99 replies to this topic

[Nman]

No, I tried that but my McAfee looks different than what the animated gif showed (Though it used to look that way before they updated it, and it was much nicer then too...) But I went through trying to disable everything I could. Is there an updated page about how to disable it?

[LDTate]

Depends on which version you have.
http://www.google.co...AAAAqgQFT9Dd6Hg

[Nman]

Okay this may take a minute, there are a lot of people out there saying different things, but I was able to find something on my own McAfee by doing some of what was said, let me see if I can fully disable it (without having to uninstall it first, I have a home network and it is on my wife's computer too so it's not like I would lose it forever, and I have another license to it to boot [they had a really good sale!]) I will let you know if I can fully disable it. Edit: Well I just tried to restore a part of combo fix that it had quarantined and it deleted it... I will turn McAfee completely off now if you want and then I can reinstall combo fix, there is a way to completely disable it, not as easy as the original though

Edited by Nman, 05 July 2010 - 08:39 PM.

[Nman]

Real Quick I got the following pop up and this is not the first time I have had this problem, but it has been a while since it has been here so I am wondering what it is, I have more details in another pic if you need them. Sorry, tired and in a hurry, I forgot to say, I was wondering if this may some how be related to the problems I am having Can't believe I forgot to say that...

Edited by Nman, 06 July 2010 - 12:15 AM.

[LDTate]

================= FIREFOX ===================

FF - ProfilePath - c:\users\nathan~1\appdata\roaming\mozilla\firefox\profiles\6i6mazbs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2490311&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://discussions.godandscience.org/index.php
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=60459&p=

That's a FireFox plugin.

Uninstall FireFox and reinstall it if you use it.

[Nman]

================= FIREFOX ===================

FF - ProfilePath - c:\users\nathan~1\appdata\roaming\mozilla\firefox\profiles\6i6mazbs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2490311&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://discussions.godandscience.org/index.php
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=60459&p=

That's a FireFox plugin.

Uninstall FireFox and reinstall it if you use it.

Yeah, I use Fire Fox daily, never IE so I will have to do that. Now that I look through all of this though it looks like the voice of the martyrs tool bar I have, Fire Fox had issues with the God and Science tool bar too, and I had to remove it. I am starting to wonder if maybe the problem I am having is linked to that, my wife has the same fire fox and tool bars I have and never has any issues. She has the same McAfee too and OS. I need to copy all of my passwords down before I uninstall though.... this will be fun.

[LDTate]

Firefox wouldn't stop the tools like combofix from running.

[Nman]

Right, I was meaning if maybe the problem on my computer that we are trying to figure out is causing fire fox to have problems. Also, I have figured out a more complete way to disable McAfee (though it took a while) so do you want me to disable it and re-run combo fix? Mind you it removed part of combo fix so should I uninstall what is left and then reinstall? Sorry all of this is taking so long.

[Nman]

Sorry, my comp notgood this up and it wouldn't load the page saying that a response was added, double post!

Edited by Nman, 06 July 2010 - 12:22 PM.

[LDTate]

so do you want me to disable it and re-run combo fix? Mind you it removed part of combo fix so should I uninstall what is left and then reinstall? Sorry all of this is taking so long.

Don't worry about how long it's taking.
Yes I would uninstall combofix and download a new copy.

Try it this way:

• Click START run
• Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

[Nman]

Okay it crashed before it even started this time... I am going to uninstall McAfee and then try, McAfee is acting weird and will not work properly. I went in safe mode after the crash, McAfee says the fire wall is on, so when i went to the setting to turn it off it said it was already off and no matter what I did, I could not turn it back on. I have one more license on McAfee any way, so there should be no problem. I will access my account and take care of making sure it doesn't get canceled. Then I will re-run combofix. Scratch that, I can deactivate it for now via their site, I will do that now. Okay I deactivated it and the version on my computer will not respond to that, it still thinks it is active, so I will uninstall it and reinstall it later.

Edited by Nman, 06 July 2010 - 01:03 PM.

[LDTate]

I'll be away for a few hours.

[Nman]

Cool, I will post the log when I have it, have a good day! I will be at work here soon!

[Nman]

ComboFix 10-07-06.01 - Nathaniel 07/06/2010 12:16:00.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2813.1838 [GMT -7:00]
Running from: c:\users\Nathaniel\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-06-06 to 2010-07-06 )))))))))))))))))))))))))))))))
.

2010-07-06 19:24 . 2010-07-06 19:24 -------- d-----w- c:\users\Nathaniel\AppData\Local\temp
2010-07-06 19:24 . 2010-07-06 19:24 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-07-06 19:24 . 2010-07-06 19:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-02 18:44 . 2010-07-02 18:44 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbFFB8.tmp.exe
2010-06-30 17:53 . 2010-06-30 17:53 -------- d-----w- c:\users\Nathaniel\AppData\Local\Adobe
2010-06-30 02:42 . 2010-06-30 02:42 -------- d-----w- c:\users\Nathaniel\AppData\Roaming\Malwarebytes
2010-06-30 02:41 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-30 02:41 . 2010-06-30 02:41 -------- d-----w- c:\programdata\Malwarebytes
2010-06-30 02:41 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-30 02:41 . 2010-06-30 02:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-25 21:25 . 2010-07-05 05:51 -------- d-----w- C:\ARENA
2010-06-24 01:46 . 2010-06-24 01:46 -------- d-----w- c:\windows\system32\Adobe
2010-06-24 00:57 . 2010-06-24 00:57 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb9D79.tmp.exe
2010-06-22 20:02 . 2009-11-08 17:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-22 20:02 . 2009-11-08 17:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-06-22 20:02 . 2009-11-08 17:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-06-22 20:02 . 2009-11-08 17:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-06-22 20:02 . 2009-11-08 17:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-06-22 20:00 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-06-22 20:00 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-06-17 01:55 . 2010-06-17 01:55 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-06-11 02:21 . 2010-06-28 20:29 -------- d-----w- c:\program files\Common Files\Steam
2010-06-11 02:21 . 2010-07-06 19:09 -------- d-----w- c:\program files\Steam
2010-06-08 23:07 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-08 23:07 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-06-08 23:07 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-06-08 23:07 . 2010-05-04 19:15 834048 ----a-w- c:\windows\system32\wininet.dll
2010-06-08 23:06 . 2010-05-04 18:37 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-06-08 23:06 . 2010-05-01 14:13 2037248 ----a-w- c:\windows\system32\win32k.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-06 19:09 . 2010-01-07 19:34 -------- d-----w- c:\program files\McAfee
2010-07-06 19:09 . 2010-01-07 19:25 -------- d-----w- c:\programdata\McAfee
2010-07-06 19:08 . 2010-01-07 19:34 -------- d-----w- c:\program files\Common Files\McAfee
2010-07-02 18:44 . 2009-05-04 03:45 -------- d-----w- c:\program files\Google
2010-06-24 18:02 . 2009-10-09 04:50 -------- d-----w- c:\programdata\NOS
2010-06-22 20:04 . 2009-07-27 11:50 -------- d-----w- c:\program files\Microsoft.NET
2010-06-09 20:16 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-06-09 06:59 . 2009-07-27 11:48 -------- d-----w- c:\programdata\Microsoft Help
2010-05-21 21:14 . 2009-10-15 05:33 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 16:54 . 2009-09-18 22:26 86672 ----a-w- c:\users\Nathaniel\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-21 07:01 . 2009-07-27 11:47 -------- d-----w- c:\program files\Microsoft Works
2010-05-20 20:12 . 2009-05-04 03:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-20 20:11 . 2010-05-20 20:11 5311698 ----a-w- c:\programdata\ArcSoft\Global Deploy\CheckUpdate\ArcConnect.exe
2010-05-20 19:11 . 2010-05-19 18:14 -------- d-----w- c:\programdata\ArcSoft
2010-05-20 06:57 . 2010-05-19 18:14 -------- d-----w- c:\users\Nathaniel\AppData\Roaming\ArcSoft
2010-05-20 00:16 . 2010-05-20 00:16 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-6\Markup.dll
2010-05-20 00:16 . 2010-05-20 00:16 690952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-7\SpotlightResources.dll
2010-05-20 00:15 . 2010-05-20 00:15 416128 ----a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse-6\NetTVResources.dll
2010-05-20 00:15 . 2009-09-23 02:58 652296 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2010-05-19 18:15 . 2010-05-19 18:15 -------- d-----w- c:\program files\Sanyo
2010-05-19 18:14 . 2010-05-19 18:12 -------- d-----w- c:\program files\Common Files\ArcSoft
2010-05-19 18:14 . 2010-05-19 18:12 -------- d-----w- c:\program files\ArcSoft
2010-04-27 04:49 . 2010-04-27 04:49 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbF392.tmp.exe
2010-04-23 19:43 . 2009-09-23 02:59 690952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-04-23 14:13 . 2010-05-25 19:47 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-16 16:43 . 2010-06-22 20:00 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll
2010-04-16 16:43 . 2010-06-22 20:00 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll
2010-04-16 16:43 . 2010-06-22 20:00 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll
2010-04-16 16:43 . 2010-06-22 20:00 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll
2010-04-08 01:04 . 2009-09-23 02:59 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-04-08 01:04 . 2010-04-08 01:04 690952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-6\SpotlightResources.dll
2010-04-08 01:04 . 2009-09-23 02:59 416128 ----a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2010-04-08 01:04 . 2010-04-08 01:04 652296 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore-5\Microsoft.MediaCenter.Sports.UI.dll
2009-09-18 22:25 . 2009-09-18 22:25 13 --sh--r- c:\windows\System32\drivers\fbd.sys
2009-09-18 22:24 . 2009-09-18 22:24 4 --sh--r- c:\windows\System32\drivers\taishop.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{e4878b45-e2c0-4307-b6e8-734922f92f5b}"= "c:\program files\Road_Runner\tbRoad.dll" [2009-09-08 2260504]

[HKEY_CLASSES_ROOT\clsid\{e4878b45-e2c0-4307-b6e8-734922f92f5b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e4878b45-e2c0-4307-b6e8-734922f92f5b}]
2009-09-08 17:32 2260504 ----a-w- c:\program files\Road_Runner\tbRoad.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{e4878b45-e2c0-4307-b6e8-734922f92f5b}"= "c:\program files\Road_Runner\tbRoad.dll" [2009-09-08 2260504]

[HKEY_CLASSES_ROOT\clsid\{e4878b45-e2c0-4307-b6e8-734922f92f5b}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{E4878B45-E2C0-4307-B6E8-734922F92F5B}"= "c:\program files\Road_Runner\tbRoad.dll" [2009-09-08 2260504]

[HKEY_CLASSES_ROOT\clsid\{e4878b45-e2c0-4307-b6e8-734922f92f5b}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-30 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-07-03 135680]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Steam"="c:\program files\Steam\Steam.exe" [2010-06-11 1238352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-22 61440]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-13 6965792]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-18 1451304]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-03-07 468320]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2009-03-09 55160]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-12-18 448376]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2009-03-23 729088]
"NDSTray.exe"="c:\program files\TOSHIBA\ConfigFree\NDSTray.exe" [2009-05-13 299008]
"cfFncEnabler.exe"="c:\program files\TOSHIBA\ConfigFree\cfFncEnabler.exe" [2009-03-24 16384]
"Teco"="c:\program files\TOSHIBA\TECO\Teco.exe" [2009-04-15 1318912]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe" [2009-03-24 1007616]
"TPCHWMsg"="c:\program files\TOSHIBA\TPHM\TPCHWMsg.exe" [2009-04-09 570736]
"ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-04-01 1283384]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-03-13 1833504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]

c:\users\Nathaniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"VistaSp2"=hex(:12,ab,fe,e3,92,7f,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-03 135664]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-04-22 176128]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-03 20:51]

2010-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-03 20:51]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.rr.com/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Nathaniel\AppData\Roaming\Mozilla\Firefox\Profiles\6i6mazbs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2490311&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://discussions.godandscience.org/index.php
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=60459&p=
FF - component: c:\users\Nathaniel\AppData\Roaming\Mozilla\Firefox\Profiles\6i6mazbs.default\extensions\{336dc353-5272-420c-84e7-ba1f3c9c2aeb}\components\Engine.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-06 12:24
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-07-06 12:29:38
ComboFix-quarantined-files.txt 2010-07-06 19:29

Pre-Run: 183,813,939,200 bytes free
Post-Run: 191,763,402,752 bytes free

- - End Of File - - FBA25078685609F5B98EF3926E7548D4



Okay that is the report I got this time. During the scan, and generation of the report I got 2 notifications from windows about two systems that stopped working, I will post them as well just in case it is important to this, and I will reinstall McAfee.


Product
PEV.exe

Problem
Stopped working

Date
7/6/2010 12:17 PM

Status
Not Reported

Problem signature
Problem Event Name: APPCRASH
Application Name: PEV.exe
Application Version: 0.0.0.0
Application Timestamp: 4bd0e994
Fault Module Name: PEV.exe
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 4bd0e994
Exception Code: 40000015
Exception Offset: 0008d560
OS Version: 6.0.6002.2.2.0.768.3
Locale ID: 1033
Additional Information 1: 6e00
Additional Information 2: 50428c8b02b10d9f186d86925177726f
Additional Information 3: 375f
Additional Information 4: 4352bf9cce35616f6047a7f4d6d575ad

Files that help describe the problem
Version.txt
AppCompat.txt
memory.hdmp
minidump.mdmp



Product
Attribute Utility

Problem
Stopped working

Date
7/6/2010 12:24 PM

Status
Report Sent

Problem signature
Problem Event Name: InPageError
Error Status Code: c0000185
Faulting Media Type: 00000003
OS Version: 6.0.6002.2.2.0.768.3
Locale ID: 1033
Additional Information 1: 0121
Additional Information 2: d0a89b9bfce668a3a35c5529480c602e
Additional Information 3: 7b81
Additional Information 4: ae042d939cca7766d4c734a02846db9b

Extra information about the problem
Bucket ID: 511421

[Nman]

To add to this, I had my Vicki run a scan to see if anything had changed sine I reinstalled McAfee, and while it still stopped, it did find this: So yeah, I need to get around to uninstalling and reinstalling fire fox.... fun She also did some research on ieui.dll and found a site talking about that, and saying how there is a virus that replaces ieui.dll with a fake one. She said it was on uniblue.com, have you ever heard of this? Not sure if any of this is helpful, just trying to help figure this thing out. Good night!