ComboFix 11-10-03.01 - adz 04/10/2011 1:48.1.2 - x86 NETWORK Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2047.1543 [GMT 1:00] Running from: c:\users\adz\Downloads\ComboFix.exe AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\autorun.ini c:\windows\system32\muzapp.exe c:\windows\system32\shsvcs.dll.vgorg c:\windows\system32\themeui.dll.vgorg c:\windows\system32\uxtheme.dll.vgorg . . ((((((((((((((((((((((((( Files Created from 2011-09-04 to 2011-10-04 ))))))))))))))))))))))))))))))) . . 2011-10-04 00:54 . 2011-10-04 00:54 -------- d-----w- c:\users\adz\AppData\Local\temp 2011-10-04 00:54 . 2011-10-04 00:54 -------- d-----w- c:\users\Guest\AppData\Local\temp 2011-10-03 23:17 . 2011-10-03 23:17 -------- d-----w- C:\linuxmint 2011-09-29 03:16 . 2011-09-29 03:16 -------- d-----w- c:\windows\Sun 2011-09-29 01:04 . 2011-09-29 01:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware(1667) 2011-09-22 16:44 . 2011-09-29 02:22 -------- d-----w- c:\users\adz\AppData\Roaming\OnLive App 2011-09-21 12:22 . 2011-07-06 15:31 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-09-21 12:22 . 2011-06-17 16:03 375808 ----a-w- c:\windows\system32\winsrv.dll 2011-09-21 12:22 . 2011-06-17 20:13 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys 2011-09-21 12:22 . 2011-06-20 08:54 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe 2011-09-21 12:22 . 2011-06-20 08:54 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe 2011-09-21 12:22 . 2011-07-11 13:25 2048 ----a-w- c:\windows\system32\tzres.dll 2011-09-18 12:05 . 2011-09-18 12:05 -------- d-----w- c:\users\adz\AppData\Roaming\Birdstep Technology 2011-09-18 12:04 . 2011-03-23 15:15 90112 ----a-w- c:\windows\system32\drivers\ew_jucdcacm.sys 2011-09-18 12:04 . 2011-03-23 15:15 861696 ----a-w- c:\windows\system32\drivers\mod7700.sys 2011-09-18 12:04 . 2011-03-23 15:15 73216 ----a-w- c:\windows\system32\drivers\ew_jubusenum.sys 2011-09-18 12:04 . 2011-03-23 15:15 64384 ----a-w- c:\windows\system32\drivers\ew_jucdcecm.sys 2011-09-18 12:04 . 2011-03-23 15:15 26624 ----a-w- c:\windows\system32\drivers\ew_juextctrl.sys 2011-09-18 12:04 . 2011-03-23 15:15 25856 ----a-w- c:\windows\system32\drivers\ewdcsc.sys 2011-09-18 12:04 . 2011-03-23 15:15 235392 ----a-w- c:\windows\system32\drivers\ewusbnet.sys 2011-09-18 12:04 . 2011-03-23 15:15 193792 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys 2011-09-18 12:04 . 2011-03-23 15:15 19200 ----a-w- c:\windows\system32\drivers\ew_hwupgrade.sys 2011-09-18 12:04 . 2011-03-23 15:15 11136 ----a-w- c:\windows\system32\drivers\ew_usbenumfilter.sys 2011-09-18 12:04 . 2011-03-23 15:15 102784 ----a-w- c:\windows\system32\drivers\ew_hwusbdev.sys 2011-09-18 12:02 . 2011-10-04 03:22 -------- d-----w- c:\program files\Huawei Modems 2011-09-18 12:02 . 2011-09-18 12:02 67156 ----a-w- c:\windows\Huawei ModemsUninstall.exe 2011-09-15 20:48 . 2011-03-23 15:15 1112288 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01007.dll 2011-09-15 20:20 . 2011-09-15 20:20 -------- d-----w- c:\program files\3 Mobile Broadband 2011-09-15 20:04 . 2011-10-04 03:22 -------- d-----w- c:\users\adz\{0333f286-1abd-47a8-8db3-542683bfd37d} 2011-09-13 12:32 . 2011-09-22 17:33 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-09-12 20:33 . 2011-09-12 20:33 -------- d-----w- c:\programdata\PC Tools 2011-09-12 19:40 . 2011-09-29 02:22 -------- d-----w- c:\programdata\Trend Micro 2011-09-12 19:39 . 2011-09-12 19:39 -------- d-----w- c:\windows\system32\GroupPolicy 2011-09-07 22:25 . 2011-09-07 22:25 -------- d-----w- c:\programdata\MediaMonkey 2011-09-07 19:06 . 2011-10-04 03:22 -------- d-----w- c:\users\adz\AppData\Local\MediaMonkey 2011-09-07 19:06 . 2011-09-07 19:06 -------- d-----w- c:\program files\MediaMonkey . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-09-06 20:45 . 2011-03-14 00:50 41184 ----a-w- c:\windows\avastSS.scr 2011-09-06 20:45 . 2011-03-14 00:50 199304 ----a-w- c:\windows\system32\aswBoot.exe 2011-09-06 20:38 . 2011-03-14 00:50 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-09-06 20:37 . 2011-03-14 00:51 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-09-06 20:36 . 2011-03-14 00:51 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-09-06 20:36 . 2011-03-14 00:51 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-09-06 20:36 . 2011-03-14 00:50 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-09-06 20:36 . 2011-03-14 00:52 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-08-11 16:10 . 2011-08-11 16:10 0 ----a-w- c:\windows\system32\ConduitEngine.tmp 2011-07-20 08:44 . 2011-07-26 14:39 6881616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{70386860-6686-4DD3-8726-D98D2CFC04BD}\mpengine.dll 2011-07-06 18:52 . 2011-07-18 12:29 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-07-06 18:52 . 2011-07-18 12:29 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-09-28 11:34 . 2011-09-12 21:04 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2011-04-20 . 690D53BD10A804BB6D0A772D1C0E6907 . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll [7] 2009-04-11 . C818C44C201898399BF999BB6B35D4E3 . 247296 . . [6.0.6002.18005] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6002.18005_none_cf1bd6361a0f622e\shsvcs.dll [7] 2008-01-19 . 27F10F348E508243F6254846F8370D0D . 247296 . . [6.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll [7] 2006-11-02 . B264DFA21677728613267FE63802B332 . 245248 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6000.16386_none_caf99b2e2002860e\shsvcs.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-09-06 20:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\adz\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\adz\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\adz\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2011-07-29 4283256] "WinPatrol System Monitor"="c:\program files\BillP Studios\WinPatrol\WinPatrol.exe" [2009-10-10 320832] "HuaWeiEVDO.exe"="c:\program files\3 Mobile\3 Mobile Broadband\3 Mobile Broadband.exe" [2007-10-26 970752] "IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" [2011-07-20 4393816] "AliceConnect"="c:\program files\3 Mobile Broadband\3Connect\Wilog.exe" [2011-03-23 10042776] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416] "PlusService"="c:\program files\Yuna Software\Messenger Plus!\PlusService.exe" [2011-09-20 801792] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "EnableShellExecuteHooks"= 1 (0x1) . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-09-29 113024] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice] @="Service" . [HKLM\~\startupfolder\C:^Users^adz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk] backup=c:\windows\pss\Dropbox.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-05-16 22:29 136176 ----atw- c:\users\adz\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] 2007-01-01 21:22 3739648 ----a-w- c:\program files\Google\Google Talk\googletalk.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IObit Malware Fighter] 2011-07-20 11:19 4393816 ----a-w- c:\program files\IObit\IObit Malware Fighter\IMF.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2011-07-29 00:47 4283256 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlusService] 2011-09-20 11:39 801792 ----a-w- c:\program files\Yuna Software\Messenger Plus!\PlusService.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinPatrol System Monitor] 2009-10-10 21:07 320832 ----a-w- c:\program files\BillP Studios\WinPatrol\WinPatrol.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background "WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-03-13 691696] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2011-02-22 51984] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2011-02-22 69392] R1 aswSnx;aswSnx; [x] R1 aswSP;aswSP; [x] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2010-09-29 236088] R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2010-07-07 236104] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-09-29 12880] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-09-29 67664] R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [2011-05-28 353168] R2 aswFsBlk;aswFsBlk; [x] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-09-06 54616] R2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [2011-03-23 1740696] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [2011-07-20 820568] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2010-11-25 160448] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2009-09-27 240232] R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service [x] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-06-16 76088] R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2011-06-07 20032] R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2011-03-23 102784] R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [2011-03-23 11136] R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wlh_x86\FileMonitor.sys [2011-07-11 18768] R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-06-09 13224] R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x] R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [x] R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [x] R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [x] R3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [2010-08-11 9216] R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010-11-24 89192] R3 pctNdis;PC Tools Firewall Intermediate Filter Service;c:\windows\system32\DRIVERS\pctNdis.sys [2010-07-08 57536] R3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw.sys [2010-11-25 124992] R3 RDPDISPM;RDPDISPM;c:\windows\system32\DRIVERS\rdpdispm.sys [2010-02-08 15488] R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\drivers\wlh_x86\regfilter.sys [2011-03-22 30600] R3 SiS6350;SiS6350;c:\windows\system32\DRIVERS\SISGRKMD.sys [2007-06-05 454520] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-06-16 181432] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2011-02-22 33552] R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\drivers\wlh_x86\UrlFilter.sys [2011-03-22 19280] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2010-08-11 114688] R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2010-08-11 105856] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2010-09-29 30112] S1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2010-07-07 22600] S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi.sys [2010-11-17 249616] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-09-29 116608] S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2011-03-23 235392] S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2011-03-23 73216] S3 OAnet;OnlineArmor Service;c:\windows\system32\DRIVERS\oanet.sys [2010-07-07 29256] S3 pctNdisMP;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis.sys [2010-07-08 57536] S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-06-09 27632] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSGB6.sys [2008-09-09 48128] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2011-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-622969088-916114322-552598207-1000Core.job - c:\users\adz\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-16 22:29] . 2011-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-622969088-916114322-552598207-1000UA.job - c:\users\adz\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-16 22:29] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mStart Page = hxxp://en.uk.acer.yahoo.com uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com FF - ProfilePath - c:\users\adz\AppData\Roaming\Mozilla\Firefox\Profiles\nd2iwvbc.default\ FF - prefs.js: browser.startup.homepage - www.facebook.com # Mozilla User Preferences /* Do not edit this file. * * If you make changes to this file while the application is running, * the changes will be overwritten when the application exits. * * To make a manual change to preferences, you can visit the URL about:config * For more information, see hxxp://www.mozilla.org/unix/customizing.html#prefs */ FF - user.js: app.update.auto - false FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1317673254 FF - user.js: app.update.lastUpdateTime.background-update-timer - 1317668568 FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1317668448 FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1317672628 FF - user.js: browser.bookmarks.restore_default_bookmarks - false FF - user.js: browser.cache.disk.capacity - 1048576 FF - user.js: browser.cache.disk.smart_size.first_run - false FF - user.js: browser.cache.disk.smart_size_cached_value - 819200 FF - user.js: browser.download.lastDir - c:\\Users\\adz\\Downloads FF - user.js: browser.migration.version - 5 FF - user.js: browser.places.smartBookmarksVersion - 2 FF - user.js: browser.preferences.advanced.selectedTabIndex - 0 FF - user.js: browser.rights.3.shown - true FF - user.js: browser.startup.homepage - www.facebook.com FF - user.js: browser.startup.homepage_override.buildID - 20110922153450 FF - user.js: browser.startup.homepage_override.mstone - rv:7.0 FF - user.js: browser.syncPromoViewsLeft - 0 FF - user.js: extensions.adblockplus.currentVersion - 1.3.10 FF - user.js: extensions.blocklist.pingCountTotal - 17 FF - user.js: extensions.blocklist.pingCountVersion - 2 FF - user.js: extensions.bootstrappedAddons - {} FF - user.js: extensions.databaseSchema - 5 FF - user.js: extensions.enabledAddons - gmailwatcher@sonthakit:1.43,{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10,wrc@avast.com:6.0.1289,{972ce4c6-7e08-4474-a285-3208198ce6fd}:7.0 FF - user.js: extensions.gmailwatcher.delayfirstcheckingfor - 60 FF - user.js: extensions.gmailwatcher.feedenhance - true FF - user.js: extensions.gmailwatcher.interval - 9 FF - user.js: extensions.gmailwatcher.msiopenbehavior - 3 FF - user.js: extensions.gmailwatcher.newlyarrived - true FF - user.js: extensions.gmailwatcher.reuseexistingmailtab - false FF - user.js: extensions.gmailwatcher.soundfile - c:\\Users\\adz\\Downloads\\gotmail4.wav FF - user.js: extensions.gmailwatcher.soundtype - 2 FF - user.js: extensions.gmailwatcher.version - 143 FF - user.js: extensions.installCache - [{\name\:\winreg-app-global\,\addons\:{\wrc@avast.com\:{\descriptor\:\c:\\\\Program Files\\\\AVAST Software\\\\Avast\\\\WebRep\\\\FF\,\mtime\:1317666760643}}},{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\c:\\\\Program Files\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1317209700122}}},{\name\:\app-profile\,\addons\:{\gmailwatcher@sonthakit\:{\descriptor\:\c:\\\\Users\\\\adz\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\nd2iwvbc.default\\\\extensions\\\\gmailwatcher@sonthakit.xpi\,\mtime\:1316873743258},\{0471d3b0-a403-11df-981c-0800200c9a66}\:{\descriptor\:\c:\\\\Users\\\\adz\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\nd2iwvbc.default\\\\extensions\\\\{0471d3b0-a403-11df-981c-0800200c9a66}.xpi\,\mtime\:1316780862732},\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\descriptor\:\c:\\\\Users\\\\adz\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\nd2iwvbc.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\,\mtime\:1317213096482}}}] FF - user.js: extensions.lastAppVersion - 7.0 FF - user.js: extensions.lastPlatformVersion - 7.0 FF - user.js: extensions.pendingOperations - false FF - user.js: extensions.ui.lastCategory - addons://list/extension FF - user.js: extensions.ui.locale.hidden - true FF - user.js: extensions.wrc.RulesVersion - FF - user.js: extensions.wrc.SearchRules./v1/update/rule/foo.bar.style - some style FF - user.js: extensions.wrc.SearchRules./v1/update/rule/foo.bar.url - testik.bb FF - user.js: extensions.wrc.SearchRules.ask.com.style - .WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.ask.com.url - ^http(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.* FF - user.js: extensions.wrc.SearchRules.atlas.cz.style - .WRCN {display:none} .result .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.atlas.cz.url - ^http\\:\\/\\/searchatlas\\.centrum\\.cz\\/.+ FF - user.js: extensions.wrc.SearchRules.atlas.sk.style - .WRCN {display:none} .katalogSponsorItem .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.atlas.sk.url - ^http\\:\\/\\/hladaj\\.atlas\\.sk\\/.+ FF - user.js: extensions.wrc.SearchRules.baidu.com.style - .WRCN {display:none} .result .f .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.baidu.com.url - ^http\\:\\/\\/www\\.baidu\\.com\\/.* FF - user.js: extensions.wrc.SearchRules.bing.com.style - .WRCN {display:none} .sb_tlst .WRCN, .sp_pss .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.bing.com.url - ^http(s)?\\:\\/\\/www\\.bing\\.com\\/(.)* FF - user.js: extensions.wrc.SearchRules.centrum.cz.style - .WRCN {display:none} .results-list h3 > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.centrum.cz.url - ^http(s)?\\:\\/\\/search\\.centrum\\.cz\\/(.)* FF - user.js: extensions.wrc.SearchRules.centrum.sk.style - .WRCN {display:none} .katalogSponsorItem .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.centrum.sk.url - ^http\\:\\/\\/search\\.centrum\\.sk\\/.+ FF - user.js: extensions.wrc.SearchRules.delicious.com.style - .WRCN {display:none} .taggedlink + .WRCN, .data .full-url .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.delicious.com.url - ^http\\:\\/\\/www\\.delicious\\.com\\/(.)* FF - user.js: extensions.wrc.SearchRules.dmoz.org.style - .WRCN {display:none} ol.site li .WRCN{display:inline !important; background: url(\IMAGE\) right no-repeat} ol.site li .ref .WRCN {display:none!important} FF - user.js: extensions.wrc.SearchRules.dmoz.org.url - ^http\\:\\/\\/www\\.dmoz\\.org\\/search(.)+ FF - user.js: extensions.wrc.SearchRules.excite.com.style - .WRCN {display:none} .listing .resultsLink + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.excite.com.url - ^http\\:\\/\\/msxml\\.excite\\.com\\/excite\\/ws\\/.+ FF - user.js: extensions.wrc.SearchRules.facebook.com.style - .WRCN {display:none} .WRCN {display:none} .uiAttachmentTitle .WRCN, .uiStreamMessage .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.facebook.com.url - ^http\\:\\/\\/www\\.facebook\\.com\\/.* FF - user.js: extensions.wrc.SearchRules.fastweb.it.style - .WRCN {display:none} .gs-title .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.fastweb.it.url - ^http\\:\\/\\/www\\.fastweb\\.it\\/portale\\/google\\/.+ FF - user.js: extensions.wrc.SearchRules.gazeta.pl.style - .WRCN {display:none} .res_body .res_entry .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.gazeta.pl.url - ^http\\:\\/\\/szukaj\\.gazeta\\.pl\\/.+ FF - user.js: extensions.wrc.SearchRules.google.com.style - .WRCN {display:none} .r .WRCN, .osl .WRCN, .bc .WRCN, .fc .WRCN, #rhsline ol .WRCN {display:inline; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.google.com.url - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.* FF - user.js: extensions.wrc.SearchRules.interia.pl.style - .WRCN {display:none} .row .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.interia.pl.url - ^http\\:\\/\\/(www\\.)?google\\.interia\\.pl\\/szukaj\\/.+ FF - user.js: extensions.wrc.SearchRules.lycos.com.style - .WRCN {display:none} .results .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .results .sponsored .WRCN {display: none!important} FF - user.js: extensions.wrc.SearchRules.lycos.com.url - ^http\\:\\/\\/search\\.lycos\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+ FF - user.js: extensions.wrc.SearchRules.onet.pl.style - .WRCN {display:none} #main .link .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.onet.pl.url - ^http\\:\\/\\/szukaj\\.onet\\.pl\\/.+ FF - user.js: extensions.wrc.SearchRules.paginegialle.it.style - .WRCN {display:none} .lnkwww + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.paginegialle.it.url - ^http\\:\\/\\/www\\.paginegialle\\.it\\/pgol\\/.+ FF - user.js: extensions.wrc.SearchRules.public.avast.com.style - .WRCN {display:inline; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.public.avast.com.url - ^http(s)?\\:\\/\\/public\\.avast\\.com\\/(.)* FF - user.js: extensions.wrc.SearchRules.rambler.ru.style - .WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.rambler.ru.url - ^http\\:\\/\\/nova\\.rambler\\.ru\\/.+ FF - user.js: extensions.wrc.SearchRules.scroogle.org.style - a + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.scroogle.org.url - ^http\\:\\/\\/www\\.scroogle\\.org\\/.* FF - user.js: extensions.wrc.SearchRules.seznam.cz.style - .WRCN {display:none} #results .text .WRCN, .sklik-title > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.seznam.cz.url - ^http(s)?\\:\\/\\/search\\.seznam\\.cz\\/(.)* FF - user.js: extensions.wrc.SearchRules.sky.com.style - .WRCN {display:none} #results h3 .WRCN, #sponsored_top h3 .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.sky.com.url - ^http\\:\\/\\/search\\.sky\\.com/.+ FF - user.js: extensions.wrc.SearchRules.slashdot.org.style - .WRCN {display:none} .body i .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.slashdot.org.url - ^http\\:\\/\\/slashdot\\.org\\/.* FF - user.js: extensions.wrc.SearchRules.terra.com.br.style - .WRCN {display:none} .col-left-full .list-results .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.terra.com.br.url - ^http\\:\\/\\/buscador\\.terra\\.com\\.br\\/.+ FF - user.js: extensions.wrc.SearchRules.tiscali.it.style - .WRCN {display:none} .item .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.tiscali.it.url - ^http\\:\\/\\/search\\.tiscali\\.it\\/.+ FF - user.js: extensions.wrc.SearchRules.twitter.com.style - .WRCN {display:none} .entry-content .web + .WRCN, .twtr-tweet-text .twtr-hyperlink + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.twitter.com.url - ^hxxp://twitter\\.com\\/.* FF - user.js: extensions.wrc.SearchRules.uol.com.br.style - .WRCN {display:none} #results dt .WRCN, #results .link .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} #results .link .similar .WRCN {display: none!important} FF - user.js: extensions.wrc.SearchRules.uol.com.br.url - ^http\\:\\/\\/(.\\.)?busca\\.uol\\.com\\.br\\/.+ FF - user.js: extensions.wrc.SearchRules.virgilio.it.style - .WRCN {display:none} .risultati .record .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .risultati .record .sponsor + .WRCN {display: none!important} FF - user.js: extensions.wrc.SearchRules.virgilio.it.url - ^http\\:\\/\\/ricerca\\.virgilio\\.it\\/.+ FF - user.js: extensions.wrc.SearchRules.virginmedia.com.style - .WRCN {display:none} .result-title .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.virginmedia.com.url - ^http\\:\\/\\/search\\.virginmedia\\.com\\/.+ FF - user.js: extensions.wrc.SearchRules.whereis.com.style - .WRCN {display:none} .priority_url .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.whereis.com.url - ^http\\:\\/\\/www\\.whereis\\.com\\/.* FF - user.js: extensions.wrc.SearchRules.wp.pl.style - .WRCN {display:none} .rek big .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.wp.pl.url - ^http\\:\\/\\/szukaj\\.wp\\.pl\\/.+ FF - user.js: extensions.wrc.SearchRules.yahoo.com.style - .WRCN {display:none} .sm-hd .WRCN, .sm-links .WRCN, .res h3 > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.yahoo.com.url - ^http(s)?\\:\\/\\/((.)+\\.)?search\\.yahoo\\.com\\/(.)* FF - user.js: extensions.wrc.SearchRules.yandex.ru.style - .WRCN {display:none} .b-serp-item__title-link + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.yandex.ru.url - ^http\\:\\/\\/yandex\\.ru\\/.+ FF - user.js: extensions.wrc.SearchRules.yell.com.style - .WRCN {display:none} .advert-content .WRCN, .other-cta .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .advert-content .star + .WRCN, .advert-content .logoImg + .WRCN, .other-cta .shareLink + .WRCN {display: none!important} FF - user.js: extensions.wrc.SearchRules.yell.com.url - ^http\\:\\/\\/www\\.yell\\.com\\/.+ FF - user.js: extensions.wrc.SearchRules.zoznam.sk.style - .WRCN {display:none} .box_content .link_right .link_title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} FF - user.js: extensions.wrc.SearchRules.zoznam.sk.url - ^http\\:\\/\\/www\\.zoznam\\.sk\\/.+ FF - user.js: font.internaluseonly.changed - true FF - user.js: idle.lastDailyNotification - 1317134109 FF - user.js: integratedgmail-pre_version - -1 FF - user.js: integratedgmail-version - 2.6.26 FF - user.js: intl.charsetmenu.browser.cache - windows-1251, windows-1252, ISO-8859-1, UTF-8 FF - user.js: longfocus.gmanager.first-time - false FF - user.js: longfocus.gmanager.version - 0.6.4.1 FF - user.js: network.cookie.prefsMigrated - true FF - user.js: places.database.lastMaintenance - 1317134109 FF - user.js: places.history.expiration.transient_current_max_pages - 64387 FF - user.js: privacy.cpd.siteSettings - true FF - user.js: privacy.sanitize.migrateFx3Prefs - true FF - user.js: privacy.sanitize.timeSpan - 0 FF - user.js: security.warn_viewing_mixed - false FF - user.js: services.sync.clients.lastSync - 0 FF - user.js: services.sync.clients.lastSyncLocal - 0 FF - user.js: services.sync.migrated - true FF - user.js: services.sync.tabs.lastSync - 0 FF - user.js: services.sync.tabs.lastSyncLocal - 0 FF - user.js: storage.vacuum.last.index - 1 FF - user.js: storage.vacuum.last.places.sqlite - 1315922215 FF - user.js: toolkit.telemetry.prompted - true FF - user.js: urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey - 1319737694 FF - user.js: weboftrust.accessible - true FF - user.js: weboftrust.automatic_updates - false FF - user.js: weboftrust.cookie_updated - 1317257070236 FF - user.js: weboftrust.extension_id - 4a5ba2db3382d8eab70e1df9f451c723083771b2 FF - user.js: weboftrust.firstrun_guide - 2 FF - user.js: weboftrust.last_message - 20110214 FF - user.js: weboftrust.last_version - 20110704 FF - user.js: weboftrust.search.aolsearch.display - AOL Search FF - user.js: weboftrust.search.aolsearch.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/ FF - user.js: weboftrust.search.aolsearch.pre0.match - 3 FF - user.js: weboftrust.search.aolsearch.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*redir\\\\?.*s_cu=(http.+)(&.*)? FF - user.js: weboftrust.search.aolsearch.prestyle - .HL [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.aolsearch.style - a.find ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.aolsearch.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*search\\\\?.+ FF - user.js: weboftrust.search.ask.display - Ask.com Web Search FF - user.js: weboftrust.search.ask.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/ FF - user.js: weboftrust.search.ask.pre0.match - 4 FF - user.js: weboftrust.search.ask.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/(bar|r)\\\\?.*&u=(http[^&]+) FF - user.js: weboftrust.search.ask.prestyle - .s_binoc2 ~ [ATTR], .nu ~ [ATTR], [ATTR=\safeweb.norton.com\] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.ask.style - a.title ~ [ATTR=\NAME\], a.L4 ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.ask.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/web\\\\?.+ FF - user.js: weboftrust.search.baidu.display - Baidu FF - user.js: weboftrust.search.baidu.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/ FF - user.js: weboftrust.search.baidu.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.baidu.style - .f a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.baidu.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/s\\\\?.+ FF - user.js: weboftrust.search.bing.display - Bing FF - user.js: weboftrust.search.bing.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(msn(scache)?|live|bingj?|microsofttranslator)\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/ FF - user.js: weboftrust.search.bing.prestyle - .rc_p [ATTR], .sb_vdl [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.bing.style - .nc_tc a ~ [ATTR=\NAME\], .sb_tlst a ~ [ATTR=\NAME\], .sn_rct a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.bing.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*bing\\.com\\/search\\\\? FF - user.js: weboftrust.search.dmoz.display - dmoz - Open Directory Project FF - user.js: weboftrust.search.dmoz.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dmoz\\.org\\/ FF - user.js: weboftrust.search.dmoz.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.dmoz.style - li a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.dmoz.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dmoz\\.org\\/ FF - user.js: weboftrust.search.dogpile.display - Dogpile FF - user.js: weboftrust.search.dogpile.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/ FF - user.js: weboftrust.search.dogpile.pre0.match - 3 FF - user.js: weboftrust.search.dogpile.pre0.re - ^http(s)?\\:\\/\\/cs\\.(dogpile|infospace)\\.com\\/ClickHandler.+ru=(http[^&]+) FF - user.js: weboftrust.search.dogpile.prestyle - .paidSearchResult [ATTR] { display: none ! important; } .searchResultsPane { max-width: 44.08em; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.dogpile.style - a.resultTitle ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 1px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.dogpile.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/(info\\.[^\\/]+/)?(search\\/)?web.+ FF - user.js: weboftrust.search.facebook.display - Facebook FF - user.js: weboftrust.search.facebook.dynamic - 1 FF - user.js: weboftrust.search.facebook.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(facebook\\.(com|net)|fbcdn\\.net|bing\\.com)\\/ FF - user.js: weboftrust.search.facebook.match0.attribute0.flags - n FF - user.js: weboftrust.search.facebook.match0.attribute0.name - class FF - user.js: weboftrust.search.facebook.match0.attribute0.re - mceContentBody FF - user.js: weboftrust.search.facebook.match0.element - body FF - user.js: weboftrust.search.facebook.prestyle - .uiHeader [ATTR], a.uiLinkSubtle ~ [ATTR], .profile-picture [ATTR], .HovercardContent td > a ~ [ATTR], .uiAttachmentTitle ~ a ~ [ATTR], a.UIImageBlock_Image ~ [ATTR], .UIMediaItem [ATTR], .UIStoryAttachment_Caption [ATTR], .uiStreamPassive [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.facebook.style - a[onmousedown^=\UntrustedLink\] ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.facebook.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*facebook\\.com\\/ FF - user.js: weboftrust.search.gmail.display - Gmail FF - user.js: weboftrust.search.gmail.dynamic - 1 FF - user.js: weboftrust.search.gmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/ FF - user.js: weboftrust.search.gmail.match0.attribute0.flags - n FF - user.js: weboftrust.search.gmail.match0.attribute0.name - class FF - user.js: weboftrust.search.gmail.match0.attribute0.re - editable FF - user.js: weboftrust.search.gmail.match0.element - body FF - user.js: weboftrust.search.gmail.pre0.match - 4 FF - user.js: weboftrust.search.gmail.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?googlesyndication\\.com\\/(aclk|pagead).*\\\\?.*adurl=(.+)(&.*)? FF - user.js: weboftrust.search.gmail.prestyle - .e ~ [ATTR], #gbd [ATTR], #gbi [ATTR], .vd ~ [ATTR], .Ni ~ [ATTR], .mr ~ [ATTR], [ATTR] { position: absolute; visibility: hidden; } .e:last-of-type ~ [ATTR] { position: relative; visibility: visible; } FF - user.js: weboftrust.search.gmail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 2px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.gmail.url - ^http(s)?\\:\\/\\/mail\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(mail|a)\\/.+ FF - user.js: weboftrust.search.gmail.urlign - &(name=htmlcompose|view=(js|cw)&) FF - user.js: weboftrust.search.google.display - Google FF - user.js: weboftrust.search.google.dynamic - 1 FF - user.js: weboftrust.search.google.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|docs|picasaweb|profiles|adwords|labs|investor|encrypted|code|services|checkout|trends|plus)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\: FF - user.js: weboftrust.search.google.pre0.match - 9 FF - user.js: weboftrust.search.google.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3D)(https?(\\:|%3A)[^&]+)(&.*)? FF - user.js: weboftrust.search.google.prestyle - #scTopOfPageRefinementLinks[partner=\wot\] [ATTR], #gb [ATTR], #gbd [ATTR], .g > div > div > div span > a.l ~ [ATTR], .ts td > a ~ [ATTR], .result-image [ATTR], .cite ~ [ATTR], .gl [ATTR], .g > a:not([class]):first-child ~ [ATTR], a.f1 ~ [ATTR], a.fl ~ [ATTR], a[href^=\/\][href*=\&oi=video_result\] ~ [ATTR], a[href^=\/\][href*=\&ct=image\] ~ [ATTR], a[href^=\/\][href*=\&sa=X&\] ~ [ATTR], .slk [ATTR], #gbar [ATTR], #ssb [ATTR], #doc3 [ATTR], #sft [ATTR], .osl [ATTR], #rtr [ATTR], .bc [ATTR] { display: none ! important; } a[creator=\SiteAdvisor\] img { position: relative ! important; } [mclinkinfo] a ~ [ATTR], a[creator=\SiteAdvisor\] + [ATTR=\siteadvisor.com\], [id^=\BubbleLayer\] [ATTR] { display: none ! important; } [ATTR] { display: none ! important; } FF - user.js: weboftrust.search.google.script - if(document.location.protocol==\http:\){if(typeof(contentscript)==\object\){contentscript.update();}else if((!window.parent||window==window.parent)&&typeof(loader)!=\object\){loader={time:Date.now(),maxage:300000,url:\hxxp://api.mywot.com/0.4/script?target=google\};var script=wot_getlastscript();if(!script||script.url.indexOf(loader.url)!=0||script.time<(loader.time-loader.maxage)){wot_loadscript(loader.url+(wot_getapiparams()||\\)+\&_=\+loader.time);}else if(script.status==200&&script.code.length>0){eval(script.code);}}} FF - user.js: weboftrust.search.google.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; display: inline-block ! important; } FF - user.js: weboftrust.search.google.url - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/ FF - user.js: weboftrust.search.google.urlign - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(\\+|a\\/|accounts|ad(s|manager|planner|sense|words)|alerts|analytics|apps|appserve|base|calendar|chrome(frame)?|codesearch|comparisonads|corporate|crisisresponse|datacenter|dfp|dictionary|doodle|educators|enterprise|events|experimental|familysafety|finance|flutrends|friendconnect|goog411|googlebooks|googlenotebook|googlevoice|gwt|help|history|hostednews|images|imgres|ime|insights|landing|local|logos|mapmaker|maps|mobile|moon|music|newproducts|news|notebook|patents|phone|postini|powermeter|press|profiles|publicdata|puzzles|onlinechallenge|reader|recaptcha|relief|services|s2|sitesearch|sky|smallbusinessnetwork|squared|submit|support|sync|talk|toolbar|uds|ventures|voice|wallet|web(masters|elements)|intl\\/[^\\/]+\\/.+|search\\\\?.*tbm=isch) FF - user.js: weboftrust.search.googleimages.display - Google Image Search FF - user.js: weboftrust.search.googleimages.dynamic - 1 FF - user.js: weboftrust.search.googleimages.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|docs|picasaweb|adwords|labs|investor)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\: FF - user.js: weboftrust.search.googleimages.pre0.match - 5 FF - user.js: weboftrust.search.googleimages.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/imgres\\\\?.*img(ref)?url=(.+)(&.*)? FF - user.js: weboftrust.search.googleimages.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.googleimages.style - a.rg_l ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 5px; left: 5px; position: absolute; visibility: visible; } #ImgContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 0px; margin-left: -20px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.googleimages.url - ^http(s)?\\:\\/\\/(www|images)\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(images\\\\?.+|search\\\\?.*tbm=isch) FF - user.js: weboftrust.search.hotmail.display - Windows Live Hotmail FF - user.js: weboftrust.search.hotmail.dynamic - 1 FF - user.js: weboftrust.search.hotmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(live|(imagine-)?msn|microsoft)\\.com\\/ FF - user.js: weboftrust.search.hotmail.match0.element - #mp0_msgPartBody FF - user.js: weboftrust.search.hotmail.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.hotmail.style - .MsgPartBody a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.hotmail.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*mail\\.live\\.com\\/mail\\/ FF - user.js: weboftrust.search.ixquick.display - Ixquick FF - user.js: weboftrust.search.ixquick.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/? FF - user.js: weboftrust.search.ixquick.pre0.match - 6 FF - user.js: weboftrust.search.ixquick.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)? FF - user.js: weboftrust.search.ixquick.pre1.match - 4 FF - user.js: weboftrust.search.ixquick.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/highlight.*&u=(http[^&]*) FF - user.js: weboftrust.search.ixquick.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.ixquick.style - a.title ~ [ATTR=\NAME\], a.title2 ~ [ATTR=\NAME\], .result h3 > a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.ixquick.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/metasearch FF - user.js: weboftrust.search.mailru.display - Mail.Ru FF - user.js: weboftrust.search.mailru.ign - ^http(s)?\\:\\/\\/(.+\\.)?mail\\.ru\\/ FF - user.js: weboftrust.search.mailru.pre0.match - 9 FF - user.js: weboftrust.search.mailru.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3D)(https?(\\:|%3A)[^&]+)(&.*)? FF - user.js: weboftrust.search.mailru.prestyle - .video-thumb [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.mailru.style - .res-head a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.mailru.url - ^http(s)?\\:\\/\\/go\\.mail\\.ru\\/search\\?.+ FF - user.js: weboftrust.search.naver.display - Naver FF - user.js: weboftrust.search.naver.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/ FF - user.js: weboftrust.search.naver.prestyle - .thumb_wrap [ATTR], .thumb [ATTR], .mov_thumb [ATTR], .btn_area [ATTR], .txt_block [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.naver.style - #content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.naver.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/search.*\\\\?.+ FF - user.js: weboftrust.search.rambler.display - Rambler FF - user.js: weboftrust.search.rambler.ign - ^http(s)?\\:\\/\\/(.+\\.)?rambler\\.ru\\/ FF - user.js: weboftrust.search.rambler.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.rambler.style - .search-results a.title ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.rambler.url - ^http(s)?\\:\\/\\/nova\\.rambler\\.ru\\/(search|srch)\\?.+ FF - user.js: weboftrust.search.reddit.display - reddit FF - user.js: weboftrust.search.reddit.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/ FF - user.js: weboftrust.search.reddit.prestyle - .thumbnail ~ [ATTR], .footer [ATTR], #ad [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.reddit.style - .content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.reddit.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/ FF - user.js: weboftrust.search.reddit.urlign - ^http(s)?\\:\\/\\/blog\\.reddit\\.com\\/ FF - user.js: weboftrust.search.searchcom.display - Search.com FF - user.js: weboftrust.search.searchcom.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*search\\.com\\/.+ FF - user.js: weboftrust.search.searchcom.pre0.match - 3 FF - user.js: weboftrust.search.searchcom.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?search\\.com\\/click.*\\\\?.*,(http.*)$ FF - user.js: weboftrust.search.searchcom.pre1.match - 6 FF - user.js: weboftrust.search.searchcom.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)? FF - user.js: weboftrust.search.searchcom.prestyle - .attrib [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.searchcom.style - .title a ~ [ATTR=\NAME\], .savvyad_unit a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } .savvyad_unit a ~ [ATTR] { float: right; margin-top: -16px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.searchcom.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*search\\.com\\/search(\\\\?|\\/).+ FF - user.js: weboftrust.search.seznam.display - Seznam FF - user.js: weboftrust.search.seznam.ign - ^http(s)?\\:\\/\\/(.+\\.)?(seznam|sklik)\\.cz\\/ FF - user.js: weboftrust.search.seznam.pre0.match - 3 FF - user.js: weboftrust.search.seznam.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?sklik\\.cz\\/click.*url=([^&]+) FF - user.js: weboftrust.search.seznam.prestyle - .limiter > a ~ [ATTR], .hintImage a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.seznam.style - .result a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.seznam.url - ^http(s)?\\:\\/\\/search\\.seznam\\.cz\\/ FF - user.js: weboftrust.search.twitter.display - Twitter FF - user.js: weboftrust.search.twitter.dynamic - 1 FF - user.js: weboftrust.search.twitter.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/ FF - user.js: weboftrust.search.twitter.prestyle - .meta a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.twitter.style - #content a ~ [ATTR=\NAME\], .tweet-text a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.twitter.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/ FF - user.js: weboftrust.search.webde.display - WEB.DE FF - user.js: weboftrust.search.webde.ign - ^http(s)?\\:\\/\\/(.+\\.)?web\\.de\\/ FF - user.js: weboftrust.search.webde.pre0.match - 9 FF - user.js: weboftrust.search.webde.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3D)(https?(\\:|%3A)[^&]+)(&.*)? FF - user.js: weboftrust.search.webde.prestyle - [ATTR] { position: absolute; visibility: hidden; } .sponsoredLink a { display: inline ! important; } FF - user.js: weboftrust.search.webde.style - .resultContent h3 a ~ [ATTR=\NAME\], .sponsoredLink h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; position: relative; visibility: visible; } FF - user.js: weboftrust.search.webde.url - ^http(s)?\\:\\/\\/suche\\.web\\.de\\/search\\/(web|dir) FF - user.js: weboftrust.search.wikipedia.display - Wikipedia FF - user.js: weboftrust.search.wikipedia.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(wik(ipedia|ibooks|inews|imedia(foundation)?|iquote|isource|tionary|iversity)|mediawiki)\\.org\\/ FF - user.js: weboftrust.search.wikipedia.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.wikipedia.style - #bodyContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat ! important; margin-left: 4px ! important; position: relative; visibility: visible; } FF - user.js: weboftrust.search.wikipedia.url - ^http(s)?\\:\\/\\/.+\\.wiki(pedia|news)\\.org\\/ FF - user.js: weboftrust.search.wikipedia.urlign - \\/w\\/extensions\\/|&action=(edit|submit) FF - user.js: weboftrust.search.yahoo.display - Yahoo! FF - user.js: weboftrust.search.yahoo.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|^http(s)?\\:\\/\\/.+\\/search\\/cache\\\\? FF - user.js: weboftrust.search.yahoo.pre0.match - 4 FF - user.js: weboftrust.search.yahoo.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*http.+yahoo\\.[a-z]{2,}.+fu=(http.+) FF - user.js: weboftrust.search.yahoo.pre1.match - 4 FF - user.js: weboftrust.search.yahoo.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*(http.+) FF - user.js: weboftrust.search.yahoo.pre2.match - 4 FF - user.js: weboftrust.search.yahoo.pre2.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/click\\\\?u=(http.+) FF - user.js: weboftrust.search.yahoo.prestyle - .bbox [ATTR], .right [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.yahoo.style - a.yschttl ~ [ATTR=\NAME\], .active a ~ [ATTR=\NAME\], .hd h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.yahoo.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/search[;\\\\?].+ FF - user.js: weboftrust.search.yahoomail.display - Yahoo! Mail FF - user.js: weboftrust.search.yahoomail.dynamic - 1 FF - user.js: weboftrust.search.yahoomail.ign - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*(yahoo\\.(com|net)|ymailupdates\\.com)\\/ FF - user.js: weboftrust.search.yahoomail.match0.condition - or FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.name - class FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.re - msg-body FF - user.js: weboftrust.search.yahoomail.match0.match0.element - div FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.name - id FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.re - ^(messageAreaIframe|ViewArea_.*)$ FF - user.js: weboftrust.search.yahoomail.match0.match1.element - $frame FF - user.js: weboftrust.search.yahoomail.prestyle - [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.yahoomail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.yahoomail.url - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*mail\\.yahoo\\.(com|net)\\/(dc|neo|om\\/api)\\/ FF - user.js: weboftrust.search.yandex.display - Yandex FF - user.js: weboftrust.search.yandex.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yandex\\.[a-z]{2,}\\/ FF - user.js: weboftrust.search.yandex.prestyle - .redirect [ATTR], .show-player ~ [ATTR], .moreInfo [ATTR], .l-head [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } FF - user.js: weboftrust.search.yandex.style - .b-serp-item__title-link ~ [ATTR=\NAME\], .b-serp-item__title__link ~ [ATTR=\NAME\], .agp ~ [ATTR=\NAME\], .title ~ [ATTR=\NAME\], .domain ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 0px; margin-right: 4px; position: relative; visibility: visible; } FF - user.js: weboftrust.search.yandex.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yandex\\.(ru|com)\\/(yandsearch|search\\.xml)\\\\?.+ FF - user.js: weboftrust.shared.1 - 4sq.com,abcn.ws,aol.it,apne.ws,bbc.in,bzfd.it,cs.pn,d3w.io,dlvr.it,eca.sh,engt.co,es.pn,exm.nr,f.ast.ly,fa.by,flpbd.it,gd.is,ht.ly,huff.to,ind.pn,is.gd,j.mp,lat.ms,lnkd.in,migre.me,n.pr,nblo.gs,nyr.kr,nyti.ms,on.cnn.com,on.mash.to,on.msnbc.com,ow.ly,pep.si,ping.fm,politi.co,post.ly,rww.to,su.pr,t.co,tcrn.ch,tgr.ph,thkpr.gs,tiny.ly,tinyurl.com,tl.gd,tldr.us,tr.im,twitter.com,usat.me,wapo.st,wp.me,x.co,yhoo.it FF - user.js: weboftrust.shared.2 - bit.ly,bitly.com,goo.gl,gu.com,sites.google.com FF - user.js: weboftrust.show_rating_frame - false FF - user.js: weboftrust.update_checked - 1317254576392 FF - user.js: weboftrust.witness_id - dd1097d7c8c8cfbd0a5e23750f4b6738c3114e17 FF - user.js: weboftrust.witness_key - 035106d09507edb41c3346fbab91a932939641f6 FF - user.js: xpinstall.whitelist.add - FF - user.js: xpinstall.whitelist.add.36 - . - - - - ORPHANS REMOVED - - - - . Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file) Notify-WBSrv - c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll MSConfigStartUp-00PCTFW - c:\program files\PC Tools Firewall Plus\FirewallGUI.exe MSConfigStartUp-ThreatFire - c:\program files\ThreatFire\TFTray.exe AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-10-04 01:54 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet006\Services\ThreatFire] "AlternateImagePath"="" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet006\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(1844) c:\users\adz\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . Completion time: 2011-10-04 01:56:46 ComboFix-quarantined-files.txt 2011-10-04 00:56 . Pre-Run: 52,227,088,384 bytes free Post-Run: 53,307,305,984 bytes free . - - End Of File - - 3CDBAEEAE9D9CB5A954CE8932F9BD865