OK - DRAGGED THE CFSCRIPT FILE TO COMBO FIX AND HERE IS THE RESULTS:
ComboFix 10-04-29.04 - Road Queen 04/29/2010 21:45:19.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1919.1184 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Road Queen\Desktop\CFSCRIPT.txt
AV: Trend Micro AntiVirus *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\000641AF.bin
c:\program files\AskBarDis\bar\Cache\0006427A.bin
c:\program files\AskBarDis\bar\Cache\000642E7.bin
c:\program files\AskBarDis\bar\Cache\00064374.bin
c:\program files\AskBarDis\bar\Cache\00064401.bin
c:\program files\AskBarDis\bar\Cache\0006448D.bin
c:\program files\AskBarDis\bar\Cache\000F286E
c:\program files\AskBarDis\bar\Cache\002D1561
c:\program files\AskBarDis\bar\Cache\00E856E1
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\AskLogo.ico
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\bar\Settings\prevCfg2.htm
c:\program files\AskBarDis\PopSwatter\History\notallow
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe
.
((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-30 )))))))))))))))))))))))))))))))
.
2010-04-28 22:05 . 2010-03-30 04:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-28 22:05 . 2010-03-30 04:45 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-26 23:39 . 2010-04-26 23:39 ——– d—–w- c:\program files\ERUNT
2010-04-26 22:55 . 2010-04-26 22:56 ——– d—–w- c:\documents and settings\Guest\Application Data\GetRightToGo
2010-04-26 22:35 . 2010-04-26 22:36 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\IM
2010-04-26 22:32 . 2010-04-26 22:32 ——– d-sh–w- c:\documents and settings\Guest\PrivacIE
2010-04-26 22:32 . 2010-04-26 22:32 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\Yahoo
2010-04-26 22:32 . 2010-04-26 22:32 ——– d—–w- c:\documents and settings\Guest\Application Data\Yahoo!
2010-04-26 22:32 . 2010-04-26 22:32 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\Roxio
2010-04-26 21:01 . 2010-04-26 21:01 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Local Settings\Application Data\Mozilla
2010-04-26 19:03 . 2010-04-26 19:03 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Local Settings\Application Data\Adobe
2010-04-25 23:36 . 2010-04-25 23:36 ——– d-sh–w- c:\documents and settings\MR. WONDERFUL\PrivacIE
2010-04-25 23:34 . 2010-04-25 23:35 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Local Settings\Application Data\IM
2010-04-25 23:34 . 2010-04-25 23:36 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Local Settings\Application Data\Yahoo
2010-04-25 23:34 . 2010-04-25 23:36 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Application Data\Yahoo!
2010-04-25 23:32 . 2010-04-25 23:32 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Application Data\DisplayTune
2010-04-25 23:32 . 2010-04-25 23:32 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Local Settings\Application Data\Roxio
2010-04-25 23:32 . 2010-04-25 23:32 ——– d—–w- c:\documents and settings\MR. WONDERFUL\Application Data\Sonic
2010-04-25 13:38 . 2010-04-25 13:38 ——– d—–w- c:\documents and settings\King of the Road\Local Settings\Application Data\avG
2010-04-25 13:38 . 2010-04-25 13:38 ——– d—–w- c:\documents and settings\All Users\Application Data\avG
2010-04-24 22:00 . 2010-04-24 22:00 297416 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-04-22 01:37 . 2010-04-22 01:37 439816 —-a-w- c:\documents and settings\Road Queen\Application Data\Real\Update\setup3.10\setup.exe
2010-04-19 22:28 . 2010-04-19 22:28 ——– d—–w- c:\documents and settings\King of the Road\Application Data\FoxyTunes
2010-04-19 22:28 . 2010-04-19 22:28 ——– d—–w- c:\program files\FoxyTunes
2010-04-04 17:46 . 2010-04-18 15:41 ——– d—–w- c:\documents and settings\Road Queen\ALL MY MUSIC
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-29 23:52 . 2007-01-22 23:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-04-28 22:05 . 2008-03-06 23:08 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-26 22:31 . 2006-12-25 13:21 ——– d—–w- c:\program files\Web Publish
2010-04-17 19:31 . 2006-12-24 23:14 ——– d—–w- c:\program files\Verizon
2010-03-29 11:43 . 2006-12-24 23:14 ——– d—–w- c:\documents and settings\All Users\Application Data\Motive
2010-03-26 19:37 . 2010-03-26 19:35 ——– d—–w- c:\program files\Common Files\Motive
2010-03-18 00:34 . 2006-12-25 03:52 1080 —-a-w- c:\windows\AUTOLNCH.REG
2010-03-10 06:15 . 2006-06-17 09:23 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-03-07 02:15 . 2010-01-31 19:55 50354 —-a-w- c:\documents and settings\Road Queen\Application Data\Facebook\uninstall.exe
2010-03-07 02:15 . 2010-01-31 19:55 ——– d—–w- c:\documents and settings\Road Queen\Application Data\Facebook
2010-03-06 05:30 . 2010-03-06 05:30 5582848 —-a-w- c:\documents and settings\Road Queen\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-02-25 06:24 . 2006-06-17 09:23 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2006-06-17 09:23 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-19 23:47 . 2010-02-19 23:47 3604480 —-a-w- c:\windows\system32\GPhotos.scr
2010-02-16 14:08 . 2006-06-17 09:23 2146304 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-04 05:59 2024448 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2006-06-17 09:23 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2006-06-17 09:23 226880 —-a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-04 01:29 . 2010-02-04 01:29 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2010-02-04 01:29 . 2010-02-04 01:29 47360 —-a-w- c:\documents and settings\Road Queen\Application Data\pcouffin.sys
2010-02-04 01:29 . 2010-02-04 01:29 47360 —-a-w- c:\documents and settings\Road Queen\Application Data\pcouffin.sys
2009-08-20 22:20 . 2009-08-20 22:18 3571200 –sha-w- c:\program files\ehthumbs.db
2006-12-26 16:09 . 2006-12-26 16:10 13163318 —-a-w- c:\program files\IncrediMail Data.cab
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"iLike"="c:\program files\iLike\1.2.16\ilikesidebar.exe" [2008-09-10 63024]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-04 68856]
"SmileboxTray"="c:\documents and settings\Road Queen\Application Data\Smilebox\SmileboxTray.exe" [2010-01-19 266888]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5244216]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VX3000"="c:\windows\vVX3000.exe" [2006-10-13 707376]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-28 185896]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-14 16010752]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-10 139264]
"QuickTime Task"="c:\program files\QUICKTIME\QTTASK.EXE" [2008-01-05 282624]
"nwiz"="nwiz.exe" [2009-02-18 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2006-10-13 277296]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"CHotkey"="zHotkey.exe" [2004-12-09 550912]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-22 1191936]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 77312]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2005-07-11 1695744]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-03-17 1565696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT GWY"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-25 81920]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2010-01-26 1020248]
c:\documents and settings\Road Queen\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\PrintMaster 16\pmremind.exe [2004-1-20 339968]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-1 111376]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-2-5 54512]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Hello\\Hello.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Babylock\\palette Ver4\\Palmake.exe"=
"c:\\Program Files\\Babylock\\palette Ver4\\Palfutil.exe"=
"c:\\Program Files\\Babylock\\palette Ver4\\Paledit.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\UPnP\\yupnpsrv.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1590:UDP"= 1590:UDP:Windows Media Format SDK (wmplayer.exe)
"1591:UDP"= 1591:UDP:Windows Media Format SDK (wmplayer.exe)
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [3/27/2009 10:27 PM 90112]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [9/10/2009 6:17 PM 36368]
R3 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [9/10/2009 6:38 PM 50704]
R3 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [9/10/2009 6:38 PM 689416]
S2 gupdate1c985a11a9ca53b;Google Update Service (gupdate1c985a11a9ca53b);c:\program files\Google\Update\GoogleUpdate.exe [2/2/2009 9:45 PM 133104]
S3 EraserUtilDrv10741;EraserUtilDrv10741;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10741.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10741.sys [?]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [9/27/2006 5:12 PM 10664]
.
Contents of the 'Scheduled Tasks' folder
2010-04-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2006-12-25 19:19]
2010-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 01:45]
2010-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 01:45]
2008-02-28 c:\windows\Tasks\IncrediMail.job
- c:\progra~1\INCRED~1\bin\IncMail.exe [2006-12-07 22:37]
2010-04-30 c:\windows\Tasks\User_Feed_Synchronization-{5E05261E-1193-4CB6-BCEE-20C057ECD00C}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
2010-04-29 c:\windows\Tasks\User_Feed_Synchronization-{C553D9FA-0964-4A1E-AE14-7E6FD5C03094}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
2010-04-30 c:\windows\Tasks\{A8878FF8-D0B5-4EA3-BFCB-4FEABADB6743}_PIROZZI_Owner.job
- c:\windows\system32\mobsync.exe [2006-06-17 00:12]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.verizon.yahoo.com/?_bc=1
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Add animation to IncrediMail Style Box - c:\program files\IncrediMail\bin\resources\WebMenuImg.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB
FF - ProfilePath - c:\documents and settings\Road Queen\Application Data\Mozilla\Firefox\Profiles\4e89e6pn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://home.verizon.yahoo.com/|http://www.facebook.com/home.php?#!/PeachyDar?ref=profile|http://www.youtube.com/user/PEACHYDAR1#p/u
FF - component: c:\documents and settings\Road Queen\Application Data\Mozilla\Firefox\Profiles\4e89e6pn.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\documents and settings\Road Queen\Application Data\Mozilla\Firefox\Profiles\4e89e6pn.default\extensions\{aed7e1c0-c1e8-4153-a40b-40bb58ba05d9}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Road Queen\Application Data\Mozilla\Firefox\Profiles\4e89e6pn.default\extensions\{aed7e1c0-c1e8-4153-a40b-40bb58ba05d9}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\Road Queen\Application Data\Mozilla\Firefox\Profiles\4e89e6pn.default\extensions\{dc9b3c92-0be4-4089-9aec-5c25b7f3d0c8}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Road Queen\Application Data\Mozilla\Firefox\Profiles\4e89e6pn.default\extensions\{dc9b3c92-0be4-4089-9aec-5c25b7f3d0c8}\components\RadioWMPCore.dll
FF - plugin: c:\documents and settings\Road Queen\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\documents and settings\Road Queen\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\Road Queen\Application Data\Mozilla\Firefox\Profiles\4e89e6pn.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll
FF - plugin: c:\program files\Common Files\Motive\npMotive.dll
FF - plugin: c:\program files\eMusic Download Manager\plugin\npemusic.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
pref(dom.disable_open_during_load, true);c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-04-29 21:54
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_USERS\S-1-5-21-3909265270-4093740595-4061975602-1009\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_0461&Pid_4d16\6&235ebf88&0&0000\LogConf]
@DACL=(02 0000)
.
Completion time: 2010-04-29 21:56:17
ComboFix-quarantined-files.txt 2010-04-30 01:56
ComboFix2.txt 2010-04-30 00:50
Pre-Run: 65,390,493,696 bytes free
Post-Run: 65,374,097,408 bytes free
- - End Of File - - 1D1441C8162BAFE698D31723E3FD4C71
