre><pre>extensions.rdf</pre><pre>extensions.cache</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - Unable to create XML parser object</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - Unable to load XML document into the parser</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - failed to save the modified extension.rdf</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - unknown exception.</pre><pre>.default</pre><pre>CFirefoxBrowser::BuildDefaultProfileFilePath - failed.</pre><pre>CFirefoxBrowser::BuildDefaultProfileFilePath - BuildDefaultProfileFilePath</pre><pre>CFirefoxBrowser HandleExtensionIni - start</pre><pre>extensions.ini</pre><pre>CFirefoxBrowser HandleExtensionIni sIniPath:</pre><pre>SOFTWARE\Mozilla\Firefox\extensions</pre><pre>CFirefoxBrowser HandleExtensionIni szId:</pre><pre>CFirefoxBrowser HandleExtensionIni value of ::</pre><pre>CFirefoxBrowser HandleExtensionIni, sProfileExtensionPath:</pre><pre>CFirefoxBrowser HandleExtensionIni, sProfileExtensionPath exists</pre><pre>CFirefoxBrowser HandleExtensionIni, SetTextVector of ExtensionDirs</pre><pre>CFirefoxBrowser IsToolbarEnabled - start</pre><pre>CFirefoxBrowser IsToolbarEnabled - Error in casting - return false.</pre><pre>CFirefoxBrowser IsToolbarEnabled, ff toolbar folder name</pre><pre>CFirefoxBrowser IsToolbarEnabled - Error PathFileExists - return false.</pre><pre>Extension%d</pre><pre>CFirefoxBrowser IsToolbarEnabled. szToolbarDir=</pre><pre>CFirefoxBrowser IsToolbarEnabled - szToolbarDir is empty</pre><pre>\install.rdf</pre><pre>CFirefoxBrowser GetToolbarInstallState - start</pre><pre>CFirefoxBrowser GetToolbarInstallState, ff toolbar id</pre><pre>CFirefoxBrowser::RollbackNewTab - Firefox is running.</pre><pre>avg.install.newtab</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled, conf file</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled, FF toolbar ID</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled toolbar enabled</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled toolbar disabled</pre><pre>CFirefoxBrowser::RefreshFFBelow4ExtenionsRDF</pre><pre>CFirefoxBrowser::RefreshFFBelow4ExtenionsRDF - Version below 4, delete Extenions.rdf</pre><pre>CFirefoxBrowser::RefreshFFBelow4ExtenionsRDF, deleting extensions.rdf</pre><pre>\extensions.rdf</pre><pre>CFirefoxBrowser::RefreshFFBelow4ExtenionsRDF, extensions.rdf from path found, delete it</pre><pre>CFirefoxBrowser::ResetHP - start</pre><pre>CFirefoxBrowser::ResetHP - Firefox is running.</pre><pre>CFirefoxBrowser::ResetHP - GetDefaultProfile.</pre><pre>CFirefoxBrowser::ResetHP, next profile</pre><pre>CFirefoxBrowser::ResetHP - ,zsPartnerHomePage:</pre><pre>CFirefoxBrowser::ResetHP, szHomepage</pre><pre>CFirefoxBrowser::ResetHP, szHomepage not empty</pre><pre>CFirefoxBrowser::ResetHP, 1:sCurrUrl,</pre><pre>CFirefoxBrowser::ResetHP, zsCurrHomePage,</pre><pre>CFirefoxBrowser::ResetHP ,bFoundPartnerUrl = true;</pre><pre>CFirefoxBrowser::ResetHP ,sCurrUrl not equal to iniHost</pre><pre>CFirefoxBrowser::ResetHP ,bFoundPartnerUrl is true;</pre><pre>CFirefoxBrowser::ResetHP ,bReverted is true</pre><pre>CFirefoxBrowser::ResetHP ,bReverted is false and zsCurrHomePage is</pre><pre>CFirefoxBrowser::ResetHP, sCurrHomePage before deciding how to reset</pre><pre>CFirefoxBrowser::ResetHP ,zsCurrHomePage is empty</pre><pre>CFirefoxBrowser::ResetHP, Homepage empty so set tp default</pre><pre>CFirefoxBrowser::ResetHP, Partner removed</pre><pre>CFirefoxBrowser::ResetDSP - start</pre><pre>CFirefoxBrowser::ResetDSP - Firefox is running.</pre><pre>CFirefoxBrowser::ResetDSP failed to write Pref.js to profile</pre><pre>CFirefoxBrowser::DeleteXmlFromProgramFiles - start</pre><pre>CFirefoxBrowser::DeleteXmlFromProgramFiles - GetCurrentFirefoxInstallationPath failed</pre><pre>CFirefoxBrowser::DeleteXmlFromProgramFiles - Delete file from</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - Firefox is running.</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - delete DEFAULT_ENGINE SELECTED_ENGINE</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - SetDeafultSearchProviderToString failed</pre><pre>CFirefoxBrowser, zsShouldEnableNT</pre><pre>CFirefoxBrowser::SetEnableNTToReg - Set zsShouldEnableNT to 0</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , start</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry ,FFSearchAssetsAdded</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Writing to registry</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , write Revert_HP</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Writing None to Revert_HP</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Aleady exist in registry</pre><pre>CFirefoxBrowser::RevertHpFromRegistry , start</pre><pre>CFirefoxBrowser::RevertHpFromRegistry , Reverting the homepage.</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , start</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry ,FFSearchAssetsAdded</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , Writing to registry</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , Write Revert_DSP</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , Writing None to Revert_DSP</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Already exist in registry</pre><pre>CFirefoxBrowser::GetDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::SetDeafultSearchProviderToString - start</pre><pre>CFirefoxBrowser::SetDeafultSearchProviderToString - Firefox is running.</pre><pre>CFirefoxBrowser::RevertDspFromRegistry - start</pre><pre>CFirefoxBrowser::RevertDspFromRegistry - Firefox is running.</pre><pre>CFirefoxBrowser::RevertDspFromRegistry , start</pre><pre>CFirefoxBrowser::RevertOnlyDspFromRegistry - start</pre><pre>CFirefoxBrowser::RevertOnlyDspFromRegistry - Firefox is running.</pre><pre>CFirefoxBrowser::RevertOnlyDspFromRegistry - revert value is</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , start</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry ,FFSearchAssetsAdded</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Writing to registry</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry, not our value</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry, write Revert_KU</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Writing None to Revert_KU</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Aleady exist in registry</pre><pre>CFirefoxBrowser::RevertKeywordUrlFromRegistry , start</pre><pre>CFirefoxBrowser::RevertKeywordUrlFromRegistry , Reverting the keywordURL.</pre><pre>CFirefoxBrowser::IsHostBrowser,FF</pre><pre>CFirefoxBrowser::RefreshHpUrl - start</pre><pre>CFirefoxBrowser::RefreshHpUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshHpUrl - Firefox is running.</pre><pre>CFirefoxBrowser::RefreshHpUrl, next profile</pre><pre>CFirefoxBrowser::RefreshHpUrl, szHomepage</pre><pre>CFirefoxBrowser::RefreshHpUrl, Homepage empty so set tp default</pre><pre>CFirefoxBrowser::RefreshHpUrl, Partner removed</pre><pre>CFirefoxBrowser::RefreshDspUrl , start</pre><pre>CFirefoxBrowser::RefreshDspUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - start</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - failed to find xml to temp</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - failed to replace common values</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - copy XML to program files</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - copy XML to User Data</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - copy XML to program files succeded, erased cache</pre><pre>CFirefoxBrowser::RefreshKeywordUrl - start</pre><pre>CFirefoxBrowser::RefreshKeywordUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshKeywordUrl - Firefox is running.</pre><pre>CFirefoxBrowser::IsExtensionEnabled - start</pre><pre>CFirefoxBrowser::IsExtensionEnabled - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::IsExtensionEnabled - failed to build extension.sqlite path.</pre><pre>CFirefoxBrowser::IsExtensionEnabled - CopyFileToTmpFolder faild.</pre><pre>CFirefoxBrowser::IsExtensionEnabled - sqlite3_open</pre><pre>CFirefoxBrowser::IsExtensionEnabled - sqlite3_prepare</pre><pre>CFirefoxBrowser::IsExtensionEnabled - unknown state</pre><pre>CFirefoxBrowser::IsExtensionEnabled - DB empty.</pre><pre>CChromeExtensionJson::CChromeExtensionJson() - failed reading addons Json</pre><pre>CFirefoxBrowser::AddCampaignIdToXML - XML filename</pre><pre>CFirefoxBrowser::AddCampaignIdToXML - ReadTempXML failed.</pre><pre>CFirefoxBrowser::GetCampaignIdFromXML - XML filename</pre><pre>CFirefoxBrowser::GetCampaignIdFromXML - ReadTempXML failed.</pre><pre>CFirefoxBrowser::GetCampaignIdFromXML - cmpid</pre><pre>CFirefoxBrowser::IsPartnerDefaultSearchProvider - Start.</pre><pre>CFirefoxBrowser::IsPartnerHomePage - Start.</pre><pre>CFirefoxBrowser::IsPartnerHomePage - Can't get homepage.</pre><pre>CFirefoxBrowser::DeleteUserSearchProvider() - start</pre><pre>CFirefoxBrowser::DeleteUserSearchProvider() - delete</pre><pre>CFirefoxBrowser::AutoDisableToolbar - start</pre><pre>\FireFoxExt\</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsID</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsName</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsToolbarVersion</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetAppID</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetMinVer</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetMaxVer</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsCreator</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsDescription</pre><pre>RDF/Description/em:homepageURL</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsHomepageURL</pre><pre>CFirefoxBrowser::AutoDisableToolbar - Can't get paths.</pre><pre>\extensions.sqlite</pre><pre>CFirefoxBrowser::AutoDisableToolbar - error sqlite3_open</pre><pre>CFirefoxBrowser::AutoDisableToolbar insert err</pre><pre>CFirefoxBrowser::AutoDisableToolbar - sqlite3_prepare</pre><pre>CFirefoxBrowser::AutoDisableToolbar - NO id</pre><pre>CFirefoxBrowser::AutoDisableToolbar insert locale err</pre><pre>)CFirefoxBrowser::AutoDisableToolbar insert targetApplication err</pre><pre>CFirefoxBrowser::PrepateDisable - sqlite3_prepare</pre><pre>CFirefoxBrowser::PrepateDisable - NO id</pre><pre>CFirefoxBrowser::PrepateDisable - addon table</pre><pre>CFirefoxBrowser::PrepateDisable - locale table</pre><pre>CFirefoxBrowser::PrepateDisable - targetApplication</pre><pre>CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Start.</pre><pre>CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Can't get paths.</pre><pre>CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Failed to delete file:</pre><pre>P%d/%d/%d %d:%d:%d</pre><pre>\SiteSafety.dll</pre><pre>CSiteSafetyAdapter::CSiteSafetyAdapter error loading SiteSAfety.dll</pre><pre>CSiteSafetyAdapter::CSiteSafetyAdapter() - _avg_sitesafety_urldb_update</pre><pre>CSiteSafetyAdapter::CSiteSafetyAdapter() - _avg_sitesafety_urldb_is_up_to_date</pre><pre>CSiteSafetyAdapter::CSiteSafetyAdapter() - _avg_sitesafety_set_feed_server_url</pre><pre>CSiteSafetyAdapter::CSiteSafetyAdapter() - _avg_sitesafety_urldb_update_async</pre><pre>CSiteSafetyAdapter::CSiteSafetyAdapter() - _avg_sitesafety_urldb_update_wait</pre><pre>Qlogger.properties</pre><pre>CLoggerServer::CopyLoggerProperties() - failed to calculate log4cplus.properties path</pre><pre>CLoggerServer::CopyLoggerProperties() - failed to create log4cplus.properties path</pre><pre>CCrashReport::GlobalExceptionFilter no crash report files</pre><pre>avgdumpx.exe</pre><pre>-p %d -c %d %d -D toolbar</pre><pre>CCrashReport::GlobalExceptionFilter shellexecute res</pre><pre>CCrashReport::CopyFile start</pre><pre>CCrashReportAdapter::CopyFile cannot create dir</pre><pre>CCrashReportAdapter::CopyFile to</pre><pre>CCrashReport::CCrashReport() no AV installed/AV version isn't 2014</pre><pre>CCrashReport::CCrashReport() installed from third party not copying files</pre><pre>CCrashReport::CCrashReport() - CrashReport Path is</pre><pre>avgdiagex.exe</pre><pre>avgsysx.dll</pre><pre>avgcommx.dll</pre><pre>crash.avgdx</pre><pre>CrashReport</pre><pre>QXpiUnInstaller.cpp: DetermineFFProfilesDir</pre><pre>XpiUnInstaller.cpp: RemoveDirecetoryRecurse</pre><pre>XpiUnInstaller.cpp: fnProfilesXpiUnInstaller, DetermineFFProfilesDir failed.</pre><pre>XpiUnInstaller.cpp: fnProfilesXpiUnInstaller, folder name</pre><pre>XpiUnInstaller.cpp: fnProfilesXpiUnInstaller, about to remove</pre><pre>CFFConfig::Initialize() - m_szFirefoxFolder</pre><pre>prefs.js</pre><pre>prefs.js.tmp</pre><pre>localstore.rdf</pre><pre>CFFConfig::GetValue - key</pre><pre>CFFConfig::SetValue - key</pre><pre>CFFConfig: DeleteKey, removing:</pre><pre>CFFConfig: DeleteKey, IsInitialized failed</pre><pre>CFFConfig: ParsePreferences, szKey:</pre><pre>CFFConfig: ParsePreferences, couldn't determine key name</pre><pre>CFFConfig: ParsePreferences, PARSING_TYPE_DELETE, found key, value:</pre><pre>CFFConfig: ParsePreferences, Key not found, Key:</pre><pre>CPaypalDomainListReader::CheckFileExist "data.dat" does not exist</pre><pre>CPaypalDomainListReader::Init "data.zip" file does not exists</pre><pre>CPaypalDomainListReader::CheckFileExist "data.zip" exist</pre><pre>CPaypalDomainListReader::CheckFileExist copy or unzip"data.zip" result</pre><pre>CPaypalDomainListReader::Init "data.dat" file exists</pre><pre>\%s\Paypal</pre><pre>CIEApproveExtension::EnumIEWindows: IsApproveExtension: true</pre><pre>CIEApproveExtension::EnumIEWindows: m_bSendIEMsg = true</pre><pre>CIEApproveExtension::SetAVGToolbarEnabled_IE9: send WM_KEYDOWN with Enter</pre><pre>%s\..\Roaming\Microsoft\Windows\IEDownloadHistory\index.dat</pre><pre>%s\..\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat</pre><pre>CPathPermissions:GrantRegKeyAccess, start</pre><pre>CPathPermissions:GrantRegKeyAccess, FullKey is empty</pre><pre>HKEY_</pre><pre>CPathPermissions:GrantRegKeyAccess, GetNamedSecurityInfo FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess, RegOpenKeyEx FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,return false</pre><pre>CPathPermissions:GrantRegKeyAccess ,OpenProcessToken FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,HeapAlloc NULL</pre><pre>CPathPermissions:GrantRegKeyAccess ,InitializeAcl FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,AddAccessAllowedAce FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,InitializeSecurityDescriptor FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,SetSecurityDescriptorDacl FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,RegSetKeySecurity FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,SetNamedSecurityInfo FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,end ,return true</pre><pre>R0.0.0</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy ScriptHelper.exe err</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy ScriptHelper.exe from</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy ScriptHelper.exe to</pre><pre>manifest.json</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy manifest.json err</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy manifest.json from</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy manifest.json to</pre><pre>SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh</pre><pre>CChInstallerState::ActivateState CreateRegistryKey</pre><pre>launchchrome.js</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy launchchrome.js err</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy launchchrome.js from</pre><pre>CScriptHelperInstaller::CopyProduct() - failed to copy launchchrome.js to</pre><pre>UNINSTALL DeleteNativeMsgHost started</pre><pre>SOFTWARE\Google\Chrome\NativeMessagingHosts\</pre><pre>\\.\avgtp</pre><pre>{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}</pre><pre>CDomainADBlockerCH::CDomainADBlockerCH error!!! empty chrome path</pre><pre>Local Storage\chrome-extension_gighmmpiobklfepjocnamgkkbiglidom_0.localstorage</pre><pre>CDomainADBlockerCH::CDomainADBlockerCH SQLite path</pre><pre>CDomainADBlockerCH::AddDomainToAdBlocker failed to open sqlite table.</pre><pre>CDomainADBlockerCH::IsDomainInWhiteList failed to open sqlite table.</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_prepare error</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_step empty error</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_step error</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_column_text - error: can't read 'custom_filters' value</pre><pre>CDomainADBlockerCH::OpenTable - sqlite3_open error</pre><pre>CAdBlock::AddDomain sqlite3_exec statement</pre><pre>CAdBlock::AddDomain sqlite3_exec error</pre><pre>@@||%s^$document</pre><pre>CDomainADBlockerPlus::ReadLinesFromFile inFile.is_open failed return false</pre><pre>CDomainADBlockerPlus::WriteLinesToFile outFile.is_open failed return false</pre><pre>Assertion failed: %s, file %s, line %d</pre><pre>%Program Files%\AVG SafeGuard toolbar\vprot.exe</pre><pre>18.1.0.443</pre><pre>VProtect.exe</pre><b>ScriptHelper.exe_2420:</b><pre>.text</pre><pre>`.orpc</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>PSSSSSSh</pre><pre>F><.tN<[tJ<\tF<*tB<|t><^t:<$t6</pre><pre><9%u3</pre><pre>t8It.IIt#</pre><pre>.FGy"</pre><pre> 2 34 567</pre><pre>>.uBV</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>tGHt.Ht&</pre><pre>.\Executer.cpp</pre><pre>.%D,3</pre><pre>.\GenericWnd.cpp</pre><pre>.\ScriptHelperApi.cpp</pre><pre>keyname</pre><pre>.\ChromeNativeListener.cpp</pre><pre>{ "id": %d, "name": "%s", "current": %d, "revert": %d }</pre><pre>log4cplusU.dll</pre><pre>kernel32.dll</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>GetProcessWindowStation</pre><pre>portuguese-brazilian</pre><pre>operator</pre><pre>USER32.DLL</pre><pre>inflate 1.2.5 Copyright 1995-2010 Mark Adler</pre><pre>unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll</pre><pre>3.7.3</pre><pre>SQLite format 3</pre><pre>CREATE TABLE sqlite_master(</pre><pre>sql text</pre><pre>CREATE TEMP TABLE sqlite_temp_master(</pre><pre>REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYo</pre><pre>()$^.* ?[]|\-{},:=!</pre><pre>.\ProductManager.cpp</pre><pre>RegDeleteKeyExW</pre><pre>.\Registry.cpp</pre><pre>.\SystemCommands.cpp</pre><pre>fail to unload log4cplusU.dll</pre><pre>.\Logger.cpp</pre><pre>.\InternetExplorer.cpp</pre><pre>.\FirefoxBrowser.cpp</pre><pre>keyword.URL</pre><pre>select * from addon where id='%s'</pre><pre>SELECT active FROM addon WHERE id='%s'</pre><pre>INSERT INTO addon (id,location,version,type,defaultLocale,visible,active,userDisabled,pendingUninstall,descriptor,applyBackgroundUpdates,bootstrap,skinnable,softDisabled,IsForeignInstall,hasBinaryComponents,strictCompatibility) VALUES ('%s','winreg-app-global','%s','extension',3,1,0,1,0,'%s',1,0,0,0,1,0,0)</pre><pre>INSERT INTO locale (id,name,description,creator,homepageURL) VALUES ('%s','%s','%s','%s','%s')</pre><pre>INSERT INTO targetApplication (addon_internal_id,id,minVersion,maxVersion) VALUES ('%s','%s','%s','%s')</pre><pre>.\ChromeBrowser.cpp</pre><pre>startup_urls</pre><pre>urls_to_restore_on_startup</pre><pre>icon_url</pre><pre>instant_url</pre><pre>keyword</pre><pre>search_url</pre><pre>suggest_url</pre><pre>VALUES ('%s','%s','%s','%s',%d,%d,'%s',%d,%d,'%s','%s',%d)</pre><pre>(short_name,keyword,favicon_url,url,show_in_default_list,safe_for_autoreplace,originating_url,date_created,usage_count,input_encodings,suggest_url,autogenerate_keyword)</pre><pre>keywords</pre><pre>INSERT INTO %s %s %s</pre><pre>keywords_backup</pre><pre>VALUES ('%s','%s','%s','%s',%d,%d,'%s',%d,%d,'%s','%s')</pre><pre>(short_name,keyword,favicon_url,url,show_in_default_list,safe_for_autoreplace,originating_url,date_created,usage_count,input_encodings,suggest_url)</pre><pre>SET short_name='%s', keyword='%s', favicon_url='%s', url='%s', show_in_default_list=%d, safe_for_autoreplace=%d, originating_url='%s', date_created=%d, usage_count=%d, input_encodings='%s', suggest_url='%s', prepopulate_id=0, autogenerate_keyword=%d</pre><pre>SET short_name='%s', keyword='%s', favicon_url='%s', url='%s', show_in_default_list=%d, safe_for_autoreplace=%d, originating_url='%s', date_created=%d, usage_count=%d, input_encodings='%s', suggest_url='%s', prepopulate_id=0</pre><pre>WHERE short_name='%s'</pre><pre>UPDATE %s %s %s</pre><pre>SELECT * FROM %s WHERE %s</pre><pre>SELECT * FROM %s WHERE id=%d</pre><pre>UPDATE meta SET value='%d' WHERE key='Default Search Provider ID'</pre><pre>INSERT INTO meta (key,value) VALUES ('Default Search Provider ID','%d')</pre><pre>UPDATE meta SET value='%d' WHERE key='Default Search Provider ID Backup'</pre><pre>INSERT INTO meta (key,value) VALUES ('Default Search Provider ID Backup','%d')</pre><pre>SELECT value FROM meta WHERE key='Default Search Provider ID'</pre><pre>SELECT value FROM meta WHERE key='Default Search Provider ID Backup'</pre><pre>url LIKE '%</pre><pre>DELETE FROM %s WHERE id=%d</pre><pre>select min (id) from keywords</pre><pre>webNavigation</pre><pre>webRequest</pre><pre>webRequestBlocking</pre><pre>webRequestInternal</pre><pre>http://dnt.cloud.avg.com/*</pre><pre>http://dntf.cloud.avg.com/*</pre><pre>http://toolbar.avg.com/*</pre><pre>from_webstore</pre><pre>search_terms_replacement_key</pre><pre>SELECT * FROM keywords WHERE short_name='%s'</pre><pre>SELECT new_tab_url FROM %s WHERE id=%d</pre><pre>SELECT id, short_name FROM %s</pre><pre>SELECT instant_url FROM keywords WHERE short_name='%s'</pre><pre>0A743C17-7543-48b3-8A75-F60D0F132DD9</pre><pre>.\UnInstallerHelper.cpp</pre><pre>.\LocalSystemCommands.cpp</pre><pre>.\HttpClient.cpp</pre><pre>.\DriverHelper.cpp</pre><pre>.\CrashReportAdapter.cpp</pre><pre>.\Browser.cpp</pre><pre>.\Thread.cpp</pre><pre>.\PathPermissions.cpp</pre><pre>.\Directory.cpp</pre><pre>.\FFConfig.cpp</pre><pre>%s%s", %s%s%s);</pre><pre>invalid _N_type: %d</pre><pre>.\INIReader.cpp</pre><pre>.\EmailNotifier.cpp</pre><pre>.\DomainBlockerManager.cpp</pre><pre>.\StringConverter.cpp</pre><pre>.\PaypalDomainListReader.cpp</pre><pre>.\UpdaterRequest.cpp</pre><pre>.\CoInitializer.cpp</pre><pre>.\IEApproveExtension.cpp</pre><pre>.\ScriptHelperWrapper.cpp</pre><pre>large file support is disabled</pre><pre>SQL logic error or missing database</pre><pre>foreign_keys</pre><pre>sqlite_compileoption_get</pre><pre>sqlite_compileoption_used</pre><pre>sqlite_source_id</pre><pre>sqlite_version</pre><pre>sqlite_attach</pre><pre>sqlite_detach</pre><pre>sqlite_stat1</pre><pre>sqlite_rename_parent</pre><pre>sqlite_rename_trigger</pre><pre>sqlite_rename_table</pre><pre>RowKey</pre><pre>SQLITE_</pre><pre>d-d-d d:d:d</pre><pre>d:d:d</pre><pre>d-d-d</pre><pre>failed to allocate %u bytes of memory</pre><pre>failed memory resize %u to %u bytes</pre><pre>922337203685477580</pre><pre>API call with %s database connection pointer</pre><pre>%s-shm</pre><pre>%s\etilqs_</pre><pre>OsError 0x%x (%u)</pre><pre>Recovered %d frames from WAL file %s</pre><pre>invalid page number %d</pre><pre>2nd reference to page %d</pre><pre>Failed to read ptrmap key=%d</pre><pre>Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)</pre><pre>%d of %d pages missing from overflow list starting at %d</pre><pre>failed to get page %d</pre><pre>freelist leaf count too big on page %d</pre><pre>Page %d:</pre><pre>unable to get the page. error code=%d</pre><pre>btreeInitPage() returns error code %d</pre><pre>On tree page %d cell %d:</pre><pre>On page %d at right child:</pre><pre>Corruption detected in cell %d on page %d</pre><pre>Multiple uses for byte %d of page %d</pre><pre>Fragmentation of %d bytes reported as %d on page %d</pre><pre>Page %d is never used</pre><pre>Pointer map page %d is referenced</pre><pre>Outstanding page count goes from %d to %d during this analysis</pre><pre>keyinfo(%d</pre><pre>%s(%d)</pre><pre>%s-mjX</pre><pre>foreign key constraint failed</pre><pre>unable to use function %s in the requested context</pre><pre>bind on a busy prepared statement: [%s]</pre><pre>zeroblob(%d)</pre><pre>abort at %d in [%s]: %s</pre><pre>constraint failed at %d in [%s]</pre><pre>cannot open savepoint - SQL statements in progress</pre><pre>no such savepoint: %s</pre><pre>cannot %s savepoint - SQL statements in progress</pre><pre>cannot rollback transaction - SQL statements in progress</pre><pre>cannot commit transaction - SQL statements in progress</pre><pre>sqlite_temp_master</pre><pre>sqlite_master</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid</pre><pre>cannot change %s wal mode from within a transaction</pre><pre>database table is locked: %s</pre><pre>statement aborts at %d: [%s] %s</pre><pre>cannot open virtual table: %s</pre><pre>cannot open view: %s</pre><pre>no such column: "%s"</pre><pre>foreign key</pre><pre>indexed</pre><pre>cannot open %s column for writing</pre><pre>cannot open value of type %s</pre><pre>misuse of aliased aggregate %s</pre><pre>%s: %s.%s.%s</pre><pre>%s: %s.%s</pre><pre>%s: %s</pre><pre>not authorized to use function: %s</pre><pre>%r %s BY term out of range - should be between 1 and %d</pre><pre>too many terms in %s BY clause</pre><pre>Expression tree is too large (maximum depth %d)</pre><pre>variable number must be between ?1 and ?%d</pre><pre>too many SQL variables</pre><pre>too many columns in %s</pre><pre>misuse of aggregate: %s()</pre><pre>%.*s"%w"%s</pre><pre>%s%.*s"%w"</pre><pre>%s OR name=%Q</pre><pre>type='trigger' AND (%s)</pre><pre>there is already another table or index with this name: %s</pre><pre>sqlite_</pre><pre>table %s may not be altered</pre><pre>view %s may not be altered</pre><pre>UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;</pre><pre>UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');</pre><pre>sqlite_sequence</pre><pre>UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q</pre><pre>UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;</pre><pre>Cannot add a PRIMARY KEY column</pre><pre>UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q</pre><pre>sqlite_altertab_%s</pre><pre>CREATE TABLE %Q.%s(%s)</pre><pre>DELETE FROM %Q.%s WHERE tbl=%Q</pre><pre>SELECT tbl, idx, stat FROM %Q.sqlite_stat1</pre><pre>invalid name: "%s"</pre><pre>too many attached databases - max %d</pre><pre>database %s is already in use</pre><pre>unable to open database: %s</pre><pre>no such database: %s</pre><pre>cannot detach database %s</pre><pre>database %s is locked</pre><pre>%s %T cannot reference objects in database %s</pre><pre>access to %s.%s.%s is prohibited</pre><pre>access to %s.%s is prohibited</pre><pre>object name reserved for internal use: %s</pre><pre>there is already an index named %s</pre><pre>too many columns on %s</pre><pre>duplicate column name: %s</pre><pre>default value of column [%s] is not constant</pre><pre>table "%s" has more than one primary key</pre><pre>AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY</pre><pre>no such collation sequence: %s</pre><pre>CREATE %s %.*s</pre><pre>UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d</pre><pre>CREATE TABLE %Q.sqlite_sequence(name,seq)</pre><pre>view %s is circularly defined</pre><pre>UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d</pre><pre>table %s may not be dropped</pre><pre>use DROP TABLE to delete table %s</pre><pre>use DROP VIEW to delete view %s</pre><pre>DELETE FROM %s.sqlite_sequence WHERE name=%Q</pre><pre>DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q</pre><pre>foreign key on %s should reference only one column of table %T</pre><pre>number of columns in foreign key does not match the number of columns in the referenced table</pre><pre>unknown column "%s" in foreign key definition</pre><pre>indexed columns are not unique</pre><pre>table %s may not be indexed</pre><pre>views may not be indexed</pre><pre>virtual tables may not be indexed</pre><pre>there is already a table named %s</pre><pre>index %s already exists</pre><pre>sqlite_autoindex_%s_%d</pre><pre>table %s has no column named %s</pre><pre>CREATE%s INDEX %.*s</pre><pre>INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);</pre><pre>no such index: %S</pre><pre>index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped</pre><pre>DELETE FROM %Q.%s WHERE name=%Q AND type='index'</pre><pre>DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q</pre><pre>a JOIN clause is required before %s</pre><pre>unable to identify the object to be reindexed</pre><pre>table %s may not be modified</pre><pre>cannot modify %s because it is a view</pre><pre>foreign key mismatch</pre><pre>table %S has %d columns but %d values were supplied</pre><pre>%d values for %d columns</pre><pre>table %S has no column named %s</pre><pre>%s.%s may not be NULL</pre><pre>PRIMARY KEY must be unique</pre><pre>sqlite3_extension_init</pre><pre>unable to open shared library [%s]</pre><pre>no entry point [%s] in shared library [%s]</pre><pre>error during initialization: %s</pre><pre>automatic extension loading failed: %s</pre><pre>foreign_key_list</pre><pre>*** in database %s ***</pre><pre>unsupported encoding: %s</pre><pre>malformed database schema (%s)</pre><pre>%s - %s</pre><pre>unsupported file format</pre><pre>SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid</pre><pre>database schema is locked: %s</pre><pre>unknown or unsupported join type: %T %T%s%T</pre><pre>RIGHT and FULL OUTER JOINs are not currently supported</pre><pre>a NATURAL join may not have an ON or USING clause</pre><pre>cannot have both ON and USING clauses in the same join</pre><pre>cannot join using column %s - column not present in both tables</pre><pre>%s.%s</pre><pre>%s:%d</pre><pre>ORDER BY clause should come after %s not before</pre><pre>LIMIT clause should come after %s not before</pre><pre>SELECTs to the left and right of %s do not have the same number of result columns</pre><pre>no such index: %s</pre><pre>sqlite_subquery_%p_</pre><pre>no such table: %s</pre><pre>sqlite3_get_table() called with two or more incompatible queries</pre><pre>cannot create %s trigger on view: %S</pre><pre>cannot create INSTEAD OF trigger on table: %S</pre><pre>INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')</pre><pre>no such trigger: %S</pre><pre>-- TRIGGER %s</pre><pre>no such column: %s</pre><pre>cannot VACUUM - SQL statements in progress</pre><pre>PRAGMA vacuum_db.synchronous=OFF</pre><pre>SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'</pre><pre>SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0</pre><pre>SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'</pre><pre>SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';</pre><pre>INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)</pre><pre>UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d</pre><pre>vtable constructor failed: %s</pre><pre>vtable constructor did not declare schema: %s</pre><pre>no such module: %s</pre><pre>table %s: xBestIndex returned an invalid plan</pre><pre>at most %d tables in a join</pre><pre>cannot use index: %s</pre><pre>TABLE %s</pre><pre>%s AS %s</pre><pre>%s WITH AUTOMATIC INDEX</pre><pre>%s WITH INDEX %s</pre><pre>%s VIA MULTI-INDEX UNION</pre><pre>%s USING PRIMARY KEY</pre><pre>%s VIRTUAL TABLE INDEX %d:%s</pre><pre>%s ORDER BY</pre><pre>the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers</pre><pre>unable to close due to unfinished backup operation</pre><pre>unknown database: %s</pre><pre>no such vfs: %s</pre><pre>database corruption at line %d of [%.10s]</pre><pre>misuse at line %d of [%.10s]</pre><pre>cannot open file at line %d of [%.10s]</pre><pre>.\XpiInstaller.cpp</pre><pre>.\JSONParser.cpp</pre><pre>.\Driver.cpp</pre><pre>.\AVInfo.cpp</pre><pre>.\DomainADBlockerCH.cpp</pre><pre>\n@@||%s/$document</pre><pre>UPDATE ItemTable SET value='%s' WHERE key='custom_filters'</pre><pre>INSERT INTO ItemTable VALUES ('custom_filters', '"%s"')</pre><pre>SELECT value FROM ItemTable WHERE key='custom_filters'</pre><pre>1.2.5</pre><pre>.\DomainADBlockerPlus.cpp</pre><pre>c:\BuildAgent\work\906b1f4be197b432\CommonRep\CommonComp\ScriptHelper\1.0.0\ScriptHelper\Release\ScriptHelper.pdb</pre><pre>VERSION.dll</pre><pre>WTSAPI32.dll</pre><pre>USERENV.dll</pre><pre>SensApi.dll</pre><pre>GetProcessHeap</pre><pre>GetWindowsDirectoryW</pre><pre>KERNEL32.dll</pre><pre>keybd_event</pre><pre>GetKeyboardState</pre><pre>CreateDialogIndirectParamW</pre><pre>EnumWindows</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>RegCloseKey</pre><pre>RegDeleteKeyW</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyExW</pre><pre>RegFlushKey</pre><pre>RegLoadKeyW</pre><pre>RegUnLoadKeyW</pre><pre>CryptDeriveKey</pre><pre>CryptDestroyKey</pre><pre>RegSetKeySecurity</pre><pre>ADVAPI32.dll</pre><pre>ShellExecuteW</pre><pre>ShellExecuteExW</pre><pre>SHELL32.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>UrlUnescapeW</pre><pre>SHLWAPI.dll</pre><pre>RPCRT4.dll</pre><pre>CRYPT32.dll</pre><pre>DeleteUrlCacheEntryW</pre><pre>FindNextUrlCacheEntryW</pre><pre>FindFirstUrlCacheEntryW</pre><pre>HttpSendRequestW</pre><pre>HttpAddRequestHeadersW</pre><pre>HttpQueryInfoW</pre><pre>HttpOpenRequestW</pre><pre>WININET.dll</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>.?AVCExecuter@@</pre><pre>.?AVCUninstallerExecuter@@</pre><pre>.?AVCAvgExecuter@@</pre><pre>.?AVCNotepadExecuter@@</pre><pre>.?AVCCalcExecuter@@</pre><pre>.?AVCExplorerExecuter@@</pre><pre>.?AVCVProtExecuter@@</pre><pre>.?AV?$IDispEventImpl@$0A@VCGenericWnd@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$0PPPP@$0PPPP@VCComTypeInfoHolder@ATL@@@ATL@@</pre><pre>.?AV?$IDispEventSimpleImpl@$0A@VCGenericWnd@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@</pre><pre>.?AV?$_IDispEventLocator@$0A@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@</pre><pre>.?AV?$CAtlExeInheritedModuleT@VCScriptHelperModule@@@@</pre><pre>.?AVCChromeNativeListener@@</pre><pre>zcÁ</pre><pre>.?AVCFirefoxBrowser@@</pre><pre>.?AVCFirefoxSearchProvider@@</pre><pre>.?AVCChromeBrowser@@</pre><pre>.?AVCChromeSearchProvider@@</pre><pre>.?AVCChromeToolbarData@@</pre><pre>.?AVCHttpClient@@</pre><pre>.?AVCCrashReportAdapter@@</pre><pre>.?AVCThreadPostMsgOnEvent@@</pre><pre>'ScriptHelper.EXE'</pre><pre>ScriptHelper.ScriptHelperApi.1 = s 'ScriptHelperApi Class'</pre><pre>CLSID = s '{F25AF245-4A81-40DC-92F9-E9021F207706}'</pre><pre>ScriptHelper.ScriptHelperApi = s 'ScriptHelperApi Class'</pre><pre>CurVer = s 'ScriptHelper.ScriptHelperApi.1'</pre><pre>ForceRemove {F25AF245-4A81-40DC-92F9-E9021F207706} = s 'ScriptHelperApi Class'</pre><pre>ProgID = s 'ScriptHelper.ScriptHelperApi.1'</pre><pre>VersionIndependentProgID = s 'ScriptHelper.ScriptHelperApi'</pre><pre>{7DD95801-9882-11CF-9FA9-00AA006C42C4}</pre><pre>{7DD95802-9882-11CF-9FA9-00AA006C42C4}</pre><pre>'TypeLib' = s '{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}'</pre><pre>{59fb2056-d625-48d0-a944-1a85b5ab2640} = s ''</pre><pre>ScriptHelper.GenericWnd.1 = s 'GenericWnd Class'</pre><pre>CLSID = s '{933B95E2-E7B7-4AD9-B952-7AC336682AE3}'</pre><pre>ScriptHelper.GenericWnd = s 'GenericWnd Class'</pre><pre>CurVer = s 'ScriptHelper.GenericWnd.1'</pre><pre>ForceRemove {933B95E2-E7B7-4AD9-B952-7AC336682AE3} = s 'GenericWnd Class'</pre><pre>ProgID = s 'ScriptHelper.GenericWnd.1'</pre><pre>VersionIndependentProgID = s 'ScriptHelper.GenericWnd'</pre><pre>stdole2.tlbWWW</pre><pre>SExecuteProgramWW</pre><pre>CreateRegistryKeyWWW</pre><pre>bstrKeyNameWd</pre><pre>%SetNewTabByBrowserWWd</pre><pre>MsgW</pre><pre>x]SubMsgWW</pre><pre>BExecScriptOnPage</pre><pre>GetKeywordURLWWW</pre><pre>o-pKeyWordURLWd</pre><pre>SetKeywordURLWWWd</pre><pre>RemoveComponentKeyWW</pre><pre>RemoveRegKey</pre><pre>OpenBrowserWithUrlWW</pre><pre>6DisableChromeDSPGuardWWWd</pre><pre>PasswordBoxEnabledWWd</pre><pre>PasswordBoxInUsed</pre><pre>bsURLWWW</pre><pre>yPbsLocalURLWW</pre><pre>method ExecuteProgramW</pre><pre>method CreateRegistryKeyWW</pre><pre>method ExecScriptOnPageWWW</pre><pre>method GetKeywordURLWW</pre><pre>method SetKeywordURLWW</pre><pre>method RemoveComponentKeyW</pre><pre>method RemoveRegKeyWWW</pre><pre>method OpenBrowserWithUrlW*</pre><pre>method DisableChromeDSPGuardWW</pre><pre>method PasswordBoxEnabledW</pre><pre>method PasswordBoxInUseWWW</pre><pre>Created by MIDL version 7.00.0555 at Sun Apr 13 10:15:37 2014</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre>8%8s8</pre><pre>3%3S3</pre><pre>?.?@?_?{?</pre><pre>5,626<6[6</pre><pre>717@7[7{7</pre><pre>7Â8</pre><pre>111@1[1{1</pre><pre>=-=?=[={=</pre><pre>4P5?5{5</pre><pre>5"5&5*5.525</pre><pre>3&4 44494</pre><pre>5Y5S5b5z5</pre><pre>= >&> >3>8></pre><pre>1 1-1}1</pre><pre>="=(=.=4=:=@=</pre><pre>;"<(<1<8<</pre><pre>2<3~3%5[5</pre><pre>1-2</pre><pre>1 1$1(1,101</pre><pre>: :$:(:,:</pre><pre>6 6(646\6</pre><pre>VFloating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.</pre><pre>Snotepad.exe</pre><pre>calc.exe</pre><pre>@\avgui.exe</pre><pre>\vprot.exe</pre><pre>CScriptHelperApi::ExecuteProgram uninstaller already running, do not launch uninstaller again</pre><pre>Uninstall.exe</pre><pre>HKEY_PERFORMANCE_DATA</pre><pre>HKEY_DYN_DATA</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>CGenericWnd: NavigateToUrl, after navigate , URL:</pre><pre>CGenericWnd: NavigateToUrl , use local URL</pre><pre>CGenericWnd: NavigateToUrl start</pre><pre>CGenericWnd: InitWindow ,faild to Enable webbrowser sending events.</pre><pre>CGenericWnd: InitWindow ,faild to Get the webbrowser object</pre><pre>CGenericWnd: SetWindowSize: Set round corners: top-right and top-left</pre><pre>CGenericWnd: SetWindowSize: bSuc = true</pre><pre>CGenericWnd: SetWindowSize by Position: bSuc = true</pre><pre>CGenericWnd: SetWindowSize: height:</pre><pre>CGenericWnd: SetWindowSize: width:</pre><pre>CGenericWnd: InitConfigurationXmlPath , configuration.xml path:</pre><pre>CGenericWnd::UninstallBrowser , FAILD to Execute Seperate Installer</pre><pre>FAILD to Execute Seperate Installer</pre><pre>CGenericWnd::UninstallBrowser , FAILD to find installer.exe file</pre><pre>FAILD to find installer.exe file</pre><pre>CGenericWnd::Uninstall , FAILD to Execute Seperate Installer</pre><pre>CGenericWnd::Uninstall , FAILD to find installer.exe file</pre><pre>CGenericWnd::Uninstall , RunProcessAsUser Uninstall.exe</pre><pre>CGenericWnd::Uninstall , ShellExecute Uninstall.exe</pre><pre>/RESETSAPS /EXECUTEUNINSTALL</pre><pre>CGenericWnd::OnBroadcastMsgId UM_POSITIONUPDATE_GWND</pre><pre>CGenericWnd::OnBroadcastMsgId</pre><pre>CGenericWnd: DisplayGenericWindow, Local URL is empty</pre><pre>CGenericWnd: DisplayGenericWindow, URL is empty</pre><pre>CGenericWnd: DisplayGenericWindowModeless, Local URL is empty</pre><pre>CGenericWnd: DisplayGenericWindowModeless, URL is empty</pre><pre>AVGTB::Broadcast::MsgId</pre><pre>OLEAUT32.DLL</pre><pre>Mscoree.dll</pre><pre>Installation/Homepage/Url</pre><pre>GoogleToolbarNotifier.exe</pre><pre>Installation/KeywordUrl/EnableKeywordURL</pre><pre>%FTG%</pre><pre>.BrowserWndApi</pre><pre>\Commands.ini</pre><pre>CScriptHelperApi::CreateRegistryKey(...) - FAILED. error</pre><pre>CScriptHelperApi::CreateRegistryKey(...) - SUCCESS</pre><pre>CScriptHelperApi::CreateRegistryKey(...) - KeyName</pre><pre>MailNotifier.exe</pre><pre>CScriptHelperApi EnableToolbarByBrowser, Close IE windows</pre><pre>CScriptHelperApi::PostWndMessage Msg</pre><pre>CScriptHelperApi::SendWndMessage Msg</pre><pre>CScriptHelperApi::SendCopyDataWndMessage Msg</pre><pre>CScriptHelperApi::DisableDSPGuardChrome - can't open event.</pre><pre>CScriptHelperApi::DisableDSPGuardChrome - Setting event.</pre><pre>{"name": "%s","status": "%s", "enable":"%s"}</pre><pre>PasswordBoxEnabled</pre><pre>CScriptHelperApi::PasswordBoxEnabled, start</pre><pre>passwordbox</pre><pre>PasswordBoxInUse</pre><pre>95B7759C-8C7F-4BF1-B163-73684A933233</pre><pre>SOFTWARE\PasswordBox\Updater</pre><pre>CScriptHelperApi::PasswordBoxInUse, start</pre><pre>CChromeNativeListener::ProcessData - response</pre><pre>%CurrentNT%</pre><pre>{ "action": "getCurrentNT", "data": "%CurrentNT%", "params": "%params%" }</pre><pre>%DSPList%</pre><pre>{ "action": "getDSPList", "data": %DSPList%, "params": "%params%" }</pre><pre>P%CurrentHP%</pre><pre>{ "action": "getCurrentHP", "data": "%CurrentHP%", "params": "%params%" }</pre><pre>Þcrdata%</pre><pre>{ "action": "DecryptStr", "data": "Þcrdata%", "params": "%params%" }</pre><pre>CChromeNativeListener::ProcessData, data</pre><pre>}%CurrentNewTabValue%</pre><pre>%CurrentSearchProviderValue%</pre><pre>%CurrentHomePageValue%</pre><pre>%CmpidValue%</pre><pre>%UpdateDateValue%</pre><pre>%spvalue%</pre><pre>%CoBrandValue%</pre><pre>%sgvalue%</pre><pre>%DistributionSourceValue%</pre><pre>%ClientIDValue%</pre><pre>{"ClientID": "%ClientIDValue%","MachineID": "%MachineIDValue%","DistributionSource": "%DistributionSourceValue%","Profile": "%ProfileValue%","ToolbarVersion": "%ToolbarVersionValue%","lang": "%langvalue%","InstallDate": "%InstallDateValue%","pid": "%pidvalue%","sg": "%sgvalue%","CoBrand": "%CoBrandValue%","hp": "%hpvalue%","NT": "%NTvalue%","sp": "%spvalue%","TrackingCode": "%TrackingCodeValue%","UpdateDate": "%UpdateDateValue%","LastInstallation": "%LastInstallationValue%","CurrentHomePage": "%CurrentHomePageValue%","CurrentSearchProvider": "%CurrentSearchProviderValue%","CurrentNewTab": "%CurrentNewTabValue%","CMPID": "%CmpidValue%"}</pre><pre>mscoree.dll</pre><pre>KERNEL32.DLL</pre><pre>WUSER32.DLL</pre><pre>777705555443332</pre><pre>5555443332</pre><pre>5555443332</pre><pre>[%H:%M:%S</pre><pre>toolbar_log.txt</pre><pre>%s | %s ||</pre><pre>configuration.xml</pre><pre>InstalledProducts.ini</pre><pre>WebTuneup</pre><pre>avg-secure-search-installer.exe</pre><pre>AVG Web TuneUp</pre><pre>Advapi32.dll</pre><pre>CRegistry::CreateRegistryKey(), Create error</pre><pre>CRegistry::OpenRegistryKey() - Tried to open</pre><pre>CRegistry::OpenRegistryKey(), Open error</pre><pre>CRegistry::getValue(...), for key</pre><pre>CRegistry::setValue(...), for key</pre><pre>CRegistry::removeValue(...), for key</pre><pre>CreateRegistryKey FAIL_TO_CREATE_REGISTRY</pre><pre>CRegistry::IsKeyExists(), Open error</pre><pre>CRegistry::getMultiValue(...), for key</pre><pre>CRegistry::setMultiValue(...), for key</pre><pre>CRegistry::getQWValue(...), for key</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\ProfileList\</pre><pre>\NTUSER.DAT</pre><pre>CRegistry::SetValueAllUsers - Failed to get users key</pre><pre>CRegistry::GetValueAllUsers - Failed to get users key</pre><pre>CRegistry::CreateKeyAllUsers - Start</pre><pre>CRegistry::CreateKeyAllUsers - Failed to get users key</pre><pre>CRegistry::CreateKeyAllUsers - Number of users in reg</pre><pre>Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\</pre><pre>HKEY_USERS</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_CLASSES_ROOT</pre><pre>\lip.exe</pre><pre>okernel32.dll</pre><pre>installer_cfg.ini</pre><pre>\configuration.xml</pre><pre>CSystemCommands::CloseAllIEWindows - NOT host Browser , Exit</pre><pre>%COBRAND%</pre><pre>%DISTSOURCE%</pre><pre>%CMPID%</pre><pre>%UID%</pre><pre>wtustats.avg.com</pre><pre>%STATSDOMAIN%</pre><pre>stats.avg.com</pre><pre>avg.install.guid</pre><pre>ÿGUID%</pre><pre>Ieframe.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>NEWTABURL</pre><pre>IE_SUGGESTIONS_URL</pre><pre>IE_SUGGESTIONS_URL_FALLBACK</pre><pre>IE_SUGGESTIONS_URL_JSON</pre><pre>CH_SUGGESTIONS_URL</pre><pre>CH_SUGGESTIONS_URL_FALLBACK</pre><pre>FAV_ICON_URL_FALLBACK</pre><pre>Installation/Chrome/PEMGUID</pre><pre>Installation/Chrome/INSTANT</pre><pre>Installation/Chrome/TERM</pre><pre>updater.xml</pre><pre>Updater/Logger/Port</pre><pre>127.0.0.1</pre><pre>c:\BuildAgent\work\906b1f4be197b432\CommonRep\Common\Include\log4cplus\include\log4cplus/helpers/pointer.h</pre><pre>Microsoft\Internet Explorer\AboutURLs</pre><pre>res://ieframe.dll/tabswelcome.htm</pre><pre>Open registry HKEY_CURRENT_USER Start Page</pre><pre>SuggestionsURL</pre><pre>SuggestionsURLFallback</pre><pre>SuggestionsURL_JSON</pre><pre>FaviconURLFallback</pre><pre>CInternetExplorer::UpdateSearchProvider - try to open key:</pre><pre>CInternetExplorer::UpdateSearchProvider - key does not exist!</pre><pre>CInternetExplorer::UpdateSearchProvider - try to create key:</pre><pre>CInternetExplorer::UpdateSearchProvider - create key ended - return:</pre><pre>CInternetExplorer::UpdateSearchProvider - create key return:</pre><pre>iexplore.exe</pre><pre>\Internet Explorer\iexplore.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings</pre><pre>CInternetExplorer::EnableToolband, DeleteKey</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings\</pre><pre>CInternetExplorer::IsToolbarEnabled key</pre><pre>CInternetExplorer::IsToolbarEnabled key exist</pre><pre>Software\Microsoft\Internet Explorer\Toolbar\WebBrowser</pre><pre>\internet explorer\iexplore.exe"</pre><pre>\favicon.ico</pre><pre>favicon.ico</pre><pre>Mozilla/4.0 (compatible; MSIE</pre><pre>; Windows NT</pre><pre>desktop.ini</pre><pre>index.dat</pre><pre>{95B7759C-8C7F-4BF1-B163-73684A933233}</pre><pre>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\User Preferences</pre><pre>CInternetExplorer::SetDefaultSearchProvider, GrantRegKeyAccess</pre><pre>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</pre><pre>CInternetExplorer::SetEnableNTToReg, zsShouldEnableNT</pre><pre>CInternetExplorer::SetEnableNTToReg - Set zsShouldEnableNT to 0</pre><pre>CInternetExplorer::RefreshHpUrl , start</pre><pre>CInternetExplorer::RefreshHpUrl - NOT host Browser , Exit</pre><pre>CInternetExplorer::RefreshHpUrl , szHomepage before replace</pre><pre>CInternetExplorer::RefreshHpUrl , zsPartnerHomePage is empty</pre><pre>CInternetExplorer::RefreshHpUrl , Driver is not running</pre><pre>CInternetExplorer::RefreshHpUrl , Driver is running and guard is enabled</pre><pre>CInternetExplorer::RefreshHpUrl , szHomepage after replace</pre><pre>CInternetExplorer::RefreshDspUrl , start</pre><pre>CInternetExplorer::RefreshDspUrl - NOT host Browser , Exit</pre><pre>CInternetExplorer::RefreshDspUrl, GrantRegKeyAccess</pre><pre>CInternetExplorer::RefreshNtUrl , start</pre><pre>CInternetExplorer::RefreshNtUrl - NOT host Browser , Exit</pre><pre>CInternetExplorer::AutoDisableToolbar - Can't create key.</pre><pre>CFirefoxBrowser::CFirefoxBrowser() - start</pre><pre>CFirefoxBrowser::CFirefoxBrowser() - INI</pre><pre>CFirefoxBrowser::CFirefoxBrowser() - failed to read INI file, try to get info from INI backup in registry.</pre><pre>firefox.exe</pre><pre>CFirefoxBrowser::GetVersion - start</pre><pre>CFirefoxBrowser::GetVersion - version:</pre><pre>CFirefoxBrowser::GetVersionEx - start</pre><pre>CFirefoxBrowser::GetVersionEx - Not Installed</pre><pre>extensions.lastAppVersion</pre><pre>CFirefoxBrowser::GetVersionEx - version:</pre><pre>CFirefoxBrowser::GetVersionEx - short version:</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>CFirefoxBrowser::GetFullVersion - start</pre><pre>CFirefoxBrowser::GetFullVersion - version:</pre><pre>CFirefoxBrowser::GetFullVersion - Full final version:</pre><pre>CFirefoxBrowser::CreateSearchProvider - start</pre><pre>CFirefoxBrowser::CreateSearchProvider - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::CreateSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::CreateSearchProvider - failed to find xml to temp</pre><pre>CFirefoxBrowser::CreateSearchProvider - failed to replace common values</pre><pre>CFirefoxBrowser::CreateSearchProvider - copy XML to program files failed.</pre><pre>FireFoxSearchXml.tmp</pre><pre>CFirefoxBrowser::UpdateSearchProvider - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::WriteKeyToGuardToSetDSP - start</pre><pre>FirefoxSPName</pre><pre>CFirefoxBrowser::WriteKeyToGuardToSetDSP - end, return:</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - Firefox is running.</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - application is running in SYSTEM account!. Can not set as DSP.</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - INI Path:</pre><pre>CFirefoxBrowser::SetDefaultSearchProvider - failed to set DSP in all profiles</pre><pre>CFirefoxBrowser::IsNewTabActive</pre><pre>avg.userPreferences.newtabDisabledByUser</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the user canceled</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the CURRENT_USER NT flag is not enabled</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is not active becuase the LOCAL_MACHINE NT flag is not enabled</pre><pre>CFirefoxBrowser::IsNewTabActive - the new tab is active.</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - temp XML filename</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - ReadTempXML failed.</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - XML filename</pre><pre>CFirefoxBrowser::ReplaceCommonValues() - Partner name is empty.</pre><pre>CFirefoxBrowser::DetermineFFProfilesDir - start</pre><pre>CFirefoxBrowser::DetermineFFProfilesDir - GetSafeEnv return NULL</pre><pre>\Mozilla\Firefox\Profiles\</pre><pre>CFirefoxBrowser::DetermineFFProfilesDir - Firefox Folder</pre><pre>CFirefoxBrowser::DetermineFFDir - start</pre><pre>CFirefoxBrowser::DetermineFFDir - GetSafeEnv return NULL</pre><pre>CFirefoxBrowser::GetSearchXMLLocation - GetCurrentFirefoxInstallationPath failed</pre><pre>CFirefoxBrowser::GetSearchXMLLocation - first XML location</pre><pre>CFirefoxBrowser::GetSearchXMLLocation - second XML location</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles - Copy from</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles - Copy to</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles firefox version is less than 21</pre><pre>CFirefoxBrowser::CopyXmlToProgramFiles create browser folder</pre><pre>CFirefoxBrowser::CopyXmlToUserData - Copy from</pre><pre>CFirefoxBrowser::CopyXmlToUserData - Copy to</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles failed to write Pref.js to profile(USER)</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles failed to write Pref.js to profile</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles. Create directory is failed</pre><pre>CFirefoxBrowser::SetDSPinAllProfiles. CopyFile is failed</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::SetDSPInAllProfilesAfterInstall. FireFoxSearchXml.tmp is not exist</pre><pre>CFirefoxBrowser::ReadTempXML() - CreateFile failed. GetLastError</pre><pre>CFirefoxBrowser::ReadTempXML() - ReadFile failed. GetLastError</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider -pzsIniFile is not NULL</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider -Get display name</pre><pre>CFirefoxBrowser::ReplaceDefaultSearchProvider - DSP Display Name:</pre><pre>browser.search.defaultenginename</pre><pre>browser.search.selectedEngine</pre><pre>CFirefoxBrowser::WriteFile - CreateFile failed. GetLastError</pre><pre>CFirefoxBrowser::WriteFile - WriteFile failed. GetLastError</pre><pre>CFirefoxBrowser::WriteFile() - WriteFile failed. size written too small</pre><pre>CFirefoxBrowser::InitSearchProviderFromIni - ini</pre><pre>CFirefoxBrowser::InitSearchProviderFromIni - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::InitSearchProviderFromRegistry</pre><pre>CFirefoxBrowser::InitSearchProviderFromRegistry - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::GetHomepage, homepage</pre><pre>CFirefoxBrowser::GetHomepage, next profile</pre><pre>browser.startup.homepage</pre><pre>CFirefoxBrowser::GetHomepage, success</pre><pre>CFirefoxBrowser::SetHomepage, homepage</pre><pre>CFirefoxBrowser::SetHomepage - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::SetHomepage - Firefox is running.</pre><pre>CFirefoxBrowser::SetHomepage, next profile</pre><pre>CFirefoxBrowser::SetHomepage, success</pre><pre>CFirefoxBrowser::GetKeywordUrl, szKeyWordUrl</pre><pre>CFirefoxBrowser::GetKeywordUrl, next profile</pre><pre>LCFirefoxBrowser::GetKeywordUrl, success</pre><pre>CFirefoxBrowser::SetKeywordUrl, szKeyWordUrl</pre><pre>CFirefoxBrowser::SetKeywordUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::SetKeywordUrl - Firefox is running.</pre><pre>CFirefoxBrowser::SetKeywordUrl, next profile</pre><pre>CFirefoxBrowser::SetKeywordUrl, success</pre><pre>CFirefoxBrowser::DeleteSearchProvider - start</pre><pre>CFirefoxBrowser::DeleteSearchProvider - Firefox is running.</pre><pre>CFirefoxBrowser::DeleteSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::SearchProviderExist - start</pre><pre>CFirefoxBrowser::SearchProviderExist - Firefox is running.</pre><pre>CFirefoxBrowser::SearchProviderExist - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::SearchProviderExist - failed to get Default search engine for profile</pre><pre>CFirefoxBrowser::SearchProviderExist - ProfileExist</pre><pre>CFirefoxBrowser::SearchProviderExist - ProfileDefault</pre><pre>CFirefoxBrowser::SearchProviderExist - ProgramFilesExist</pre><pre>CFirefoxBrowser::SearchProviderExist - ProgramFilesDefault</pre><pre>CFirefoxBrowser::SearchProviderExist - Exist</pre><pre>CFirefoxBrowser::SearchProviderExist - Default</pre><pre>CFirefoxBrowser::HandleXMLInInstalltion - start</pre><pre>CFirefoxBrowser::HandleXMLInInstalltion - File Path</pre><pre>CFirefoxBrowser::HandleXMLInInstalltion - delete</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox\</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - start</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - fail to get CurrentVersion from</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - CurrentVersion</pre><pre>PathToExe</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - fail to get PathToExe from</pre><pre>CFirefoxBrowser::GetCurrentFirefoxInstallationPath - Path</pre><pre>\search.json</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite Sqlite path</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite - sqlite3_open</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite sql</pre><pre>CFirefoxBrowser::RefreshSearchProviderSearchSqlite err</pre><pre>\search.sqlite</pre><pre>RefreshUserSearchProviderList - check if search.json file exists @ path:</pre><pre>RefreshUserSearchProviderList - try to delete search.json @ path:</pre><pre>CFirefoxBrowser EnableToolband - start</pre><pre>CFirefoxBrowser EnableToolband - failed to cast.</pre><pre>CFirefoxBrowser EnableToolband, id</pre><pre>CFirefoxBrowser EnableToolband, enabled</pre><pre>CFirefoxBrowser::IsExtensionEnabled - Failed to get extension ID.</pre><pre>extensions.json</pre><pre>CFirefoxBrowser::CheckInExtensionsJson - failed to build extension.sqlite path.</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable - start</pre><pre>extensions.sqlite</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable - failed to build extension.sqlite path.</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable - sqlite3_open</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable sql</pre><pre>CFirefoxBrowser::InsertUpdateAddonTable err</pre><pre>CFirefoxBrowser::AddonTableContainsToolbar - sqlite3_prepare</pre><pre>extensions.rdf</pre><pre>extensions.cache</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - Unable to create XML parser object</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - Unable to load XML document into the parser</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - failed to save the modified extension.rdf</pre><pre>CFirefoxBrowser::EnableInExtensionsRDF - unknown exception.</pre><pre>.default</pre><pre>CFirefoxBrowser::BuildDefaultProfileFilePath - failed.</pre><pre>CFirefoxBrowser::BuildDefaultProfileFilePath - BuildDefaultProfileFilePath</pre><pre>CFirefoxBrowser HandleExtensionIni - start</pre><pre>extensions.ini</pre><pre>CFirefoxBrowser HandleExtensionIni sIniPath:</pre><pre>SOFTWARE\Mozilla\Firefox\extensions</pre><pre>CFirefoxBrowser HandleExtensionIni szId:</pre><pre>CFirefoxBrowser HandleExtensionIni value of ::</pre><pre>CFirefoxBrowser HandleExtensionIni, sProfileExtensionPath:</pre><pre>CFirefoxBrowser HandleExtensionIni, sProfileExtensionPath exists</pre><pre>CFirefoxBrowser HandleExtensionIni, SetTextVector of ExtensionDirs</pre><pre>CFirefoxBrowser IsToolbarEnabled - start</pre><pre>CFirefoxBrowser IsToolbarEnabled - Error in casting - return false.</pre><pre>CFirefoxBrowser IsToolbarEnabled, ff toolbar folder name</pre><pre>CFirefoxBrowser IsToolbarEnabled - Error PathFileExists - return false.</pre><pre>Extension%d</pre><pre>CFirefoxBrowser IsToolbarEnabled. szToolbarDir=</pre><pre>CFirefoxBrowser IsToolbarEnabled - szToolbarDir is empty</pre><pre>\install.rdf</pre><pre>CFirefoxBrowser GetToolbarInstallState - start</pre><pre>CFirefoxBrowser GetToolbarInstallState, ff toolbar id</pre><pre>CFirefoxBrowser::CompareWithRDFVersion, szVersion</pre><pre>CFirefoxBrowser::CompareWithRDFVersion, szRDFVersion</pre><pre>CFirefoxBrowser::CompareWithRDFVersion, Version1 section</pre><pre>CFirefoxBrowser::CompareWithRDFVersion, Version2 section</pre><pre>CFirefoxBrowser::CompareWithRDFVersion, szVersion length</pre><pre>CFirefoxBrowser::CompareWithRDFVersion, szRDFVersion length</pre><pre>CFirefoxBrowser::InstallNewToolbar, start</pre><pre>CFirefoxBrowser::InstallNewToolbar, fnXpiInstaller - Install remote xpi.</pre><pre>CFirefoxBrowser::InstallNewToolbar, fnXpiInstaller - url:</pre><pre>CFirefoxBrowser::InstallNewToolbar, fnXpiInstaller - szFFToolbarId:</pre><pre>CFirefoxBrowser::InstallNewToolbar, fnXpiInstaller - szFolderName:</pre><pre>CFirefoxBrowser::InstallNewToolbar, fnXpiInstaller - szVersion:</pre><pre>CFirefoxBrowser::InstallNewToolbar, toolbar installed:</pre><pre>CFirefoxBrowser::CreateUpdateFileForWatcher, start</pre><pre>CFirefoxBrowser::CreateUpdateFileForWatcher, opening update file to:</pre><pre>CFirefoxBrowser::CreateUpdateFileForWatcher, write .ini title:</pre><pre>%s=%s</pre><pre>CFirefoxBrowser::CreateUpdateFileForWatcher, szFFToolbarId:</pre><pre>CFirefoxBrowser::CreateUpdateFileForWatcher, szNewToolbarFolder:</pre><pre>CFirefoxBrowser::DisableEnableAddOnScreen</pre><pre>CFirefoxBrowser::DisableEnableAddOnScreen, setting extensions.autoDisableScopes to 0</pre><pre>extensions.autoDisableScopes</pre><pre>CFirefoxBrowser::RollbackNewTab - Firefox is running.</pre><pre>avg.install.newtab</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled, conf file</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled, FF toolbar ID</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled toolbar enabled</pre><pre>CFirefoxBrowser::IsAVGToolbarEnabled toolbar disabled</pre><pre>CFirefoxBrowser::ResetHP - start</pre><pre>CFirefoxBrowser::ResetHP - Firefox is running.</pre><pre>CFirefoxBrowser::ResetHP - GetDefaultProfile.</pre><pre>CFirefoxBrowser::ResetHP, next profile</pre><pre>CFirefoxBrowser::ResetHP - ,zsPartnerHomePage:</pre><pre>CFirefoxBrowser::ResetHP, szHomepage</pre><pre>CFirefoxBrowser::ResetHP, szHomepage not empty</pre><pre>CFirefoxBrowser::ResetHP, 1:sCurrUrl,</pre><pre>CFirefoxBrowser::ResetHP, zsCurrHomePage,</pre><pre>CFirefoxBrowser::ResetHP ,bFoundPartnerUrl = true;</pre><pre>CFirefoxBrowser::ResetHP ,sCurrUrl not equal to iniHost</pre><pre>CFirefoxBrowser::ResetHP ,bFoundPartnerUrl is true;</pre><pre>CFirefoxBrowser::ResetHP ,bReverted is true</pre><pre>CFirefoxBrowser::ResetHP ,bReverted is false and zsCurrHomePage is</pre><pre>CFirefoxBrowser::ResetHP, sCurrHomePage before deciding how to reset</pre><pre>CFirefoxBrowser::ResetHP ,zsCurrHomePage is empty</pre><pre>CFirefoxBrowser::ResetHP, Homepage empty so set tp default</pre><pre>CFirefoxBrowser::ResetHP, Partner removed</pre><pre>CFirefoxBrowser::ResetDSP - start</pre><pre>CFirefoxBrowser::ResetDSP - Firefox is running.</pre><pre>avg-secure-search.xml</pre><pre>CFirefoxBrowser::ResetDSP failed to write Pref.js to profile</pre><pre>CFirefoxBrowser::DeleteXmlFromProgramFiles - start</pre><pre>CFirefoxBrowser::DeleteXmlFromProgramFiles - GetCurrentFirefoxInstallationPath failed</pre><pre>CFirefoxBrowser::DeleteXmlFromProgramFiles - Delete file from</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - Firefox is running.</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - delete DEFAULT_ENGINE SELECTED_ENGINE</pre><pre>CFirefoxBrowser::ResetDefaultSearchProvider - SetDeafultSearchProviderToString failed</pre><pre>CFirefoxBrowser::ShowToolband - start, bShow:</pre><pre>CFirefoxBrowser::ShowToolband - Firefox is running.</pre><pre>CFirefoxBrowser::ShowToolband - Error file not found:</pre><pre>CFirefoxBrowser::ShowToolband - end</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - start, zsPath:</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Unable to create XML parser object</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Unable to load XML document into the parser</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't find the root node</pre><pre>RDF:RDF/RDF:Description[@RDF:about="chrome://browser/content/browser.xul"]</pre><pre>http://www.w3.org/1999/02/22-rdf-syntax-ns#</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't create the description element</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't create attribute</pre><pre>chrome://browser/content/browser.xul</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't modify attribute</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't get attributes map</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't add attribute to the element</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't append the description node to the root node</pre><pre>RDF:RDF/RDF:Description[@RDF:about="chrome://browser/content/browser.xul"]/NC:persist[@RDF:resource="chrome://browser/content/browser.xul#avgTB-Toolbar"]</pre><pre>http://home.netscape.com/NC-rdf#</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't create the persist node</pre><pre>chrome://browser/content/browser.xul#avgTB-Toolbar</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't append the persist node to the description node</pre><pre>RDF:RDF/RDF:Description[@RDF:about="chrome://browser/content/browser.xul#avgTB-Toolbar"]</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't create the collapsed element</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't append the collapsed node to the root node</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - Can't change the collapsed node value</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - failed to save the modified XML file</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - unknown exception.</pre><pre>CFirefoxBrowser::ModifyLocalStoreXML - end</pre><pre>CFirefoxBrowser, zsShouldEnableNT</pre><pre>CFirefoxBrowser::SetEnableNTToReg - Set zsShouldEnableNT to 0</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , start</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry ,FFSearchAssetsAdded</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Writing to registry</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , write Revert_HP</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Writing None to Revert_HP</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Aleady exist in registry</pre><pre>CFirefoxBrowser::RevertHpFromRegistry , start</pre><pre>CFirefoxBrowser::RevertHpFromRegistry , Reverting the homepage.</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , start</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry ,FFSearchAssetsAdded</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , Writing to registry</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , Write Revert_DSP</pre><pre>CFirefoxBrowser::SaveRevertDspToRegistry , Writing None to Revert_DSP</pre><pre>CFirefoxBrowser::SaveRevertHpToRegistry , Already exist in registry</pre><pre>CFirefoxBrowser::GetDefaultSearchProvider - start</pre><pre>CFirefoxBrowser::SetDeafultSearchProviderToString - start</pre><pre>CFirefoxBrowser::SetDeafultSearchProviderToString - Firefox is running.</pre><pre>CFirefoxBrowser::RevertDspFromRegistry - start</pre><pre>CFirefoxBrowser::RevertDspFromRegistry - Firefox is running.</pre><pre>CFirefoxBrowser::RevertDspFromRegistry , start</pre><pre>CFirefoxBrowser::RevertOnlyDspFromRegistry - start</pre><pre>CFirefoxBrowser::RevertOnlyDspFromRegistry - Firefox is running.</pre><pre>CFirefoxBrowser::RevertOnlyDspFromRegistry - revert value is</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , start</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry ,FFSearchAssetsAdded</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Writing to registry</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry, not our value</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry, write Revert_KU</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Writing None to Revert_KU</pre><pre>CFirefoxBrowser::SaveRevertKeywordUrlToRegistry , Aleady exist in registry</pre><pre>CFirefoxBrowser::RevertKeywordUrlFromRegistry , start</pre><pre>CFirefoxBrowser::RevertKeywordUrlFromRegistry , Reverting the keywordURL.</pre><pre>CFirefoxBrowser::IsHostBrowser,FF</pre><pre>CFirefoxBrowser::RefreshHpUrl - start</pre><pre>CFirefoxBrowser::RefreshHpUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshHpUrl - Firefox is running.</pre><pre>CFirefoxBrowser::RefreshHpUrl, next profile</pre><pre>CFirefoxBrowser::RefreshHpUrl , szHomepage before replace</pre><pre>CFirefoxBrowser::RefreshHpUrl, szHomepage</pre><pre>CFirefoxBrowser::RefreshHpUrl, Homepage empty so set tp default</pre><pre>CFirefoxBrowser::RefreshHpUrl, Partner removed</pre><pre>CFirefoxBrowser::RefreshDspUrl , start</pre><pre>CFirefoxBrowser::RefreshDspUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - start</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - failed to find xml to temp</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - failed to replace common values</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - copy XML to program files</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - copy XML to User Data</pre><pre>CFirefoxBrowser::RefreshSearchProviderXml - copy XML to program files succeded, erased cache</pre><pre>CFirefoxBrowser::RefreshKeywordUrl - start</pre><pre>CFirefoxBrowser::RefreshKeywordUrl - NOT host Browser , Exit</pre><pre>CFirefoxBrowser::RefreshKeywordUrl - Firefox is running.</pre><pre>Installation/KeywordUrl/Url</pre><pre>CFirefoxBrowser::IsExtensionEnabled - start</pre><pre>CFirefoxBrowser::IsExtensionEnabled - ERROR_INVALID_HANDLE</pre><pre>CFirefoxBrowser::IsExtensionEnabled - failed to build extension.sqlite path.</pre><pre>CFirefoxBrowser::IsExtensionEnabled - CopyFileToTmpFolder faild.</pre><pre>CFirefoxBrowser::IsExtensionEnabled - sqlite3_open</pre><pre>CFirefoxBrowser::IsExtensionEnabled - sqlite3_prepare</pre><pre>CFirefoxBrowser::IsExtensionEnabled - unknown state</pre><pre>CFirefoxBrowser::IsExtensionEnabled - DB empty.</pre><pre>CChromeExtensionJson::CChromeExtensionJson() - failed reading addons Json</pre><pre>CFirefoxBrowser::AddCampaignIdToXML - XML filename</pre><pre>CFirefoxBrowser::AddCampaignIdToXML - ReadTempXML failed.</pre><pre>CFirefoxBrowser::GetCampaignIdFromXML - XML filename</pre><pre>CFirefoxBrowser::GetCampaignIdFromXML - ReadTempXML failed.</pre><pre>CFirefoxBrowser::GetCampaignIdFromXML - cmpid</pre><pre>CFirefoxBrowser::IsPartnerDefaultSearchProvider - Start.</pre><pre>CFirefoxBrowser::IsPartnerHomePage - Start.</pre><pre>CFirefoxBrowser::IsPartnerHomePage - Can't get homepage.</pre><pre>CFirefoxBrowser::DeleteUserSearchProvider() - start</pre><pre>CFirefoxBrowser::DeleteUserSearchProvider() - delete</pre><pre>CFirefoxBrowser::AutoDisableToolbar - start</pre><pre>\FireFoxExt\</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsID</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsName</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsToolbarVersion</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetAppID</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetMinVer</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsTargetMaxVer</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsCreator</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsDescription</pre><pre>RDF/Description/em:homepageURL</pre><pre>CFirefoxBrowser::AutoDisableToolbar - can't get zsHomepageURL</pre><pre>CFirefoxBrowser::AutoDisableToolbar - Can't get paths.</pre><pre>\extensions.sqlite</pre><pre>CFirefoxBrowser::AutoDisableToolbar - error sqlite3_open</pre><pre>CFirefoxBrowser::AutoDisableToolbar insert err</pre><pre>CFirefoxBrowser::AutoDisableToolbar - sqlite3_prepare</pre><pre>CFirefoxBrowser::AutoDisableToolbar - NO id</pre><pre>CFirefoxBrowser::AutoDisableToolbar insert locale err</pre><pre>)CFirefoxBrowser::AutoDisableToolbar insert targetApplication err</pre><pre>CFirefoxBrowser::PrepateDisable - sqlite3_prepare</pre><pre>CFirefoxBrowser::PrepateDisable - NO id</pre><pre>CFirefoxBrowser::PrepateDisable - addon table</pre><pre>CFirefoxBrowser::PrepateDisable - locale table</pre><pre>CFirefoxBrowser::PrepateDisable - targetApplication</pre><pre>CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Start.</pre><pre>CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Can't get paths.</pre><pre>CFirefoxBrowser::DeleteXMLFromAllUsersAppData - Failed to delete file:</pre><pre>CChromeBrowser::CChromeBrowser() - KillChrome:</pre><pre>CChromeBrowser::CChromeBrowser() - XP:</pre><pre>chrome.exe</pre><pre>CChromeBrowser::GetHomepage - start</pre><pre>CChromeBrowser::GetHomepage - ret</pre><pre>CChromeBrowser::GetStartup - start</pre><pre>CChromeBrowser::SetHomepage - hp</pre><pre>CChromeBrowser::SetHomepage - NOT host Browser , Exit</pre><pre>CChromeBrowser::SetHomepage - reading json from file</pre><pre>CChromeBrowser::SetHomepage - bReadJSONSuccessful</pre><pre>CChromeBrowser::SetHomepage - writing json to file</pre><pre>CChromeBrowser::SetHomepage - ret</pre><pre>CChromeBrowser::SetStartup - hp</pre><pre>CChromeBrowser::SetStartup - NOT host Browser , Exit</pre><pre>CChromeBrowser::SetStartup - reading json from file</pre><pre>CChromeBrowser::SetStartup - bReadJSONSuccessful</pre><pre>CChromeBrowser::SetStartup - hp set</pre><pre>CChromeBrowser::SetStartup - ret</pre><pre>CChromeBrowser::CreateSearchProvider - start</pre><pre>CChromeBrowser::CreateSearchProvider - NOT host Browser , Exit</pre><pre>CChromeBrowser::CreateSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::CreateSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::CreateSearchProvider - CChromeSearchProvider.sShortName</pre><pre>CChromeBrowser::CreateSearchProvider - CChromeSearchProvider.sUrl</pre><pre>CChromeBrowser::CreateSearchProvider - AlreadyExist, so we update.</pre><pre>CChromeBrowser::CreateSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>CChromeBrowser::UpdateSearchProvider - NOT host Browser , Exit</pre><pre>CChromeBrowser::DeleteSearchProvider - start</pre><pre>CChromeBrowser::DeleteSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::DeleteSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SearchProviderExist - CChromeSearchProvider.sShortName</pre><pre>CChromeBrowser::SearchProviderExist - CChromeSearchProvider.sUrl</pre><pre>CChromeBrowser::SearchProviderExist - start</pre><pre>CChromeBrowser::SearchProviderExist - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SearchProviderExist - search provider exist.</pre><pre>CChromeBrowser::SearchProviderExist GetIdFromMetaTable</pre><pre>\Chrome\Default\Preferences</pre><pre>CChromeBrowser::GetDefaultSearchProvider - reading json from file</pre><pre>CChromeBrowser::GetDefaultSearchProvider - bReadJSONSuccessful</pre><pre>CChromeBrowser::GetDefaultSearchProvider - JSON probelm didn't read all values</pre><pre>CChromeBrowser::GetDefaultSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::GetDefaultSearchProvider - start</pre><pre>CChromeBrowser::GetDefaultSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::GetDefaultSearchProvider - INSTALLER_ERROR_CHROME_ERROR</pre><pre>CChromeBrowser::GetDefaultSearchProvider GetIdFromMetaTable</pre><pre>CChromeBrowser::SetDefaultSearchProvider - start</pre><pre>CChromeBrowser::SetDefaultSearchProvider - NOT host Browser , Exit</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::SetDefaultSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Chrome version >= 17, SP exists and is default, do not set again.</pre><pre>CChromeBrowser::SetDefaultSearchProvider SearchDB</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>CChromeBrowser::SetDefaultSearchProvider - Can't write DSP to preferences.</pre><pre>CChromeBrowser::IsDefaultSearchProvider - start</pre><pre>CChromeBrowser::IsDefaultSearchProvider - bSpExists:</pre><pre>CChromeBrowser::IsDefaultSearchProvider - bDSpIsDefault:</pre><pre>CChromeBrowser::InsertUpdateDB - start</pre><pre>CChromeBrowser::InsertUpdateDB - sqlite3_open</pre><pre>CChromeBrowser::InsertUpdateDB sql</pre><pre>CChromeBrowser::InsertUpdateDB err</pre><pre>CChromeBrowser::SearchDB - start</pre><pre>CChromeBrowser::SearchDB - CChromeSearchProvider is NULL.</pre><pre>CChromeBrowser::SearchDB - Chrome is running.</pre><pre>CChromeBrowser::SearchDB - sqlite3_open</pre><pre>CChromeBrowser::SearchDB sql</pre><pre>CChromeBrowser::SearchDB - sqlite3_prepare</pre><pre>CChromeBrowser::CreateSearchProvider - pChromeSearchProvider->sShortName</pre><pre>CChromeBrowser::CreateSearchProvider - pChromeSearchProvider->sUrl</pre><pre>CChromeBrowser::UpdateMetaTable - id</pre><pre>CChromeBrowser::UpdateMetaTable - sqlite3_open</pre><pre>)CChromeBrowser::UpdateMetaTable sql</pre><pre>CChromeBrowser::UpdateMetaTable err</pre><pre>CChromeBrowser::UpdateMetaTableBackup - id</pre><pre>CChromeBrowser::UpdateMetaTableBackup - sqlite3_open</pre><pre>CChromeBrowser::UpdateMetaTableBackup sql</pre><pre>CChromeBrowser::UpdateMetaTableBackup err</pre><pre>CChromeBrowser::GetIdFromMetaTable - start</pre><pre>CChromeBrowser::GetIdFromMetaTable - Chrome is running.</pre><pre>CChromeBrowser::GetIdFromMetaTable - sqlite3_open</pre><pre>CChromeBrowser::GetIdFromMetaTable - sqlite3_prepare</pre><pre>CChromeBrowser::GetIdFromMetaTable - sqlite3_step</pre><pre>CChromeBrowser::GetIdFromMetaTable - return value</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - start</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - Chrome is running.</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_open</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_prepare</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - sqlite3_step</pre><pre>CChromeBrowser::GetBackupIdFromMetaTable - return value</pre><pre>CChromeBrowser::UpdateMetaWithoutSignature sql</pre><pre>CChromeBrowser::UpdateMetaWithoutSignature err</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szIniPath</pre><pre>CChromeBrowser::InitSearchProviderFromIni - NOT host Browser , Exit</pre><pre>CChromeBrowser::InitSearchProviderFromIni - iniReader.Init failed.</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szDisplayName</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szDefaultSearchURL</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szPartner</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szSuggestionsURL</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szSuggestionsURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromIni - szFaviconURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromIni - failed to create CChromeSearchProvider.</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - NOT host Browser , Exit</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szDisplayName</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szDefaultSearchURL</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szPartner</pre><pre>https:</pre><pre>http:</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szSuggestionsURL</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szSuggestionsURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - szFaviconURLFallback</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - zsInstantUrl</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - zsSearchTerm</pre><pre>avg.yandex.com.tr</pre><pre>http://suggest.yandex.com.tr/suggest-ff.cgi?uil=tr&part={searchTerms}</pre><pre>http://yandex.com.tr/favicon.ico</pre><pre>http://avg.yandex.com.tr/yandsearch?win=106&clid=2064887&text={searchTerms}</pre><pre>CChromeBrowser::InitSearchProviderFromRegistry - failed to create CChromeSearchProvider.</pre><pre>ÌhromeBrowser::CreateWhereClause - both short_name and url are empty!</pre><pre>CChromeBrowser::DeleteSearchProvider - id</pre><pre>CChromeBrowser::DeleteSearchProvider - sqlite3_open</pre><pre>CChromeBrowser::DeleteSearchProvider sql</pre><pre>CChromeBrowser::DeleteSearchProvider err</pre><pre>CChromeBrowser::DeleteSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>Google\Chrome\Application\chrome.exe</pre><pre>CurrentChromeInstallationPath :</pre><pre>CChromeBrowser::CloseBrowser - NOT host Browser , Exit</pre><pre>CChromeBrowser::ResetHP - reading json from file</pre><pre>SOFTWARE\Google\Chrome\extensions\</pre><pre>CChromeBrowser::GetVersion - Not Installed</pre><pre>ChromeBrowser:: Version Failed</pre><pre>ChromeBrowser:: Version</pre><pre>ChromeExt</pre><pre>CChromeBrowser::ResetHP - hp</pre><pre>CChromeBrowser::ResetHP - bReadJSONSuccessful</pre><pre>CChromeBrowser::ResetHP - writing json to file</pre><pre>CChromeBrowser::ResetHP - Parnter found, try to revert</pre><pre>CChromeBrowser::ResetHP - Parnter found, revert failed - reset the HP.</pre><pre>CChromeBrowser::ResetHP - Parnter found, revert failed - reset the Startup.</pre><pre>CChromeBrowser::ResetHP - ret</pre><pre>CChromeBrowser::ResetDSP - start</pre><pre>CChromeBrowser::ResetDSP - sqlite3_open</pre><pre>CChromeBrowser::ResetDSP - Chrome version >= 17, we need to update the meta signature</pre><pre>CChromeBrowser, zsShouldEnableNT</pre><pre>CChromeBrowser::SetEnableNTToReg() - bIsUpdateInstallation</pre><pre>CChromeBrowser::SetEnableNTToReg - Set zsShouldEnableNT to 0</pre><pre>CChromeBrowser::SetEnableNTToReg() - szIsNewTabEnabled is set</pre><pre>CChromeBrowser::SaveRevertHpToRegistry - start</pre><pre>ChromeSearchAssetsAdded</pre><pre>CChromeBrowser::SaveRevertHpToRegistry - ChromeSearchAssetsAdded</pre><pre>CChromeBrowser::SaveRevertHpToRegistry - Chrome is running.</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , start</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , Writing to registry</pre><pre>CChromeBrowser::SaveRevertHpToRegistry ,szHomepage not empty</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , Writing None to Revert_HP</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , Already exist in registry</pre><pre>CChromeBrowser::SaveRevertHpToRegistry , zsRevertSupCh Already exist in registry</pre><pre>CChromeBrowser::SaveRevertDspToRegistry - start</pre><pre>CChromeBrowser::SaveRevertDspToRegistry - ChromeSearchAssetsAdded</pre><pre>CChromeBrowser::SaveRevertDspToRegistry - Chrome is running.</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , start</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , Writing to registry</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , write Revert_DSP</pre><pre>CChromeBrowser::SaveRevertDspToRegistry , Writing None to Revert_DSP</pre><pre>CChromeBrowser::SaveRevertDspToRegistry ,Already exist in registry</pre><pre>CChromeBrowser::RevertHpFromRegistry - start</pre><pre>CChromeBrowser::RevertHpFromRegistry - Chrome is running.</pre><pre>CChromeBrowser::RevertHpFromRegistry , start</pre><pre>CChromeBrowser::RevertStartupFromRegistry - start</pre><pre>CChromeBrowser::RevertStartupFromRegistry - Chrome is running.</pre><pre>CChromeBrowser::RevertStartupFromRegistry , start</pre><pre>CChromeBrowser::RevertDspFromRegistry - start</pre><pre>CChromeBrowser::RevertDspFromRegistry - Chrome is running.</pre><pre>CChromeBrowser::RevertDspFromRegistry , start</pre><pre>CChromeBrowser::IsHostBrowser,CH</pre><pre>CChromeBrowser::RefreshHpUrl - hp</pre><pre>CChromeBrowser::RefreshHpUrl - NOT host Browser , Exit</pre><pre>CChromeBrowser::RefreshHpUrl - reading json from file</pre><pre>CChromeBrowser::RefreshHpUrl - bReadJSONSuccessful</pre><pre>CChromeBrowser::RefreshHpUrl - writing json to file</pre><pre>CChromeBrowser::RefreshHpUrl - ret</pre><pre>CChromeBrowser::RefreshDspUrl , start</pre><pre>CChromeBrowser::RefreshDspUrl - NOT host Browser , Exit</pre><pre>CChromeBrowser::UpdateSearchProvider - start</pre><pre>CChromeBrowser::UpdateSearchProvider - Chrome is running.</pre><pre>CChromeBrowser::UpdateSearchProvider - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::UpdateSearchProvider - Chrome version >= 17, SP exists and is default, do not set again.</pre><pre>CChromeBrowser::UpdateSearchProvider - Chrome version >= 17, we need to update the meta signature</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - start</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - can't get the PEM GUID from the configuration file.</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - crx file is not exists.</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - Can't read the preference file.</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - Can't get the extension state.</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - extension is not enabled</pre><pre>CChromeBrowser::IsAVGToolbarEnabled - end</pre><pre>CChromeBrowser::IsNewTabActive - start</pre><pre>CChromeBrowser::IsNewTabActive - the new tab is not active because Instant URL is not exists.</pre><pre>CChromeBrowser::IsNewTabActive - the new tab is not active becuase the CURRENT_USER NT flag is not enabled</pre><pre>CChromeBrowser::IsNewTabActive - the new tab is not active becuase the LOCAL_MACHINE NT flag is not enabled</pre><pre>CChromeBrowser::IsNewTabActive - end, the new tab is active</pre><pre>CChromeBrowser::IsExtensionEnabled start.</pre><pre>CChromeBrowser::IsExtensionEnabled - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::IsExtensionEnabled - empty extension name</pre><pre>CChromeBrowser::IsExtensionEnabled - INSTALLER_ERROR_CHROME_ERROR</pre><pre>CDomainADBlockerCH::GetExtensionState we don't currenty support this state.</pre><pre>CChromeBrowser::SetExtensionEnabled start.</pre><pre>CChromeBrowser::SetExtensionEnabled - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::SetExtensionEnabled - empty extension name</pre><pre>CChromeBrowser::SetExtensionEnabled - INSTALLER_ERROR_CHROME_ERROR</pre><pre>CChromeBrowser::SetExtensionEnabled - enable extention</pre><pre>sCChromeBrowser::SetExtensionEnabled - disable extention</pre><pre>CChromeBrowser::SetExtensionEnabled - writing json to file</pre><pre>CChromeBrowser::SetExtensionEnabled failed to read preferences</pre><pre>CChromeBrowser::EnableExtension - Start</pre><pre>CChromeBrowser::EnableExtension - NOT host Browser , Exit</pre><pre>CChromeBrowser::EnableExtension - EnableExtensionExtractingCrx, zsVersion</pre><pre>CChromeBrowser::EnableExtension - EnableExtensionInPreference, zsVersion</pre><pre>CChromeBrowser::EnableExtension - function ret:</pre><pre>\avg.crx</pre><pre>CChromeBrowser::EnableExtensionInPreference - Start</pre><pre>CChromeBrowser::EnableExtensionInPreference,</pre><pre>CChromeBrowser::EnableExtensionInPreference - Can't read the preference file.</pre><pre>\manifest.json</pre><pre>eCChromeBrowser::EnableExtensionInPreference - return value:</pre><pre>\Google\Chrome\User Data\Default\Preferences</pre><pre>\Google\Chrome\User Data\Default\Web Data</pre><pre>CChromeBrowser::MoveDetourFilesFromAVGFolder, Begin</pre><pre>\Chrome\Default\Web Data</pre><pre>CChromeBrowser::MoveDetourFilesFromAVGFolder, End. err=</pre><pre>\Chrome\Default\</pre><pre>Web Data</pre><pre>\Google\Chrome\User Data\Default\</pre><pre>CChromeBrowser::SetDSPInPrefFile - Start</pre><pre>CChromeBrowser::SetDSPInPrefFile - reading json from file</pre><pre>CChromeBrowser::SetDSPInPrefFile - bReadJSONSuccessful</pre><pre>CChromeBrowser::GetPartnerDSPUrl - start</pre><pre>CChromeBrowser::GetPartnerDSPUrl - Chrome is running.</pre><pre>CChromeBrowser::GetPartnerDSPUrl - sqlite3_open</pre><pre>CChromeBrowser::GetPartnerDSPUrl sql</pre><pre>CChromeBrowser::GetPartnerDSPUrl - sqlite3_prepare</pre><pre>CChromeBrowser::GetPartnerDSPUrl - pChromeSearchProvider->sUrl</pre><pre>CChromeBrowser::AutoDisableToolbar - Start.</pre><pre>%LOCALAPPDATA%\Google\Chrome\User Data\Default\</pre><pre>CChromeBrowser::AutoDisableToolbar - Can't get paths.</pre><pre>CChromeBrowser::AutoDisableToolbar - Can't disable user toolbar.</pre><pre>CChromeBrowser::EnableToolband - ERROR_INVALID_HANDLE</pre><pre>CChromeBrowser::IsPartnerDefaultSearchProvider - Start.</pre><pre>CChromeBrowser::IsPartnerHomePage - Start.</pre><pre>CChromeBrowser::GetStartupFromJson - failed reading Json</pre><pre>CChromeBrowser::GetStartupFromJson - szStartup:</pre><pre>CChromeBrowser::GetHomepageFromJson - failed reading Json</pre><pre>CChromeBrowser::GetHomepageFromJson - szHomepage:</pre><pre>\Web Data.tmp</pre><pre>CChromeBrowser::GetAvgNewTabUrl- failed:</pre><pre>CChromeBrowser::GetAvgNewTabUrl - sqlite3_open</pre><pre>CChromeBrowser::GetAvgNewTabUrl - sqlite3_prepare</pre><pre>CChromeBrowser::GetAvgNewTabUrl - new tab url</pre><pre>CChromeBrowser::GetSPList - DB:</pre><pre>CChromeBrowser::GetSPList - sqlite3_open</pre><pre>CChromeBrowser::GetSPList - sqlite3_prepare</pre><pre>CChromeBrowser::GetSPList - id</pre><pre>CChromeBrowser::GetSPList - short name</pre><pre>CChromeBrowser::GetSPList - ERR:</pre><pre>CChromeBrowser::IsInstantURLActive - start</pre><pre>CChromeBrowser::IsInstantURLActive - Chrome is running.</pre><pre>CChromeBrowser::IsInstantURLActive - sqlite3_open</pre><pre>CChromeBrowser::IsInstantURLActive sql</pre><pre>CChromeBrowser::IsInstantURLActive - sqlite3_prepare</pre><pre>CChromeBrowser::IsInstantURLActive - res</pre><pre>\Google\Chrome\User Data\Default\Current Session</pre><pre>CUnInstallerHelper::CloseVProtector() Sending vprot.exe WM_QUIT</pre><pre>vprot.exe</pre><pre>%s failed with error %d: %s</pre><pre>CUnInstallerHelper::ExecuteSeperateInstaller starting the function</pre><pre>CUnInstallerHelper::ExecuteSeperateInstaller, GetConfigurationFileName FAILED.</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, start</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, Installer Path:</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, Config File:</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, Partner:</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, Executed From Contrl Pannel:</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, Need Elevation:</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD XPIPATH</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD UNINSTALLPAGE</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD DEP</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD REGISTERSATB</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD PROMPT</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD OFFLINE</pre><pre>/EXECUTEUNINSTALL</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD EXECUTEUNINSTALL</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD CHANGEPROFILE</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD RESETSAPSFF</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD PARTNER</pre><pre>CUnInstallerHelper::CreateTempCopyAndExecute, ADD FROMELEVATION</pre><pre>CUnInstallerHelper::CopyFileToTemp, success=%s to copy %s to %s</pre><pre>var oShell = new ActiveXObject("Shell.Application");</pre><pre>var commandtoRun = WScript.arguments(0);</pre><pre>oShell.ShellExecute(commandtoRun, "%PARAMETERS%", "" , "open", 3);</pre><pre>CCLocalSystemCommands::RunProcessAsUser , ShellExecute</pre><pre>explorer.exe</pre><pre>CLocalSystemCommands::LaunchAppIntoDifferentSession - LoadLibrary Advapi32.dll</pre><pre>CLocalSystemCommands::LaunchAppIntoDifferentSession - FreeLibrary Advapi32.dll</pre><pre>CHttpClient::DetermineHostAndUrl, resource</pre><pre>http://</pre><pre>https://</pre><pre>CHttpClient::DetermineHostAndUrl, Host</pre><pre>CHttpClient::DetermineHostAndUrl, Url</pre><pre>CHttpClient::SendString start</pre><pre>Mozilla/4.0 (compatible; MSIE 4.0; Windows NT 4.0)</pre><pre>CHttpClient::SendString userAgent</pre><pre>CHttpClient::SendString InternetOpen failed.</pre><pre>CHttpClient::SendString InternetConnect failed.</pre><pre>CHttpClient::SendString HttpOpenRequest failed.</pre><pre>CHttpClient::SendString HttpQueryInfo failed.</pre><pre>%s: Ioctl = %p, ret = %d. GLE = %d</pre><pre>CCrashReport::GlobalExceptionFilter no crash report files</pre><pre>avgdumpx.exe</pre><pre>-p %d -c %d %d -D toolbar</pre><pre>CCrashReport::GlobalExceptionFilter shellexecute res</pre><pre>avgdiagex.exe</pre><pre>avgsysx.dll</pre><pre>avgcommx.dll</pre><pre>crash.avgdx</pre><pre>CrashReport</pre><pre>CBrowser::IsSearchAssetsAdded, Browser key</pre><pre>CBrowser::IsSearchAssetsAdded, value if browser key</pre><pre>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>ie.http</pre><pre>firefox</pre><pre>chrome</pre><pre>http\shell\open\command\</pre><pre>Installation/NewTab/Url</pre><pre>CThreadPostMsgOnEvent::Execute() - event to initialized</pre><pre>CThreadPostMsgOnEvent::Execute() - got the event - send message</pre><pre>CThreadPostMsgOnEvent::Execute() - an error ocurred</pre><pre>CThreadPostMsgOnEvent::Execute() - set event</pre><pre>CThreadPostMsgOnEvent::WaitForEvent() CreateEvent err</pre><pre>LLookupPrivilegeValue error: %u</pre><pre>AdjustTokenPrivileges error: %u</pre><pre>AllocateAndInitializeSid (Everyone) error %u</pre><pre>AllocateAndInitializeSid (Admin) error %u</pre><pre>Failed in SetEntriesInAcl. error %u</pre><pre>First SetNamedSecurityInfo call failed: %u</pre><pre>OpenProcessToken failed: %u</pre><pre>Could not set owner. Error: %u</pre><pre>Second SetNamedSecurityInfo call failed: %u</pre><pre>CPathPermissions:GrantRegKeyAccess, start</pre><pre>CPathPermissions:GrantRegKeyAccess, FullKey is empty</pre><pre>HKEY_</pre><pre>CPathPermissions:GrantRegKeyAccess, GetNamedSecurityInfo FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess, RegOpenKeyEx FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,return false</pre><pre>CPathPermissions:GrantRegKeyAccess ,OpenProcessToken FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,HeapAlloc NULL</pre><pre>CPathPermissions:GrantRegKeyAccess ,InitializeAcl FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,AddAccessAllowedAce FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,InitializeSecurityDescriptor FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,SetSecurityDescriptorDacl FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,RegSetKeySecurity FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,SetNamedSecurityInfo FAIL</pre><pre>CPathPermissions:GrantRegKeyAccess ,end ,return true</pre><pre>CFFConfig::Initialize() - m_szFirefoxFolder</pre><pre>prefs.js</pre><pre>prefs.js.tmp</pre><pre>localstore.rdf</pre><pre>CFFConfig::GetValue - key</pre><pre>CFFConfig::SetValue - key</pre><pre>CFFConfig: DeleteKey, removing:</pre><pre>CFFConfig: DeleteKey, IsInitialized failed</pre><pre>CFFConfig: ParsePreferences, szKey:</pre><pre>CFFConfig: ParsePreferences, couldn't determine key name</pre><pre>CFFConfig: ParsePreferences, PARSING_TYPE_DELETE, found key, value:</pre><pre>CFFConfig: ParsePreferences, Key not found, Key:</pre><pre>CPaypalDomainListReader::CheckFileExist "data.dat" does not exist</pre><pre>CPaypalDomainListReader::Init "data.zip" file does not exists</pre><pre>CPaypalDomainListReader::CheckFileExist "data.zip" exist</pre><pre>CPaypalDomainListReader::CheckFileExist copy or unzip"data.zip" result</pre><pre>CPaypalDomainListReader::Init "data.dat" file exists</pre><pre>\%s\Paypal</pre><pre>RemoteUpdater/Campaign/Url</pre><pre>CUpdaterRequest::ParseXML - Ended to Campign URL</pre><pre>RemoteUpdater/Campaign/CmdLineParams</pre><pre>CUpdaterRequest::ParseXML - Parsed url</pre><pre>Url%d</pre><pre>CUpdaterRequest::ParseXML - Parsed url param:</pre><pre>CUpdaterRequest::ParseXML - Parsed url data:</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>CUpdaterRequest::UpdateWithRemoteToolbarData - http request: send=[</pre><pre>CUpdaterRequest::GetLocalToolbarsInfo() - read partnerID start: configuration.xml:</pre><pre>CUpdaterRequest::GetDownloadUrl(), Browser</pre><pre>CUpdaterRequest::GetDownloadUrl - failed to read Server url</pre><pre>CUpdaterRequest::GetDownloadUrl - failed to parse XML</pre><pre>CUpdaterRequest::GetDownloadUrl - Url</pre><pre>CUpdaterRequest::GetDownloadUrl - NewVersion</pre><pre>CUpdaterRequest::GetDownloadUrl - should download</pre><pre>CUpdaterRequest::GetDownloadUrl - no toolbars returned</pre><pre>\UpdaterConfig.ini</pre><pre>ServerURL</pre><pre>XpiInstaller ExtractFileNameFromUrl sUrl</pre><pre>XpiInstaller ExtractFileNameFromUrl fails, (end <= sUrl)</pre><pre>XpiInstaller ExtractFileNameFromUrl fails, (*end != '/')</pre><pre>XpiInstaller Trying to ExtractFileNameFromUrl</pre><pre>XpiInstaller HttpGetFile sFileName</pre><pre>XpiInstaller HttpGetFile sTempDir</pre><pre>XpiInstaller HttpGetFile sXpiResource</pre><pre>\\.\avgtp</pre><pre>R%d/%d/%d %d:%d:%d</pre><pre>{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}</pre><pre>CDomainADBlockerCH::CDomainADBlockerCH error!!! empty chrome path</pre><pre>Local Storage\chrome-extension_gighmmpiobklfepjocnamgkkbiglidom_0.localstorage</pre><pre>CDomainADBlockerCH::CDomainADBlockerCH SQLite path</pre><pre>CDomainADBlockerCH::AddDomainToAdBlocker failed to open sqlite table.</pre><pre>CDomainADBlockerCH::IsDomainInWhiteList failed to open sqlite table.</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_prepare error</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_step empty error</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_step error</pre><pre>CDomainADBlockerCH::GetCustomFilters sqlite3_column_text - error: can't read 'custom_filters' value</pre><pre>CDomainADBlockerCH::OpenTable - sqlite3_open error</pre><pre>CAdBlock::AddDomain sqlite3_exec statement</pre><pre>CAdBlock::AddDomain sqlite3_exec error</pre><pre>@@||%s^$document</pre><pre>CDomainADBlockerPlus::ReadLinesFromFile inFile.is_open failed return false</pre><pre>CDomainADBlockerPlus::WriteLinesToFile outFile.is_open failed return false</pre><pre>Assertion failed: %s, file %s, line %d</pre><pre>%Program Files%\Common Files\AVG Secure Search\ScriptHelperInstaller\18.1.0\ScriptHelper.exe</pre><pre>{8856F961-340A-11D0-A96B-00C04FD705A2}</pre><pre>Configuration.xml!res://ieframe.dll/tabswelcome.htm</pre><pre>ChangeNewTab ?SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy9SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved</pre><pre>ScriptHelper.exe</pre><pre>18.1.0.443</pre></pre></win8></pre>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps

Related articles