Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ATTACHMENT INFECTION!?


  • This topic is locked This topic is locked
45 replies to this topic

#1 SpyCatcher*

SpyCatcher*

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 14 September 2013 - 09:09 PM

Hello,

 

Since Tuesday September 10 I’m having some security issues on my Outlook. When I opened Inbox there was an email with an attachment. Next to the attachment was a red mark with the following warning:

 

“Be careful! This sender failed our fraud detection checks.

Show content”

 

I’m still wondering if this “show content” link means: show content of the attachment; or show content of the warning message. I didn’t open it of course!

 

Also I didn’t open the attachment. There was three different links in the heading under my address, which I think were referring to the attachment:

 

Download as a zip, cv my name.doc & view online.

 

Now, besides the above descriptions, I remember very well after opening the message (not the attachment) I began to hear a very subtle noise indicating that the hdd is busy; so I got more suspicious, because my laptop has become 100% silent due to a very recent hardware cleaning. I’m pretty sure this didn’t happen after the cleaning, but I began to hear it most of the time since the moment I opened the email; everything else is working great, and there is no any further indication of infection.

 

MBAM, SAS, Avast & Eset scans were all clean.

 

Originally I posted about this problem in a different forum and was advised to post here, hopefully will get solved because of your great help

 

Original thread:

 

http://www.bleepingcomputer.com/forums/t/507476/infected-email-attachment-scan-remove-software/

 

NOTE:

 

Quotation from dds.txt

 

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

 

Both programs has been removed. AVG more than a year ago, and MSE yesterday!

 

I also don’t understand the so many explicit terms next to FF, e.g.:

 

“Regional Municipality of Peel, Canada – true”

 

 

 

DDS LOG

 

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 10.40.2

Run by Eigenaar at 2:04:28 on 2013-09-15

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: Privatefirewall *Enabled*

.

============== Running Processes ================

.

C:\WINDOWS\System32\wudfhost.exe

C:\Program Files\Privacyware\Privatefirewall 7.0\pfsvc.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\locator.exe

C:\WINDOWS\System32\dllhost.exe

C:\WINDOWS\System32\vssvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\BCMSMMSG.exe

C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Program Files\Privacyware\Privatefirewall 7.0\PFGUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k eapsvcs

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\System32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [ccleaner] "c:\program files\ccleaner\CCleaner.exe" /AUTO

mRun: [IgfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [BCMSMMSG] BCMSMMSG.exe

mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [Privatefirewall] c:\program files\privacyware\privatefirewall 7.0\PFGUI.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\eigenaar\menust~1\progra~1\opstar~1\erunta~1.lnk - c:\windows\erunt\AUTOBACK.EXE

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - <orphaned>

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

.

INFO: HKLM has more than 50 listed domains.

   If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab

TCP: NameServer = 192.168.2.254

TCP: Interfaces\{35751F28-AEA5-4E74-B19B-CA68D7DF5B51} : DHCPNameServer = 192.168.2.254

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\eigenaar\application data\mozilla\firefox\profiles\6szjk2rx.default\

FF - prefs.js: browser.search.selectedEngine - WOT Safe Search

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_8_800_94.dll

FF - plugin: c:\windows\system32\npDeployJava1.dll

FF - plugin: c:\windows\system32\npptools.dll

.

---- FIREFOX POLICIES ----

FF - user.js: accessibility.blockautorefresh - true

FF - user.js: accessibility.typeaheadfind - true

FF - user.js: accessibility.typeaheadfind.flashBar - 0

FF - user.js: app.update.disable_button.showUpdateHistory - false

FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1350688141

FF - user.js: app.update.lastUpdateTime.background-update-timer - 1350688381

FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1350688261

FF - user.js: app.update.lastUpdateTime.browser-cleanup-thumbnails - 1350682697

FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1350668113

FF - user.js: browser.bookmarks.restore_default_bookmarks - false

FF - user.js: browser.cache.disk.capacity - 1048576

FF - user.js: browser.cache.disk.smart_size.first_run - false

FF - user.js: browser.cache.disk.smart_size_cached_value - 552960

FF - user.js: browser.cache.memory.capacity - 16000

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.download.dir - c:\\documents and settings\\eigenaar\\mijn documenten\\security tools 120212\\120902 TOOLS MALWARE

FF - user.js: browser.download.folderList - 2

FF - user.js: browser.download.lastDir - c:\\documents and settings\\eigenaar\\mijn documenten\\security tools 120212\\120902 TOOLS MALWARE

FF - user.js: browser.download.manager.closeWhenDone - true

FF - user.js: browser.download.save_converter_index - 0

FF - user.js: browser.download.useDownloadDir - false

FF - user.js: browser.migration.version - 6

FF - user.js: browser.open.lastDir - c:\\uniserver\\www

FF - user.js: browser.pagethumbnails.storage_version - 2

FF - user.js: browser.places.smartBookmarksVersion - 4

FF - user.js: browser.preferences.advanced.selectedTabIndex - 1

FF - user.js: browser.rights.3.shown - true

FF - user.js: browser.search.selectedEngine - WOT Safe Search

FF - user.js: browser.search.useDBForOrder - true

FF - user.js: browser.startup.homepage_override.buildID - 20121010144125

FF - user.js: browser.startup.homepage_override.mstone - 16.0.1

FF - user.js: browser.syncPromoViewsLeft - 0

FF - user.js: browser.tabs.loadInBackground - false

FF - user.js: browser.tabs.warnOnClose - false

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.default.behavior - 1

FF - user.js: capability.policy.maonoscript.javascript.enabled - allAccess

FF - user.js: capability.policy.maonoscript.sites - addons.mozilla.org addthis.com atdmt.com bbcode.org bitdefender.com bleepingcomputer.com cbsistatic.com cloudfront.net cnet.com cnetstatic.com com.com computer-support.nl computerhope.com crowdscience.com disqus.com dll-files.com drweb.com exponential.com facebook.com facebook.net fbcdn.net feedburner.com firstdata.com firstdata.lv flashgot.net geekstogo.com gigya.com google-analytics.com google.com google.nl googleadservices.com googleapis.com googlesyndication.com googletagservices.com googleusercontent.com gstatic.com hotmail.com informaction.com intellitxt.com ip-adress.com ipaddress.com iperceptions.com jotti.org kaspersky-911.com kaspersky-labs.com kaspersky.com kontera.com literotica.com live.com malwarebytes.org maone.net microsoft.com mozilla.net mozilla.org msn.com netdna-cdn.com noscript.net passport.com passport.net passportimages.com paypal.com paypalobjects.com persona.org piriform.com providesupport.com quantserve.com scorecardresearch.com securecode.com skimresources.com techspot.com trialpay.com twitter.com viglink.com virustotal.com wlxrs.com wordpress.com yahoo.com yahooapis.com yimg.com youtube-nocookie.com youtube.com ytimg.com about: about:addons about:blank about:blocked about:certerror about:config about:crashes about:credits about:home about:memory about:neterror about:plugins about:privatebrowsing about:sessionrestore about:support blob: chrome: file:// hxxp://addthis.com http://atdmt.com http://bbcode.org http://bitdefender.com http://bleepingcomputer.com http://cbsistatic.com http://cloudfront.net http://cnet.com http://cnetstatic.com http://com.com http://computer-support.nl http://computerhope.com http://crowdscience.com http://disqus.com http://dll-files.com http://drweb.com http://exponential.com http://facebook.com http://facebook.net http://fbcdn.net http://feedburner.com http://firstdata.com http://firstdata.lv http://flashgot.net http://geekstogo.com http://gigya.com http://google-analytics.com http://google.com http://google.nl http://googleadservices.com http://googleapis.com http://googlesyndication.com http://googletagservices.com http://googleusercontent.com http://gstatic.com http://hotmail.com http://informaction.com http://intellitxt.com http://ip-adress.com http://ipaddress.com http://iperceptions.com http://jotti.org http://kaspersky-911.com http://kaspersky-labs.com http://kaspersky.com http://kontera.com http://literotica.com http://live.com http://malwarebytes.org http://maone.net http://microsoft.com http://mozilla.net http://mozilla.org http://msn.com http://netdna-cdn.com http://noscript.net http://passport.com http://passport.net http://passportimages.com http://paypal.com http://paypalobjects.com http://persona.org http://piriform.com http://providesupport.com http://quantserve.com http://scorecardresearch.com http://securecode.com http://skimresources.com http://techspot.com http://trialpay.com http://twitter.com http://viglink.com http://virustotal.com http://wlxrs.com http://wordpress.com http://yahoo.com http://yahooapis.com http://yimg.com http://youtube-nocookie.com http://youtube.com http://ytimg.com https://addthis.com https://atdmt.com https://bbcode.org https://bitdefender.com https://bleepingcomputer.com https://cbsistatic.com https://cloudfront.net https://cnet.com https://cnetstatic.com https://com.com https://computer-support.nl https://computerhope.com https://crowdscience.com https://disqus.com https://dll-files.com https://drweb.com https://exponential.com https://facebook.com https://facebook.net https://fbcdn.net https://feedburner.com https://firstdata.com https://firstdata.lv https://flashgot.net https://geekstogo.com https://gigya.com https://google-analytics.com https://google.com https://google.nl https://googleadservices.com https://googleapis.com https://googlesyndication.com https://googletagservices.com https://googleusercontent.com https://gstatic.com https://hotmail.com https://informaction.com https://intellitxt.com https://ip-adress.com https://ipaddress.com https://iperceptions.com https://jotti.org https://kaspersky-911.com https://kaspersky-labs.com https://kaspersky.com https://kontera.com https://literotica.com https://live.com https://malwarebytes.org https://maone.net https://microsoft.com https://mozilla.net https://mozilla.org https://msn.com https://netdna-cdn.com https://noscript.net https://passport.com https://passport.net https://passportimages.com https://paypal.com https://paypalobjects.com https://persona.org https://piriform.com https://providesupport.com https://quantserve.com https://scorecardresearch.com https://securecode.com https://skimresources.com https://techspot.com https://trialpay.com https://twitter.com https://viglink.com https://virustotal.com https://wlxrs.com https://wordpress.com https://yahoo.com https://yahooapis.com https://yimg.com https://youtube-nocookie.com https://youtube.com https://ytimg.com resource:

FF - user.js: content.max.tokenizing.time - 3000000

FF - user.js: content.maxtextrun - 4095

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 1000000

FF - user.js: dom.disable_window_flip - false

FF - user.js: dom.max_chrome_script_run_time - 0

FF - user.js: extensions.adblockplus.currentVersion - 2.1.2

FF - user.js: extensions.bdqscan.lastActionDate - 1350483556821

FF - user.js: extensions.bdqscan.lastScanDate - 1350483556821

FF - user.js: extensions.blocklist.pingCountTotal - 237

FF - user.js: extensions.blocklist.pingCountVersion - 7

FF - user.js: extensions.bootstrappedAddons - {\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\version\:\2.1.2\,\type\:\extension\,\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\}}

FF - user.js: extensions.bprivacy.AutoDelLSOnExitMode - 1

FF - user.js: extensions.bprivacy.AutoDelLSOnStart - true

FF - user.js: extensions.bprivacy.DataDir - f:\\Better Privacy111231

FF - user.js: extensions.bprivacy.DefaultFlashCookieDeletion - true

FF - user.js: extensions.bprivacy.NotifyOnNewLSO - 1

FF - user.js: extensions.bprivacy.initiated - 3

FF - user.js: extensions.bprivacy.keycode - 122

FF - user.js: extensions.bprivacy.lastSession - zaterdag 15 september 2012 12:16:16

FF - user.js: extensions.bprivacy.removed - 211

FF - user.js: extensions.bprivacy.timer - Sat Oct 20 2012 01:07:07 GMT+0200

FF - user.js: extensions.bprivacy.useDelTimer - true

FF - user.js: extensions.databaseSchema - 13

FF - user.js: extensions.enabledAddons - {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.68,{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20120926,{6614d11d-d21d-b211-ae23-815234e1ebb5}:2.7.0,{27c60876-b5c9-4335-b4f3-52b26782220c}:0.9.4,{e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.119,{73a6fe31-595d-460b-a920-fcc0f8843232}:2.5.8,{972ce4c6-7e08-4474-a285-3208198ce6fd}:16.0.1

FF - user.js: extensions.hotfix.lastVersion - 20120430.01

FF - user.js: extensions.https_everywhere.1&1 Internet - true

FF - user.js: extensions.https_everywhere.100-gute-gruende.de - true

FF - user.js: extensions.https_everywhere.1177.se - true

FF - user.js: extensions.https_everywhere.123-Reg - true

FF - user.js: extensions.https_everywhere.123systems - true

FF - user.js: extensions.https_everywhere.1NightStandStory - true

FF - user.js: extensions.https_everywhere.1time.co.za - true

FF - user.js: extensions.https_everywhere.2020mobile - true

FF - user.js: extensions.https_everywhere.2o7.net - true

FF - user.js: extensions.https_everywhere.33Bits - false

FF - user.js: extensions.https_everywhere.37Signals - true

FF - user.js: extensions.https_everywhere.38.de - true

FF - user.js: extensions.https_everywhere.3min - true

FF - user.js: extensions.https_everywhere.4Shared (buggy) - false

FF - user.js: extensions.https_everywhere.4sevens - true

FF - user.js: extensions.https_everywhere.7chan - true

FF - user.js: extensions.https_everywhere.99.se - true

FF - user.js: extensions.https_everywhere.ABIS-Studien.se - true

FF - user.js: extensions.https_everywhere.ABN AMRO Bank - true

FF - user.js: extensions.https_everywhere.ACLU of North Carolina - true

FF - user.js: extensions.https_everywhere.ACLU of Southern California - true

FF - user.js: extensions.https_everywhere.ACM.org - true

FF - user.js: extensions.https_everywhere.AJC.com - true

FF - user.js: extensions.https_everywhere.AK-Vorrat - true

FF - user.js: extensions.https_everywhere.ANB - true

FF - user.js: extensions.https_everywhere.ANZ - true

FF - user.js: extensions.https_everywhere.AOK - true

FF - user.js: extensions.https_everywhere.AOL (partial) - true

FF - user.js: extensions.https_everywhere.ATBank - true

FF - user.js: extensions.https_everywhere.Aaai.org - true

FF - user.js: extensions.https_everywhere.Abbo-shop.ch - true

FF - user.js: extensions.https_everywhere.AbcLinuxu - true

FF - user.js: extensions.https_everywhere.AbeBooks - true

FF - user.js: extensions.https_everywhere.AboutMe (broken) - false

FF - user.js: extensions.https_everywhere.AboutMe - true

FF - user.js: extensions.https_everywhere.Abuse.ch - true

FF - user.js: extensions.https_everywhere.AccessNow.org - true

FF - user.js: extensions.https_everywhere.Accessibility.nl - true

FF - user.js: extensions.https_everywhere.Accessible Information Management (gunadiframework.com) - true

FF - user.js: extensions.https_everywhere.Act.demandprogress.org - true

FF - user.js: extensions.https_everywhere.Actel.com - true

FF - user.js: extensions.https_everywhere.AdaFruit - true

FF - user.js: extensions.https_everywhere.AdblockPlus - true

FF - user.js: extensions.https_everywhere.Adbrite - true

FF - user.js: extensions.https_everywhere.AddBooks.se - true

FF - user.js: extensions.https_everywhere.AddThis - true

FF - user.js: extensions.https_everywhere.AddToAny - true

FF - user.js: extensions.https_everywhere.Adlibris/Capris - true

FF - user.js: extensions.https_everywhere.Adobe - true

FF - user.js: extensions.https_everywhere.Adoyacademy.se - true

FF - user.js: extensions.https_everywhere.Adtech.de - true

FF - user.js: extensions.https_everywhere.Adversary - false

FF - user.js: extensions.https_everywhere.Aea.se - true

FF - user.js: extensions.https_everywhere.Aer Lingus (testing) - false

FF - user.js: extensions.https_everywhere.Aeriagames - true

FF - user.js: extensions.https_everywhere.Afford.com - true

FF - user.js: extensions.https_everywhere.Aftenposten - true

FF - user.js: extensions.https_everywhere.Agnitum - true

FF - user.js: extensions.https_everywhere.Ahnlab - true

FF - user.js: extensions.https_everywhere.Ai.Hitbox.com - true

FF - user.js: extensions.https_everywhere.Air Asia - true

FF - user.js: extensions.https_everywhere.AirshipVentures - true

FF - user.js: extensions.https_everywhere.Airtricity - true

FF - user.js: extensions.https_everywhere.AkademikerFörsäkring.se - true

FF - user.js: extensions.https_everywhere.Akismet - true

FF - user.js: extensions.https_everywhere.Alaska Airlines - true

FF - user.js: extensions.https_everywhere.Aldi - Germany - true

FF - user.js: extensions.https_everywhere.Alex.se - true

FF - user.js: extensions.https_everywhere.AliceDSL - true

FF - user.js: extensions.https_everywhere.All-inkl.com - true

FF - user.js: extensions.https_everywhere.AllThingsD - true

FF - user.js: extensions.https_everywhere.Allegro - false

FF - user.js: extensions.https_everywhere.AlliedModders forum - true

FF - user.js: extensions.https_everywhere.Allingsas.se - true

FF - user.js: extensions.https_everywhere.Alternate - true

FF - user.js: extensions.https_everywhere.AltonTowers (broken) - false

FF - user.js: extensions.https_everywhere.AltonTowers - true

FF - user.js: extensions.https_everywhere.Amahi.org - true

FF - user.js: extensions.https_everywhere.Amazon (buggy) - false

FF - user.js: extensions.https_everywhere.Amazon Web Services - true

FF - user.js: extensions.https_everywhere.Ambx.com - true

FF - user.js: extensions.https_everywhere.American Airlines - true

FF - user.js: extensions.https_everywhere.American Epilepsy Society (partial) - true

FF - user.js: extensions.https_everywhere.American Foundation for Suicide Prevention - true

FF - user.js: extensions.https_everywhere.AmericanExpress - true

FF - user.js: extensions.https_everywhere.Americana Exchange - true

FF - user.js: extensions.https_everywhere.Amerika21.de - false

FF - user.js: extensions.https_everywhere.Amnesty-International - true

FF - user.js: extensions.https_everywhere.An Post - true

FF - user.js: extensions.https_everywhere.AnarchistNews.org - false

FF - user.js: extensions.https_everywhere.Android - true

FF - user.js: extensions.https_everywhere.Androidpolice - true

FF - user.js: extensions.https_everywhere.Animenfo.com - true

FF - user.js: extensions.https_everywhere.AnnualCreditReport.com - true

FF - user.js: extensions.https_everywhere.Ansa.it - true

FF - user.js: extensions.https_everywhere.AntiSpam e.V. - true

FF - user.js: extensions.https_everywhere.Anybeat - true

FF - user.js: extensions.https_everywhere.Apache - true

FF - user.js: extensions.https_everywhere.Apoteket.se - true

FF - user.js: extensions.https_everywhere.Apple.com (partial) - true

FF - user.js: extensions.https_everywhere.Applebee's - true

FF - user.js: extensions.https_everywhere.April.org - true

FF - user.js: extensions.https_everywhere.Arbeitsagentur.de - true

FF - user.js: extensions.https_everywhere.Arch Linux - true

FF - user.js: extensions.https_everywhere.ArchiveOfOurOwn - true

FF - user.js: extensions.https_everywhere.Archos.com - true

FF - user.js: extensions.https_everywhere.Argos - true

FF - user.js: extensions.https_everywhere.Arlanda.se - true

FF - user.js: extensions.https_everywhere.Assembla - true

FF - user.js: extensions.https_everywhere.Asterisk - true

FF - user.js: extensions.https_everywhere.Atheists.org - true

FF - user.js: extensions.https_everywhere.Atlassian - true

FF - user.js: extensions.https_everywhere.Atomicorp - true

FF - user.js: extensions.https_everywhere.Attendesource.com - false

FF - user.js: extensions.https_everywhere.Attention Deficit Disorders Association - Southern Region - true

FF - user.js: extensions.https_everywhere.Audible.de - true

FF - user.js: extensions.https_everywhere.Australian Koala Foundation - true

FF - user.js: extensions.https_everywhere.Austrian Airlines - true

FF - user.js: extensions.https_everywhere.Authorize.Net - true

FF - user.js: extensions.https_everywhere.Autistici/inventati - false

FF - user.js: extensions.https_everywhere.Avaaz - true

FF - user.js: extensions.https_everywhere.Avadirect - true

FF - user.js: extensions.https_everywhere.Avanza.se - true

FF - user.js: extensions.https_everywhere.Avast - true

FF - user.js: extensions.https_everywhere.Avira - true

FF - user.js: extensions.https_everywhere.Avropa.se - true

FF - user.js: extensions.https_everywhere.Azingsport.se - true

FF - user.js: extensions.https_everywhere.BKK-Advita - true

FF - user.js: extensions.https_everywhere.BKW-FMB.ch - true

FF - user.js: extensions.https_everywhere.BT - true

FF - user.js: extensions.https_everywhere.BTCGuild.com - true

FF - user.js: extensions.https_everywhere.BTH.se - true

FF - user.js: extensions.https_everywhere.BTunnel - true

FF - user.js: extensions.https_everywhere.Backupify - true

FF - user.js: extensions.https_everywhere.Badoo.com - true

FF - user.js: extensions.https_everywhere.Badwarebusters.org - true

FF - user.js: extensions.https_everywhere.Bagatoo.se - true

FF - user.js: extensions.https_everywhere.Bahn-BKK - true

FF - user.js: extensions.https_everywhere.Bahn.de - true

FF - user.js: extensions.https_everywhere.Balatarin - true

FF - user.js: extensions.https_everywhere.Baldershage.se - true

FF - user.js: extensions.https_everywhere.Balkongshoppen.se - true

FF - user.js: extensions.https_everywhere.Bandcamp (buggy) - false

FF - user.js: extensions.https_everywhere.Bandcamp - true

FF - user.js: extensions.https_everywhere.BankOfNewZeland - true

FF - user.js: extensions.https_everywhere.Bankofscotland.de - true

FF - user.js: extensions.https_everywhere.Barclays - true

FF - user.js: extensions.https_everywhere.Barmer-GEK - true

FF - user.js: extensions.https_everywhere.Barnes and Noble (partial) - true

FF - user.js: extensions.https_everywhere.Barnes and Noble - true

FF - user.js: extensions.https_everywhere.Barnskospecialisten.se - true

FF - user.js: extensions.https_everywhere.Belpino.se - true

FF - user.js: extensions.https_everywhere.Bendigo Bank - true

FF - user.js: extensions.https_everywhere.Bergens Tidende - false

FF - user.js: extensions.https_everywhere.Berklee College of Music - true

FF - user.js: extensions.https_everywhere.BerliOS - false

FF - user.js: extensions.https_everywhere.Berlin.de - true

FF - user.js: extensions.https_everywhere.Bhiab.se - true

FF - user.js: extensions.https_everywhere.BinRev - true

FF - user.js: extensions.https_everywhere.BinSearch - true

FF - user.js: extensions.https_everywhere.BinaryTurf - true

FF - user.js: extensions.https_everywhere.Binero.se - true

FF - user.js: extensions.https_everywhere.Birthprint - true

FF - user.js: extensions.https_everywhere.BitBucket - true

FF - user.js: extensions.https_everywhere.Bitcoin - false

FF - user.js: extensions.https_everywhere.Black Night - true

FF - user.js: extensions.https_everywhere.BlackHat - true

FF - user.js: extensions.https_everywhere.BlameStella - true

FF - user.js: extensions.https_everywhere.Blau.de - true

FF - user.js: extensions.https_everywhere.Blekko - true

FF - user.js: extensions.https_everywhere.Blip (broken) - false

FF - user.js: extensions.https_everywhere.Blip - true

FF - user.js: extensions.https_everywhere.Blipp.com - true

FF - user.js: extensions.https_everywhere.BlockBuster UK - true

FF - user.js: extensions.https_everywhere.BlockExplorer.com - true

FF - user.js: extensions.https_everywhere.Blocket.se - true

FF - user.js: extensions.https_everywhere.Bloglines - true

FF - user.js: extensions.https_everywhere.BlueCoat - true

FF - user.js: extensions.https_everywhere.BlueHost - true

FF - user.js: extensions.https_everywhere.Bmibaby.com - true

FF - user.js: extensions.https_everywhere.Boards.ie - true

FF - user.js: extensions.https_everywhere.Bodum - true

FF - user.js: extensions.https_everywhere.Boe.es - true

FF - user.js: extensions.https_everywhere.Boell.de - true

FF - user.js: extensions.https_everywhere.BofA (buggy) - false

FF - user.js: extensions.https_everywhere.BofA - true

FF - user.js: extensions.https_everywhere.Boinc - true

FF - user.js: extensions.https_everywhere.Bokborgen.se - true

FF - user.js: extensions.https_everywhere.Bokelskere - true

FF - user.js: extensions.https_everywhere.Bolagsverket.se - true

FF - user.js: extensions.https_everywhere.Boltbus.com - true

FF - user.js: extensions.https_everywhere.BookMyName - true

FF - user.js: extensions.https_everywhere.Booking.com - true

FF - user.js: extensions.https_everywhere.Booklog.jp - true

FF - user.js: extensions.https_everywhere.Bookworm - true

FF - user.js: extensions.https_everywhere.Bothar - true

FF - user.js: extensions.https_everywhere.BoxUK - true

FF - user.js: extensions.https_everywhere.Boxee.tv - true

FF - user.js: extensions.https_everywhere.Brainbench - true

FF - user.js: extensions.https_everywhere.Braunschweig - true

FF - user.js: extensions.https_everywhere.Brigham Young University (partial) - true

FF - user.js: extensions.https_everywhere.Britcoin.co.uk - true

FF - user.js: extensions.https_everywhere.BritishAirways - true

FF - user.js: extensions.https_everywhere.Broadband Reports - true

FF - user.js: extensions.https_everywhere.BrowserShots - true

FF - user.js: extensions.https_everywhere.Buckyballs - true

FF - user.js: extensions.https_everywhere.Budgetgolf.se - true

FF - user.js: extensions.https_everywhere.BufferedIO - false

FF - user.js: extensions.https_everywhere.BuisnessInsider (broken) - false

FF - user.js: extensions.https_everywhere.BuisnessInsider - true

FF - user.js: extensions.https_everywhere.BulbMan - true

FF - user.js: extensions.https_everywhere.BulkSMS - true

FF - user.js: extensions.https_everywhere.Bullguard - true

FF - user.js: extensions.https_everywhere.Bungie - true

FF - user.js: extensions.https_everywhere.Bunkus.org - true

FF - user.js: extensions.https_everywhere.Bussgods.se - true

FF - user.js: extensions.https_everywhere.C-Base - true

FF - user.js: extensions.https_everywhere.CA-PCR.fr - true

FF - user.js: extensions.https_everywhere.CACert.org - false

FF - user.js: extensions.https_everywhere.CDT - true

FF - user.js: extensions.https_everywhere.CDW and CDW-G - true

FF - user.js: extensions.https_everywhere.CERT.fi - true

FF - user.js: extensions.https_everywhere.CERT.se - true

FF - user.js: extensions.https_everywhere.CHL.it - true

FF - user.js: extensions.https_everywhere.CIA Cybersurf - true

FF - user.js: extensions.https_everywhere.CIBC - true

FF - user.js: extensions.https_everywhere.CIO.com.au - true

FF - user.js: extensions.https_everywhere.CJ - true

FF - user.js: extensions.https_everywhere.CMSWire - true

FF - user.js: extensions.https_everywhere.CPJ - true

FF - user.js: extensions.https_everywhere.CPSC.gov - true

FF - user.js: extensions.https_everywhere.CRM Metrix - true

FF - user.js: extensions.https_everywhere.CSAF - false

FF - user.js: extensions.https_everywhere.CSIS.dk - true

FF - user.js: extensions.https_everywhere.CSRSupport.com - true

FF - user.js: extensions.https_everywhere.CTunnel - true

FF - user.js: extensions.https_everywhere.CVI Melles Griot - true

FF - user.js: extensions.https_everywhere.CaceTech - true

FF - user.js: extensions.https_everywhere.Caisse d'Epargne - true

FF - user.js: extensions.https_everywhere.California STD/HIV Prevention Training Center (partial) - true

FF - user.js: extensions.https_everywhere.Caltech - true

FF - user.js: extensions.https_everywhere.Calum - true

FF - user.js: extensions.https_everywhere.Cam.ac.uk - true

FF - user.js: extensions.https_everywhere.Campact.de - true

FF - user.js: extensions.https_everywhere.Canada Post - true

FF - user.js: extensions.https_everywhere.Canadian Lung Association - true

FF - user.js: extensions.https_everywhere.CanalDigital - true

FF - user.js: extensions.https_everywhere.Canv.as - true

FF - user.js: extensions.https_everywhere.Carnegie Mellon School of Computer Science - true

FF - user.js: extensions.https_everywhere.Cdon.se - true

FF - user.js: extensions.https_everywhere.Celiac Disease Foundation - true

FF - user.js: extensions.https_everywhere.Censorship.govt.nz - true

FF - user.js: extensions.https_everywhere.Centos - true

FF - user.js: extensions.https_everywhere.Cert - true

FF - user.js: extensions.https_everywhere.Change.org - true

FF - user.js: extensions.https_everywhere.Changemakers - true

FF - user.js: extensions.https_everywhere.Charity Wings - true

FF - user.js: extensions.https_everywhere.Charlotte Nature Museum - true

FF - user.js: extensions.https_everywhere.Chase - true

FF - user.js: extensions.https_everywhere.CheapSSLs - true

FF - user.js: extensions.https_everywhere.Check Point - true

FF - user.js: extensions.https_everywhere.Check24.de - true

FF - user.js: extensions.https_everywhere.ChillingEffects - true

FF - user.js: extensions.https_everywhere.Chromium.org - true

FF - user.js: extensions.https_everywhere.Chronicle - true

FF - user.js: extensions.https_everywhere.Cia.vc - false

FF - user.js: extensions.https_everywhere.Cisco - false

FF - user.js: extensions.https_everywhere.CiteULike - true

FF - user.js: extensions.https_everywhere.Citibank (testing) - false

FF - user.js: extensions.https_everywhere.CitizensInformation - true

FF - user.js: extensions.https_everywhere.Citrix - true

FF - user.js: extensions.https_everywhere.City of Portland, OR - true

FF - user.js: extensions.https_everywhere.Clasohlson.se - true

FF - user.js: extensions.https_everywhere.Clickbank.com - true

FF - user.js: extensions.https_everywhere.Cloudflare - true

FF - user.js: extensions.https_everywhere.Cloudfront - true

FF - user.js: extensions.https_everywhere.Codecoop (CACert) - false

FF - user.js: extensions.https_everywhere.Codeplex - true

FF - user.js: extensions.https_everywhere.CodingTeam - true

FF - user.js: extensions.https_everywhere.CollegiateLink (partial) - true

FF - user.js: extensions.https_everywhere.Colorado State Attorney General - true

FF - user.js: extensions.https_everywhere.CommonDreams - true

FF - user.js: extensions.https_everywhere.CommuniGate - true

FF - user.js: extensions.https_everywhere.Comodo (Partial) - true

FF - user.js: extensions.https_everywhere.CompaniesHouse - true

FF - user.js: extensions.https_everywhere.CompaniesInTheUK - true

FF - user.js: extensions.https_everywhere.CompareTheMarket - true

FF - user.js: extensions.https_everywhere.Comparis.ch - true

FF - user.js: extensions.https_everywhere.ComputerWorld - true

FF - user.js: extensions.https_everywhere.Comviq.se - true

FF - user.js: extensions.https_everywhere.Connect.me - true

FF - user.js: extensions.https_everywhere.Consumer Reports - true

FF - user.js: extensions.https_everywhere.Continental - true

FF - user.js: extensions.https_everywhere.Coop.ch - true

FF - user.js: extensions.https_everywhere.Coop.no - true

FF - user.js: extensions.https_everywhere.Cotse.net - true

FF - user.js: extensions.https_everywhere.Couchsurfing - true

FF - user.js: extensions.https_everywhere.Countquest.se - true

FF - user.js: extensions.https_everywhere.Courage Campaign - true

FF - user.js: extensions.https_everywhere.CreateSpace - true

FF - user.js: extensions.https_everywhere.Creative Commons - true

FF - user.js: extensions.https_everywhere.Crucial.com (partial) - true

FF - user.js: extensions.https_everywhere.Crypto.is - true

FF - user.js: extensions.https_everywhere.CryptoSMS - false

FF - user.js: extensions.https_everywhere.Cs.arizona.edu - true

FF - user.js: extensions.https_everywhere.Ctt - true

FF - user.js: extensions.https_everywhere.Cultura Sparebank - true

FF - user.js: extensions.https_everywhere.Curvehost - true

FF - user.js: extensions.https_everywhere.Cykloteket.se - true

FF - user.js: extensions.https_everywhere.D.S.V. Sint Jansbrug - true

FF - user.js: extensions.https_everywhere.DAB Bank - true

FF - user.js: extensions.https_everywhere.DALnet - true

FF - user.js: extensions.https_everywhere.DHL.de - true

FF - user.js: extensions.https_everywhere.DMU - true

FF - user.js: extensions.https_everywhere.DTunnel - true

FF - user.js: extensions.https_everywhere.DVDFab - false

FF - user.js: extensions.https_everywhere.DaLinuxFrenchPage - true

FF - user.js: extensions.https_everywhere.Daft.ie - false

FF - user.js: extensions.https_everywhere.Daily - true

FF - user.js: extensions.https_everywhere.Dailykos - true

FF - user.js: extensions.https_everywhere.DataCenterKnowledge.com - true

FF - user.js: extensions.https_everywhere.Datatilsynet - true

FF - user.js: extensions.https_everywhere.Deaconess Health System - true

FF - user.js: extensions.https_everywhere.Deal Extreme - true

FF - user.js: extensions.https_everywhere.Debian - false

FF - user.js: extensions.https_everywhere.DebianLists - false

FF - user.js: extensions.https_everywhere.Decdna.net - true

FF - user.js: extensions.https_everywhere.Deco.proteste.pt - true

FF - user.js: extensions.https_everywhere.Deepbit.net - true

FF - user.js: extensions.https_everywhere.Defcon - true

FF - user.js: extensions.https_everywhere.Delicious - true

FF - user.js: extensions.https_everywhere.Delico.se - true

FF - user.js: extensions.https_everywhere.Dell - true

FF - user.js: extensions.https_everywhere.Delta.no - true

FF - user.js: extensions.https_everywhere.DemocracyInAction - true

FF - user.js: extensions.https_everywhere.DemocracyNow - true

FF - user.js: extensions.https_everywhere.Demonoid - true

FF - user.js: extensions.https_everywhere.Dephormation.org.uk - true

FF - user.js: extensions.https_everywhere.DepositProtection - true

FF - user.js: extensions.https_everywhere.Der Freitag - false

FF - user.js: extensions.https_everywhere.Deutsche BKK - true

FF - user.js: extensions.https_everywhere.Deutsche Kreditbank - true

FF - user.js: extensions.https_everywhere.Develop-online.net - true

FF - user.js: extensions.https_everywhere.DeviantArt (pending) - false

FF - user.js: extensions.https_everywhere.Deviantart - true

FF - user.js: extensions.https_everywhere.Devstructure - true

FF - user.js: extensions.https_everywhere.Dfri.se - true

FF - user.js: extensions.https_everywhere.Diagonalperiodico.net - true

FF - user.js: extensions.https_everywhere.Diasp.org - true

FF - user.js: extensions.https_everywhere.Diaspora - true

FF - user.js: extensions.https_everywhere.Die-Linke.de - true

FF - user.js: extensions.https_everywhere.Die.net - true

FF - user.js: extensions.https_everywhere.DigiCert - true

FF - user.js: extensions.https_everywhere.DigitalForensicsMagazine - true

FF - user.js: extensions.https_everywhere.Digitalegesellschaft - true

FF - user.js: extensions.https_everywhere.Digitec.ch - true

FF - user.js: extensions.https_everywhere.DigiumEnterprise.com - true

FF - user.js: extensions.https_everywhere.DirectSpace - true

FF - user.js: extensions.https_everywhere.Directbox - true

FF - user.js: extensions.https_everywhere.Disability.gov - true

FF - user.js: extensions.https_everywhere.Discovery Place - true

FF - user.js: extensions.https_everywhere.Diskusjon - true

FF - user.js: extensions.https_everywhere.Disqus (unreliable) - false

FF - user.js: extensions.https_everywhere.Disqus - true

FF - user.js: extensions.https_everywhere.Ditt Distrikt - true

FF - user.js: extensions.https_everywhere.DjurRattsAlliansen.se - true

FF - user.js: extensions.https_everywhere.DnB Nor - true

FF - user.js: extensions.https_everywhere.Dnsexit - true

FF - user.js: extensions.https_everywhere.DoctorsWithoutBorders.org - true

FF - user.js: extensions.https_everywhere.Document.no - true

FF - user.js: extensions.https_everywhere.DocumentCloud - true

FF - user.js: extensions.https_everywhere.Dopplr.com - true

FF - user.js: extensions.https_everywhere.DotBit - false

FF - user.js: extensions.https_everywhere.Dotster - true

FF - user.js: extensions.https_everywhere.Doubleclick.net (disabled) - false

FF - user.js: extensions.https_everywhere.Dr.Web - true

FF - user.js: extensions.https_everywhere.DreamHost (partial) - true

FF - user.js: extensions.https_everywhere.Dreamwidth - false

FF - user.js: extensions.https_everywhere.DropDav - true

FF - user.js: extensions.https_everywhere.Dropbox - true

FF - user.js: extensions.https_everywhere.Drupal - true

FF - user.js: extensions.https_everywhere.Drwho.virtadpt.net (self-signed) - false

FF - user.js: extensions.https_everywhere.DuckDuckGo - true

FF - user.js: extensions.https_everywhere.DynaDot - true

FF - user.js: extensions.https_everywhere.Dynamo Dresden - true

FF - user.js: extensions.https_everywhere.ED.gov (partial) - true

FF - user.js: extensions.https_everywhere.ED.gov - true

FF - user.js: extensions.https_everywhere.EDP.pt - true

FF - user.js: extensions.https_everywhere.EFF - true

FF - user.js: extensions.https_everywhere.ELENA - true

FF - user.js: extensions.https_everywhere.EPA (.ie) - true

FF - user.js: extensions.https_everywhere.EPEAT - true

FF - user.js: extensions.https_everywhere.EPIC - true

FF - user.js: extensions.https_everywhere.ESB.ie - true

FF - user.js: extensions.https_everywhere.ESISS - true

FF - user.js: extensions.https_everywhere.ESRB - true

FF - user.js: extensions.https_everywhere.ETS - true

FF - user.js: extensions.https_everywhere.ETegro Technologies (default off) - false

FF - user.js: extensions.https_everywhere.EZTV - true

FF - user.js: extensions.https_everywhere.EarthLink (partial) - false

FF - user.js: extensions.https_everywhere.EasyNews - true

FF - user.js: extensions.https_everywhere.Ebi.ac.uk - true

FF - user.js: extensions.https_everywhere.Economist (broken) - false

FF - user.js: extensions.https_everywhere.Economist - true

FF - user.js: extensions.https_everywhere.EdUbuntu - true

FF - user.js: extensions.https_everywhere.Edas.info - true

FF - user.js: extensions.https_everywhere.Egg - true

FF - user.js: extensions.https_everywhere.Elgiganten.se - true

FF - user.js: extensions.https_everywhere.Emediate.eu - true

FF - user.js: extensions.https_everywhere.Employeeexpress.gov - true

FF - user.js: extensions.https_everywhere.Emsisoft - true

FF - user.js: extensions.https_everywhere.Encosia - true

FF - user.js: extensions.https_everywhere.EnergyStar - true

FF - user.js: extensions.https_everywhere.Eniro.se - true

FF - user.js: extensions.https_everywhere.Enom - true

FF - user.js: extensions.https_everywhere.Epilepsy Foundation of America - true

FF - user.js: extensions.https_everywhere.Epilepsy Ontario - true

FF - user.js: extensions.https_everywhere.Epson.com (partial) - true

FF - user.js: extensions.https_everywhere.EquifaxCanada - false

FF - user.js: extensions.https_everywhere.Erowid - true

FF - user.js: extensions.https_everywhere.Euro-ix.net - true

FF - user.js: extensions.https_everywhere.Europa.eu - true

FF - user.js: extensions.https_everywhere.Eventbrite - true

FF - user.js: extensions.https_everywhere.Evernote - true

FF - user.js: extensions.https_everywhere.EzineArticles - true

FF - user.js: extensions.https_everywhere.F-Secure (default off) - false

FF - user.js: extensions.https_everywhere.F-Secure - true

FF - user.js: extensions.https_everywhere.FAAN College Network - true

FF - user.js: extensions.https_everywhere.FAS.org - true

FF - user.js: extensions.https_everywhere.FAZ (broken) - false

FF - user.js: extensions.https_everywhere.FAZ - true

FF - user.js: extensions.https_everywhere.FB18_Forum - true

FF - user.js: extensions.https_everywhere.FFMPEG - false

FF - user.js: extensions.https_everywhere.FHI.se - true

FF - user.js: extensions.https_everywhere.FHS.se - true

FF - user.js: extensions.https_everywhere.FMV.se - true

FF - user.js: extensions.https_everywhere.FSDN.com - true

FF - user.js: extensions.https_everywhere.FSFE.org - true

FF - user.js: extensions.https_everywhere.FTD.de - true

FF - user.js: extensions.https_everywhere.Facebook Apps - true

FF - user.js: extensions.https_everywhere.Facebook - true

FF - user.js: extensions.https_everywhere.Facebook+ (may break apps) - false

FF - user.js: extensions.https_everywhere.Fanboy - true

FF - user.js: extensions.https_everywhere.Farmaciforbundet.se - true

FF - user.js: extensions.https_everywhere.Fass.se - true

FF - user.js: extensions.https_everywhere.Fastly - true

FF - user.js: extensions.https_everywhere.Fastmail - true

FF - user.js: extensions.https_everywhere.Fedora Project - true

FF - user.js: extensions.https_everywhere.FeeFighters - true

FF - user.js: extensions.https_everywhere.FeedMyInbox - true

FF - user.js: extensions.https_everywhere.Fefe - true

FF - user.js: extensions.https_everywhere.Feide - true

FF - user.js: extensions.https_everywhere.Feross - true

FF - user.js: extensions.https_everywhere.FetLife - true

FF - user.js: extensions.https_everywhere.Fianna Fail - true

FF - user.js: extensions.https_everywhere.Fibank - true

FF - user.js: extensions.https_everywhere.Fifth Third Bank - true

FF - user.js: extensions.https_everywhere.Finn - true

FF - user.js: extensions.https_everywhere.FirstGiving - true

FF - user.js: extensions.https_everywhere.Fiskeriverket.se - true

FF - user.js: extensions.https_everywhere.FitBit - true

FF - user.js: extensions.https_everywhere.FiveTV - true

FF - user.js: extensions.https_everywhere.Flashback.org - true

FF - user.js: extensions.https_everywhere.Flattr - true

FF - user.js: extensions.https_everywhere.Flickr (partial) - true

FF - user.js: extensions.https_everywhere.Flossmanuals - true

FF - user.js: extensions.https_everywhere.FluxBB.org - true

FF - user.js: extensions.https_everywhere.Focus.de - true

FF - user.js: extensions.https_everywhere.FoeBuD e.V. - true

FF - user.js: extensions.https_everywhere.Fokus Bank - true

FF - user.js: extensions.https_everywhere.Folksam.se - true

FF - user.js: extensions.https_everywhere.FooFighters - true

FF - user.js: extensions.https_everywhere.Food Allergy & Anaphylaxis Network - true

FF - user.js: extensions.https_everywhere.Food Allergy Initiative - true

FF - user.js: extensions.https_everywhere.Forbrukerraadet - true

FF - user.js: extensions.https_everywhere.Foris Wine - true

FF - user.js: extensions.https_everywhere.Formspring (broken) - false

FF - user.js: extensions.https_everywhere.Forsakringskassan.se - true

FF - user.js: extensions.https_everywhere.Forsvarsforbundet.se - true

FF - user.js: extensions.https_everywhere.Fortum.se - true

FF - user.js: extensions.https_everywhere.Foundation for Health Coverage Education - true

FF - user.js: extensions.https_everywhere.Foursquare.com - true

FF - user.js: extensions.https_everywhere.Free Software Foundation - true

FF - user.js: extensions.https_everywhere.FreeDNS.Afraid.org - true

FF - user.js: extensions.https_everywhere.FreeDesktop Bugzilla - true

FF - user.js: extensions.https_everywhere.Freedom to Tinker - true

FF - user.js: extensions.https_everywhere.Freedombox Foundation - true

FF - user.js: extensions.https_everywhere.Freelancer - true

FF - user.js: extensions.https_everywhere.Freenet - true

FF - user.js: extensions.https_everywhere.Freenode.net - false

FF - user.js: extensions.https_everywhere.Freie Arbeiterinnen- und Arbeiter-Union (FAU) - false

FF - user.js: extensions.https_everywhere.FriBID.se - true

FF - user.js: extensions.https_everywhere.Fridge - true

FF - user.js: extensions.https_everywhere.Friendfeed - true

FF - user.js: extensions.https_everywhere.Frontline Defenders - true

FF - user.js: extensions.https_everywhere.FusionIO - true

FF - user.js: extensions.https_everywhere.FusionNet - true

FF - user.js: extensions.https_everywhere.FutureQuest Support - true

FF - user.js: extensions.https_everywhere.G Data Software - true

FF - user.js: extensions.https_everywhere.G5 - US Department of Education - true

FF - user.js: extensions.https_everywhere.GKG - true

FF - user.js: extensions.https_everywhere.GLAD (Gay & Lesbian Advocates & Defenders) - true

FF - user.js: extensions.https_everywhere.GLS Bank - true

FF - user.js: extensions.https_everywhere.GMX - true

FF - user.js: extensions.https_everywhere.GNOME (partial) - true

FF - user.js: extensions.https_everywhere.GNOME - true

FF - user.js: extensions.https_everywhere.GRSecurity.net - true

FF - user.js: extensions.https_everywhere.GU.se - true

FF - user.js: extensions.https_everywhere.Gandi - true

FF - user.js: extensions.https_everywhere.Gartner.com - true

FF - user.js: extensions.https_everywhere.Geek.com - false

FF - user.js: extensions.https_everywhere.Geek.net - true

FF - user.js: extensions.https_everywhere.Gentoo (CAcert) - true

FF - user.js: extensions.https_everywhere.Gentoo (partial) - true

FF - user.js: extensions.https_everywhere.Gentoo - true

FF - user.js: extensions.https_everywhere.GeoTrust - true

FF - user.js: extensions.https_everywhere.German BigBrotherAwards - true

FF - user.js: extensions.https_everywhere.GetClicky - true

FF - user.js: extensions.https_everywhere.GetFirebug - true

FF - user.js: extensions.https_everywhere.GetPersonas.com - true

FF - user.js: extensions.https_everywhere.Getdigital.de - true

FF - user.js: extensions.https_everywhere.GiBlod.no - true

FF - user.js: extensions.https_everywhere.Gibson Research - true

FF - user.js: extensions.https_everywhere.Gigaset.com - true

FF - user.js: extensions.https_everywhere.GitHub - true

FF - user.js: extensions.https_everywhere.Gitorious - true

FF - user.js: extensions.https_everywhere.Give Kids the World - true

FF - user.js: extensions.https_everywhere.GlenScott - true

FF - user.js: extensions.https_everywhere.Global Scale Technologies - true

FF - user.js: extensions.https_everywhere.GlobalSign - true

FF - user.js: extensions.https_everywhere.Globaltestsupply - true

FF - user.js: extensions.https_everywhere.Gnuheter.org - false

FF - user.js: extensions.https_everywhere.GoDaddy - true

FF - user.js: extensions.https_everywhere.Good.net - true

FF - user.js: extensions.https_everywhere.Google APIs - true

FF - user.js: extensions.https_everywhere.Google Images - true

FF - user.js: extensions.https_everywhere.Google Search - true

FF - user.js: extensions.https_everywhere.Google Services - true

FF - user.js: extensions.https_everywhere.Google Shopping - true

FF - user.js: extensions.https_everywhere.Google Videos - true

FF - user.js: extensions.https_everywhere.GoogleCanada - true

FF - user.js: extensions.https_everywhere.GoogleMaps - true

FF - user.js: extensions.https_everywhere.GoogleMelange - true

FF - user.js: extensions.https_everywhere.GoogleServices - true

FF - user.js: extensions.https_everywhere.GoogleSorry - true

FF - user.js: extensions.https_everywhere.Governo Português (broken) - false

FF - user.js: extensions.https_everywhere.Governo Português - true

FF - user.js: extensions.https_everywhere.Gowalla (partial) - true

FF - user.js: extensions.https_everywhere.Gowalla - true

FF - user.js: extensions.https_everywhere.Gravatar - true

FF - user.js: extensions.https_everywhere.Grepular - true

FF - user.js: extensions.https_everywhere.Groton.org - true

FF - user.js: extensions.https_everywhere.Groupon DE/UK - true

FF - user.js: extensions.https_everywhere.Groupon.se - true

FF - user.js: extensions.https_everywhere.Gsfacket.se - true

FF - user.js: extensions.https_everywhere.Guardian Project - true

FF - user.js: extensions.https_everywhere.GuideStar - true

FF - user.js: extensions.https_everywhere.Guifi.net - true

FF - user.js: extensions.https_everywhere.Gulesider - true

FF - user.js: extensions.https_everywhere.GunIO - true

FF - user.js: extensions.https_everywhere.Gynecomastia.org - true

FF - user.js: extensions.https_everywhere.HD.se - true

FF - user.js: extensions.https_everywhere.HGO.se - true

FF - user.js: extensions.https_everywhere.HH.se - true

FF - user.js: extensions.https_everywhere.HIG.se - true

FF - user.js: extensions.https_everywhere.HIS.se - true

FF - user.js: extensions.https_everywhere.HKK - true

FF - user.js: extensions.https_everywhere.HMV - true

FF - user.js: extensions.https_everywhere.HON.ch (Health On the Net) - false

FF - user.js: extensions.https_everywhere.HSBC - true

FF - user.js: extensions.https_everywhere.HSV.se - true

FF - user.js: extensions.https_everywhere.HTC - false

FF - user.js: extensions.https_everywhere.HTTPwatch.com - true

FF - user.js: extensions.https_everywhere.HUK Coburg - true

FF - user.js: extensions.https_everywhere.HackerNews - true

FF - user.js: extensions.https_everywhere.Hackinthebox.org - true

FF - user.js: extensions.https_everywhere.Hadopi.fr - true

FF - user.js: extensions.https_everywhere.Hakko.com - true

FF - user.js: extensions.https_everywhere.Halebop.se - true

FF - user.js: extensions.https_everywhere.Halifax - true

FF - user.js: extensions.https_everywhere.Hamburg - true

FF - user.js: extensions.https_everywhere.Handbrake.fr - true

FF - user.js: extensions.https_everywhere.Hawaiian Airlines - true

FF - user.js: extensions.https_everywhere.HealthCheckUSA - true

FF - user.js: extensions.https_everywhere.Heathkit - true

FF - user.js: extensions.https_everywhere.Heroku (buggy) - false

FF - user.js: extensions.https_everywhere.Heroku - true

FF - user.js: extensions.https_everywhere.Hexagon - true

FF - user.js: extensions.https_everywhere.Hi - true

FF - user.js: extensions.https_everywhere.Hidemyass - true

FF - user.js: extensions.https_everywhere.Hm.com - true

FF - user.js: extensions.https_everywhere.Home School Legal Defense Association - true

FF - user.js: extensions.https_everywhere.Homebase - true

FF - user.js: extensions.https_everywhere.Homecomputing.fr - false

FF - user.js: extensions.https_everywhere.Hostican Web Hosting - true

FF - user.js: extensions.https_everywhere.Hosts - true

FF - user.js: extensions.https_everywhere.Hotfile - true

FF - user.js: extensions.https_everywhere.Hotmail / Live - true

FF - user.js: extensions.https_everywhere.Hotwire - true

FF - user.js: extensions.https_everywhere.Human Rights Campaign (partial) - true

FF - user.js: extensions.https_everywhere.Hungerhost - true

FF - user.js: extensions.https_everywhere.Huntington's Disease Society of America - true

FF - user.js: extensions.https_everywhere.HurricaneElectric - true

FF - user.js: extensions.https_everywhere.Hushmail - true

FF - user.js: extensions.https_everywhere.Hustler - true

FF - user.js: extensions.https_everywhere.Hypovereinsbank - true

FF - user.js: extensions.https_everywhere.I Do Foundation - true

FF - user.js: extensions.https_everywhere.I2P - false

FF - user.js: extensions.https_everywhere.IANA - true

FF - user.js: extensions.https_everywhere.IBM - false

FF - user.js: extensions.https_everywhere.ICA.se - true

FF - user.js: extensions.https_everywhere.ICMail - true

FF - user.js: extensions.https_everywhere.IDG.com.au - true

FF - user.js: extensions.https_everywhere.IDG.se - true

FF - user.js: extensions.https_everywhere.IEEE - true

FF - user.js: extensions.https_everywhere.IELTS - true

FF - user.js: extensions.https_everywhere.IETF - true

FF - user.js: extensions.https_everywhere.IFA.ch - true

FF - user.js: extensions.https_everywhere.IIS.net - true

FF - user.js: extensions.https_everywhere.IIS.se - true

FF - user.js: extensions.https_everywhere.IKK-Gesundplus - true

FF - user.js: extensions.https_everywhere.IKK-Suedwest - true

FF - user.js: extensions.https_everywhere.ILO.org - true

FF - user.js: extensions.https_everywhere.IMF.org - true

FF - user.js: extensions.https_everywhere.ING DIRECT - true

FF - user.js: extensions.https_everywhere.IPCC.ch - true

FF - user.js: extensions.https_everywhere.IRF.se - true

FF - user.js: extensions.https_everywhere.ISC - true

FF - user.js: extensions.https_everywhere.ISIS - true

FF - user.js: extensions.https_everywhere.Iberia - true

FF - user.js: extensions.https_everywhere.IceHeberg - true

FF - user.js: extensions.https_everywhere.Identica - true

FF - user.js: extensions.https_everywhere.IdentityTheft - true

FF - user.js: extensions.https_everywhere.Imgur (partial, broken) - false

FF - user.js: extensions.https_everywhere.Imgur - true

FF - user.js: extensions.https_everywhere.Immunityinc.com - true

FF - user.js: extensions.https_everywhere.Imrworldwide.com - true

FF - user.js: extensions.https_everywhere.Indybay - true

FF - user.js: extensions.https_everywhere.Indymedia.org - true

FF - user.js: extensions.https_everywhere.Inet.se - true

FF - user.js: extensions.https_everywhere.Info.iet.unipi.it - false

FF - user.js: extensions.https_everywhere.InfoWorld.com - true

FF - user.js: extensions.https_everywhere.Infragard.net - true

FF - user.js: extensions.https_everywhere.Inria.fr - true

FF - user.js: extensions.https_everywhere.Inschrijven.nl - true

FF - user.js: extensions.https_everywhere.Insight - true

FF - user.js: extensions.https_everywhere.Instagram (partial) - true

FF - user.js: extensions.https_everywhere.InstantSSL - true

FF - user.js: extensions.https_everywhere.Instapaper - true

FF - user.js: extensions.https_everywhere.InterNetworX - true

FF - user.js: extensions.https_everywhere.Interactive Marketing Solutions - true

FF - user.js: extensions.https_everywhere.Internews - true

FF - user.js: extensions.https_everywhere.Interpol - true

FF - user.js: extensions.https_everywhere.Intl Cannagraphic Magazine - true

FF - user.js: extensions.https_everywhere.Irish Broadband - true

FF - user.js: extensions.https_everywhere.IsoHunt - true

FF - user.js: extensions.https_everywhere.ItsLearning - true

FF - user.js: extensions.https_everywhere.Ixquick - true

FF - user.js: extensions.https_everywhere.Izquierda-unida.es - false

FF - user.js: extensions.https_everywhere.JAKO-O - true

FF - user.js: extensions.https_everywhere.JANET - true

FF - user.js: extensions.https_everywhere.JBoss - true

FF - user.js: extensions.https_everywhere.JP-CERT - true

FF - user.js: extensions.https_everywhere.JPG Magazine (self-signed) - false

FF - user.js: extensions.https_everywhere.JPG Magazine - true

FF - user.js: extensions.https_everywhere.JVN.jp - true

FF - user.js: extensions.https_everywhere.Japan Airlines - true

FF - user.js: extensions.https_everywhere.Japan Information Technology Promotion Agency - true

FF - user.js: extensions.https_everywhere.Jappix - true

FF - user.js: extensions.https_everywhere.Java - true

FF - user.js: extensions.https_everywhere.Jet2.com - true

FF - user.js: extensions.https_everywhere.Jobscout24 - true

FF - user.js: extensions.https_everywhere.Joker - true

FF - user.js: extensions.https_everywhere.Joslin Diabetes Center - true

FF - user.js: extensions.https_everywhere.Jottit - true

FF - user.js: extensions.https_everywhere.Journeyed - true

FF - user.js: extensions.https_everywhere.Joyclub.de - true

FF - user.js: extensions.https_everywhere.Juniper Networks - true

FF - user.js: extensions.https_everywhere.Jusek.se - true

FF - user.js: extensions.https_everywhere.JustGive - true

FF - user.js: extensions.https_everywhere.JustGiving - true

FF - user.js: extensions.https_everywhere.JustTomatoes.com - true

FF - user.js: extensions.https_everywhere.KAU.se - true

FF - user.js: extensions.https_everywhere.KDE (partial) - true

FF - user.js: extensions.https_everywhere.KDE Bugtracker - true

FF - user.js: extensions.https_everywhere.KEMI.se - true

FF - user.js: extensions.https_everywhere.KI.se - true

FF - user.js: extensions.https_everywhere.KKH-Allianz - true

FF - user.js: extensions.https_everywhere.KKH.se - true

FF - user.js: extensions.https_everywhere.KLM - true

FF - user.js: extensions.https_everywhere.KMH.se - true

FF - user.js: extensions.https_everywhere.KPN - true

FF - user.js: extensions.https_everywhere.KPT.ch - true

FF - user.js: extensions.https_everywhere.KTH.se - true

FF - user.js: extensions.https_everywhere.Kabel Deutschland - true

FF - user.js: extensions.https_everywhere.Kachingle - true

FF - user.js: extensions.https_everywhere.Kanotix - false

FF - user.js: extensions.https_everywhere.Karagarga - true

FF - user.js: extensions.https_everywhere.Kayak - true

FF - user.js: extensions.https_everywhere.Keepassx - true

FF - user.js: extensions.https_everywhere.Kernel.org - true

FF - user.js: extensions.https_everywhere.Khronos Group (partial) - true

FF - user.js: extensions.https_everywhere.KickassTorrents - true

FF - user.js: extensions.https_everywhere.Kintera Network - true

FF - user.js: extensions.https_everywhere.Kismetwireless.net - true

FF - user.js: extensions.https_everywhere.Knappschaft-Bahn-See - true

FF - user.js: extensions.https_everywhere.Knopper.net (self-signed) - false

FF - user.js: extensions.https_everywhere.Kohls.com - true

FF - user.js: extensions.https_everywhere.Kommunal.se - true

FF - user.js: extensions.https_everywhere.Komplett.no - true

FF - user.js: extensions.https_everywhere.Konami.com - true

FF - user.js: extensions.https_everywhere.Konstfack.se - true

FF - user.js: extensions.https_everywhere.Kotex - true

FF - user.js: extensions.https_everywhere.KriminalVarden.se - true

FF - user.js: extensions.https_everywhere.Kuantokusta.pt - true

FF - user.js: extensions.https_everywhere.Kyberia.sk - true

FF - user.js: extensions.https_everywhere.LIU.se - true

FF - user.js: extensions.https_everywhere.LKML - true

FF - user.js: extensions.https_everywhere.LM Uni Muenchen - true

FF - user.js: extensions.https_everywhere.LWN - true

FF - user.js: extensions.https_everywhere.La Caixa - true

FF - user.js: extensions.https_everywhere.LabCorp - true

FF - user.js: extensions.https_everywhere.Lansforsakringar.se - true

FF - user.js: extensions.https_everywhere.Lantmateriet.se - true

FF - user.js: extensions.https_everywhere.LastPass - false

FF - user.js: extensions.https_everywhere.Lastminute.com - true

FF - user.js: extensions.https_everywhere.Launchpad - true

FF - user.js: extensions.https_everywhere.Lavabit - true

FF - user.js: extensions.https_everywhere.Lavasoft (broken) - false

FF - user.js: extensions.https_everywhere.Lavasoft - true

FF - user.js: extensions.https_everywhere.Lawblog.de - false

FF - user.js: extensions.https_everywhere.LboroAcUk - true

FF - user.js: extensions.https_everywhere.LegitScript - true

FF - user.js: extensions.https_everywhere.Legtux - false

FF - user.js: extensions.https_everywhere.Lelo.com - true

FF - user.js: extensions.https_everywhere.Lenovo (partial) - true

FF - user.js: extensions.https_everywhere.Lenovo - true

FF - user.js: extensions.https_everywhere.LensRentals.com - true

FF - user.js: extensions.https_everywhere.Library Anywhere - true

FF - user.js: extensions.https_everywhere.LibraryThing - true

FF - user.js: extensions.https_everywhere.LibreOffice - true

FF - user.js: extensions.https_everywhere.LibreOffice-Box - true

FF - user.js: extensions.https_everywhere.Lichtblick.de - true

FF - user.js: extensions.https_everywhere.Life Extension Magazine - true

FF - user.js: extensions.https_everywhere.Liferay.com - true

FF - user.js: extensions.https_everywhere.LiftShare - true

FF - user.js: extensions.https_everywhere.Lighttpd.net - false

FF - user.js: extensions.https_everywhere.Lindt USA - true

FF - user.js: extensions.https_everywhere.Link+ Catalog - true

FF - user.js: extensions.https_everywhere.LinkedIn (minimal) - true

FF - user.js: extensions.https_everywhere.LinkedIn (partial) - false

FF - user.js: extensions.https_everywhere.Linkomanija - false

FF - user.js: extensions.https_everywhere.Linksysbycisco.com - true

FF - user.js: extensions.https_everywhere.Linode - true

FF - user.js: extensions.https_everywhere.Linux Foundation - true

FF - user.js: extensions.https_everywhere.Linux.com - true

FF - user.js: extensions.https_everywhere.Linux.org.ru - true

FF - user.js: extensions.https_everywhere.LinuxFoundation - true

FF - user.js: extensions.https_everywhere.LinuxQuestions - true

FF - user.js: extensions.https_everywhere.LinuxQuestions.org - true

FF - user.js: extensions.https_everywhere.LiveJournal - false

FF - user.js: extensions.https_everywhere.LoadImpact.com - true

FF - user.js: extensions.https_everywhere.Local 20/20 - true

FF - user.js: extensions.https_everywhere.Local.ch - true

FF - user.js: extensions.https_everywhere.Lone Star Overnight - true

FF - user.js: extensions.https_everywhere.Loopt - true

FF - user.js: extensions.https_everywhere.LoveFilm - true

FF - user.js: extensions.https_everywhere.Ludios.org - true

FF - user.js: extensions.https_everywhere.M86security - true

FF - user.js: extensions.https_everywhere.MAAWG - true

FF - user.js: extensions.https_everywhere.MADD California - true

FF - user.js: extensions.https_everywhere.MAH.se - true

FF - user.js: extensions.https_everywhere.MAPS - true

FF - user.js: extensions.https_everywhere.MDH.se - true

FF - user.js: extensions.https_everywhere.METRO Transit (Harris County, Houston, Texas) - true

FF - user.js: extensions.https_everywhere.MIN_Commsy - true

FF - user.js: extensions.https_everywhere.MIUN.se - true

FF - user.js: extensions.https_everywhere.MIX-Computer.de - true

FF - user.js: extensions.https_everywhere.MSN (Other domains) - true

FF - user.js: extensions.https_everywhere.MSN - false

FF - user.js: extensions.https_everywhere.MYEDDEBT.com - true

FF - user.js: extensions.https_everywhere.MacWorld - true

FF - user.js: extensions.https_everywhere.Magento (buggy) - false

FF - user.js: extensions.https_everywhere.Magento - true

FF - user.js: extensions.https_everywhere.Magnatune - true

FF - user.js: extensions.https_everywhere.Magnet.ie - true

FF - user.js: extensions.https_everywhere.Mail.com - true

FF - user.js: extensions.https_everywhere.Maine Civil Liberties Union - true

FF - user.js: extensions.https_everywhere.Make My Trip - true

FF - user.js: extensions.https_everywhere.Make-A-Wish Foundation of Michigan - true

FF - user.js: extensions.https_everywhere.Malwarebytes - true

FF - user.js: extensions.https_everywhere.Mandriva.com - true

FF - user.js: extensions.https_everywhere.MapQuest (questionable) - false

FF - user.js: extensions.https_everywhere.MapQuest - true

FF - user.js: extensions.https_everywhere.Marketwatch.com (broken) - false

FF - user.js: extensions.https_everywhere.MarksandSpencer - true

FF - user.js: extensions.https_everywhere.Marxists Internet Archive - false

FF - user.js: extensions.https_everywhere.Mashable.com - true

FF - user.js: extensions.https_everywhere.Massachusetts General Hospital OCD & Related Disorders Program - true

FF - user.js: extensions.https_everywhere.Massage Magazine - true

FF - user.js: extensions.https_everywhere.Materiel.net - true

FF - user.js: extensions.https_everywhere.Mathtag.com - true

FF - user.js: extensions.https_everywhere.MaxMind - true

FF - user.js: extensions.https_everywhere.May First/People Link - true

FF - user.js: extensions.https_everywhere.McAfee (buggy) - false

FF - user.js: extensions.https_everywhere.McAfee - true

FF - user.js: extensions.https_everywhere.Media Temple - true

FF - user.js: extensions.https_everywhere.Mediamarkt.se - true

FF - user.js: extensions.https_everywhere.MedicAlert - true

FF - user.js: extensions.https_everywhere.Medikamente-Per-Klick - true

FF - user.js: extensions.https_everywhere.Medstop.se - true

FF - user.js: extensions.https_everywhere.Meebo - true

FF - user.js: extensions.https_everywhere.Meego - true

FF - user.js: extensions.https_everywhere.Meltwaternews.con - true

FF - user.js: extensions.https_everywhere.Mibbit - true

FF - user.js: extensions.https_everywhere.Microchip.com - true

FF - user.js: extensions.https_everywhere.Microsoft - true

FF - user.js: extensions.https_everywhere.Mijn ING - true

FF - user.js: extensions.https_everywhere.Miles-and-more.com - true

FF - user.js: extensions.https_everywhere.MilkAndMore - true

FF - user.js: extensions.https_everywhere.Minecraft - true

FF - user.js: extensions.https_everywhere.Miniatur Wunderland - true

FF - user.js: extensions.https_everywhere.Mint - true

FF - user.js: extensions.https_everywhere.Minus.com - true

FF - user.js: extensions.https_everywhere.MirBSD - true

FF - user.js: extensions.https_everywhere.Miranda-IM (buggy) - false

FF - user.js: extensions.https_everywhere.Miranda-IM - true

FF - user.js: extensions.https_everywhere.Mises.org - true

FF - user.js: extensions.https_everywhere.Mitsubishi.com - true

FF - user.js: extensions.https_everywhere.Mobygames.com - true

FF - user.js: extensions.https_everywhere.ModSecurity - true

FF - user.js: extensions.https_everywhere.MomentusMedia - true

FF - user.js: extensions.https_everywhere.Monarch.co.uk - true

FF - user.js: extensions.https_everywhere.Moneybookers - true

FF - user.js: extensions.https_everywhere.Mookie1.com - true

FF - user.js: extensions.https_everywhere.MoonPig - true

FF - user.js: extensions.https_everywhere.Motesplatsen.se - true

FF - user.js: extensions.https_everywhere.Mountyhall - false

FF - user.js: extensions.https_everywhere.MoveOn - true

FF - user.js: extensions.https_everywhere.Movelia - true

FF - user.js: extensions.https_everywhere.Mozdev - true

FF - user.js: extensions.https_everywhere.Mozilla - true

FF - user.js: extensions.https_everywhere.Mozy - true

FF - user.js: extensions.https_everywhere.Mpx - true

FF - user.js: extensions.https_everywhere.Mt.Gox - true

FF - user.js: extensions.https_everywhere.Mullet.se - true

FF - user.js: extensions.https_everywhere.Mullvad.net - true

FF - user.js: extensions.https_everywhere.Musikerforbundet.se - true

FF - user.js: extensions.https_everywhere.My-files.de - true

FF - user.js: extensions.https_everywhere.MyCharity.ie - true

FF - user.js: extensions.https_everywhere.MyChart - true

FF - user.js: extensions.https_everywhere.MyEdAccount.Com - true

FF - user.js: extensions.https_everywhere.MyOpenID - true

FF - user.js: extensions.https_everywhere.MyPlayDirect - true

FF - user.js: extensions.https_everywhere.MyPoints - true

FF - user.js: extensions.https_everywhere.MySQL - true

FF - user.js: extensions.https_everywhere.MyTUM.de - true

FF - user.js: extensions.https_everywhere.MyUHC - true

FF - user.js: extensions.https_everywhere.MyWOT - true

FF - user.js: extensions.https_everywhere.Myspace - true

FF - user.js: extensions.https_everywhere.NAB - true

FF - user.js: extensions.https_everywhere.NL Overheid - true

FF - user.js: extensions.https_everywhere.NL Politiek - true

FF - user.js: extensions.https_everywhere.NPR.org - true

FF - user.js: extensions.https_everywhere.NSF.gov (broken) - false

FF - user.js: extensions.https_everywhere.NSF.gov - true

FF - user.js: extensions.https_everywhere.NTU - true

FF - user.js: extensions.https_everywhere.NYDailyNews - true

FF - user.js: extensions.https_everywhere.NYTimes - true

FF - user.js: extensions.https_everywhere.NZBIndex - true

FF - user.js: extensions.https_everywhere.NZBIndex.nl - true

FF - user.js: extensions.https_everywhere.NameCheap - true

FF - user.js: extensions.https_everywhere.Names - true

FF - user.js: extensions.https_everywhere.NanoHUB - true

FF - user.js: extensions.https_everywhere.National American Arab Nursing Association - true

FF - user.js: extensions.https_everywhere.National Children's Leukemia Foundation - true

FF - user.js: extensions.https_everywhere.National Eating Disorders Association - true

FF - user.js: extensions.https_everywhere.National Lawyers Guild - true

FF - user.js: extensions.https_everywhere.National Press Photographers Association - true

FF - user.js: extensions.https_everywhere.National Suicide Prevention Lifeline - true

FF - user.js: extensions.https_everywhere.National Vulvodynia Association - true

FF - user.js: extensions.https_everywhere.NationalArchivesGovUK - true

FF - user.js: extensions.https_everywhere.NationalLottery - true

FF - user.js: extensions.https_everywhere.Nattstad.se - true

FF - user.js: extensions.https_everywhere.Naturvardsverket.se - true

FF - user.js: extensions.https_everywhere.Naukri - true

FF - user.js: extensions.https_everywhere.Nectarine Demoscene Music - true

FF - user.js: extensions.https_everywhere.Neelwafurat.com - true

FF - user.js: extensions.https_everywhere.Nelly.com - true

FF - user.js: extensions.https_everywhere.Netbeat Webmail - true

FF - user.js: extensions.https_everywhere.Netdoktor.se - true

FF - user.js: extensions.https_everywhere.Netflix (buggy) - false

FF - user.js: extensions.https_everywhere.Netflix - true

FF - user.js: extensions.https_everywhere.NetflixCanada - false

FF - user.js: extensions.https_everywhere.Nether - true

FF - user.js: extensions.https_everywhere.Nettica - true

FF - user.js: extensions.https_everywhere.NetworkWorld - true

FF - user.js: extensions.https_everywhere.Netzpolitik.org - true

FF - user.js: extensions.https_everywhere.New Moon Girls Online - true

FF - user.js: extensions.https_everywhere.NewIT - true

FF - user.js: extensions.https_everywhere.NewsGator - true

FF - user.js: extensions.https_everywhere.Newzbin - true

FF - user.js: extensions.https_everywhere.Next - true

FF - user.js: extensions.https_everywhere.NextBus - true

FF - user.js: extensions.https_everywhere.NicAc - true

FF - user.js: extensions.https_everywhere.NicIo - true

FF - user.js: extensions.https_everywhere.Nicotine Anonymous - true

FF - user.js: extensions.https_everywhere.Ninite - true

FF - user.js: extensions.https_everywhere.Nintendo.com - true

FF - user.js: extensions.https_everywhere.No Deep Packet Inspection campaign - true

FF - user.js: extensions.https_everywhere.Noisebridge - true

FF - user.js: extensions.https_everywhere.Nokia - true

FF - user.js: extensions.https_everywhere.Nordea - true

FF - user.js: extensions.https_everywhere.Nordnet.se - true

FF - user.js: extensions.https_everywhere.Nordu.net - true

FF - user.js: extensions.https_everywhere.Norman.com - true

FF - user.js: extensions.https_everywhere.Northpole.fi - false

FF - user.js: extensions.https_everywhere.Norwegian.com - true

FF - user.js: extensions.https_everywhere.NottinghamAC - true

FF - user.js: extensions.https_everywhere.Nttdocomo.com - true

FF - user.js: extensions.https_everywhere.Nttxstore - true

FF - user.js: extensions.https_everywhere.NutriCentre - true

FF - user.js: extensions.https_everywhere.O2online.de - true

FF - user.js: extensions.https_everywhere.OKCupid.com - false

FF - user.js: extensions.https_everywhere.OVH - true

FF - user.js: extensions.https_everywhere.Officersforbundet.se - true

FF - user.js: extensions.https_everywhere.Official Colorado No-Call List - true

FF - user.js: extensions.https_everywhere.Ohloh - true

FF - user.js: extensions.https_everywhere.Olark - true

FF - user.js: extensions.https_everywhere.OmniGroup.com - true

FF - user.js: extensions.https_everywhere.Omron.com - true

FF - user.js: extensions.https_everywhere.OnTrac - true

FF - user.js: extensions.https_everywhere.Onehub.com - true

FF - user.js: extensions.https_everywhere.Online.nl - true

FF - user.js: extensions.https_everywhere.Ontario Lung Association - true

FF - user.js: extensions.https_everywhere.OomphMe - false

FF - user.js: extensions.https_everywhere.Open-Mesh - true

FF - user.js: extensions.https_everywhere.OpenBSD Europe - true

FF - user.js: extensions.https_everywhere.OpenDNS - true

FF - user.js: extensions.https_everywhere.OpenID - true

FF - user.js: extensions.https_everywhere.OpenLeaks - true

FF - user.js: extensions.https_everywhere.OpenSC Project - true

FF - user.js: extensions.https_everywhere.OpenSSL - false

FF - user.js: extensions.https_everywhere.OpenStreetMap Wiki - true

FF - user.js: extensions.https_everywhere.OpenVPN - true

FF - user.js: extensions.https_everywhere.Openprinting - true

FF - user.js: extensions.https_everywhere.Opera - false

FF - user.js: extensions.https_everywhere.Orange - true

FF - user.js: extensions.https_everywhere.OverClockers - true

FF - user.js: extensions.https_everywhere.Overlake Hospital Medical Center - true

FF - user.js: extensions.https_everywhere.Oxfam Unwrapped - true

FF - user.js: extensions.https_everywhere.OzBargain - true

FF - user.js: extensions.https_everywhere.PBA Galleries - true

FF - user.js: extensions.https_everywhere.PC World - true

FF - user.js: extensions.https_everywhere.PCCaseGear - true

FF - user.js: extensions.https_everywhere.PFLAG-Parents, Families, & Friends of Lesbians and Gays (partial) - true

FF - user.js: extensions.https_everywhere.PGP - true

FF - user.js: extensions.https_everywhere.PNC - true

FF - user.js: extensions.https_everywhere.PRV.se - true

FF - user.js: extensions.https_everywhere.PS-Webhosting Webmail - true

FF - user.js: extensions.https_everywhere.PageKite - true

FF - user.js: extensions.https_everywhere.PaidContent - true

FF - user.js: extensions.https_everywhere.Panasonic.com - true

FF - user.js: extensions.https_everywhere.Pandora (broken) - false

FF - user.js: extensions.https_everywhere.Pandora - true

FF - user.js: extensions.https_everywhere.Panic.com - true

FF - user.js: extensions.https_everywhere.Paper.li - true

FF - user.js: extensions.https_everywhere.Parship.nl - true

FF - user.js: extensions.https_everywhere.PassThePopcorn - true

FF - user.js: extensions.https_everywhere.PasswordCard - true

FF - user.js: extensions.https_everywhere.Pastebin.ca - false

FF - user.js: extensions.https_everywhere.Pastebin.com - false

FF - user.js: extensions.https_everywhere.Pastee.org - true

FF - user.js: extensions.https_everywhere.PayPal - true

FF - user.js: extensions.https_everywhere.Pdadb.net - false

FF - user.js: extensions.https_everywhere.PearsonVue - true

FF - user.js: extensions.https_everywhere.PensionsMyndigheten.se - true

FF - user.js: extensions.https_everywhere.PhishTank - true

FF - user.js: extensions.https_everywhere.Phoromatic.com - true

FF - user.js: extensions.https_everywhere.Photonconsulting.com - true

FF - user.js: extensions.https_everywhere.Picasa Web Albums - true

FF - user.js: extensions.https_everywhere.Picplz - true

FF - user.js: extensions.https_everywhere.Pinboard.in - true

FF - user.js: extensions.https_everywhere.Ping.fm - true

FF - user.js: extensions.https_everywhere.Pinterest - true

FF - user.js: extensions.https_everywhere.Pipex - true

FF - user.js: extensions.https_everywhere.Pirate Party - true

FF - user.js: extensions.https_everywhere.PirateParty - true

FF - user.js: extensions.https_everywhere.Piscatus.se - true

FF - user.js: extensions.https_everywhere.Pivotal Tracker - true

FF - user.js: extensions.https_everywhere.Pizzahut UK - true

FF - user.js: extensions.https_everywhere.PlanetRomeo - true

FF - user.js: extensions.https_everywhere.Planned Parenthood - true

FF - user.js: extensions.https_everywhere.Playboy - true

FF - user.js: extensions.https_everywhere.Pledgie - true

FF - user.js: extensions.https_everywhere.PlentyOfFish - true

FF - user.js: extensions.https_everywhere.Pliktverket.se - true

FF - user.js: extensions.https_everywhere.Plone.org - true

FF - user.js: extensions.https_everywhere.Plus.net - true

FF - user.js: extensions.https_everywhere.Plusgirot.se - true

FF - user.js: extensions.https_everywhere.PodOmatic.com - true

FF - user.js: extensions.https_everywhere.Pogo - true

FF - user.js: extensions.https_everywhere.Poivy.com - true

FF - user.js: extensions.https_everywhere.PolarnoPyret.se - true

FF - user.js: extensions.https_everywhere.Policia.es - false

FF - user.js: extensions.https_everywhere.Polisforbundet.se - true

FF - user.js: extensions.https_everywhere.Polldaddy - true

FF - user.js: extensions.https_everywhere.Porteus Linux - true

FF - user.js: extensions.https_everywhere.PositiveSSL - true

FF - user.js: extensions.https_everywhere.Post.ch - true

FF - user.js: extensions.https_everywhere.Postbank - true

FF - user.js: extensions.https_everywhere.Poste.it - true

FF - user.js: extensions.https_everywhere.Posten.se - true

FF - user.js: extensions.https_everywhere.Posterous - true

FF - user.js: extensions.https_everywhere.PostgreSQL - true

FF - user.js: extensions.https_everywhere.Powells.com - true

FF - user.js: extensions.https_everywhere.Powernotebooks.com - true

FF - user.js: extensions.https_everywhere.Prad.de - false

FF - user.js: extensions.https_everywhere.Previa.se - true

FF - user.js: extensions.https_everywhere.PreyProject - true

FF - user.js: extensions.https_everywhere.Priberam.pt - true

FF - user.js: extensions.https_everywhere.Princeton.edu - true

FF - user.js: extensions.https_everywhere.Privacy International - true

FF - user.js: extensions.https_everywhere.Privacy Rights Clearinghouse - true

FF - user.js: extensions.https_everywhere.PrivacyBox - true

FF - user.js: extensions.https_everywhere.PrivatePaste - true

FF - user.js: extensions.https_everywhere.PrivateWifi - true

FF - user.js: extensions.https_everywhere.ProPublica.org - true

FF - user.js: extensions.https_everywhere.Project Euler - true

FF - user.js: extensions.https_everywhere.Project Syndicate (broken) - false

FF - user.js: extensions.https_everywhere.Project Syndicate - true

FF - user.js: extensions.https_everywhere.ProjectHoneypot - true

FF - user.js: extensions.https_everywhere.Prolific.com.tw - false

FF - user.js: extensions.https_everywhere.Prometric - true

FF - user.js: extensions.https_everywhere.Proxify - true

FF - user.js: extensions.https_everywhere.Proxy.org - true

FF - user.js: extensions.https_everywhere.Public Citizen - true

FF - user.js: extensions.https_everywhere.Publicintelligence - true

FF - user.js: extensions.https_everywhere.Puma.com - true

FF - user.js: extensions.https_everywhere.PureHacking - true

FF - user.js: extensions.https_everywhere.Puritan.com - true

FF - user.js: extensions.https_everywhere.Pypi (default off) - false

FF - user.js: extensions.https_everywhere.Python.org SVN (default off) - false

FF - user.js: extensions.https_everywhere.QIP - true

FF - user.js: extensions.https_everywhere.Qualtrics (surveys) - true

FF - user.js: extensions.https_everywhere.Qualys - true

FF - user.js: extensions.https_everywhere.Quora - false

FF - user.js: extensions.https_everywhere.Quorks - false

FF - user.js: extensions.https_everywhere.Qxl - true

FF - user.js: extensions.https_everywhere.R00tshell.lighthouseapp.com - false

FF - user.js: extensions.https_everywhere.RAC - true

FF - user.js: extensions.https_everywhere.RFC-Editor - true

FF - user.js: extensions.https_everywhere.RIAA - true

FF - user.js: extensions.https_everywhere.RIS - true

FF - user.js: extensions.https_everywhere.ROBOXchange - true

FF - user.js: extensions.https_everywhere.RSA - true

FF - user.js: extensions.https_everywhere.RT.com - true

FF - user.js: extensions.https_everywhere.RT.ru - true

FF - user.js: extensions.https_everywhere.Rabobank - true

FF - user.js: extensions.https_everywhere.Rackerhacker - true

FF - user.js: extensions.https_everywhere.RadioShack (broken) - false

FF - user.js: extensions.https_everywhere.RadioShack - true

FF - user.js: extensions.https_everywhere.Raiffeisen.ch - true

FF - user.js: extensions.https_everywhere.Random.org (broken) - false

FF - user.js: extensions.https_everywhere.Random.org - true

FF - user.js: extensions.https_everywhere.RapidSSL - true

FF - user.js: extensions.https_everywhere.RatePoint (partial) - true

FF - user.js: extensions.https_everywhere.ReadItLaterList.com - true

FF - user.js: extensions.https_everywhere.ReadSpeaker - true

FF - user.js: extensions.https_everywhere.ReadWriteWeb (broken) - false

FF - user.js: extensions.https_everywhere.ReadWriteWeb - true

FF - user.js: extensions.https_everywhere.Reco.se - true

FF - user.js: extensions.https_everywhere.RedHat - true

FF - user.js: extensions.https_everywhere.RedIRIS.es - true

FF - user.js: extensions.https_everywhere.Redbox.com - true

FF - user.js: extensions.https_everywhere.Reddit (hackish) - false

FF - user.js: extensions.https_everywhere.Reddit - true

FF - user.js: extensions.https_everywhere.Reddit+ - false

FF - user.js: extensions.https_everywhere.Reformed Church - true

FF - user.js: extensions.https_everywhere.Regional Municipality of Peel, Canada - true

FF - user.js: extensions.https_everywhere.Register.com - true

FF - user.js: extensions.https_everywhere.Reichelt.de - true

FF - user.js: extensions.https_everywhere.RememberTheMilk - true

FF - user.js: extensions.https_everywhere.Resurs.se - true

FF - user.js: extensions.https_everywhere.Revsci.net - true

FF - user.js: extensions.https_everywhere.Ricardo.ch - true

FF - user.js: extensions.https_everywhere.Riga - true

FF - user.js: extensions.https_everywhere.Riksgalden.se - true

FF - user.js: extensions.https_everywhere.Riseup - true

FF - user.js: extensions.https_everywhere.RoadRunner - true

FF - user.js: extensions.https_everywhere.Robeco - true

FF - user.js: extensions.https_everywhere.Roccat.org - false

FF - user.js: extensions.https_everywhere.Roiservice.com - true

FF - user.js: extensions.https_everywhere.Rottentomatoes - true

FF - user.js: extensions.https_everywhere.RoyalGovUK - true

FF - user.js: extensions.https_everywhere.RubyGems.org - true

FF - user.js: extensions.https_everywhere.Rutgers - true

FF - user.js: extensions.https_everywhere.Ryanair.com - true

FF - user.js: extensions.https_everywhere.SAMBA - true

FF - user.js: extensions.https_everywhere.SANS - true

FF - user.js: extensions.https_everywhere.SBB.ch - true

FF - user.js: extensions.https_everywhere.SF.se - true

FF - user.js: extensions.https_everywhere.SGSStudentbostader.se - true

FF - user.js: extensions.https_everywhere.SH.se - true

FF - user.js: extensions.https_everywhere.SI.se - true

FF - user.js: extensions.https_everywhere.SICS.se - true

FF - user.js: extensions.https_everywhere.SJ.se - true

FF - user.js: extensions.https_everywhere.SL.se - true

FF - user.js: extensions.https_everywhere.SLF.se - true

FF - user.js: extensions.https_everywhere.SLU.se - true

FF - user.js: extensions.https_everywhere.SNS Bank - true

FF - user.js: extensions.https_everywhere.SPCA Los Angeles - true

FF - user.js: extensions.https_everywhere.SQLite - true

FF - user.js: extensions.https_everywhere.SSLlabs.com - true

FF - user.js: extensions.https_everywhere.SSLshopper - true

FF - user.js: extensions.https_everywhere.ST.org - true

FF - user.js: extensions.https_everywhere.SVGOpen - true

FF - user.js: extensions.https_everywhere.SVT.se - true

FF - user.js: extensions.https_everywhere.Sabnzbd Forum - true

FF - user.js: extensions.https_everywhere.Sac.se - true

FF - user.js: extensions.https_everywhere.Safari Books Online - true

FF - user.js: extensions.https_everywhere.Safe-mail.net - true

FF - user.js: extensions.https_everywhere.Sagernotebook.com - true

FF - user.js: extensions.https_everywhere.Salsa Labs - true

FF - user.js: extensions.https_everywhere.Samba.org - true

FF - user.js: extensions.https_everywhere.Sanitarium.se - true

FF - user.js: extensions.https_everywhere.Savannah - true

FF - user.js: extensions.https_everywhere.ScMagazineUS.com - true

FF - user.js: extensions.https_everywhere.Schneier on Security - true

FF - user.js: extensions.https_everywhere.SchooltoPrison.org - true

FF - user.js: extensions.https_everywhere.SchuelerVZ - false

FF - user.js: extensions.https_everywhere.Sciencemag.org - true

FF - user.js: extensions.https_everywhere.Scintilla.utwente.nl - true

FF - user.js: extensions.https_everywhere.Scottevest - true

FF - user.js: extensions.https_everywhere.Screen It! Movie Reviews - true

FF - user.js: extensions.https_everywhere.Scribd.com (buggy) - false

FF - user.js: extensions.https_everywhere.Scribd.com - true

FF - user.js: extensions.https_everywhere.Scroogle - true

FF - user.js: extensions.https_everywhere.Seagate.com (broken) - false

FF - user.js: extensions.https_everywhere.Seagate.com - true

FF - user.js: extensions.https_everywhere.Search www.google.com - false

FF - user.js: extensions.https_everywhere.Secular Coalition for America - true

FF - user.js: extensions.https_everywhere.Secunia - true

FF - user.js: extensions.https_everywhere.Secure.marketwatch.com - true

FF - user.js: extensions.https_everywhere.SecureList - true

FF - user.js: extensions.https_everywhere.Securepaynet.net - true

FF - user.js: extensions.https_everywhere.Secureserver.net (partial) - true

FF - user.js: extensions.https_everywhere.Security In A Box - true

FF - user.js: extensions.https_everywhere.Security.NL - true

FF - user.js: extensions.https_everywhere.SecurityFocus.com - true

FF - user.js: extensions.https_everywhere.SecurityMetrics - true

FF - user.js: extensions.https_everywhere.SecurityWeek.com - true

FF - user.js: extensions.https_everywhere.Securosis - true

FF - user.js: extensions.https_everywhere.Senate.gov - true

FF - user.js: extensions.https_everywhere.Sendmail - true

FF - user.js: extensions.https_everywhere.Serialist - true

FF - user.js: extensions.https_everywhere.Shannon Health - true

FF - user.js: extensions.https_everywhere.ShareThis (embedded widget) - true

FF - user.js: extensions.https_everywhere.Siemens.com - true

FF - user.js: extensions.https_everywhere.Siggraph.org - true

FF - user.js: extensions.https_everywhere.SigmaBeauty - true

FF - user.js: extensions.https_everywhere.Silicon.com - true

FF - user.js: extensions.https_everywhere.Simyo.de - true

FF - user.js: extensions.https_everywhere.Simyo.nl - true

FF - user.js: extensions.https_everywhere.Sinn Fein - true

FF - user.js: extensions.https_everywhere.Sipgate - true

FF - user.js: extensions.https_everywhere.Sivers - true

FF - user.js: extensions.https_everywhere.SixApart - true

FF - user.js: extensions.https_everywhere.Sixxs.net - true

FF - user.js: extensions.https_everywhere.Skandia - true

FF - user.js: extensions.https_everywhere.Skandiabanken - true

FF - user.js: extensions.https_everywhere.Skitch - true

FF - user.js: extensions.https_everywhere.Skydsl.eu - true

FF - user.js: extensions.https_everywhere.Slo-Tech - true

FF - user.js: extensions.https_everywhere.SlySoft - false

FF - user.js: extensions.https_everywhere.SmartFTP - true

FF - user.js: extensions.https_everywhere.SocietyForScience.org - true

FF - user.js: extensions.https_everywhere.Software Freedom Law Center - true

FF - user.js: extensions.https_everywhere.Sony-Europe.com - true

FF - user.js: extensions.https_everywhere.Sony.se - true

FF - user.js: extensions.https_everywhere.SonyMusic - true

FF - user.js: extensions.https_everywhere.Soton.ac.uk - true

FF - user.js: extensions.https_everywhere.Source Forge (partial) - true

FF - user.js: extensions.https_everywhere.SouthernElectric - true

FF - user.js: extensions.https_everywhere.SpamGourmet - true

FF - user.js: extensions.https_everywhere.Spanair - true

FF - user.js: extensions.https_everywhere.Sparked - true

FF - user.js: extensions.https_everywhere.Sparkfun - true

FF - user.js: extensions.https_everywhere.Sparkstudios.com - true

FF - user.js: extensions.https_everywhere.SpecialForces - true

FF - user.js: extensions.https_everywhere.Spin.de - true

FF - user.js: extensions.https_everywhere.Spirit Airlines - true

FF - user.js: extensions.https_everywhere.Springpad - true

FF - user.js: extensions.https_everywhere.Sprint.com - true

FF - user.js: extensions.https_everywhere.Spyderco - true

FF - user.js: extensions.https_everywhere.Srware - true

FF - user.js: extensions.https_everywhere.Stan Deyo - false

FF - user.js: extensions.https_everywhere.Starfield Technologies, Inc. - true

FF - user.js: extensions.https_everywhere.StartCom - true

FF - user.js: extensions.https_everywhere.Statcounter - true

FF - user.js: extensions.https_everywhere.StateBankOfIndia - true

FF - user.js: extensions.https_everywhere.StateFarm - true

FF - user.js: extensions.https_everywhere.StatistikamtBayern - true

FF - user.js: extensions.https_everywhere.StayFriends - true

FF - user.js: extensions.https_everywhere.Stevens - true

FF - user.js: extensions.https_everywhere.Stopbadware.org - true

FF - user.js: extensions.https_everywhere.Storebrand - true

FF - user.js: extensions.https_everywhere.StudentLoans.gov - true

FF - user.js: extensions.https_everywhere.StudiVZ (disabled) - false

FF - user.js: extensions.https_everywhere.StudiVZ - true

FF - user.js: extensions.https_everywhere.StumbleUpon (breaks plugin) - false

FF - user.js: extensions.https_everywhere.StumbleUpon - true

FF - user.js: extensions.https_everywhere.SunTrust - true

FF - user.js: extensions.https_everywhere.Sunbeltsoftware.com - true

FF - user.js: extensions.https_everywhere.SuperAntiSpyware - true

FF - user.js: extensions.https_everywhere.Superstart.se - true

FF - user.js: extensions.https_everywhere.SurveyGizmo.com - true

FF - user.js: extensions.https_everywhere.SurveyMonkey (buggy) - false

FF - user.js: extensions.https_everywhere.Surveydaddy - true

FF - user.js: extensions.https_everywhere.Svenskakyrkan - true

FF - user.js: extensions.https_everywhere.Svenskaspel.se - true

FF - user.js: extensions.https_everywhere.SverigesRadio - true

FF - user.js: extensions.https_everywhere.Swiss.com - true

FF - user.js: extensions.https_everywhere.Sycom.co.jp - true

FF - user.js: extensions.https_everywhere.Sydostran.se - true

FF - user.js: extensions.https_everywhere.Symbian Foundation - true

FF - user.js: extensions.https_everywhere.System76.com - true

FF - user.js: extensions.https_everywhere.Systembolaget.se - true

FF - user.js: extensions.https_everywhere.TAZ - true

FF - user.js: extensions.https_everywhere.TD Bank (partial) - true

FF - user.js: extensions.https_everywhere.TD Canada Trust - true

FF - user.js: extensions.https_everywhere.TT.se - true

FF - user.js: extensions.https_everywhere.TV.com (broken) - false

FF - user.js: extensions.https_everywhere.TV.com - true

FF - user.js: extensions.https_everywhere.TV4play.se - true

FF - user.js: extensions.https_everywhere.TYPO3 - true

FF - user.js: extensions.https_everywhere.Tandlakarforbundet.se - true

FF - user.js: extensions.https_everywhere.Target (broken) - false

FF - user.js: extensions.https_everywhere.Target - true

FF - user.js: extensions.https_everywhere.TataSky - true

FF - user.js: extensions.https_everywhere.Tchibo.de - true

FF - user.js: extensions.https_everywhere.Tcodevelopment.com - false

FF - user.js: extensions.https_everywhere.TeamCymru - true

FF - user.js: extensions.https_everywhere.Teamviewer - true

FF - user.js: extensions.https_everywhere.Teamxlink - false

FF - user.js: extensions.https_everywhere.TechHouse - true

FF - user.js: extensions.https_everywhere.Techcrunch - false

FF - user.js: extensions.https_everywhere.Technet.com - true

FF - user.js: extensions.https_everywhere.Techniker Krankenkasse - true

FF - user.js: extensions.https_everywhere.TechnologyReview - true

FF - user.js: extensions.https_everywhere.Techsupportalert - true

FF - user.js: extensions.https_everywhere.Tele2.se - true

FF - user.js: extensions.https_everywhere.Telfort - true

FF - user.js: extensions.https_everywhere.Telia.se - true

FF - user.js: extensions.https_everywhere.Tesco - true

FF - user.js: extensions.https_everywhere.Thawte - true

FF - user.js: extensions.https_everywhere.The Book Depository - true

FF - user.js: extensions.https_everywhere.The Book People - true

FF - user.js: extensions.https_everywhere.The Church of Jesus Christ of Latter-day Saints - true

FF - user.js: extensions.https_everywhere.The Cutest Site on the Block - true

FF - user.js: extensions.https_everywhere.The Document Foundation - true

FF - user.js: extensions.https_everywhere.The Jack and Jill Children's Foundation Charity - true

FF - user.js: extensions.https_everywhere.The Open University (buggy) - false

FF - user.js: extensions.https_everywhere.The Open University - true

FF - user.js: extensions.https_everywhere.The Pirate Bay - true

FF - user.js: extensions.https_everywhere.The Privacy Blog - true

FF - user.js: extensions.https_everywhere.TheAA - true

FF - user.js: extensions.https_everywhere.TheGlobeAndMail (cert warning) - false

FF - user.js: extensions.https_everywhere.TheGlobeAndMail - true

FF - user.js: extensions.https_everywhere.ThePermitStore.com - true

FF - user.js: extensions.https_everywhere.ThePirateBay - true

FF - user.js: extensions.https_everywhere.TheTrainLine - true

FF - user.js: extensions.https_everywhere.Thefind - true

FF - user.js: extensions.https_everywhere.ThinkGeek - true

FF - user.js: extensions.https_everywhere.This is my next - true

FF - user.js: extensions.https_everywhere.ThisIsMyNext - true

FF - user.js: extensions.https_everywhere.ThisWebHost - true

FF - user.js: extensions.https_everywhere.Thomas Cook - true

FF - user.js: extensions.https_everywhere.ThreatPost - true

FF - user.js: extensions.https_everywhere.Three - true

FF - user.js: extensions.https_everywhere.Thunder Ranch - true

FF - user.js: extensions.https_everywhere.TicketingNetworkEastMidlands - true

FF - user.js: extensions.https_everywhere.Timbro.se - true

FF - user.js: extensions.https_everywhere.TinEye - true

FF - user.js: extensions.https_everywhere.TinyChat - true

FF - user.js: extensions.https_everywhere.Tirerack - true

FF - user.js: extensions.https_everywhere.Tmcnet.com - true

FF - user.js: extensions.https_everywhere.Tmobile - true

FF - user.js: extensions.https_everywhere.TodoLy - true

FF - user.js: extensions.https_everywhere.Todoist - true

FF - user.js: extensions.https_everywhere.TofinoSecurity - true

FF - user.js: extensions.https_everywhere.Tokyo Toshokan - true

FF - user.js: extensions.https_everywhere.Toolserver - true

FF - user.js: extensions.https_everywhere.Tor Project - true

FF - user.js: extensions.https_everywhere.Tor2Web - true

FF - user.js: extensions.https_everywhere.Torproject - true

FF - user.js: extensions.https_everywhere.TorrentFreak.com - true

FF - user.js: extensions.https_everywhere.Torrentz - true

FF - user.js: extensions.https_everywhere.Torservers - true

FF - user.js: extensions.https_everywhere.Tradera - true

FF - user.js: extensions.https_everywhere.Trafficfacts.com - true

FF - user.js: extensions.https_everywhere.Transifex.net - true

FF - user.js: extensions.https_everywhere.Translatewiki.net - true

FF - user.js: extensions.https_everywhere.Transportstyrelsen.se - true

FF - user.js: extensions.https_everywhere.Trashmail - true

FF - user.js: extensions.https_everywhere.TreasuryDirect - true

FF - user.js: extensions.https_everywhere.Trisquel - true

FF - user.js: extensions.https_everywhere.Trustico - true

FF - user.js: extensions.https_everywhere.Trygghansa.se - true

FF - user.js: extensions.https_everywhere.Tumblr (partial) - true

FF - user.js: extensions.https_everywhere.TunnelBear - true

FF - user.js: extensions.https_everywhere.TunnelBroker - false

FF - user.js: extensions.https_everywhere.Turn.com - true

FF - user.js: extensions.https_everywhere.Tweakers.net - true

FF - user.js: extensions.https_everywhere.Tweetdeck - true

FF - user.js: extensions.https_everywhere.Twisted4Life - true

FF - user.js: extensions.https_everywhere.TwitPic - true

FF - user.js: extensions.https_everywhere.Twitter - true

FF - user.js: extensions.https_everywhere.Typepad (broken) - false

FF - user.js: extensions.https_everywhere.Typepad - true

FF - user.js: extensions.https_everywhere.U-blox.com - false

FF - user.js: extensions.https_everywhere.UCSB.edu - true

FF - user.js: extensions.https_everywhere.UCSD - true

FF - user.js: extensions.https_everywhere.UCSD.edu - true

FF - user.js: extensions.https_everywhere.UHH_Informatik - true

FF - user.js: extensions.https_everywhere.UIE - true

FF - user.js: extensions.https_everywhere.UK Local Government - true

FF - user.js: extensions.https_everywhere.UN.org - true

FF - user.js: extensions.https_everywhere.UNFPA.org - true

FF - user.js: extensions.https_everywhere.UNIDO.org - true

FF - user.js: extensions.https_everywhere.UNM - true

FF - user.js: extensions.https_everywhere.UNODC.org - true

FF - user.js: extensions.https_everywhere.UNSW - true

FF - user.js: extensions.https_everywhere.UOregon (Partial!) - true

FF - user.js: extensions.https_everywhere.UPC - true

FF - user.js: extensions.https_everywhere.UPU.int - true

FF - user.js: extensions.https_everywhere.UQ WiMAX - true

FF - user.js: extensions.https_everywhere.US Congressional Budget Office - true

FF - user.js: extensions.https_everywhere.US OSHA.gov - true

FF - user.js: extensions.https_everywhere.US Selective Service System - true

FF - user.js: extensions.https_everywhere.US Social Security Administration - true

FF - user.js: extensions.https_everywhere.US SocialSecAdmin - true

FF - user.js: extensions.https_everywhere.US-Cert.gov - true

FF - user.js: extensions.https_everywhere.USBank - true

FF - user.js: extensions.https_everywhere.USDA-ARS - true

FF - user.js: extensions.https_everywhere.USENIX - true

FF - user.js: extensions.https_everywhere.USPS - true

FF - user.js: extensions.https_everywhere.UU.se - true

FF - user.js: extensions.https_everywhere.Ubuntuone - true

FF - user.js: extensions.https_everywhere.UiO - true

FF - user.js: extensions.https_everywhere.Uma.es - true

FF - user.js: extensions.https_everywhere.Unbound - true

FF - user.js: extensions.https_everywhere.Underskog - true

FF - user.js: extensions.https_everywhere.Uni-kl.de - true

FF - user.js: extensions.https_everywhere.United Airlines - true

FF - user.js: extensions.https_everywhere.Universal Subtitles - true

FF - user.js: extensions.https_everywhere.University of Alaska (partial) - true

FF - user.js: extensions.https_everywhere.University of Alaska Jobs (uakjobs.com) - true

FF - user.js: extensions.https_everywhere.University of Illinois at Chicago (partial) - false

FF - user.js: extensions.https_everywhere.University of North Texas (partial) - true

FF - user.js: extensions.https_everywhere.University of Southern Indiana (partial) - true

FF - user.js: extensions.https_everywhere.University of Texas at Austin (partial) - true

FF - user.js: extensions.https_everywhere.University of Texas at Dallas - true

FF - user.js: extensions.https_everywhere.Unreal Development Kit - true

FF - user.js: extensions.https_everywhere.Upay - true

FF - user.js: extensions.https_everywhere.Upplandsvasby.se - true

FF - user.js: extensions.https_everywhere.User-agents.org - false

FF - user.js: extensions.https_everywhere.UserScripts.org - true

FF - user.js: extensions.https_everywhere.UsrJoy - true

FF - user.js: extensions.https_everywhere.VG.no - true

FF - user.js: extensions.https_everywhere.VR.se - true

FF - user.js: extensions.https_everywhere.VTunnel - true

FF - user.js: extensions.https_everywhere.Value Applications - true

FF - user.js: extensions.https_everywhere.VanillaMastercard - true

FF - user.js: extensions.https_everywhere.Verbraucher-sicher-online.de - true

FF - user.js: extensions.https_everywhere.Vereinigte IKK - true

FF - user.js: extensions.https_everywhere.VeriSign - true

FF - user.js: extensions.https_everywhere.Verified Voting - true

FF - user.js: extensions.https_everywhere.Verizon - true

FF - user.js: extensions.https_everywhere.VerticalResponse - true

FF - user.js: extensions.https_everywhere.Viaverio.com - true

FF - user.js: extensions.https_everywhere.VideoLAN - false

FF - user.js: extensions.https_everywhere.Vimeo login - true

FF - user.js: extensions.https_everywhere.Virgin Australia - true

FF - user.js: extensions.https_everywhere.Virgin Mobile AU - true

FF - user.js: extensions.https_everywhere.Virginia Mason Hospital & Medical Center - true

FF - user.js: extensions.https_everywhere.VirusTotal - true

FF - user.js: extensions.https_everywhere.Virusec.com - true

FF - user.js: extensions.https_everywhere.Vision Airlines - true

FF - user.js: extensions.https_everywhere.Vista Forums - true

FF - user.js: extensions.https_everywhere.VisualWebsiteOptimizer - true

FF - user.js: extensions.https_everywhere.Vitelity - true

FF - user.js: extensions.https_everywhere.Vizzit.se - true

FF - user.js: extensions.https_everywhere.Vodafone - true

FF - user.js: extensions.https_everywhere.Volcano eCigs - true

FF - user.js: extensions.https_everywhere.Volkswagen Bank - true

FF - user.js: extensions.https_everywhere.Vonage - true

FF - user.js: extensions.https_everywhere.Vueling - true

FF - user.js: extensions.https_everywhere.Vuze - true

FF - user.js: extensions.https_everywhere.WHO.int (broken) - false

FF - user.js: extensions.https_everywhere.WHO.int - true

FF - user.js: extensions.https_everywhere.WIPmania - true

FF - user.js: extensions.https_everywhere.WTFuzz.com - true

FF - user.js: extensions.https_everywhere.Wachovia - true

FF - user.js: extensions.https_everywhere.Waffles.fm - true

FF - user.js: extensions.https_everywhere.WashingtonPost (broken) - false

FF - user.js: extensions.https_everywhere.Web Faction - true

FF - user.js: extensions.https_everywhere.WebSense - true

FF - user.js: extensions.https_everywhere.Webropolsurveys.com - true

FF - user.js: extensions.https_everywhere.Webtrekk.net - true

FF - user.js: extensions.https_everywhere.Webtru.st Keyserver - true

FF - user.js: extensions.https_everywhere.Wells Fargo - true

FF - user.js: extensions.https_everywhere.Weltbild.ch - true

FF - user.js: extensions.https_everywhere.West Jet - true

FF - user.js: extensions.https_everywhere.WestlandUtrecht Bank - true

FF - user.js: extensions.https_everywhere.Westpac - true

FF - user.js: extensions.https_everywhere.WhatCD - true

FF - user.js: extensions.https_everywhere.WhatIsMyIP - true

FF - user.js: extensions.https_everywhere.Whatimg.com - true

FF - user.js: extensions.https_everywhere.Wiggle - true

FF - user.js: extensions.https_everywhere.Wigle - true

FF - user.js: extensions.https_everywhere.Wikipedia - true

FF - user.js: extensions.https_everywhere.WinPcap - true

FF - user.js: extensions.https_everywhere.Wippies Webmail - true

FF - user.js: extensions.https_everywhere.Wired for Change - true

FF - user.js: extensions.https_everywhere.Wireshark - true

FF - user.js: extensions.https_everywhere.WirtschaftsWoche - true

FF - user.js: extensions.https_everywhere.Wizards of the Coast - true

FF - user.js: extensions.https_everywhere.Wolfram.com - true

FF - user.js: extensions.https_everywhere.Woot (broken) - false

FF - user.js: extensions.https_everywhere.WordPress - true

FF - user.js: extensions.https_everywhere.World Community Grid - true

FF - user.js: extensions.https_everywhere.World Socialist Web Site - true

FF - user.js: extensions.https_everywhere.WorstPills.org - true

FF - user.js: extensions.https_everywhere.XFCE - true

FF - user.js: extensions.https_everywhere.XO Skins - true

FF - user.js: extensions.https_everywhere.XPD.se - true

FF - user.js: extensions.https_everywhere.XS4ALL (partial) - true

FF - user.js: extensions.https_everywhere.Xing - true

FF - user.js: extensions.https_everywhere.Xiph.org - true

FF - user.js: extensions.https_everywhere.Xmarks - true

FF - user.js: extensions.https_everywhere.YFrog - true

FF - user.js: extensions.https_everywhere.Yaha - true

FF - user.js: extensions.https_everywhere.Yahoo! Mail (buggy) - false

FF - user.js: extensions.https_everywhere.Yahoo! Mail 4 (experimental) - false

FF - user.js: extensions.https_everywhere.Yahoo! Mail - true

FF - user.js: extensions.https_everywhere.Yamli API - true

FF - user.js: extensions.https_everywhere.Yandex - true

FF - user.js: extensions.https_everywhere.Yemeksepeti - true

FF - user.js: extensions.https_everywhere.Yieldmanager.com - true

FF - user.js: extensions.https_everywhere.YouMail (buggy) - false

FF - user.js: extensions.https_everywhere.YouTube (buggy) - false

FF - user.js: extensions.https_everywhere.YouTube (partial) - true

FF - user.js: extensions.https_everywhere.YouTube - true

FF - user.js: extensions.https_everywhere.YouTube-nocookie - true

FF - user.js: extensions.https_everywhere.Your Freedom - true

FF - user.js: extensions.https_everywhere.Ytimg.com - true

FF - user.js: extensions.https_everywhere.Yubico - true

FF - user.js: extensions.https_everywhere.ZDNet (buggy) - false

FF - user.js: extensions.https_everywhere.ZDNet - true

FF - user.js: extensions.https_everywhere.ZTunnel - true

FF - user.js: extensions.https_everywhere.Zareason.com - true

FF - user.js: extensions.https_everywhere.Ziggo - true

FF - user.js: extensions.https_everywhere.Zimbra - true

FF - user.js: extensions.https_everywhere.Ziplist.com - true

FF - user.js: extensions.https_everywhere.Zocalopublicsquare (disabled) - false

FF - user.js: extensions.https_everywhere.Zoho - true

FF - user.js: extensions.https_everywhere.Zoosk.com - true

FF - user.js: extensions.https_everywhere.Zscaler - true

FF - user.js: extensions.https_everywhere._observatory.use_custom_proxy - true

FF - user.js: extensions.https_everywhere.associatedcontent.com - true

FF - user.js: extensions.https_everywhere.atdmt.com - true

FF - user.js: extensions.https_everywhere.bankrate.com - true

FF - user.js: extensions.https_everywhere.bit.ly - true

FF - user.js: extensions.https_everywhere.bittorrentdotorg - false

FF - user.js: extensions.https_everywhere.boots.com - true

FF - user.js: extensions.https_everywhere.boum.org - true

FF - user.js: extensions.https_everywhere.btjunkie - true

FF - user.js: extensions.https_everywhere.ccc.de - false

FF - user.js: extensions.https_everywhere.comdirect bank - true

FF - user.js: extensions.https_everywhere.coxnewsweb.net - true

FF - user.js: extensions.https_everywhere.cve.mitre.org - true

FF - user.js: extensions.https_everywhere.e621.net - true

FF - user.js: extensions.https_everywhere.eBid.net - true

FF - user.js: extensions.https_everywhere.eHarmony - true

FF - user.js: extensions.https_everywhere.eHow (broken) - false

FF - user.js: extensions.https_everywhere.eHow - true

FF - user.js: extensions.https_everywhere.ePay.bg - true

FF - user.js: extensions.https_everywhere.ehrensenf - false

FF - user.js: extensions.https_everywhere.examiner.com - true

FF - user.js: extensions.https_everywhere.firstrun_context_menu - false

FF - user.js: extensions.https_everywhere.georgetown.edu - true

FF - user.js: extensions.https_everywhere.go!Mokulele - true

FF - user.js: extensions.https_everywhere.hi5 - true

FF - user.js: extensions.https_everywhere.iPerceptions - true

FF - user.js: extensions.https_everywhere.krebsonsecurity.com - true

FF - user.js: extensions.https_everywhere.kuro5hin.org - true

FF - user.js: extensions.https_everywhere.leadback.advertising.com - true

FF - user.js: extensions.https_everywhere.lists.mindrot.org - true

FF - user.js: extensions.https_everywhere.meinVZ - false

FF - user.js: extensions.https_everywhere.mixx.com - true

FF - user.js: extensions.https_everywhere.net-security.org - true

FF - user.js: extensions.https_everywhere.netzclub - true

FF - user.js: extensions.https_everywhere.newsvine.com - true

FF - user.js: extensions.https_everywhere.one.com - true

FF - user.js: extensions.https_everywhere.partypoker - true

FF - user.js: extensions.https_everywhere.politisktinkorrekt.info - true

FF - user.js: extensions.https_everywhere.prq.se - true

FF - user.js: extensions.https_everywhere.quantserve.com - true

FF - user.js: extensions.https_everywhere.redmine.ruby-lang.org - true

FF - user.js: extensions.https_everywhere.ripe.net - true

FF - user.js: extensions.https_everywhere.romab.com - true

FF - user.js: extensions.https_everywhere.scounter.rambler.ru - true

FF - user.js: extensions.https_everywhere.secure-u e.V. (default off) - false

FF - user.js: extensions.https_everywhere.sidux e.V. (default off) - false

FF - user.js: extensions.https_everywhere.snagajob - true

FF - user.js: extensions.https_everywhere.so36.NET - true

FF - user.js: extensions.https_everywhere.switch.ch - true

FF - user.js: extensions.https_everywhere.terreActive - true

FF - user.js: extensions.https_everywhere.uTorrent (broken) - false

FF - user.js: extensions.https_everywhere.veracode.com - true

FF - user.js: extensions.https_everywhere.voterVOICE - true

FF - user.js: extensions.https_everywhere.web.de - true

FF - user.js: extensions.https_everywhere.webtrends.com - true

FF - user.js: extensions.https_everywhere.weoInvoice - true

FF - user.js: extensions.https_everywhere.wuala - true

FF - user.js: extensions.https_everywhere.wunderground.com (buggy) - false

FF - user.js: extensions.https_everywhere.wunderground.com - true

FF - user.js: extensions.https_everywhere.xkcd - true

FF - user.js: extensions.https_everywhere.yfrog - true

FF - user.js: extensions.installCache - [{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\c:\\\\program files\\\\mozilla firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1350156093253}}},{\name\:\app-profile\,\addons\:{\{27c60876-b5c9-4335-b4f3-52b26782220c}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi\,\mtime\:1349380511700},\{6614d11d-d21d-b211-ae23-815234e1ebb5}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{6614d11d-d21d-b211-ae23-815234e1ebb5}.xpi\,\mtime\:1349378186336},\{73a6fe31-595d-460b-a920-fcc0f8843232}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi\,\mtime\:1350664152262},\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\,\mtime\:1349209648947},\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\,\mtime\:1343388656867},\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi\,\mtime\:1327411041374},\{e001c731-5e37-4538-a5cb-8168736a2360}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{e001c731-5e37-4538-a5cb-8168736a2360}\,\mtime\:1350483551845}}}]

FF - user.js: extensions.lastAppVersion - 16.0.1

FF - user.js: extensions.lastPlatformVersion - 16.0.1

FF - user.js: extensions.pendingOperations - false

FF - user.js: extensions.shownSelectionUI - true

FF - user.js: extensions.ui.dictionary.hidden - true

FF - user.js: extensions.ui.lastCategory - addons://list/plugin

FF - user.js: extensions.ui.locale.hidden - true

FF - user.js: extensions.wrc.RulesVersion - 110712152532999

FF - user.js: extensions.wrc.SearchRules./v1/update/rule/foo.bar.style - some style

FF - user.js: extensions.wrc.SearchRules./v1/update/rule/foo.bar.url - testik.bb

FF - user.js: extensions.wrc.SearchRules.ask.com.style - .WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.ask.com.url - ^http(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*

FF - user.js: extensions.wrc.SearchRules.atlas.cz.style - .WRCN {display:none} .result .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.atlas.cz.url - ^http\\:\\/\\/searchatlas\\.centrum\\.cz\\/.+

FF - user.js: extensions.wrc.SearchRules.atlas.sk.style - .WRCN {display:none} .katalogSponsorItem .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.atlas.sk.url - ^http\\:\\/\\/hladaj\\.atlas\\.sk\\/.+

FF - user.js: extensions.wrc.SearchRules.baidu.com.style - .WRCN {display:none} .result .f .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.baidu.com.url - ^http\\:\\/\\/www\\.baidu\\.com\\/.*

FF - user.js: extensions.wrc.SearchRules.bing.com.style - .WRCN {display:none} .sb_tlst .WRCN, .sp_pss .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.bing.com.url - ^http(s)?\\:\\/\\/www\\.bing\\.com\\/(.)*

FF - user.js: extensions.wrc.SearchRules.centrum.cz.style - .WRCN {display:none} .results-list h3 > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.centrum.cz.url - ^http(s)?\\:\\/\\/search\\.centrum\\.cz\\/(.)*

FF - user.js: extensions.wrc.SearchRules.centrum.sk.style - .WRCN {display:none} .katalogSponsorItem .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.centrum.sk.url - ^http\\:\\/\\/search\\.centrum\\.sk\\/.+

FF - user.js: extensions.wrc.SearchRules.delicious.com.style - .WRCN {display:none} .taggedlink + .WRCN, .data .full-url .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.delicious.com.url - ^http\\:\\/\\/www\\.delicious\\.com\\/(.)*

FF - user.js: extensions.wrc.SearchRules.dmoz.org.style - .WRCN {display:none} ol.site li .WRCN{display:inline !important; background: url(\IMAGE\) right no-repeat} ol.site li .ref .WRCN {display:none!important}

FF - user.js: extensions.wrc.SearchRules.dmoz.org.url - ^http\\:\\/\\/www\\.dmoz\\.org\\/search(.)+

FF - user.js: extensions.wrc.SearchRules.excite.com.style - .WRCN {display:none} .listing .resultsLink + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.excite.com.url - ^http\\:\\/\\/msxml\\.excite\\.com\\/excite\\/ws\\/.+

FF - user.js: extensions.wrc.SearchRules.facebook.com.style - .WRCN {display:none} .WRCN {display:none} .uiAttachmentTitle .WRCN, .uiStreamMessage .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.facebook.com.url - ^http\\:\\/\\/www\\.facebook\\.com\\/.*

FF - user.js: extensions.wrc.SearchRules.fastweb.it.style - .WRCN {display:none} .gs-title .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.fastweb.it.url - ^http\\:\\/\\/www\\.fastweb\\.it\\/portale\\/google\\/.+

FF - user.js: extensions.wrc.SearchRules.gazeta.pl.style - .WRCN {display:none} .res_body .res_entry .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.gazeta.pl.url - ^http\\:\\/\\/szukaj\\.gazeta\\.pl\\/.+

FF - user.js: extensions.wrc.SearchRules.google.com.style - .WRCN {display:none} .r .WRCN, .osl .WRCN, .bc .WRCN, .fc .WRCN, #rhsline ol .WRCN {display:inline; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.google.com.url - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.*

FF - user.js: extensions.wrc.SearchRules.interia.pl.style - .WRCN {display:none} .row .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.interia.pl.url - ^http\\:\\/\\/(www\\.)?google\\.interia\\.pl\\/szukaj\\/.+

FF - user.js: extensions.wrc.SearchRules.lycos.com.style - .WRCN {display:none} .results .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .results .sponsored .WRCN {display: none!important}

FF - user.js: extensions.wrc.SearchRules.lycos.com.url - ^http\\:\\/\\/search\\.lycos\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+

FF - user.js: extensions.wrc.SearchRules.onet.pl.style - .WRCN {display:none} #main .link .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.onet.pl.url - ^http\\:\\/\\/szukaj\\.onet\\.pl\\/.+

FF - user.js: extensions.wrc.SearchRules.paginegialle.it.style - .WRCN {display:none} .lnkwww + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.paginegialle.it.url - ^http\\:\\/\\/www\\.paginegialle\\.it\\/pgol\\/.+

FF - user.js: extensions.wrc.SearchRules.public.avast.com.style - .WRCN {display:inline; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.public.avast.com.url - ^http(s)?\\:\\/\\/public\\.avast\\.com\\/(.)*

FF - user.js: extensions.wrc.SearchRules.rambler.ru.style - .WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.rambler.ru.url - ^http\\:\\/\\/nova\\.rambler\\.ru\\/.+

FF - user.js: extensions.wrc.SearchRules.scroogle.org.style - a + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.scroogle.org.url - ^http\\:\\/\\/www\\.scroogle\\.org\\/.*

FF - user.js: extensions.wrc.SearchRules.seznam.cz.style - .WRCN {display:none} #results .text .WRCN, .sklik-title > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.seznam.cz.url - ^http(s)?\\:\\/\\/search\\.seznam\\.cz\\/(.)*

FF - user.js: extensions.wrc.SearchRules.sky.com.style - .WRCN {display:none} #results h3 .WRCN, #sponsored_top h3 .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.sky.com.url - ^http\\:\\/\\/search\\.sky\\.com/.+

FF - user.js: extensions.wrc.SearchRules.slashdot.org.style - .WRCN {display:none} .body i .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.slashdot.org.url - ^http\\:\\/\\/slashdot\\.org\\/.*

FF - user.js: extensions.wrc.SearchRules.terra.com.br.style - .WRCN {display:none} .col-left-full .list-results .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.terra.com.br.url - ^http\\:\\/\\/buscador\\.terra\\.com\\.br\\/.+

FF - user.js: extensions.wrc.SearchRules.tiscali.it.style - .WRCN {display:none} .item .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.tiscali.it.url - ^http\\:\\/\\/search\\.tiscali\\.it\\/.+

FF - user.js: extensions.wrc.SearchRules.twitter.com.style - .WRCN {display:none} .entry-content .web + .WRCN, .twtr-tweet-text .twtr-hyperlink + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.twitter.com.url - ^hxxp://twitter\\.com\\/.*

FF - user.js: extensions.wrc.SearchRules.uol.com.br.style - .WRCN {display:none} #results dt .WRCN, #results .link .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} #results .link .similar .WRCN {display: none!important}

FF - user.js: extensions.wrc.SearchRules.uol.com.br.url - ^http\\:\\/\\/(.\\.)?busca\\.uol\\.com\\.br\\/.+

FF - user.js: extensions.wrc.SearchRules.virgilio.it.style - .WRCN {display:none} .risultati .record .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .risultati .record .sponsor + .WRCN {display: none!important}

FF - user.js: extensions.wrc.SearchRules.virgilio.it.url - ^http\\:\\/\\/ricerca\\.virgilio\\.it\\/.+

FF - user.js: extensions.wrc.SearchRules.virginmedia.com.style - .WRCN {display:none} .result-title .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.virginmedia.com.url - ^http\\:\\/\\/search\\.virginmedia\\.com\\/.+

FF - user.js: extensions.wrc.SearchRules.whereis.com.style - .WRCN {display:none} .priority_url .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.whereis.com.url - ^http\\:\\/\\/www\\.whereis\\.com\\/.*

FF - user.js: extensions.wrc.SearchRules.wp.pl.style - .WRCN {display:none} .rek big .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.wp.pl.url - ^http\\:\\/\\/szukaj\\.wp\\.pl\\/.+

FF - user.js: extensions.wrc.SearchRules.yahoo.com.style - .WRCN {display:none} .sm-hd .WRCN, .sm-links .WRCN, .res h3 > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.yahoo.com.url - ^http(s)?\\:\\/\\/((.)+\\.)?search\\.yahoo\\.com\\/(.)*

FF - user.js: extensions.wrc.SearchRules.yandex.ru.style - .WRCN {display:none} .b-serp-item__title-link + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.yandex.ru.url - ^http\\:\\/\\/yandex\\.ru\\/.+

FF - user.js: extensions.wrc.SearchRules.yell.com.style - .WRCN {display:none} .advert-content .WRCN, .other-cta .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .advert-content .star + .WRCN, .advert-content .logoImg + .WRCN, .other-cta .shareLink + .WRCN {display: none!important}

FF - user.js: extensions.wrc.SearchRules.yell.com.url - ^http\\:\\/\\/www\\.yell\\.com\\/.+

FF - user.js: extensions.wrc.SearchRules.zoznam.sk.style - .WRCN {display:none} .box_content .link_right .link_title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}

FF - user.js: extensions.wrc.SearchRules.zoznam.sk.url - ^http\\:\\/\\/www\\.zoznam\\.sk\\/.+

FF - user.js: general.autoScroll - false

FF - user.js: gfx.direct2d.disabled - true

FF - user.js: idle.lastDailyNotification - 1350599725

FF - user.js: intl.charsetmenu.browser.cache - windows-1252, ISO-8859-15, windows-1251, us-ascii, UTF-8

FF - user.js: layers.acceleration.disabled - true

FF - user.js: layout.spellcheckDefault - 0

FF - user.js: network.cookie.prefsMigrated - true

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: network.proxy.no_proxies_on -

FF - user.js: network.proxy.socks_version - 4

FF - user.js: network.proxy.type - 0

FF - user.js: noscript.ABE.migration - 1

FF - user.js: noscript.gtemp -

FF - user.js: noscript.options.tabSelectedIndexes - 5,5,0

FF - user.js: noscript.policynames -

FF - user.js: noscript.subscription.lastCheck - 2068954390

FF - user.js: noscript.temp -

FF - user.js: noscript.version - 2.5.8

FF - user.js: noscript.visibleUIChecked - true

FF - user.js: places.database.lastMaintenance - 1350166190

FF - user.js: places.history.expiration.transient_current_max_pages - 20089

FF - user.js: places.history.expiration.transient_optimal_database_size - 32142294

FF - user.js: plugin.expose_full_path - true

FF - user.js: pref.advanced.javascript.disable_button.advanced - false

FF - user.js: pref.browser.homepage.disable_button.current_page - false

FF - user.js: pref.general.disable_button.default_browser - false

FF - user.js: pref.privacy.disable_button.view_passwords - false

FF - user.js: privacy.cpd.extensions-betterprivacy - true

FF - user.js: privacy.cpd.offlineApps - true

FF - user.js: privacy.cpd.siteSettings - true

FF - user.js: privacy.donottrackheader.enabled - true

FF - user.js: privacy.sanitize.migrateFx3Prefs - true

FF - user.js: privacy.sanitize.timeSpan - 0

FF - user.js: security.disable_button.openDeviceManager - false

FF - user.js: security.enable_ssl3 - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: services.sync.clients.lastSync - 0

FF - user.js: services.sync.clients.lastSyncLocal - 0

FF - user.js: services.sync.globalScore - 0

FF - user.js: services.sync.lastversion - 1.17.0

FF - user.js: services.sync.migrated - true

FF - user.js: services.sync.nextSync - 0

FF - user.js: services.sync.tabs.lastSync - 0

FF - user.js: services.sync.tabs.lastSyncLocal - 0

FF - user.js: signon.rememberSignons - false

FF - user.js: spellchecker.dictionary - en-US

FF - user.js: storage.vacuum.last.index - 1

FF - user.js: storage.vacuum.last.places.sqlite - 1348604826

FF - user.js: toolkit.startup.last_success - 1350688674

FF - user.js: toolkit.telemetry.prompted - 2

FF - user.js: ui.submenuDelay - 0

FF - user.js: urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey - 1350770211

FF - user.js: weboftrust.automatic_updates - false

FF - user.js: weboftrust.button_created - true

FF - user.js: weboftrust.cookie_updated - 1350688678639

FF - user.js: weboftrust.extension_id - 6bfe6fcb9a4228a971b08ded8a77d2d00f4da816

FF - user.js: weboftrust.firstrun_guide - 2

FF - user.js: weboftrust.last_message - 20120222

FF - user.js: weboftrust.last_version - 20120926

FF - user.js: weboftrust.search.aolsearch.display - AOL Search

FF - user.js: weboftrust.search.aolsearch.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/

FF - user.js: weboftrust.search.aolsearch.pre0.match - 3

FF - user.js: weboftrust.search.aolsearch.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*redir\\\\?.*s_cu=(http.+)(&.*)?

FF - user.js: weboftrust.search.aolsearch.prestyle - .HL [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.aolsearch.style - a.find ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.aolsearch.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*search\\\\?.+

FF - user.js: weboftrust.search.ask.display - Ask.com Web Search

FF - user.js: weboftrust.search.ask.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/|^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.com\\/(pagead|aclk)

FF - user.js: weboftrust.search.ask.pre0.match - 4

FF - user.js: weboftrust.search.ask.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/(bar|r)\\\\?.*&u=(http[^&]+)

FF - user.js: weboftrust.search.ask.prestyle - .s_binoc2 ~ [ATTR], .nu ~ [ATTR], [ATTR=\safeweb.norton.com\] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.ask.style - a.title ~ [ATTR=\NAME\], a.L4 ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.ask.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/web\\\\?.+

FF - user.js: weboftrust.search.avg.display - AVG

FF - user.js: weboftrust.search.avg.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)avg\\.com\\/

FF - user.js: weboftrust.search.avg.style - .vsc a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 0px; position: relative; }

FF - user.js: weboftrust.search.avg.url - ^http(s)?\\:\\/\\/isearch\\.avg\\.com\\/search\\?

FF - user.js: weboftrust.search.baidu.display - Baidu

FF - user.js: weboftrust.search.baidu.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/

FF - user.js: weboftrust.search.baidu.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.baidu.style - .f a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.baidu.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/s\\\\?.+

FF - user.js: weboftrust.search.bing.display - Bing

FF - user.js: weboftrust.search.bing.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(msn(scache)?|live|bingj?|microsofttranslator)\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/

FF - user.js: weboftrust.search.bing.ninja - 1

FF - user.js: weboftrust.search.bing.prestyle - .rc_p [ATTR], .sb_vdl [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.bing.style - .nc_tc a ~ [ATTR=\NAME\], .sb_tlst a ~ [ATTR=\NAME\], .sn_rct a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.bing.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*bing\\.com\\/search\\\\?

FF - user.js: weboftrust.search.daum.display - Daum

FF - user.js: weboftrust.search.daum.dynamic - 1

FF - user.js: weboftrust.search.daum.ign - ^http(s)?:\\/\\/(.+\\.)?daum\\.net

FF - user.js: weboftrust.search.daum.pre0.match - 2

FF - user.js: weboftrust.search.daum.pre0.re - ^http(s)?:\\/\\/adtc.daum.net\\/clk\\?.+\\&s=(.+)$

FF - user.js: weboftrust.search.daum.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.daum.style - .tit > a ~ [ATTR=\NAME\], #sponColl a.urlLink ~ [ATTR=\NAME\], #twitterColl .f_link ~ [ATTR=\NAME\], #premColl a.urlLink ~ [ATTR=\NAME\], #splinkColl a.urlLink ~ [ATTR=\NAME\], .wrap_tit a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; } #vclipColl [ATTR=\NAME\] {visibility:hidden; position: absolute; }

FF - user.js: weboftrust.search.daum.url - ^http:\\/\\/search\\.daum\\.net\\/search

FF - user.js: weboftrust.search.dogpile.display - Dogpile

FF - user.js: weboftrust.search.dogpile.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/|^http\\:\\/\\/(.+\\.)?r\\.msn\\.com\\/

FF - user.js: weboftrust.search.dogpile.pre0.match - 3

FF - user.js: weboftrust.search.dogpile.pre0.re - ^http(s)?\\:\\/\\/cs\\.(dogpile|infospace)\\.com\\/ClickHandler.+ru=(http[^&]+)

FF - user.js: weboftrust.search.dogpile.prestyle - .paidSearchResult [ATTR] { display: none ! important; } .searchResultsPane { max-width: 44.08em; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.dogpile.style - a.resultTitle ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.dogpile.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/(info\\.[^\\/]+/)?(search\\/)?web.+

FF - user.js: weboftrust.search.duckduckgo.display - DuckDuckGo

FF - user.js: weboftrust.search.duckduckgo.dynamic - 1

FF - user.js: weboftrust.search.duckduckgo.ign - ^https?\\:\\/\\/([\\w\\-]+\\.)?duckduckgo\\.com\\/

FF - user.js: weboftrust.search.duckduckgo.prestyle - .icon_fav2 a[href*=\mywot.com\], .icon_fav img[src^=\/wot/\] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.duckduckgo.style - .links_main h2 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 5px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.duckduckgo.url - ^https?\\:\\/\\/duckduckgo\\.com\\/

FF - user.js: weboftrust.search.facebook.display - Facebook

FF - user.js: weboftrust.search.facebook.dynamic - 1

FF - user.js: weboftrust.search.facebook.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(facebook\\.(com|net)|fbcdn\\.net|bing\\.com|akamaihd\\.net)\\/

FF - user.js: weboftrust.search.facebook.match0.attribute0.flags - n

FF - user.js: weboftrust.search.facebook.match0.attribute0.name - class

FF - user.js: weboftrust.search.facebook.match0.attribute0.re - mceContentBody

FF - user.js: weboftrust.search.facebook.match0.element - body

FF - user.js: weboftrust.search.facebook.pre0.match - 3

FF - user.js: weboftrust.search.facebook.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?facebook\\.com\\/l\\.php\\?.*u=([^&]+)

FF - user.js: weboftrust.search.facebook.prestyle - ._8t ~ [ATTR], .ogAggregationAppIcon ~ [ATTR], a.fbImageContainer ~ [ATTR], a.ogObjectScaledImageLink ~ [ATTR], a.shareMediaLink ~ [ATTR], a.-cx-PRIVATE-uiImageBlock__image ~ [ATTR], a.ogAggregateTableRowImage ~ [ATTR], a.uiIconText ~ [ATTR], a.timelineRecentActivityThumb ~ [ATTR], .ogProfileGallery .mbs a ~ [ATTR], a.uiImageBlockImage ~ [ATTR], .uiHeader [ATTR], a.uiLinkSubtle ~ [ATTR], .profile-picture [ATTR], .HovercardContent td > a ~ [ATTR], .uiAttachmentTitle ~ a ~ [ATTR], a.UIImageBlock_Image ~ [ATTR], .UIMediaItem [ATTR], .UIStoryAttachment_Caption [ATTR], .uiStreamPassive [ATTR], #jewelContainer [ATTR], a.ogAggregationExpandedGridIcon ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } .shareRedesign .attachmentText { max-height: 88px ! important; } .shareRedesign .attachmentText [ATTR] { margin-left: 0px ! important; margin-right: 4px; } .shareRedesignContainer .shareText { min-height: 50px ! important; }

FF - user.js: weboftrust.search.facebook.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.facebook.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*facebook\\.com\\/

FF - user.js: weboftrust.search.facebook.urlign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*facebook\\.com\\/(plugins|extern)\\/

FF - user.js: weboftrust.search.gmail.display - Gmail

FF - user.js: weboftrust.search.gmail.dynamic - 1

FF - user.js: weboftrust.search.gmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(google|googlesyndication)\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/

FF - user.js: weboftrust.search.gmail.match0.attribute0.flags - n

FF - user.js: weboftrust.search.gmail.match0.attribute0.name - class

FF - user.js: weboftrust.search.gmail.match0.attribute0.re - editable

FF - user.js: weboftrust.search.gmail.match0.element - body

FF - user.js: weboftrust.search.gmail.prestyle - .e ~ [ATTR], #gbd [ATTR], #gbi [ATTR], .vd ~ [ATTR], .Ni ~ [ATTR], .mr ~ [ATTR], .gbt [ATTR], [ATTR] { position: absolute; visibility: hidden; } .e:last-of-type ~ [ATTR] { position: relative; visibility: visible; } #message-area-container ~ #container .source-link ~ [ATTR], #message-area-container ~ #container .title-link ~ [ATTR] { display: none ! important; }

FF - user.js: weboftrust.search.gmail.searchlevel - 60

FF - user.js: weboftrust.search.gmail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 2px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.gmail.url - ^http(s)?\\:\\/\\/mail\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(mail|a)\\/.+

FF - user.js: weboftrust.search.gmail.urlign - &(name=htmlcompose|view=(js|cw)&)

FF - user.js: weboftrust.search.google.display - Google

FF - user.js: weboftrust.search.google.dynamic - 1

FF - user.js: weboftrust.search.google.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|support|docs|picasaweb|profiles|adwords|labs|investor|encrypted|code|services|checkout|trends|plus)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\:

FF - user.js: weboftrust.search.google.ninja - 1

FF - user.js: weboftrust.search.google.pre0.match - 9

FF - user.js: weboftrust.search.google.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|interstitial|product_url)\\\\?.*&?(q|url)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.google.prestyle - a.domainLink ~ [ATTR], #wotsafesearchlinks [ATTR], #gb [ATTR], #gbd [ATTR], .g > div > div > div span > a.l ~ [ATTR], .ts td > a ~ [ATTR], .result-image [ATTR], .cite ~ [ATTR], .gl [ATTR], .g > a:not([class]):first-child ~ [ATTR], a.f1 ~ [ATTR], a.fl ~ [ATTR], a[href^=\/\][href*=\&oi=video_result\] ~ [ATTR], a[href^=\/\][href*=\&ct=image\] ~ [ATTR], a[href^=\/\][href*=\&sa=X&\] ~ [ATTR], .slk [ATTR], #gbar [ATTR], #ssb [ATTR], #doc3 [ATTR], #sft [ATTR], .osl [ATTR], #rtr [ATTR], .bc [ATTR], #nycprv [ATTR], #tads .oslk [ATTR] { display: none !important; } a[creator=\SiteAdvisor\] img { position: relative !important; } [mclinkinfo] a ~ [ATTR], a[creator=\SiteAdvisor\] + [ATTR=\siteadvisor.com\], [id^=\BubbleLayer\] [ATTR] { display: none !important; } [ATTR] { display: none !important; } #res h3.r { overflow: visible !important; }

FF - user.js: weboftrust.search.google.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; display: inline-block ! important; }

FF - user.js: weboftrust.search.google.url - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/

FF - user.js: weboftrust.search.google.urlign - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(\\+|a\\/|accounts|ad(s|manager|planner|sense|words)|alerts|analytics|apps|appserve|base|calendar|chrome(frame)?|codesearch|comparisonads|corporate|crisisresponse|datacenter|dfp|dictionary|doodle|educators|enterprise|events|experimental|familysafety|finance|flutrends|friendconnect|goog411|googlebooks|googlenotebook|googlevoice|gwt|help|history|hostednews|images|imgres|ime|insights|landing|local|logos|mapmaker|maps|mobile|moon|music|newproducts|news|notebook|patents|phone|postini|powermeter|press|profiles|publicdata|puzzles|onlinechallenge|racing|reader|recaptcha|relief|services|s2|sitesearch|sky|smallbusinessnetwork|squared|submit|support|sync|talk|toolbar|ventures|voice|wallet|web(masters|elements)|intl\\/[^\\/]+\\/.+|search\\\\?.*tbm=isch)

FF - user.js: weboftrust.search.googleimages.display - Google Image Search

FF - user.js: weboftrust.search.googleimages.dynamic - 1

FF - user.js: weboftrust.search.googleimages.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|docs|picasaweb|adwords|labs|investor)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\:

FF - user.js: weboftrust.search.googleimages.pre0.match - 5

FF - user.js: weboftrust.search.googleimages.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/imgres\\\\?.*img(ref)?url=(.+)(&.*)?

FF - user.js: weboftrust.search.googleimages.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.googleimages.style - a.rg_l ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 5px; left: 5px; position: absolute; visibility: visible; } #ImgContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 0px; ; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.googleimages.url - ^http(s)?\\:\\/\\/(www|images)\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(images\\\\?.+|search\\\\?.*tbm=isch)

FF - user.js: weboftrust.search.goojp.display - goo

FF - user.js: weboftrust.search.goojp.ign - ^http:\\/\\/(.+)?goo\\.ne\\.jp\\/

FF - user.js: weboftrust.search.goojp.pre0.match - 6

FF - user.js: weboftrust.search.goojp.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?

FF - user.js: weboftrust.search.goojp.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.goojp.style - .res a.link ~ [ATTR=\NAME\], .sponser a.link + [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; margin-right:0.4em; top: 0.2em; position: relative; visibility: visible; opacity: 0.9; } .sponser a.link + [ATTR=\NAME\] { top: 0em; }

FF - user.js: weboftrust.search.goojp.url - ^http:\\/\\/(.+\\.)?search\\.goo\\.ne\\.jp\\/(web\\.jsp|search)

FF - user.js: weboftrust.search.hotmail.display - Windows Live Hotmail

FF - user.js: weboftrust.search.hotmail.dynamic - 1

FF - user.js: weboftrust.search.hotmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(live|(imagine-)?msn|microsoft)\\.com\\/

FF - user.js: weboftrust.search.hotmail.match0.element - #mp0_msgPartBody

FF - user.js: weboftrust.search.hotmail.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.hotmail.searchlevel - 60

FF - user.js: weboftrust.search.hotmail.style - .MsgPartBody a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.hotmail.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*mail\\.live\\.com\\/mail\\/

FF - user.js: weboftrust.search.ixquick.display - Ixquick

FF - user.js: weboftrust.search.ixquick.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/?

FF - user.js: weboftrust.search.ixquick.pre0.match - 6

FF - user.js: weboftrust.search.ixquick.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?

FF - user.js: weboftrust.search.ixquick.pre1.match - 4

FF - user.js: weboftrust.search.ixquick.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/highlight.*&u=(http[^&]*)

FF - user.js: weboftrust.search.ixquick.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.ixquick.style - a.title ~ [ATTR=\NAME\], a.title2 ~ [ATTR=\NAME\], .result h3 > a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.ixquick.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/(meta)?search

FF - user.js: weboftrust.search.libero.display - Libero Ricerca

FF - user.js: weboftrust.search.libero.ign - https?:\\/\\/(.+\\.)?libero\\.it\\/

FF - user.js: weboftrust.search.libero.pre0.match - 6

FF - user.js: weboftrust.search.libero.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?

FF - user.js: weboftrust.search.libero.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.libero.style - a.webItemTitle ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; } a.urlLink ~ [ATTR=\NAME\] {position: absolute; visibility: hidden;}

FF - user.js: weboftrust.search.libero.url - https?:\\/\\/arianna\\.libero\\.it\\/search\\/

FF - user.js: weboftrust.search.mailru.display - Mail.Ru

FF - user.js: weboftrust.search.mailru.ign - ^http(s)?\\:\\/\\/(.+\\.)?mail\\.ru\\/

FF - user.js: weboftrust.search.mailru.pre0.match - 9

FF - user.js: weboftrust.search.mailru.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.mailru.prestyle - a ~ [ATTR] ~ a ~ [ATTR], .video-thumb [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.mailru.style - .res-head a ~ [ATTR=\NAME\], .ttl a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; top: 0.15em; opacity: 0.9; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.mailru.url - ^http(s)?\\:\\/\\/go\\.mail\\.ru\\/search\\?.+

FF - user.js: weboftrust.search.naver.display - Naver

FF - user.js: weboftrust.search.naver.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/

FF - user.js: weboftrust.search.naver.prestyle - .thumb_wrap [ATTR], .thumb [ATTR], .mov_thumb [ATTR], .btn_area [ATTR], .txt_block [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.naver.style - #content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.naver.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/search.*\\\\?.+

FF - user.js: weboftrust.search.odnoklassniki.display - Odnoklassniki.ru

FF - user.js: weboftrust.search.odnoklassniki.dynamic - 1

FF - user.js: weboftrust.search.odnoklassniki.ign - ^http(s)?\\:\\/\\/((.+\\.)?odnoklassniki\\.ru)|((.+\\.)?mail\\.ru)\\/

FF - user.js: weboftrust.search.odnoklassniki.match0.attribute0.flags - n

FF - user.js: weboftrust.search.odnoklassniki.match0.attribute0.name - id

FF - user.js: weboftrust.search.odnoklassniki.match0.attribute0.re - rtaArea

FF - user.js: weboftrust.search.odnoklassniki.match0.element - div

FF - user.js: weboftrust.search.odnoklassniki.pre0.match - 6

FF - user.js: weboftrust.search.odnoklassniki.pre0.re - http(s)?\\:\\/\\/((.+\\.)?odnoklassniki\\.ru)\\/dk\\?cmd=logexternal&.*(st\\.link)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.odnoklassniki.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.odnoklassniki.style - #hook_Block_MainContainer a ~ [ATTR=\NAME\], .messageMarker a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.odnoklassniki.url - ^http(s)?\\:\\/\\/(.+\\.)?odnoklassniki\\.ru\\/

FF - user.js: weboftrust.search.onetpl.display - Onet Szukaj

FF - user.js: weboftrust.search.onetpl.ign - ^http(s)?:\\/\\/(.+\\.)?onet\\.pl\\/

FF - user.js: weboftrust.search.onetpl.pre0.match - 6

FF - user.js: weboftrust.search.onetpl.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*%26(q|url)%3D(.+)(&.*)?

FF - user.js: weboftrust.search.onetpl.prestyle - [ATTR] { position: absolute; visibility: hidden; } .linkGoogle a, .link a {display: inline !important; }

FF - user.js: weboftrust.search.onetpl.style - .link > a ~ [ATTR=\NAME\], .linkGoogle a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; margin-right:0.4em; top: 0.1em; position: relative; visibility: visible; opacity: 0.9; }

FF - user.js: weboftrust.search.onetpl.url - ^http(s)?:\\/\\/szukaj\\.onet\\.pl\\/.+\\.html

FF - user.js: weboftrust.search.pinterest.display - Pinterest

FF - user.js: weboftrust.search.pinterest.dynamic - 1

FF - user.js: weboftrust.search.pinterest.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*pinterest.com\\/)|(twitter\\.com\\/)|(facebook\\.com\\/)

FF - user.js: weboftrust.search.pinterest.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; opacity:0.9; visibility: visible; } a.facebook ~ [ATTR=\NAME\], a.twitter ~ [ATTR=\NAME\], #PinImageHolder a ~ [ATTR=\NAME\] {visibility: hidden; }

FF - user.js: weboftrust.search.pinterest.url - ^http(s)?\\:\\/\\/pinterest.com\\/

FF - user.js: weboftrust.search.rambler.display - Rambler

FF - user.js: weboftrust.search.rambler.ign - ^http(s)?\\:\\/\\/(.+\\.)?rambler\\.ru\\/

FF - user.js: weboftrust.search.rambler.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.rambler.style - .serp a[class^=\n_title\] ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.rambler.url - ^http(s)?\\:\\/\\/nova\\.rambler\\.ru\\/(search|srch)\\?.+

FF - user.js: weboftrust.search.reddit.display - reddit

FF - user.js: weboftrust.search.reddit.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/

FF - user.js: weboftrust.search.reddit.prestyle - .thumbnail ~ [ATTR], .footer [ATTR], #ad [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.reddit.style - .content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.reddit.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/

FF - user.js: weboftrust.search.reddit.urlign - ^http(s)?\\:\\/\\/blog\\.reddit\\.com\\/

FF - user.js: weboftrust.search.sapo.display - Pesquisa SAPO

FF - user.js: weboftrust.search.sapo.ign - ^https?:\\/\\/(.+\\.)?sapo\\.pt\\/

FF - user.js: weboftrust.search.sapo.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.sapo.style - .title a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.sapo.url - ^https?:\\/\\/pesquisa\\.sapo\\.pt\\/

FF - user.js: weboftrust.search.seznam.display - Seznam

FF - user.js: weboftrust.search.seznam.ign - ^http(s)?\\:\\/\\/(.+\\.)?(seznam|sklik)\\.cz\\/

FF - user.js: weboftrust.search.seznam.pre0.match - 3

FF - user.js: weboftrust.search.seznam.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?sklik\\.cz\\/click.*url=([^&]+)

FF - user.js: weboftrust.search.seznam.prestyle - .limiter > a ~ [ATTR], .hintImage a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.seznam.style - .result a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.seznam.url - ^http(s)?\\:\\/\\/search\\.seznam\\.cz\\/

FF - user.js: weboftrust.search.topsy.display - Topsy

FF - user.js: weboftrust.search.topsy.dynamic - 1

FF - user.js: weboftrust.search.topsy.ign - http\\:\\/\\/([\\w\\-]+\\.)topsy\\.com\\/

FF - user.js: weboftrust.search.topsy.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.topsy.style - a.x-result-link-title ~ [ATTR=\NAME\], a.trending-list-link ~ [ATTR=\NAME\], a.texturl ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 3px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.topsy.url - ^http\\:\\/\\/(plus\\.)?topsy\\.com\\/

FF - user.js: weboftrust.search.twitter.display - Twitter

FF - user.js: weboftrust.search.twitter.dynamic - 1

FF - user.js: weboftrust.search.twitter.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/

FF - user.js: weboftrust.search.twitter.prestyle - .meta a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.twitter.style - #content a ~ [ATTR=\NAME\], .tweet-text a ~ [ATTR=\NAME\], .message-content a ~ [ATTR=\NAME\], .js-tweet-text a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.twitter.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/

FF - user.js: weboftrust.search.twitter.urlign - ^http(s)?\\:\\/\\/platform\\.twitter\\.com\\/widgets\\/

FF - user.js: weboftrust.search.uolbr.display - UOL Busca

FF - user.js: weboftrust.search.uolbr.ign - ^http\\:\\/\\/(.*)uol\\.com\\.br\\/

FF - user.js: weboftrust.search.uolbr.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.uolbr.style - #main dt > a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; top: 0.2em; position: relative; visibility: visible; opacity: 0.9; }

FF - user.js: weboftrust.search.uolbr.url - ^http\\:\\/\\/busca\\.uol\\.com\\.br\\/web\\/

FF - user.js: weboftrust.search.vkontakte.display - VKontakte

FF - user.js: weboftrust.search.vkontakte.dynamic - 1

FF - user.js: weboftrust.search.vkontakte.ign - ^http(s)?\\:\\/\\/(.+\\.)?(vk\\.com|vkontakte\\.ru)\\/

FF - user.js: weboftrust.search.vkontakte.match0.condition - and

FF - user.js: weboftrust.search.vkontakte.match0.match0.attribute0.name - id

FF - user.js: weboftrust.search.vkontakte.match0.match0.attribute0.re - page_layout

FF - user.js: weboftrust.search.vkontakte.match0.match0.element - div

FF - user.js: weboftrust.search.vkontakte.match0.match1.attribute0.flags - n

FF - user.js: weboftrust.search.vkontakte.match0.match1.attribute0.name - class

FF - user.js: weboftrust.search.vkontakte.match0.match1.attribute0.re - editor_body

FF - user.js: weboftrust.search.vkontakte.match0.match1.element - body

FF - user.js: weboftrust.search.vkontakte.pre0.match - 5

FF - user.js: weboftrust.search.vkontakte.pre0.re - http(s)?\\:\\/\\/(vk\\.com|vkontakte\\.ru)\\/away\\.php\\?.*(to)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.vkontakte.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.vkontakte.style - #content a ~ [ATTR=\NAME\], #pv_box a ~ [ATTR=\NAME\], #wk_box a ~ [ATTR=\NAME\], a.lnk ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.vkontakte.url - ^http(s)?\\:\\/\\/(vkontakte\\.ru|vk\\.com)\\/

FF - user.js: weboftrust.search.webde.display - WEB.DE

FF - user.js: weboftrust.search.webde.ign - ^http(s)?\\:\\/\\/(.+\\.)?web\\.de\\/

FF - user.js: weboftrust.search.webde.pre0.match - 9

FF - user.js: weboftrust.search.webde.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.webde.prestyle - [ATTR] { position: absolute; visibility: hidden; } .sponsoredLink a { display: inline ! important; }

FF - user.js: weboftrust.search.webde.style - .resultContent h3 a ~ [ATTR=\NAME\], .sponsoredLink h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.webde.url - ^http(s)?\\:\\/\\/suche\\.web\\.de\\/search\\/(web|dir)

FF - user.js: weboftrust.search.wikipedia.display - Wikipedia

FF - user.js: weboftrust.search.wikipedia.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(wik(ipedia|ibooks|inews|imedia(foundation)?|iquote|isource|tionary|iversity)|mediawiki)\\.org|toolserver\\.org)\\/

FF - user.js: weboftrust.search.wikipedia.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.wikipedia.style - #bodyContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat ! important; margin-left: 4px ! important; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.wikipedia.url - ^http(s)?\\:\\/\\/.+\\.wiki(pedia|news)\\.org\\/

FF - user.js: weboftrust.search.wikipedia.urlign - \\/w\\/extensions\\/|&action=(edit|submit)

FF - user.js: weboftrust.search.wp.display - Wirtualna Polska Szukaj

FF - user.js: weboftrust.search.wp.ign - ^http(s)?\\:\\/\\/(.+\\.)?(wp|adkontekst|tanio|netsprint)\\.(pl|tv)\\/

FF - user.js: weboftrust.search.wp.pre0.match - 3

FF - user.js: weboftrust.search.wp.pre0.re - ^http(s)?\\:\\/\\/(.+\\.)?wp\\.pl\\/redir\\.html\\?u=(.+)\\&

FF - user.js: weboftrust.search.wp.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.wp.style - big a ~ [ATTR=\NAME\], .recCont h1 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; margin-right:0.4em; position: relative; visibility: visible; opacity: 0.9; } .recCont h1 a ~ [ATTR=\NAME\] {top: -0.3em;} a.fGray ~ [ATTR=\NAME\] {visibility: hidden; position: absolute; }

FF - user.js: weboftrust.search.wp.url - ^http(s)?\\:\\/\\/szukaj\\.wp\\.pl\\/szukaj

FF - user.js: weboftrust.search.yahoo.display - Yahoo!

FF - user.js: weboftrust.search.yahoo.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|^http(s)?\\:\\/\\/.+\\/search\\/cache\\\\?

FF - user.js: weboftrust.search.yahoo.ninja - 1

FF - user.js: weboftrust.search.yahoo.pre0.match - 4

FF - user.js: weboftrust.search.yahoo.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*http.+yahoo\\.[a-z]{2,}.+fu=(http.+)

FF - user.js: weboftrust.search.yahoo.pre1.match - 4

FF - user.js: weboftrust.search.yahoo.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*(http.+)

FF - user.js: weboftrust.search.yahoo.pre2.match - 4

FF - user.js: weboftrust.search.yahoo.pre2.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/click\\\\?u=(http.+)

FF - user.js: weboftrust.search.yahoo.prestyle - .bbox [ATTR], .right [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.yahoo.style - a.yschttl ~ [ATTR=\NAME\], .active a ~ [ATTR=\NAME\], .hd h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.yahoo.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/search[;\\\\?].+

FF - user.js: weboftrust.search.yahoomail.display - Yahoo! Mail

FF - user.js: weboftrust.search.yahoomail.dynamic - 1

FF - user.js: weboftrust.search.yahoomail.ign - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*(yahoo\\.(com|net)|ymailupdates\\.com)\\/

FF - user.js: weboftrust.search.yahoomail.match0.condition - or

FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.name - class

FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.re - msg-body

FF - user.js: weboftrust.search.yahoomail.match0.match0.element - div

FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.name - id

FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.re - ^(messageAreaIframe|ViewArea_.*)$

FF - user.js: weboftrust.search.yahoomail.match0.match1.element - $frame

FF - user.js: weboftrust.search.yahoomail.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.yahoomail.searchlevel - 60

FF - user.js: weboftrust.search.yahoomail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.yahoomail.url - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*mail\\.yahoo\\.(com|net)\\/(dc|neo|om\\/api)\\/

FF - user.js: weboftrust.search.yandex.display - Yandex

FF - user.js: weboftrust.search.yandex.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yandex\\.([a-z]{2,}|com\\.[a-z]{2})\\/

FF - user.js: weboftrust.search.yandex.prestyle - .redirect [ATTR], .show-player ~ [ATTR], .moreInfo [ATTR], .l-head [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.yandex.style - .b-serp-item__title-link ~ [ATTR=\NAME\], .b-serp-item__title__link ~ [ATTR=\NAME\], .agp ~ [ATTR=\NAME\], .title ~ [ATTR=\NAME\], .domain ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 0px; margin-right: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.yandex.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yandex\\.(ru|com|com\\.tr|ua|kz|by)\\/(yand|family|school)?search\\\\?.+

FF - user.js: weboftrust.shared.1 - 4sq.com,abcn.ws,aol.it,apne.ws,bbc.in,bzfd.it,clck.ru,cs.pn,d3w.io,dlvr.it,eca.sh,engt.co,es.pn,exm.nr,f.ast.ly,fa.by,flpbd.it,gd.is,ht.ly,huff.to,ind.pn,is.gd,j.mp,lat.ms,lnkd.in,migre.me,n.pr,nblo.gs,nyr.kr,nyti.ms,on.cnn.com,on.mash.to,on.msnbc.com,ow.ly,pep.si,ping.fm,politi.co,post.ly,rww.to,su.pr,t.co,tcrn.ch,tgr.ph,thkpr.gs,tiny.ly,tinyurl.com,tl.gd,tldr.us,tr.im,twitter.com,usat.me,wapo.st,wp.me,x.co,yhoo.it

FF - user.js: weboftrust.shared.2 - bit.ly,bitly.com,goo.gl,gu.com,sites.google.com

FF - user.js: weboftrust.show_rating_frame - false

FF - user.js: weboftrust.update_checked - 1350688027786

FF - user.js: weboftrust.witness_id - f8d37a9672234490d5ed83254e06c2e59efde37d

FF - user.js: weboftrust.witness_key - f4e66c84eeb157a3a01832733def5fa91878378c

FF - user.js: xpinstall.whitelist.add -

FF - user.js: xpinstall.whitelist.add.36 -

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.cache.memory.capacity - 16000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.maxtextrun - 4095

FF - user.js: content.max.tokenizing.time - 3000000

FF - user.js: content.switch.threshold - 1000000

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

FF - user.js: dom.disable_window_status_change - true

FF - user.js: browser.xul.error_pages.enabled - True

FF - user.js: browser.blink_allowed - false

.

============= SERVICES / DRIVERS ===============

.

.

=============== File Associations ===============

.

FileExt: .txt: Applications\WINWORD.EXE="c:\program files\microsoft office\office11\WINWORD.EXE" /n /dde [UserChoice] [default=edit - 'Open' doesn't exist]

.

=============== Created Last 30 ================

.

2013-09-14 23:02:27  --------  dc-h--r-           c:\documents and settings\eigenaar\Onlangs geopend

2013-09-14 21:44:00  --------  dc----w-          c:\program files\Free Window Registry Repair

2013-09-14 17:52:07  144896            -c--a-w-           c:\windows\system32\javacpl.cpl

2013-09-14 17:51:43  94632  -c--a-w-           c:\windows\system32\WindowsAccessBridge.dll

2013-09-13 20:24:17  2560    -c--a-w-           c:\windows\_MSRSTRT.EXE

2013-09-05 14:04:02  209272            -c--a-w-           c:\program files\mozilla firefox\plugins\nppdf32.dll

2013-09-05 14:04:02  209272            -c--a-w-           c:\program files\internet explorer\plugins\nppdf32.dll

2013-09-02 09:11:07  14720  -c--a-w-           c:\windows\system32\drivers\kbdhid.sys

2013-09-02 09:11:07  14720  -c--a-w-           c:\windows\system32\dllcache\kbdhid.sys

2013-08-26 10:22:46  7166848          -c--a-w-           c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9787b9d3-65e5-4c01-a89c-e4f4a37e0b50}\mpengine.dll

2013-08-26 10:04:23  7143960          -c--a-w-           c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2013-08-26 09:49:36  --------  dc----w-          c:\windows\system32\wbem\repository\FS

2013-08-26 09:49:36  --------  dc----w-          c:\windows\system32\wbem\Repository

.

==================== Find3M  ====================

.

2013-09-14 17:50:32  868264            -c--a-w-           c:\windows\system32\npDeployJava1.dll

2013-09-14 17:50:31  790440            -c--a-w-           c:\windows\system32\deployJava1.dll

2013-08-30 07:48:13  177864            -c--a-w-           c:\windows\system32\drivers\aswVmm.sys

2013-08-30 07:48:12  770344            -c--a-w-           c:\windows\system32\drivers\aswSnx.sys

2013-08-30 07:48:12  49376  -c--a-w-           c:\windows\system32\drivers\aswRvrt.sys

2013-08-30 07:48:11  66336  -c--a-w-           c:\windows\system32\drivers\aswMonFlt.sys

2013-08-30 07:47:40  41664  -c--a-w-           c:\windows\avastSS.scr

2013-08-09 01:56:37  391168            -c--a-w-           c:\windows\system32\themeui.dll

2013-08-08 06:09:45  1877888          -c--a-w-           c:\windows\system32\win32k.sys

2013-08-08 06:05:46  920064            -c--a-w-           c:\windows\system32\wininet.dll

2013-08-08 06:05:45  43520  -c----w-           c:\windows\system32\licmgr10.dll

2013-08-08 06:05:45  18944  -c--a-w-           c:\windows\system32\corpol.dll

2013-08-08 06:05:45  1469440          -c----w-           c:\windows\system32\inetcpl.cpl

2013-08-08 00:04:27  385024            -c----w-           c:\windows\system32\html.iec

2013-08-05 13:30:18  1289216          -c--a-w-           c:\windows\system32\ole32.dll

2013-08-02 23:48:38  1543680          -c----w-           c:\windows\system32\wmvdecod.dll

2013-08-01 10:49:51  692104            -c--a-w-           c:\windows\system32\FlashPlayerApp.exe

2013-08-01 10:49:50  71048  -c--a-w-           c:\windows\system32\FlashPlayerCPLApp.cpl

2013-07-10 10:37:49  406016            -c--a-w-           c:\windows\system32\usp10.dll

2013-07-04 07:34:02  2197888          -c--a-w-           c:\windows\system32\ntoskrnl.exe

2013-07-04 07:34:02  2074496          -c--a-w-           c:\windows\system32\ntkrnlpa.exe

2012-11-25 21:39:14  2024936          -c--a-w-           c:\program files\dixmlsetup.exe

.

============= FINISH:  2:06:18,06 ===============

 

The following is in attach.txt:

 

“No restore point in system.”

 

Please note that there are very recent restore points!

 

THANKS

 


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


BC AdBot (Login to Remove)

 


#2 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 14 September 2013 - 09:38 PM

Attach.zip

Attached Files


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:00 AM

Posted 19 September 2013 - 09:10 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/507862 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 20 September 2013 - 08:26 AM

Hello and thanks for responding!

 

Description of the problem: same as in post #1. There have been no changes in symptoms or system performance either.

 

Windows CD: available.

 

OS: XP Home Edition, version 2002, SP3, 32 bit

 

New DDS log:

 

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 10.40.2
Run by Eigenaar at 14:59:09 on 2013-09-20
Microsoft Windows XP Home Edition  5.1.2600.3.1252.31.1043.18.766.572 [GMT 2:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Privatefirewall *Disabled*
.
============== Running Processes ================
.
C:\WINDOWS\System32\wudfhost.exe
C:\Program Files\Privacyware\Privatefirewall 7.0\pfsvc.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\locator.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k eapsvcs
C:\WINDOWS\System32\svchost.exe -k dot3svc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [ccleaner] "c:\program files\ccleaner\CCleaner.exe" /AUTO
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [Privatefirewall] c:\program files\privacyware\privatefirewall 7.0\PFGUI.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\eigenaar\menust~1\progra~1\opstar~1\erunta~1.lnk - c:\windows\erunt\AUTOBACK.EXE
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - <orphaned>
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
   If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab
TCP: NameServer = 192.168.2.254
TCP: Interfaces\{35751F28-AEA5-4E74-B19B-CA68D7DF5B51} : DHCPNameServer = 192.168.2.254
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\eigenaar\application data\mozilla\firefox\profiles\6szjk2rx.default\
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_8_800_94.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
.
---- FIREFOX POLICIES ----
FF - user.js: accessibility.blockautorefresh - true
FF - user.js: accessibility.typeaheadfind - true
FF - user.js: accessibility.typeaheadfind.flashBar - 0
FF - user.js: app.update.disable_button.showUpdateHistory - false
FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1350688141
FF - user.js: app.update.lastUpdateTime.background-update-timer - 1350688381
FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1350688261
FF - user.js: app.update.lastUpdateTime.browser-cleanup-thumbnails - 1350682697
FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1350668113
FF - user.js: browser.bookmarks.restore_default_bookmarks - false
FF - user.js: browser.cache.disk.capacity - 1048576
FF - user.js: browser.cache.disk.smart_size.first_run - false
FF - user.js: browser.cache.disk.smart_size_cached_value - 552960
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.download.dir - c:\\documents and settings\\eigenaar\\mijn documenten\\security tools 120212\\120902 TOOLS MALWARE
FF - user.js: browser.download.folderList - 2
FF - user.js: browser.download.lastDir - c:\\documents and settings\\eigenaar\\mijn documenten\\security tools 120212\\120902 TOOLS MALWARE
FF - user.js: browser.download.manager.closeWhenDone - true
FF - user.js: browser.download.save_converter_index - 0
FF - user.js: browser.download.useDownloadDir - false
FF - user.js: browser.migration.version - 6
FF - user.js: browser.open.lastDir - c:\\uniserver\\www
FF - user.js: browser.pagethumbnails.storage_version - 2
FF - user.js: browser.places.smartBookmarksVersion - 4
FF - user.js: browser.preferences.advanced.selectedTabIndex - 1
FF - user.js: browser.rights.3.shown - true
FF - user.js: browser.search.selectedEngine - WOT Safe Search
FF - user.js: browser.search.useDBForOrder - true
FF - user.js: browser.startup.homepage_override.buildID - 20121010144125
FF - user.js: browser.startup.homepage_override.mstone - 16.0.1
FF - user.js: browser.syncPromoViewsLeft - 0
FF - user.js: browser.tabs.loadInBackground - false
FF - user.js: browser.tabs.warnOnClose - false
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.default.behavior - 1
FF - user.js: capability.policy.maonoscript.javascript.enabled - allAccess
FF - user.js: capability.policy.maonoscript.sites - addons.mozilla.org addthis.com atdmt.com bbcode.org bitdefender.com bleepingcomputer.com cbsistatic.com cloudfront.net cnet.com cnetstatic.com com.com computer-support.nl computerhope.com crowdscience.com disqus.com dll-files.com drweb.com exponential.com facebook.com facebook.net fbcdn.net feedburner.com firstdata.com firstdata.lv flashgot.net geekstogo.com gigya.com google-analytics.com google.com google.nl googleadservices.com googleapis.com googlesyndication.com googletagservices.com googleusercontent.com gstatic.com hotmail.com informaction.com intellitxt.com ip-adress.com ipaddress.com iperceptions.com jotti.org kaspersky-911.com kaspersky-labs.com kaspersky.com kontera.com literotica.com live.com malwarebytes.org maone.net microsoft.com mozilla.net mozilla.org msn.com netdna-cdn.com noscript.net passport.com passport.net passportimages.com paypal.com paypalobjects.com persona.org piriform.com providesupport.com quantserve.com scorecardresearch.com securecode.com skimresources.com techspot.com trialpay.com twitter.com viglink.com virustotal.com wlxrs.com wordpress.com yahoo.com yahooapis.com yimg.com youtube-nocookie.com youtube.com ytimg.com about: about:addons about:blank about:blocked about:certerror about:config about:crashes about:credits about:home about:memory about:neterror about:plugins about:privatebrowsing about:sessionrestore about:support blob: chrome: file:// hxxp://addthis.com http://atdmt.com http://bbcode.org http://bitdefender.com http://bleepingcomputer.com http://cbsistatic.com http://cloudfront.net http://cnet.com http://cnetstatic.com http://com.com http://computer-support.nl http://computerhope.com http://crowdscience.com http://disqus.com http://dll-files.com http://drweb.com http://exponential.com http://facebook.com http://facebook.net http://fbcdn.net http://feedburner.com http://firstdata.com http://firstdata.lv http://flashgot.net http://geekstogo.com http://gigya.com http://google-analytics.com http://google.com http://google.nl http://googleadservices.com http://googleapis.com http://googlesyndication.com http://googletagservices.com http://googleusercontent.com http://gstatic.com http://hotmail.com http://informaction.com http://intellitxt.com http://ip-adress.com http://ipaddress.com http://iperceptions.com http://jotti.org http://kaspersky-911.com http://kaspersky-labs.com http://kaspersky.com http://kontera.com http://literotica.com http://live.com http://malwarebytes.org http://maone.net http://microsoft.com http://mozilla.net http://mozilla.org http://msn.com http://netdna-cdn.com http://noscript.net http://passport.com http://passport.net http://passportimages.com http://paypal.com http://paypalobjects.com http://persona.org http://piriform.com http://providesupport.com http://quantserve.com http://scorecardresearch.com http://securecode.com http://skimresources.com http://techspot.com http://trialpay.com http://twitter.com http://viglink.com http://virustotal.com http://wlxrs.com http://wordpress.com http://yahoo.com http://yahooapis.com http://yimg.com http://youtube-nocookie.com http://youtube.com http://ytimg.com https://addthis.com https://atdmt.com https://bbcode.org https://bitdefender.com https://bleepingcomputer.com https://cbsistatic.com https://cloudfront.net https://cnet.com https://cnetstatic.com https://com.com https://computer-support.nl https://computerhope.com https://crowdscience.com https://disqus.com https://dll-files.com https://drweb.com https://exponential.com https://facebook.com https://facebook.net https://fbcdn.net https://feedburner.com https://firstdata.com https://firstdata.lv https://flashgot.net https://geekstogo.com https://gigya.com https://google-analytics.com https://google.com https://google.nl https://googleadservices.com https://googleapis.com https://googlesyndication.com https://googletagservices.com https://googleusercontent.com https://gstatic.com https://hotmail.com https://informaction.com https://intellitxt.com https://ip-adress.com https://ipaddress.com https://iperceptions.com https://jotti.org https://kaspersky-911.com https://kaspersky-labs.com https://kaspersky.com https://kontera.com https://literotica.com https://live.com https://malwarebytes.org https://maone.net https://microsoft.com https://mozilla.net https://mozilla.org https://msn.com https://netdna-cdn.com https://noscript.net https://passport.com https://passport.net https://passportimages.com https://paypal.com https://paypalobjects.com https://persona.org https://piriform.com https://providesupport.com https://quantserve.com https://scorecardresearch.com https://securecode.com https://skimresources.com https://techspot.com https://trialpay.com https://twitter.com https://viglink.com https://virustotal.com https://wlxrs.com https://wordpress.com https://yahoo.com https://yahooapis.com https://yimg.com https://youtube-nocookie.com https://youtube.com https://ytimg.com resource:
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_flip - false
FF - user.js: dom.max_chrome_script_run_time - 0
FF - user.js: extensions.adblockplus.currentVersion - 2.1.2
FF - user.js: extensions.bdqscan.lastActionDate - 1350483556821
FF - user.js: extensions.bdqscan.lastScanDate - 1350483556821
FF - user.js: extensions.blocklist.pingCountTotal - 237
FF - user.js: extensions.blocklist.pingCountVersion - 7
FF - user.js: extensions.bootstrappedAddons - {\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\version\:\2.1.2\,\type\:\extension\,\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\}}
FF - user.js: extensions.bprivacy.AutoDelLSOnExitMode - 1
FF - user.js: extensions.bprivacy.AutoDelLSOnStart - true
FF - user.js: extensions.bprivacy.DataDir - f:\\Better Privacy111231
FF - user.js: extensions.bprivacy.DefaultFlashCookieDeletion - true
FF - user.js: extensions.bprivacy.NotifyOnNewLSO - 1
FF - user.js: extensions.bprivacy.initiated - 3
FF - user.js: extensions.bprivacy.keycode - 122
FF - user.js: extensions.bprivacy.lastSession - zaterdag 15 september 2012 12:16:16
FF - user.js: extensions.bprivacy.removed - 211
FF - user.js: extensions.bprivacy.timer - Sat Oct 20 2012 01:07:07 GMT+0200
FF - user.js: extensions.bprivacy.useDelTimer - true
FF - user.js: extensions.databaseSchema - 13
FF - user.js: extensions.enabledAddons - {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.68,{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20120926,{6614d11d-d21d-b211-ae23-815234e1ebb5}:2.7.0,{27c60876-b5c9-4335-b4f3-52b26782220c}:0.9.4,{e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.119,{73a6fe31-595d-460b-a920-fcc0f8843232}:2.5.8,{972ce4c6-7e08-4474-a285-3208198ce6fd}:16.0.1
FF - user.js: extensions.hotfix.lastVersion - 20120430.01
FF - user.js: extensions.https_everywhere.1&1 Internet - true
FF - user.js: extensions.https_everywhere.100-gute-gruende.de - true
FF - user.js: extensions.https_everywhere.1177.se - true
FF - user.js: extensions.https_everywhere.123-Reg - true
FF - user.js: extensions.https_everywhere.123systems - true
FF - user.js: extensions.https_everywhere.1NightStandStory - true
FF - user.js: extensions.https_everywhere.1time.co.za - true
FF - user.js: extensions.https_everywhere.2020mobile - true
FF - user.js: extensions.https_everywhere.2o7.net - true
FF - user.js: extensions.https_everywhere.33Bits - false
FF - user.js: extensions.https_everywhere.37Signals - true
FF - user.js: extensions.https_everywhere.38.de - true
FF - user.js: extensions.https_everywhere.3min - true
FF - user.js: extensions.https_everywhere.4Shared (buggy) - false
FF - user.js: extensions.https_everywhere.4sevens - true
FF - user.js: extensions.https_everywhere.7chan - true
FF - user.js: extensions.https_everywhere.99.se - true
FF - user.js: extensions.https_everywhere.ABIS-Studien.se - true
FF - user.js: extensions.https_everywhere.ABN AMRO Bank - true
FF - user.js: extensions.https_everywhere.ACLU of North Carolina - true
FF - user.js: extensions.https_everywhere.ACLU of Southern California - true
FF - user.js: extensions.https_everywhere.ACM.org - true
FF - user.js: extensions.https_everywhere.AJC.com - true
FF - user.js: extensions.https_everywhere.AK-Vorrat - true
FF - user.js: extensions.https_everywhere.ANB - true
FF - user.js: extensions.https_everywhere.ANZ - true
FF - user.js: extensions.https_everywhere.AOK - true
FF - user.js: extensions.https_everywhere.AOL (partial) - true
FF - user.js: extensions.https_everywhere.ATBank - true
FF - user.js: extensions.https_everywhere.Aaai.org - true
FF - user.js: extensions.https_everywhere.Abbo-shop.ch - true
FF - user.js: extensions.https_everywhere.AbcLinuxu - true
FF - user.js: extensions.https_everywhere.AbeBooks - true
FF - user.js: extensions.https_everywhere.AboutMe (broken) - false
FF - user.js: extensions.https_everywhere.AboutMe - true
FF - user.js: extensions.https_everywhere.Abuse.ch - true
FF - user.js: extensions.https_everywhere.AccessNow.org - true
FF - user.js: extensions.https_everywhere.Accessibility.nl - true
FF - user.js: extensions.https_everywhere.Accessible Information Management (gunadiframework.com) - true
FF - user.js: extensions.https_everywhere.Act.demandprogress.org - true
FF - user.js: extensions.https_everywhere.Actel.com - true
FF - user.js: extensions.https_everywhere.AdaFruit - true
FF - user.js: extensions.https_everywhere.AdblockPlus - true
FF - user.js: extensions.https_everywhere.Adbrite - true
FF - user.js: extensions.https_everywhere.AddBooks.se - true
FF - user.js: extensions.https_everywhere.AddThis - true
FF - user.js: extensions.https_everywhere.AddToAny - true
FF - user.js: extensions.https_everywhere.Adlibris/Capris - true
FF - user.js: extensions.https_everywhere.Adobe - true
FF - user.js: extensions.https_everywhere.Adoyacademy.se - true
FF - user.js: extensions.https_everywhere.Adtech.de - true
FF - user.js: extensions.https_everywhere.Adversary - false
FF - user.js: extensions.https_everywhere.Aea.se - true
FF - user.js: extensions.https_everywhere.Aer Lingus (testing) - false
FF - user.js: extensions.https_everywhere.Aeriagames - true
FF - user.js: extensions.https_everywhere.Afford.com - true
FF - user.js: extensions.https_everywhere.Aftenposten - true
FF - user.js: extensions.https_everywhere.Agnitum - true
FF - user.js: extensions.https_everywhere.Ahnlab - true
FF - user.js: extensions.https_everywhere.Ai.Hitbox.com - true
FF - user.js: extensions.https_everywhere.Air Asia - true
FF - user.js: extensions.https_everywhere.AirshipVentures - true
FF - user.js: extensions.https_everywhere.Airtricity - true
FF - user.js: extensions.https_everywhere.AkademikerFörsäkring.se - true
FF - user.js: extensions.https_everywhere.Akismet - true
FF - user.js: extensions.https_everywhere.Alaska Airlines - true
FF - user.js: extensions.https_everywhere.Aldi - Germany - true
FF - user.js: extensions.https_everywhere.Alex.se - true
FF - user.js: extensions.https_everywhere.AliceDSL - true
FF - user.js: extensions.https_everywhere.All-inkl.com - true
FF - user.js: extensions.https_everywhere.AllThingsD - true
FF - user.js: extensions.https_everywhere.Allegro - false
FF - user.js: extensions.https_everywhere.AlliedModders forum - true
FF - user.js: extensions.https_everywhere.Allingsas.se - true
FF - user.js: extensions.https_everywhere.Alternate - true
FF - user.js: extensions.https_everywhere.AltonTowers (broken) - false
FF - user.js: extensions.https_everywhere.AltonTowers - true
FF - user.js: extensions.https_everywhere.Amahi.org - true
FF - user.js: extensions.https_everywhere.Amazon (buggy) - false
FF - user.js: extensions.https_everywhere.Amazon Web Services - true
FF - user.js: extensions.https_everywhere.Ambx.com - true
FF - user.js: extensions.https_everywhere.American Airlines - true
FF - user.js: extensions.https_everywhere.American Epilepsy Society (partial) - true
FF - user.js: extensions.https_everywhere.American Foundation for Suicide Prevention - true
FF - user.js: extensions.https_everywhere.AmericanExpress - true
FF - user.js: extensions.https_everywhere.Americana Exchange - true
FF - user.js: extensions.https_everywhere.Amerika21.de - false
FF - user.js: extensions.https_everywhere.Amnesty-International - true
FF - user.js: extensions.https_everywhere.An Post - true
FF - user.js: extensions.https_everywhere.AnarchistNews.org - false
FF - user.js: extensions.https_everywhere.Android - true
FF - user.js: extensions.https_everywhere.Androidpolice - true
FF - user.js: extensions.https_everywhere.Animenfo.com - true
FF - user.js: extensions.https_everywhere.AnnualCreditReport.com - true
FF - user.js: extensions.https_everywhere.Ansa.it - true
FF - user.js: extensions.https_everywhere.AntiSpam e.V. - true
FF - user.js: extensions.https_everywhere.Anybeat - true
FF - user.js: extensions.https_everywhere.Apache - true
FF - user.js: extensions.https_everywhere.Apoteket.se - true
FF - user.js: extensions.https_everywhere.Apple.com (partial) - true
FF - user.js: extensions.https_everywhere.Applebee's - true
FF - user.js: extensions.https_everywhere.April.org - true
FF - user.js: extensions.https_everywhere.Arbeitsagentur.de - true
FF - user.js: extensions.https_everywhere.Arch Linux - true
FF - user.js: extensions.https_everywhere.ArchiveOfOurOwn - true
FF - user.js: extensions.https_everywhere.Archos.com - true
FF - user.js: extensions.https_everywhere.Argos - true
FF - user.js: extensions.https_everywhere.Arlanda.se - true
FF - user.js: extensions.https_everywhere.Assembla - true
FF - user.js: extensions.https_everywhere.Asterisk - true
FF - user.js: extensions.https_everywhere.Atheists.org - true
FF - user.js: extensions.https_everywhere.Atlassian - true
FF - user.js: extensions.https_everywhere.Atomicorp - true
FF - user.js: extensions.https_everywhere.Attendesource.com - false
FF - user.js: extensions.https_everywhere.Attention Deficit Disorders Association - Southern Region - true
FF - user.js: extensions.https_everywhere.Audible.de - true
FF - user.js: extensions.https_everywhere.Australian Koala Foundation - true
FF - user.js: extensions.https_everywhere.Austrian Airlines - true
FF - user.js: extensions.https_everywhere.Authorize.Net - true
FF - user.js: extensions.https_everywhere.Autistici/inventati - false
FF - user.js: extensions.https_everywhere.Avaaz - true
FF - user.js: extensions.https_everywhere.Avadirect - true
FF - user.js: extensions.https_everywhere.Avanza.se - true
FF - user.js: extensions.https_everywhere.Avast - true
FF - user.js: extensions.https_everywhere.Avira - true
FF - user.js: extensions.https_everywhere.Avropa.se - true
FF - user.js: extensions.https_everywhere.Azingsport.se - true
FF - user.js: extensions.https_everywhere.BKK-Advita - true
FF - user.js: extensions.https_everywhere.BKW-FMB.ch - true
FF - user.js: extensions.https_everywhere.BT - true
FF - user.js: extensions.https_everywhere.BTCGuild.com - true
FF - user.js: extensions.https_everywhere.BTH.se - true
FF - user.js: extensions.https_everywhere.BTunnel - true
FF - user.js: extensions.https_everywhere.Backupify - true
FF - user.js: extensions.https_everywhere.Badoo.com - true
FF - user.js: extensions.https_everywhere.Badwarebusters.org - true
FF - user.js: extensions.https_everywhere.Bagatoo.se - true
FF - user.js: extensions.https_everywhere.Bahn-BKK - true
FF - user.js: extensions.https_everywhere.Bahn.de - true
FF - user.js: extensions.https_everywhere.Balatarin - true
FF - user.js: extensions.https_everywhere.Baldershage.se - true
FF - user.js: extensions.https_everywhere.Balkongshoppen.se - true
FF - user.js: extensions.https_everywhere.Bandcamp (buggy) - false
FF - user.js: extensions.https_everywhere.Bandcamp - true
FF - user.js: extensions.https_everywhere.BankOfNewZeland - true
FF - user.js: extensions.https_everywhere.Bankofscotland.de - true
FF - user.js: extensions.https_everywhere.Barclays - true
FF - user.js: extensions.https_everywhere.Barmer-GEK - true
FF - user.js: extensions.https_everywhere.Barnes and Noble (partial) - true
FF - user.js: extensions.https_everywhere.Barnes and Noble - true
FF - user.js: extensions.https_everywhere.Barnskospecialisten.se - true
FF - user.js: extensions.https_everywhere.Belpino.se - true
FF - user.js: extensions.https_everywhere.Bendigo Bank - true
FF - user.js: extensions.https_everywhere.Bergens Tidende - false
FF - user.js: extensions.https_everywhere.Berklee College of Music - true
FF - user.js: extensions.https_everywhere.BerliOS - false
FF - user.js: extensions.https_everywhere.Berlin.de - true
FF - user.js: extensions.https_everywhere.Bhiab.se - true
FF - user.js: extensions.https_everywhere.BinRev - true
FF - user.js: extensions.https_everywhere.BinSearch - true
FF - user.js: extensions.https_everywhere.BinaryTurf - true
FF - user.js: extensions.https_everywhere.Binero.se - true
FF - user.js: extensions.https_everywhere.Birthprint - true
FF - user.js: extensions.https_everywhere.BitBucket - true
FF - user.js: extensions.https_everywhere.Bitcoin - false
FF - user.js: extensions.https_everywhere.Black Night - true
FF - user.js: extensions.https_everywhere.BlackHat - true
FF - user.js: extensions.https_everywhere.BlameStella - true
FF - user.js: extensions.https_everywhere.Blau.de - true
FF - user.js: extensions.https_everywhere.Blekko - true
FF - user.js: extensions.https_everywhere.Blip (broken) - false
FF - user.js: extensions.https_everywhere.Blip - true
FF - user.js: extensions.https_everywhere.Blipp.com - true
FF - user.js: extensions.https_everywhere.BlockBuster UK - true
FF - user.js: extensions.https_everywhere.BlockExplorer.com - true
FF - user.js: extensions.https_everywhere.Blocket.se - true
FF - user.js: extensions.https_everywhere.Bloglines - true
FF - user.js: extensions.https_everywhere.BlueCoat - true
FF - user.js: extensions.https_everywhere.BlueHost - true
FF - user.js: extensions.https_everywhere.Bmibaby.com - true
FF - user.js: extensions.https_everywhere.Boards.ie - true
FF - user.js: extensions.https_everywhere.Bodum - true
FF - user.js: extensions.https_everywhere.Boe.es - true
FF - user.js: extensions.https_everywhere.Boell.de - true
FF - user.js: extensions.https_everywhere.BofA (buggy) - false
FF - user.js: extensions.https_everywhere.BofA - true
FF - user.js: extensions.https_everywhere.Boinc - true
FF - user.js: extensions.https_everywhere.Bokborgen.se - true
FF - user.js: extensions.https_everywhere.Bokelskere - true
FF - user.js: extensions.https_everywhere.Bolagsverket.se - true
FF - user.js: extensions.https_everywhere.Boltbus.com - true
FF - user.js: extensions.https_everywhere.BookMyName - true
FF - user.js: extensions.https_everywhere.Booking.com - true
FF - user.js: extensions.https_everywhere.Booklog.jp - true
FF - user.js: extensions.https_everywhere.Bookworm - true
FF - user.js: extensions.https_everywhere.Bothar - true
FF - user.js: extensions.https_everywhere.BoxUK - true
FF - user.js: extensions.https_everywhere.Boxee.tv - true
FF - user.js: extensions.https_everywhere.Brainbench - true
FF - user.js: extensions.https_everywhere.Braunschweig - true
FF - user.js: extensions.https_everywhere.Brigham Young University (partial) - true
FF - user.js: extensions.https_everywhere.Britcoin.co.uk - true
FF - user.js: extensions.https_everywhere.BritishAirways - true
FF - user.js: extensions.https_everywhere.Broadband Reports - true
FF - user.js: extensions.https_everywhere.BrowserShots - true
FF - user.js: extensions.https_everywhere.Buckyballs - true
FF - user.js: extensions.https_everywhere.Budgetgolf.se - true
FF - user.js: extensions.https_everywhere.BufferedIO - false
FF - user.js: extensions.https_everywhere.BuisnessInsider (broken) - false
FF - user.js: extensions.https_everywhere.BuisnessInsider - true
FF - user.js: extensions.https_everywhere.BulbMan - true
FF - user.js: extensions.https_everywhere.BulkSMS - true
FF - user.js: extensions.https_everywhere.Bullguard - true
FF - user.js: extensions.https_everywhere.Bungie - true
FF - user.js: extensions.https_everywhere.Bunkus.org - true
FF - user.js: extensions.https_everywhere.Bussgods.se - true
FF - user.js: extensions.https_everywhere.C-Base - true
FF - user.js: extensions.https_everywhere.CA-PCR.fr - true
FF - user.js: extensions.https_everywhere.CACert.org - false
FF - user.js: extensions.https_everywhere.CDT - true
FF - user.js: extensions.https_everywhere.CDW and CDW-G - true
FF - user.js: extensions.https_everywhere.CERT.fi - true
FF - user.js: extensions.https_everywhere.CERT.se - true
FF - user.js: extensions.https_everywhere.CHL.it - true
FF - user.js: extensions.https_everywhere.CIA Cybersurf - true
FF - user.js: extensions.https_everywhere.CIBC - true
FF - user.js: extensions.https_everywhere.CIO.com.au - true
FF - user.js: extensions.https_everywhere.CJ - true
FF - user.js: extensions.https_everywhere.CMSWire - true
FF - user.js: extensions.https_everywhere.CPJ - true
FF - user.js: extensions.https_everywhere.CPSC.gov - true
FF - user.js: extensions.https_everywhere.CRM Metrix - true
FF - user.js: extensions.https_everywhere.CSAF - false
FF - user.js: extensions.https_everywhere.CSIS.dk - true
FF - user.js: extensions.https_everywhere.CSRSupport.com - true
FF - user.js: extensions.https_everywhere.CTunnel - true
FF - user.js: extensions.https_everywhere.CVI Melles Griot - true
FF - user.js: extensions.https_everywhere.CaceTech - true
FF - user.js: extensions.https_everywhere.Caisse d'Epargne - true
FF - user.js: extensions.https_everywhere.California STD/HIV Prevention Training Center (partial) - true
FF - user.js: extensions.https_everywhere.Caltech - true
FF - user.js: extensions.https_everywhere.Calum - true
FF - user.js: extensions.https_everywhere.Cam.ac.uk - true
FF - user.js: extensions.https_everywhere.Campact.de - true
FF - user.js: extensions.https_everywhere.Canada Post - true
FF - user.js: extensions.https_everywhere.Canadian Lung Association - true
FF - user.js: extensions.https_everywhere.CanalDigital - true
FF - user.js: extensions.https_everywhere.Canv.as - true
FF - user.js: extensions.https_everywhere.Carnegie Mellon School of Computer Science - true
FF - user.js: extensions.https_everywhere.Cdon.se - true
FF - user.js: extensions.https_everywhere.Celiac Disease Foundation - true
FF - user.js: extensions.https_everywhere.Censorship.govt.nz - true
FF - user.js: extensions.https_everywhere.Centos - true
FF - user.js: extensions.https_everywhere.Cert - true
FF - user.js: extensions.https_everywhere.Change.org - true
FF - user.js: extensions.https_everywhere.Changemakers - true
FF - user.js: extensions.https_everywhere.Charity Wings - true
FF - user.js: extensions.https_everywhere.Charlotte Nature Museum - true
FF - user.js: extensions.https_everywhere.Chase - true
FF - user.js: extensions.https_everywhere.CheapSSLs - true
FF - user.js: extensions.https_everywhere.Check Point - true
FF - user.js: extensions.https_everywhere.Check24.de - true
FF - user.js: extensions.https_everywhere.ChillingEffects - true
FF - user.js: extensions.https_everywhere.Chromium.org - true
FF - user.js: extensions.https_everywhere.Chronicle - true
FF - user.js: extensions.https_everywhere.Cia.vc - false
FF - user.js: extensions.https_everywhere.Cisco - false
FF - user.js: extensions.https_everywhere.CiteULike - true
FF - user.js: extensions.https_everywhere.Citibank (testing) - false
FF - user.js: extensions.https_everywhere.CitizensInformation - true
FF - user.js: extensions.https_everywhere.Citrix - true
FF - user.js: extensions.https_everywhere.City of Portland, OR - true
FF - user.js: extensions.https_everywhere.Clasohlson.se - true
FF - user.js: extensions.https_everywhere.Clickbank.com - true
FF - user.js: extensions.https_everywhere.Cloudflare - true
FF - user.js: extensions.https_everywhere.Cloudfront - true
FF - user.js: extensions.https_everywhere.Codecoop (CACert) - false
FF - user.js: extensions.https_everywhere.Codeplex - true
FF - user.js: extensions.https_everywhere.CodingTeam - true
FF - user.js: extensions.https_everywhere.CollegiateLink (partial) - true
FF - user.js: extensions.https_everywhere.Colorado State Attorney General - true
FF - user.js: extensions.https_everywhere.CommonDreams - true
FF - user.js: extensions.https_everywhere.CommuniGate - true
FF - user.js: extensions.https_everywhere.Comodo (Partial) - true
FF - user.js: extensions.https_everywhere.CompaniesHouse - true
FF - user.js: extensions.https_everywhere.CompaniesInTheUK - true
FF - user.js: extensions.https_everywhere.CompareTheMarket - true
FF - user.js: extensions.https_everywhere.Comparis.ch - true
FF - user.js: extensions.https_everywhere.ComputerWorld - true
FF - user.js: extensions.https_everywhere.Comviq.se - true
FF - user.js: extensions.https_everywhere.Connect.me - true
FF - user.js: extensions.https_everywhere.Consumer Reports - true
FF - user.js: extensions.https_everywhere.Continental - true
FF - user.js: extensions.https_everywhere.Coop.ch - true
FF - user.js: extensions.https_everywhere.Coop.no - true
FF - user.js: extensions.https_everywhere.Cotse.net - true
FF - user.js: extensions.https_everywhere.Couchsurfing - true
FF - user.js: extensions.https_everywhere.Countquest.se - true
FF - user.js: extensions.https_everywhere.Courage Campaign - true
FF - user.js: extensions.https_everywhere.CreateSpace - true
FF - user.js: extensions.https_everywhere.Creative Commons - true
FF - user.js: extensions.https_everywhere.Crucial.com (partial) - true
FF - user.js: extensions.https_everywhere.Crypto.is - true
FF - user.js: extensions.https_everywhere.CryptoSMS - false
FF - user.js: extensions.https_everywhere.Cs.arizona.edu - true
FF - user.js: extensions.https_everywhere.Ctt - true
FF - user.js: extensions.https_everywhere.Cultura Sparebank - true
FF - user.js: extensions.https_everywhere.Curvehost - true
FF - user.js: extensions.https_everywhere.Cykloteket.se - true
FF - user.js: extensions.https_everywhere.D.S.V. Sint Jansbrug - true
FF - user.js: extensions.https_everywhere.DAB Bank - true
FF - user.js: extensions.https_everywhere.DALnet - true
FF - user.js: extensions.https_everywhere.DHL.de - true
FF - user.js: extensions.https_everywhere.DMU - true
FF - user.js: extensions.https_everywhere.DTunnel - true
FF - user.js: extensions.https_everywhere.DVDFab - false
FF - user.js: extensions.https_everywhere.DaLinuxFrenchPage - true
FF - user.js: extensions.https_everywhere.Daft.ie - false
FF - user.js: extensions.https_everywhere.Daily - true
FF - user.js: extensions.https_everywhere.Dailykos - true
FF - user.js: extensions.https_everywhere.DataCenterKnowledge.com - true
FF - user.js: extensions.https_everywhere.Datatilsynet - true
FF - user.js: extensions.https_everywhere.Deaconess Health System - true
FF - user.js: extensions.https_everywhere.Deal Extreme - true
FF - user.js: extensions.https_everywhere.Debian - false
FF - user.js: extensions.https_everywhere.DebianLists - false
FF - user.js: extensions.https_everywhere.Decdna.net - true
FF - user.js: extensions.https_everywhere.Deco.proteste.pt - true
FF - user.js: extensions.https_everywhere.Deepbit.net - true
FF - user.js: extensions.https_everywhere.Defcon - true
FF - user.js: extensions.https_everywhere.Delicious - true
FF - user.js: extensions.https_everywhere.Delico.se - true
FF - user.js: extensions.https_everywhere.Dell - true
FF - user.js: extensions.https_everywhere.Delta.no - true
FF - user.js: extensions.https_everywhere.DemocracyInAction - true
FF - user.js: extensions.https_everywhere.DemocracyNow - true
FF - user.js: extensions.https_everywhere.Demonoid - true
FF - user.js: extensions.https_everywhere.Dephormation.org.uk - true
FF - user.js: extensions.https_everywhere.DepositProtection - true
FF - user.js: extensions.https_everywhere.Der Freitag - false
FF - user.js: extensions.https_everywhere.Deutsche BKK - true
FF - user.js: extensions.https_everywhere.Deutsche Kreditbank - true
FF - user.js: extensions.https_everywhere.Develop-online.net - true
FF - user.js: extensions.https_everywhere.DeviantArt (pending) - false
FF - user.js: extensions.https_everywhere.Deviantart - true
FF - user.js: extensions.https_everywhere.Devstructure - true
FF - user.js: extensions.https_everywhere.Dfri.se - true
FF - user.js: extensions.https_everywhere.Diagonalperiodico.net - true
FF - user.js: extensions.https_everywhere.Diasp.org - true
FF - user.js: extensions.https_everywhere.Diaspora - true
FF - user.js: extensions.https_everywhere.Die-Linke.de - true
FF - user.js: extensions.https_everywhere.Die.net - true
FF - user.js: extensions.https_everywhere.DigiCert - true
FF - user.js: extensions.https_everywhere.DigitalForensicsMagazine - true
FF - user.js: extensions.https_everywhere.Digitalegesellschaft - true
FF - user.js: extensions.https_everywhere.Digitec.ch - true
FF - user.js: extensions.https_everywhere.DigiumEnterprise.com - true
FF - user.js: extensions.https_everywhere.DirectSpace - true
FF - user.js: extensions.https_everywhere.Directbox - true
FF - user.js: extensions.https_everywhere.Disability.gov - true
FF - user.js: extensions.https_everywhere.Discovery Place - true
FF - user.js: extensions.https_everywhere.Diskusjon - true
FF - user.js: extensions.https_everywhere.Disqus (unreliable) - false
FF - user.js: extensions.https_everywhere.Disqus - true
FF - user.js: extensions.https_everywhere.Ditt Distrikt - true
FF - user.js: extensions.https_everywhere.DjurRattsAlliansen.se - true
FF - user.js: extensions.https_everywhere.DnB Nor - true
FF - user.js: extensions.https_everywhere.Dnsexit - true
FF - user.js: extensions.https_everywhere.DoctorsWithoutBorders.org - true
FF - user.js: extensions.https_everywhere.Document.no - true
FF - user.js: extensions.https_everywhere.DocumentCloud - true
FF - user.js: extensions.https_everywhere.Dopplr.com - true
FF - user.js: extensions.https_everywhere.DotBit - false
FF - user.js: extensions.https_everywhere.Dotster - true
FF - user.js: extensions.https_everywhere.Doubleclick.net (disabled) - false
FF - user.js: extensions.https_everywhere.Dr.Web - true
FF - user.js: extensions.https_everywhere.DreamHost (partial) - true
FF - user.js: extensions.https_everywhere.Dreamwidth - false
FF - user.js: extensions.https_everywhere.DropDav - true
FF - user.js: extensions.https_everywhere.Dropbox - true
FF - user.js: extensions.https_everywhere.Drupal - true
FF - user.js: extensions.https_everywhere.Drwho.virtadpt.net (self-signed) - false
FF - user.js: extensions.https_everywhere.DuckDuckGo - true
FF - user.js: extensions.https_everywhere.DynaDot - true
FF - user.js: extensions.https_everywhere.Dynamo Dresden - true
FF - user.js: extensions.https_everywhere.ED.gov (partial) - true
FF - user.js: extensions.https_everywhere.ED.gov - true
FF - user.js: extensions.https_everywhere.EDP.pt - true
FF - user.js: extensions.https_everywhere.EFF - true
FF - user.js: extensions.https_everywhere.ELENA - true
FF - user.js: extensions.https_everywhere.EPA (.ie) - true
FF - user.js: extensions.https_everywhere.EPEAT - true
FF - user.js: extensions.https_everywhere.EPIC - true
FF - user.js: extensions.https_everywhere.ESB.ie - true
FF - user.js: extensions.https_everywhere.ESISS - true
FF - user.js: extensions.https_everywhere.ESRB - true
FF - user.js: extensions.https_everywhere.ETS - true
FF - user.js: extensions.https_everywhere.ETegro Technologies (default off) - false
FF - user.js: extensions.https_everywhere.EZTV - true
FF - user.js: extensions.https_everywhere.EarthLink (partial) - false
FF - user.js: extensions.https_everywhere.EasyNews - true
FF - user.js: extensions.https_everywhere.Ebi.ac.uk - true
FF - user.js: extensions.https_everywhere.Economist (broken) - false
FF - user.js: extensions.https_everywhere.Economist - true
FF - user.js: extensions.https_everywhere.EdUbuntu - true
FF - user.js: extensions.https_everywhere.Edas.info - true
FF - user.js: extensions.https_everywhere.Egg - true
FF - user.js: extensions.https_everywhere.Elgiganten.se - true
FF - user.js: extensions.https_everywhere.Emediate.eu - true
FF - user.js: extensions.https_everywhere.Employeeexpress.gov - true
FF - user.js: extensions.https_everywhere.Emsisoft - true
FF - user.js: extensions.https_everywhere.Encosia - true
FF - user.js: extensions.https_everywhere.EnergyStar - true
FF - user.js: extensions.https_everywhere.Eniro.se - true
FF - user.js: extensions.https_everywhere.Enom - true
FF - user.js: extensions.https_everywhere.Epilepsy Foundation of America - true
FF - user.js: extensions.https_everywhere.Epilepsy Ontario - true
FF - user.js: extensions.https_everywhere.Epson.com (partial) - true
FF - user.js: extensions.https_everywhere.EquifaxCanada - false
FF - user.js: extensions.https_everywhere.Erowid - true
FF - user.js: extensions.https_everywhere.Euro-ix.net - true
FF - user.js: extensions.https_everywhere.Europa.eu - true
FF - user.js: extensions.https_everywhere.Eventbrite - true
FF - user.js: extensions.https_everywhere.Evernote - true
FF - user.js: extensions.https_everywhere.EzineArticles - true
FF - user.js: extensions.https_everywhere.F-Secure (default off) - false
FF - user.js: extensions.https_everywhere.F-Secure - true
FF - user.js: extensions.https_everywhere.FAAN College Network - true
FF - user.js: extensions.https_everywhere.FAS.org - true
FF - user.js: extensions.https_everywhere.FAZ (broken) - false
FF - user.js: extensions.https_everywhere.FAZ - true
FF - user.js: extensions.https_everywhere.FB18_Forum - true
FF - user.js: extensions.https_everywhere.FFMPEG - false
FF - user.js: extensions.https_everywhere.FHI.se - true
FF - user.js: extensions.https_everywhere.FHS.se - true
FF - user.js: extensions.https_everywhere.FMV.se - true
FF - user.js: extensions.https_everywhere.FSDN.com - true
FF - user.js: extensions.https_everywhere.FSFE.org - true
FF - user.js: extensions.https_everywhere.FTD.de - true
FF - user.js: extensions.https_everywhere.Facebook Apps - true
FF - user.js: extensions.https_everywhere.Facebook - true
FF - user.js: extensions.https_everywhere.Facebook+ (may break apps) - false
FF - user.js: extensions.https_everywhere.Fanboy - true
FF - user.js: extensions.https_everywhere.Farmaciforbundet.se - true
FF - user.js: extensions.https_everywhere.Fass.se - true
FF - user.js: extensions.https_everywhere.Fastly - true
FF - user.js: extensions.https_everywhere.Fastmail - true
FF - user.js: extensions.https_everywhere.Fedora Project - true
FF - user.js: extensions.https_everywhere.FeeFighters - true
FF - user.js: extensions.https_everywhere.FeedMyInbox - true
FF - user.js: extensions.https_everywhere.Fefe - true
FF - user.js: extensions.https_everywhere.Feide - true
FF - user.js: extensions.https_everywhere.Feross - true
FF - user.js: extensions.https_everywhere.FetLife - true
FF - user.js: extensions.https_everywhere.Fianna Fail - true
FF - user.js: extensions.https_everywhere.Fibank - true
FF - user.js: extensions.https_everywhere.Fifth Third Bank - true
FF - user.js: extensions.https_everywhere.Finn - true
FF - user.js: extensions.https_everywhere.FirstGiving - true
FF - user.js: extensions.https_everywhere.Fiskeriverket.se - true
FF - user.js: extensions.https_everywhere.FitBit - true
FF - user.js: extensions.https_everywhere.FiveTV - true
FF - user.js: extensions.https_everywhere.Flashback.org - true
FF - user.js: extensions.https_everywhere.Flattr - true
FF - user.js: extensions.https_everywhere.Flickr (partial) - true
FF - user.js: extensions.https_everywhere.Flossmanuals - true
FF - user.js: extensions.https_everywhere.FluxBB.org - true
FF - user.js: extensions.https_everywhere.Focus.de - true
FF - user.js: extensions.https_everywhere.FoeBuD e.V. - true
FF - user.js: extensions.https_everywhere.Fokus Bank - true
FF - user.js: extensions.https_everywhere.Folksam.se - true
FF - user.js: extensions.https_everywhere.FooFighters - true
FF - user.js: extensions.https_everywhere.Food Allergy & Anaphylaxis Network - true
FF - user.js: extensions.https_everywhere.Food Allergy Initiative - true
FF - user.js: extensions.https_everywhere.Forbrukerraadet - true
FF - user.js: extensions.https_everywhere.Foris Wine - true
FF - user.js: extensions.https_everywhere.Formspring (broken) - false
FF - user.js: extensions.https_everywhere.Forsakringskassan.se - true
FF - user.js: extensions.https_everywhere.Forsvarsforbundet.se - true
FF - user.js: extensions.https_everywhere.Fortum.se - true
FF - user.js: extensions.https_everywhere.Foundation for Health Coverage Education - true
FF - user.js: extensions.https_everywhere.Foursquare.com - true
FF - user.js: extensions.https_everywhere.Free Software Foundation - true
FF - user.js: extensions.https_everywhere.FreeDNS.Afraid.org - true
FF - user.js: extensions.https_everywhere.FreeDesktop Bugzilla - true
FF - user.js: extensions.https_everywhere.Freedom to Tinker - true
FF - user.js: extensions.https_everywhere.Freedombox Foundation - true
FF - user.js: extensions.https_everywhere.Freelancer - true
FF - user.js: extensions.https_everywhere.Freenet - true
FF - user.js: extensions.https_everywhere.Freenode.net - false
FF - user.js: extensions.https_everywhere.Freie Arbeiterinnen- und Arbeiter-Union (FAU) - false
FF - user.js: extensions.https_everywhere.FriBID.se - true
FF - user.js: extensions.https_everywhere.Fridge - true
FF - user.js: extensions.https_everywhere.Friendfeed - true
FF - user.js: extensions.https_everywhere.Frontline Defenders - true
FF - user.js: extensions.https_everywhere.FusionIO - true
FF - user.js: extensions.https_everywhere.FusionNet - true
FF - user.js: extensions.https_everywhere.FutureQuest Support - true
FF - user.js: extensions.https_everywhere.G Data Software - true
FF - user.js: extensions.https_everywhere.G5 - US Department of Education - true
FF - user.js: extensions.https_everywhere.GKG - true
FF - user.js: extensions.https_everywhere.GLAD (Gay & Lesbian Advocates & Defenders) - true
FF - user.js: extensions.https_everywhere.GLS Bank - true
FF - user.js: extensions.https_everywhere.GMX - true
FF - user.js: extensions.https_everywhere.GNOME (partial) - true
FF - user.js: extensions.https_everywhere.GNOME - true
FF - user.js: extensions.https_everywhere.GRSecurity.net - true
FF - user.js: extensions.https_everywhere.GU.se - true
FF - user.js: extensions.https_everywhere.Gandi - true
FF - user.js: extensions.https_everywhere.Gartner.com - true
FF - user.js: extensions.https_everywhere.Geek.com - false
FF - user.js: extensions.https_everywhere.Geek.net - true
FF - user.js: extensions.https_everywhere.Gentoo (CAcert) - true
FF - user.js: extensions.https_everywhere.Gentoo (partial) - true
FF - user.js: extensions.https_everywhere.Gentoo - true
FF - user.js: extensions.https_everywhere.GeoTrust - true
FF - user.js: extensions.https_everywhere.German BigBrotherAwards - true
FF - user.js: extensions.https_everywhere.GetClicky - true
FF - user.js: extensions.https_everywhere.GetFirebug - true
FF - user.js: extensions.https_everywhere.GetPersonas.com - true
FF - user.js: extensions.https_everywhere.Getdigital.de - true
FF - user.js: extensions.https_everywhere.GiBlod.no - true
FF - user.js: extensions.https_everywhere.Gibson Research - true
FF - user.js: extensions.https_everywhere.Gigaset.com - true
FF - user.js: extensions.https_everywhere.GitHub - true
FF - user.js: extensions.https_everywhere.Gitorious - true
FF - user.js: extensions.https_everywhere.Give Kids the World - true
FF - user.js: extensions.https_everywhere.GlenScott - true
FF - user.js: extensions.https_everywhere.Global Scale Technologies - true
FF - user.js: extensions.https_everywhere.GlobalSign - true
FF - user.js: extensions.https_everywhere.Globaltestsupply - true
FF - user.js: extensions.https_everywhere.Gnuheter.org - false
FF - user.js: extensions.https_everywhere.GoDaddy - true
FF - user.js: extensions.https_everywhere.Good.net - true
FF - user.js: extensions.https_everywhere.Google APIs - true
FF - user.js: extensions.https_everywhere.Google Images - true
FF - user.js: extensions.https_everywhere.Google Search - true
FF - user.js: extensions.https_everywhere.Google Services - true
FF - user.js: extensions.https_everywhere.Google Shopping - true
FF - user.js: extensions.https_everywhere.Google Videos - true
FF - user.js: extensions.https_everywhere.GoogleCanada - true
FF - user.js: extensions.https_everywhere.GoogleMaps - true
FF - user.js: extensions.https_everywhere.GoogleMelange - true
FF - user.js: extensions.https_everywhere.GoogleServices - true
FF - user.js: extensions.https_everywhere.GoogleSorry - true
FF - user.js: extensions.https_everywhere.Governo Português (broken) - false
FF - user.js: extensions.https_everywhere.Governo Português - true
FF - user.js: extensions.https_everywhere.Gowalla (partial) - true
FF - user.js: extensions.https_everywhere.Gowalla - true
FF - user.js: extensions.https_everywhere.Gravatar - true
FF - user.js: extensions.https_everywhere.Grepular - true
FF - user.js: extensions.https_everywhere.Groton.org - true
FF - user.js: extensions.https_everywhere.Groupon DE/UK - true
FF - user.js: extensions.https_everywhere.Groupon.se - true
FF - user.js: extensions.https_everywhere.Gsfacket.se - true
FF - user.js: extensions.https_everywhere.Guardian Project - true
FF - user.js: extensions.https_everywhere.GuideStar - true
FF - user.js: extensions.https_everywhere.Guifi.net - true
FF - user.js: extensions.https_everywhere.Gulesider - true
FF - user.js: extensions.https_everywhere.GunIO - true
FF - user.js: extensions.https_everywhere.Gynecomastia.org - true
FF - user.js: extensions.https_everywhere.HD.se - true
FF - user.js: extensions.https_everywhere.HGO.se - true
FF - user.js: extensions.https_everywhere.HH.se - true
FF - user.js: extensions.https_everywhere.HIG.se - true
FF - user.js: extensions.https_everywhere.HIS.se - true
FF - user.js: extensions.https_everywhere.HKK - true
FF - user.js: extensions.https_everywhere.HMV - true
FF - user.js: extensions.https_everywhere.HON.ch (Health On the Net) - false
FF - user.js: extensions.https_everywhere.HSBC - true
FF - user.js: extensions.https_everywhere.HSV.se - true
FF - user.js: extensions.https_everywhere.HTC - false
FF - user.js: extensions.https_everywhere.HTTPwatch.com - true
FF - user.js: extensions.https_everywhere.HUK Coburg - true
FF - user.js: extensions.https_everywhere.HackerNews - true
FF - user.js: extensions.https_everywhere.Hackinthebox.org - true
FF - user.js: extensions.https_everywhere.Hadopi.fr - true
FF - user.js: extensions.https_everywhere.Hakko.com - true
FF - user.js: extensions.https_everywhere.Halebop.se - true
FF - user.js: extensions.https_everywhere.Halifax - true
FF - user.js: extensions.https_everywhere.Hamburg - true
FF - user.js: extensions.https_everywhere.Handbrake.fr - true
FF - user.js: extensions.https_everywhere.Hawaiian Airlines - true
FF - user.js: extensions.https_everywhere.HealthCheckUSA - true
FF - user.js: extensions.https_everywhere.Heathkit - true
FF - user.js: extensions.https_everywhere.Heroku (buggy) - false
FF - user.js: extensions.https_everywhere.Heroku - true
FF - user.js: extensions.https_everywhere.Hexagon - true
FF - user.js: extensions.https_everywhere.Hi - true
FF - user.js: extensions.https_everywhere.Hidemyass - true
FF - user.js: extensions.https_everywhere.Hm.com - true
FF - user.js: extensions.https_everywhere.Home School Legal Defense Association - true
FF - user.js: extensions.https_everywhere.Homebase - true
FF - user.js: extensions.https_everywhere.Homecomputing.fr - false
FF - user.js: extensions.https_everywhere.Hostican Web Hosting - true
FF - user.js: extensions.https_everywhere.Hosts - true
FF - user.js: extensions.https_everywhere.Hotfile - true
FF - user.js: extensions.https_everywhere.Hotmail / Live - true
FF - user.js: extensions.https_everywhere.Hotwire - true
FF - user.js: extensions.https_everywhere.Human Rights Campaign (partial) - true
FF - user.js: extensions.https_everywhere.Hungerhost - true
FF - user.js: extensions.https_everywhere.Huntington's Disease Society of America - true
FF - user.js: extensions.https_everywhere.HurricaneElectric - true
FF - user.js: extensions.https_everywhere.Hushmail - true
FF - user.js: extensions.https_everywhere.Hustler - true
FF - user.js: extensions.https_everywhere.Hypovereinsbank - true
FF - user.js: extensions.https_everywhere.I Do Foundation - true
FF - user.js: extensions.https_everywhere.I2P - false
FF - user.js: extensions.https_everywhere.IANA - true
FF - user.js: extensions.https_everywhere.IBM - false
FF - user.js: extensions.https_everywhere.ICA.se - true
FF - user.js: extensions.https_everywhere.ICMail - true
FF - user.js: extensions.https_everywhere.IDG.com.au - true
FF - user.js: extensions.https_everywhere.IDG.se - true
FF - user.js: extensions.https_everywhere.IEEE - true
FF - user.js: extensions.https_everywhere.IELTS - true
FF - user.js: extensions.https_everywhere.IETF - true
FF - user.js: extensions.https_everywhere.IFA.ch - true
FF - user.js: extensions.https_everywhere.IIS.net - true
FF - user.js: extensions.https_everywhere.IIS.se - true
FF - user.js: extensions.https_everywhere.IKK-Gesundplus - true
FF - user.js: extensions.https_everywhere.IKK-Suedwest - true
FF - user.js: extensions.https_everywhere.ILO.org - true
FF - user.js: extensions.https_everywhere.IMF.org - true
FF - user.js: extensions.https_everywhere.ING DIRECT - true
FF - user.js: extensions.https_everywhere.IPCC.ch - true
FF - user.js: extensions.https_everywhere.IRF.se - true
FF - user.js: extensions.https_everywhere.ISC - true
FF - user.js: extensions.https_everywhere.ISIS - true
FF - user.js: extensions.https_everywhere.Iberia - true
FF - user.js: extensions.https_everywhere.IceHeberg - true
FF - user.js: extensions.https_everywhere.Identica - true
FF - user.js: extensions.https_everywhere.IdentityTheft - true
FF - user.js: extensions.https_everywhere.Imgur (partial, broken) - false
FF - user.js: extensions.https_everywhere.Imgur - true
FF - user.js: extensions.https_everywhere.Immunityinc.com - true
FF - user.js: extensions.https_everywhere.Imrworldwide.com - true
FF - user.js: extensions.https_everywhere.Indybay - true
FF - user.js: extensions.https_everywhere.Indymedia.org - true
FF - user.js: extensions.https_everywhere.Inet.se - true
FF - user.js: extensions.https_everywhere.Info.iet.unipi.it - false
FF - user.js: extensions.https_everywhere.InfoWorld.com - true
FF - user.js: extensions.https_everywhere.Infragard.net - true
FF - user.js: extensions.https_everywhere.Inria.fr - true
FF - user.js: extensions.https_everywhere.Inschrijven.nl - true
FF - user.js: extensions.https_everywhere.Insight - true
FF - user.js: extensions.https_everywhere.Instagram (partial) - true
FF - user.js: extensions.https_everywhere.InstantSSL - true
FF - user.js: extensions.https_everywhere.Instapaper - true
FF - user.js: extensions.https_everywhere.InterNetworX - true
FF - user.js: extensions.https_everywhere.Interactive Marketing Solutions - true
FF - user.js: extensions.https_everywhere.Internews - true
FF - user.js: extensions.https_everywhere.Interpol - true
FF - user.js: extensions.https_everywhere.Intl Cannagraphic Magazine - true
FF - user.js: extensions.https_everywhere.Irish Broadband - true
FF - user.js: extensions.https_everywhere.IsoHunt - true
FF - user.js: extensions.https_everywhere.ItsLearning - true
FF - user.js: extensions.https_everywhere.Ixquick - true
FF - user.js: extensions.https_everywhere.Izquierda-unida.es - false
FF - user.js: extensions.https_everywhere.JAKO-O - true
FF - user.js: extensions.https_everywhere.JANET - true
FF - user.js: extensions.https_everywhere.JBoss - true
FF - user.js: extensions.https_everywhere.JP-CERT - true
FF - user.js: extensions.https_everywhere.JPG Magazine (self-signed) - false
FF - user.js: extensions.https_everywhere.JPG Magazine - true
FF - user.js: extensions.https_everywhere.JVN.jp - true
FF - user.js: extensions.https_everywhere.Japan Airlines - true
FF - user.js: extensions.https_everywhere.Japan Information Technology Promotion Agency - true
FF - user.js: extensions.https_everywhere.Jappix - true
FF - user.js: extensions.https_everywhere.Java - true
FF - user.js: extensions.https_everywhere.Jet2.com - true
FF - user.js: extensions.https_everywhere.Jobscout24 - true
FF - user.js: extensions.https_everywhere.Joker - true
FF - user.js: extensions.https_everywhere.Joslin Diabetes Center - true
FF - user.js: extensions.https_everywhere.Jottit - true
FF - user.js: extensions.https_everywhere.Journeyed - true
FF - user.js: extensions.https_everywhere.Joyclub.de - true
FF - user.js: extensions.https_everywhere.Juniper Networks - true
FF - user.js: extensions.https_everywhere.Jusek.se - true
FF - user.js: extensions.https_everywhere.JustGive - true
FF - user.js: extensions.https_everywhere.JustGiving - true
FF - user.js: extensions.https_everywhere.JustTomatoes.com - true
FF - user.js: extensions.https_everywhere.KAU.se - true
FF - user.js: extensions.https_everywhere.KDE (partial) - true
FF - user.js: extensions.https_everywhere.KDE Bugtracker - true
FF - user.js: extensions.https_everywhere.KEMI.se - true
FF - user.js: extensions.https_everywhere.KI.se - true
FF - user.js: extensions.https_everywhere.KKH-Allianz - true
FF - user.js: extensions.https_everywhere.KKH.se - true
FF - user.js: extensions.https_everywhere.KLM - true
FF - user.js: extensions.https_everywhere.KMH.se - true
FF - user.js: extensions.https_everywhere.KPN - true
FF - user.js: extensions.https_everywhere.KPT.ch - true
FF - user.js: extensions.https_everywhere.KTH.se - true
FF - user.js: extensions.https_everywhere.Kabel Deutschland - true
FF - user.js: extensions.https_everywhere.Kachingle - true
FF - user.js: extensions.https_everywhere.Kanotix - false
FF - user.js: extensions.https_everywhere.Karagarga - true
FF - user.js: extensions.https_everywhere.Kayak - true
FF - user.js: extensions.https_everywhere.Keepassx - true
FF - user.js: extensions.https_everywhere.Kernel.org - true
FF - user.js: extensions.https_everywhere.Khronos Group (partial) - true
FF - user.js: extensions.https_everywhere.KickassTorrents - true
FF - user.js: extensions.https_everywhere.Kintera Network - true
FF - user.js: extensions.https_everywhere.Kismetwireless.net - true
FF - user.js: extensions.https_everywhere.Knappschaft-Bahn-See - true
FF - user.js: extensions.https_everywhere.Knopper.net (self-signed) - false
FF - user.js: extensions.https_everywhere.Kohls.com - true
FF - user.js: extensions.https_everywhere.Kommunal.se - true
FF - user.js: extensions.https_everywhere.Komplett.no - true
FF - user.js: extensions.https_everywhere.Konami.com - true
FF - user.js: extensions.https_everywhere.Konstfack.se - true
FF - user.js: extensions.https_everywhere.Kotex - true
FF - user.js: extensions.https_everywhere.KriminalVarden.se - true
FF - user.js: extensions.https_everywhere.Kuantokusta.pt - true
FF - user.js: extensions.https_everywhere.Kyberia.sk - true
FF - user.js: extensions.https_everywhere.LIU.se - true
FF - user.js: extensions.https_everywhere.LKML - true
FF - user.js: extensions.https_everywhere.LM Uni Muenchen - true
FF - user.js: extensions.https_everywhere.LWN - true
FF - user.js: extensions.https_everywhere.La Caixa - true
FF - user.js: extensions.https_everywhere.LabCorp - true
FF - user.js: extensions.https_everywhere.Lansforsakringar.se - true
FF - user.js: extensions.https_everywhere.Lantmateriet.se - true
FF - user.js: extensions.https_everywhere.LastPass - false
FF - user.js: extensions.https_everywhere.Lastminute.com - true
FF - user.js: extensions.https_everywhere.Launchpad - true
FF - user.js: extensions.https_everywhere.Lavabit - true
FF - user.js: extensions.https_everywhere.Lavasoft (broken) - false
FF - user.js: extensions.https_everywhere.Lavasoft - true
FF - user.js: extensions.https_everywhere.Lawblog.de - false
FF - user.js: extensions.https_everywhere.LboroAcUk - true
FF - user.js: extensions.https_everywhere.LegitScript - true
FF - user.js: extensions.https_everywhere.Legtux - false
FF - user.js: extensions.https_everywhere.Lelo.com - true
FF - user.js: extensions.https_everywhere.Lenovo (partial) - true
FF - user.js: extensions.https_everywhere.Lenovo - true
FF - user.js: extensions.https_everywhere.LensRentals.com - true
FF - user.js: extensions.https_everywhere.Library Anywhere - true
FF - user.js: extensions.https_everywhere.LibraryThing - true
FF - user.js: extensions.https_everywhere.LibreOffice - true
FF - user.js: extensions.https_everywhere.LibreOffice-Box - true
FF - user.js: extensions.https_everywhere.Lichtblick.de - true
FF - user.js: extensions.https_everywhere.Life Extension Magazine - true
FF - user.js: extensions.https_everywhere.Liferay.com - true
FF - user.js: extensions.https_everywhere.LiftShare - true
FF - user.js: extensions.https_everywhere.Lighttpd.net - false
FF - user.js: extensions.https_everywhere.Lindt USA - true
FF - user.js: extensions.https_everywhere.Link+ Catalog - true
FF - user.js: extensions.https_everywhere.LinkedIn (minimal) - true
FF - user.js: extensions.https_everywhere.LinkedIn (partial) - false
FF - user.js: extensions.https_everywhere.Linkomanija - false
FF - user.js: extensions.https_everywhere.Linksysbycisco.com - true
FF - user.js: extensions.https_everywhere.Linode - true
FF - user.js: extensions.https_everywhere.Linux Foundation - true
FF - user.js: extensions.https_everywhere.Linux.com - true
FF - user.js: extensions.https_everywhere.Linux.org.ru - true
FF - user.js: extensions.https_everywhere.LinuxFoundation - true
FF - user.js: extensions.https_everywhere.LinuxQuestions - true
FF - user.js: extensions.https_everywhere.LinuxQuestions.org - true
FF - user.js: extensions.https_everywhere.LiveJournal - false
FF - user.js: extensions.https_everywhere.LoadImpact.com - true
FF - user.js: extensions.https_everywhere.Local 20/20 - true
FF - user.js: extensions.https_everywhere.Local.ch - true
FF - user.js: extensions.https_everywhere.Lone Star Overnight - true
FF - user.js: extensions.https_everywhere.Loopt - true
FF - user.js: extensions.https_everywhere.LoveFilm - true
FF - user.js: extensions.https_everywhere.Ludios.org - true
FF - user.js: extensions.https_everywhere.M86security - true
FF - user.js: extensions.https_everywhere.MAAWG - true
FF - user.js: extensions.https_everywhere.MADD California - true
FF - user.js: extensions.https_everywhere.MAH.se - true
FF - user.js: extensions.https_everywhere.MAPS - true
FF - user.js: extensions.https_everywhere.MDH.se - true
FF - user.js: extensions.https_everywhere.METRO Transit (Harris County, Houston, Texas) - true
FF - user.js: extensions.https_everywhere.MIN_Commsy - true
FF - user.js: extensions.https_everywhere.MIUN.se - true
FF - user.js: extensions.https_everywhere.MIX-Computer.de - true
FF - user.js: extensions.https_everywhere.MSN (Other domains) - true
FF - user.js: extensions.https_everywhere.MSN - false
FF - user.js: extensions.https_everywhere.MYEDDEBT.com - true
FF - user.js: extensions.https_everywhere.MacWorld - true
FF - user.js: extensions.https_everywhere.Magento (buggy) - false
FF - user.js: extensions.https_everywhere.Magento - true
FF - user.js: extensions.https_everywhere.Magnatune - true
FF - user.js: extensions.https_everywhere.Magnet.ie - true
FF - user.js: extensions.https_everywhere.Mail.com - true
FF - user.js: extensions.https_everywhere.Maine Civil Liberties Union - true
FF - user.js: extensions.https_everywhere.Make My Trip - true
FF - user.js: extensions.https_everywhere.Make-A-Wish Foundation of Michigan - true
FF - user.js: extensions.https_everywhere.Malwarebytes - true
FF - user.js: extensions.https_everywhere.Mandriva.com - true
FF - user.js: extensions.https_everywhere.MapQuest (questionable) - false
FF - user.js: extensions.https_everywhere.MapQuest - true
FF - user.js: extensions.https_everywhere.Marketwatch.com (broken) - false
FF - user.js: extensions.https_everywhere.MarksandSpencer - true
FF - user.js: extensions.https_everywhere.Marxists Internet Archive - false
FF - user.js: extensions.https_everywhere.Mashable.com - true
FF - user.js: extensions.https_everywhere.Massachusetts General Hospital OCD & Related Disorders Program - true
FF - user.js: extensions.https_everywhere.Massage Magazine - true
FF - user.js: extensions.https_everywhere.Materiel.net - true
FF - user.js: extensions.https_everywhere.Mathtag.com - true
FF - user.js: extensions.https_everywhere.MaxMind - true
FF - user.js: extensions.https_everywhere.May First/People Link - true
FF - user.js: extensions.https_everywhere.McAfee (buggy) - false
FF - user.js: extensions.https_everywhere.McAfee - true
FF - user.js: extensions.https_everywhere.Media Temple - true
FF - user.js: extensions.https_everywhere.Mediamarkt.se - true
FF - user.js: extensions.https_everywhere.MedicAlert - true
FF - user.js: extensions.https_everywhere.Medikamente-Per-Klick - true
FF - user.js: extensions.https_everywhere.Medstop.se - true
FF - user.js: extensions.https_everywhere.Meebo - true
FF - user.js: extensions.https_everywhere.Meego - true
FF - user.js: extensions.https_everywhere.Meltwaternews.con - true
FF - user.js: extensions.https_everywhere.Mibbit - true
FF - user.js: extensions.https_everywhere.Microchip.com - true
FF - user.js: extensions.https_everywhere.Microsoft - true
FF - user.js: extensions.https_everywhere.Mijn ING - true
FF - user.js: extensions.https_everywhere.Miles-and-more.com - true
FF - user.js: extensions.https_everywhere.MilkAndMore - true
FF - user.js: extensions.https_everywhere.Minecraft - true
FF - user.js: extensions.https_everywhere.Miniatur Wunderland - true
FF - user.js: extensions.https_everywhere.Mint - true
FF - user.js: extensions.https_everywhere.Minus.com - true
FF - user.js: extensions.https_everywhere.MirBSD - true
FF - user.js: extensions.https_everywhere.Miranda-IM (buggy) - false
FF - user.js: extensions.https_everywhere.Miranda-IM - true
FF - user.js: extensions.https_everywhere.Mises.org - true
FF - user.js: extensions.https_everywhere.Mitsubishi.com - true
FF - user.js: extensions.https_everywhere.Mobygames.com - true
FF - user.js: extensions.https_everywhere.ModSecurity - true
FF - user.js: extensions.https_everywhere.MomentusMedia - true
FF - user.js: extensions.https_everywhere.Monarch.co.uk - true
FF - user.js: extensions.https_everywhere.Moneybookers - true
FF - user.js: extensions.https_everywhere.Mookie1.com - true
FF - user.js: extensions.https_everywhere.MoonPig - true
FF - user.js: extensions.https_everywhere.Motesplatsen.se - true
FF - user.js: extensions.https_everywhere.Mountyhall - false
FF - user.js: extensions.https_everywhere.MoveOn - true
FF - user.js: extensions.https_everywhere.Movelia - true
FF - user.js: extensions.https_everywhere.Mozdev - true
FF - user.js: extensions.https_everywhere.Mozilla - true
FF - user.js: extensions.https_everywhere.Mozy - true
FF - user.js: extensions.https_everywhere.Mpx - true
FF - user.js: extensions.https_everywhere.Mt.Gox - true
FF - user.js: extensions.https_everywhere.Mullet.se - true
FF - user.js: extensions.https_everywhere.Mullvad.net - true
FF - user.js: extensions.https_everywhere.Musikerforbundet.se - true
FF - user.js: extensions.https_everywhere.My-files.de - true
FF - user.js: extensions.https_everywhere.MyCharity.ie - true
FF - user.js: extensions.https_everywhere.MyChart - true
FF - user.js: extensions.https_everywhere.MyEdAccount.Com - true
FF - user.js: extensions.https_everywhere.MyOpenID - true
FF - user.js: extensions.https_everywhere.MyPlayDirect - true
FF - user.js: extensions.https_everywhere.MyPoints - true
FF - user.js: extensions.https_everywhere.MySQL - true
FF - user.js: extensions.https_everywhere.MyTUM.de - true
FF - user.js: extensions.https_everywhere.MyUHC - true
FF - user.js: extensions.https_everywhere.MyWOT - true
FF - user.js: extensions.https_everywhere.Myspace - true
FF - user.js: extensions.https_everywhere.NAB - true
FF - user.js: extensions.https_everywhere.NL Overheid - true
FF - user.js: extensions.https_everywhere.NL Politiek - true
FF - user.js: extensions.https_everywhere.NPR.org - true
FF - user.js: extensions.https_everywhere.NSF.gov (broken) - false
FF - user.js: extensions.https_everywhere.NSF.gov - true
FF - user.js: extensions.https_everywhere.NTU - true
FF - user.js: extensions.https_everywhere.NYDailyNews - true
FF - user.js: extensions.https_everywhere.NYTimes - true
FF - user.js: extensions.https_everywhere.NZBIndex - true
FF - user.js: extensions.https_everywhere.NZBIndex.nl - true
FF - user.js: extensions.https_everywhere.NameCheap - true
FF - user.js: extensions.https_everywhere.Names - true
FF - user.js: extensions.https_everywhere.NanoHUB - true
FF - user.js: extensions.https_everywhere.National American Arab Nursing Association - true
FF - user.js: extensions.https_everywhere.National Children's Leukemia Foundation - true
FF - user.js: extensions.https_everywhere.National Eating Disorders Association - true
FF - user.js: extensions.https_everywhere.National Lawyers Guild - true
FF - user.js: extensions.https_everywhere.National Press Photographers Association - true
FF - user.js: extensions.https_everywhere.National Suicide Prevention Lifeline - true
FF - user.js: extensions.https_everywhere.National Vulvodynia Association - true
FF - user.js: extensions.https_everywhere.NationalArchivesGovUK - true
FF - user.js: extensions.https_everywhere.NationalLottery - true
FF - user.js: extensions.https_everywhere.Nattstad.se - true
FF - user.js: extensions.https_everywhere.Naturvardsverket.se - true
FF - user.js: extensions.https_everywhere.Naukri - true
FF - user.js: extensions.https_everywhere.Nectarine Demoscene Music - true
FF - user.js: extensions.https_everywhere.Neelwafurat.com - true
FF - user.js: extensions.https_everywhere.Nelly.com - true
FF - user.js: extensions.https_everywhere.Netbeat Webmail - true
FF - user.js: extensions.https_everywhere.Netdoktor.se - true
FF - user.js: extensions.https_everywhere.Netflix (buggy) - false
FF - user.js: extensions.https_everywhere.Netflix - true
FF - user.js: extensions.https_everywhere.NetflixCanada - false
FF - user.js: extensions.https_everywhere.Nether - true
FF - user.js: extensions.https_everywhere.Nettica - true
FF - user.js: extensions.https_everywhere.NetworkWorld - true
FF - user.js: extensions.https_everywhere.Netzpolitik.org - true
FF - user.js: extensions.https_everywhere.New Moon Girls Online - true
FF - user.js: extensions.https_everywhere.NewIT - true
FF - user.js: extensions.https_everywhere.NewsGator - true
FF - user.js: extensions.https_everywhere.Newzbin - true
FF - user.js: extensions.https_everywhere.Next - true
FF - user.js: extensions.https_everywhere.NextBus - true
FF - user.js: extensions.https_everywhere.NicAc - true
FF - user.js: extensions.https_everywhere.NicIo - true
FF - user.js: extensions.https_everywhere.Nicotine Anonymous - true
FF - user.js: extensions.https_everywhere.Ninite - true
FF - user.js: extensions.https_everywhere.Nintendo.com - true
FF - user.js: extensions.https_everywhere.No Deep Packet Inspection campaign - true
FF - user.js: extensions.https_everywhere.Noisebridge - true
FF - user.js: extensions.https_everywhere.Nokia - true
FF - user.js: extensions.https_everywhere.Nordea - true
FF - user.js: extensions.https_everywhere.Nordnet.se - true
FF - user.js: extensions.https_everywhere.Nordu.net - true
FF - user.js: extensions.https_everywhere.Norman.com - true
FF - user.js: extensions.https_everywhere.Northpole.fi - false
FF - user.js: extensions.https_everywhere.Norwegian.com - true
FF - user.js: extensions.https_everywhere.NottinghamAC - true
FF - user.js: extensions.https_everywhere.Nttdocomo.com - true
FF - user.js: extensions.https_everywhere.Nttxstore - true
FF - user.js: extensions.https_everywhere.NutriCentre - true
FF - user.js: extensions.https_everywhere.O2online.de - true
FF - user.js: extensions.https_everywhere.OKCupid.com - false
FF - user.js: extensions.https_everywhere.OVH - true
FF - user.js: extensions.https_everywhere.Officersforbundet.se - true
FF - user.js: extensions.https_everywhere.Official Colorado No-Call List - true
FF - user.js: extensions.https_everywhere.Ohloh - true
FF - user.js: extensions.https_everywhere.Olark - true
FF - user.js: extensions.https_everywhere.OmniGroup.com - true
FF - user.js: extensions.https_everywhere.Omron.com - true
FF - user.js: extensions.https_everywhere.OnTrac - true
FF - user.js: extensions.https_everywhere.Onehub.com - true
FF - user.js: extensions.https_everywhere.Online.nl - true
FF - user.js: extensions.https_everywhere.Ontario Lung Association - true
FF - user.js: extensions.https_everywhere.OomphMe - false
FF - user.js: extensions.https_everywhere.Open-Mesh - true
FF - user.js: extensions.https_everywhere.OpenBSD Europe - true
FF - user.js: extensions.https_everywhere.OpenDNS - true
FF - user.js: extensions.https_everywhere.OpenID - true
FF - user.js: extensions.https_everywhere.OpenLeaks - true
FF - user.js: extensions.https_everywhere.OpenSC Project - true
FF - user.js: extensions.https_everywhere.OpenSSL - false
FF - user.js: extensions.https_everywhere.OpenStreetMap Wiki - true
FF - user.js: extensions.https_everywhere.OpenVPN - true
FF - user.js: extensions.https_everywhere.Openprinting - true
FF - user.js: extensions.https_everywhere.Opera - false
FF - user.js: extensions.https_everywhere.Orange - true
FF - user.js: extensions.https_everywhere.OverClockers - true
FF - user.js: extensions.https_everywhere.Overlake Hospital Medical Center - true
FF - user.js: extensions.https_everywhere.Oxfam Unwrapped - true
FF - user.js: extensions.https_everywhere.OzBargain - true
FF - user.js: extensions.https_everywhere.PBA Galleries - true
FF - user.js: extensions.https_everywhere.PC World - true
FF - user.js: extensions.https_everywhere.PCCaseGear - true
FF - user.js: extensions.https_everywhere.PFLAG-Parents, Families, & Friends of Lesbians and Gays (partial) - true
FF - user.js: extensions.https_everywhere.PGP - true
FF - user.js: extensions.https_everywhere.PNC - true
FF - user.js: extensions.https_everywhere.PRV.se - true
FF - user.js: extensions.https_everywhere.PS-Webhosting Webmail - true
FF - user.js: extensions.https_everywhere.PageKite - true
FF - user.js: extensions.https_everywhere.PaidContent - true
FF - user.js: extensions.https_everywhere.Panasonic.com - true
FF - user.js: extensions.https_everywhere.Pandora (broken) - false
FF - user.js: extensions.https_everywhere.Pandora - true
FF - user.js: extensions.https_everywhere.Panic.com - true
FF - user.js: extensions.https_everywhere.Paper.li - true
FF - user.js: extensions.https_everywhere.Parship.nl - true
FF - user.js: extensions.https_everywhere.PassThePopcorn - true
FF - user.js: extensions.https_everywhere.PasswordCard - true
FF - user.js: extensions.https_everywhere.Pastebin.ca - false
FF - user.js: extensions.https_everywhere.Pastebin.com - false
FF - user.js: extensions.https_everywhere.Pastee.org - true
FF - user.js: extensions.https_everywhere.PayPal - true
FF - user.js: extensions.https_everywhere.Pdadb.net - false
FF - user.js: extensions.https_everywhere.PearsonVue - true
FF - user.js: extensions.https_everywhere.PensionsMyndigheten.se - true
FF - user.js: extensions.https_everywhere.PhishTank - true
FF - user.js: extensions.https_everywhere.Phoromatic.com - true
FF - user.js: extensions.https_everywhere.Photonconsulting.com - true
FF - user.js: extensions.https_everywhere.Picasa Web Albums - true
FF - user.js: extensions.https_everywhere.Picplz - true
FF - user.js: extensions.https_everywhere.Pinboard.in - true
FF - user.js: extensions.https_everywhere.Ping.fm - true
FF - user.js: extensions.https_everywhere.Pinterest - true
FF - user.js: extensions.https_everywhere.Pipex - true
FF - user.js: extensions.https_everywhere.Pirate Party - true
FF - user.js: extensions.https_everywhere.PirateParty - true
FF - user.js: extensions.https_everywhere.Piscatus.se - true
FF - user.js: extensions.https_everywhere.Pivotal Tracker - true
FF - user.js: extensions.https_everywhere.Pizzahut UK - true
FF - user.js: extensions.https_everywhere.PlanetRomeo - true
FF - user.js: extensions.https_everywhere.Planned Parenthood - true
FF - user.js: extensions.https_everywhere.Playboy - true
FF - user.js: extensions.https_everywhere.Pledgie - true
FF - user.js: extensions.https_everywhere.PlentyOfFish - true
FF - user.js: extensions.https_everywhere.Pliktverket.se - true
FF - user.js: extensions.https_everywhere.Plone.org - true
FF - user.js: extensions.https_everywhere.Plus.net - true
FF - user.js: extensions.https_everywhere.Plusgirot.se - true
FF - user.js: extensions.https_everywhere.PodOmatic.com - true
FF - user.js: extensions.https_everywhere.Pogo - true
FF - user.js: extensions.https_everywhere.Poivy.com - true
FF - user.js: extensions.https_everywhere.PolarnoPyret.se - true
FF - user.js: extensions.https_everywhere.Policia.es - false
FF - user.js: extensions.https_everywhere.Polisforbundet.se - true
FF - user.js: extensions.https_everywhere.Polldaddy - true
FF - user.js: extensions.https_everywhere.Porteus Linux - true
FF - user.js: extensions.https_everywhere.PositiveSSL - true
FF - user.js: extensions.https_everywhere.Post.ch - true
FF - user.js: extensions.https_everywhere.Postbank - true
FF - user.js: extensions.https_everywhere.Poste.it - true
FF - user.js: extensions.https_everywhere.Posten.se - true
FF - user.js: extensions.https_everywhere.Posterous - true
FF - user.js: extensions.https_everywhere.PostgreSQL - true
FF - user.js: extensions.https_everywhere.Powells.com - true
FF - user.js: extensions.https_everywhere.Powernotebooks.com - true
FF - user.js: extensions.https_everywhere.Prad.de - false
FF - user.js: extensions.https_everywhere.Previa.se - true
FF - user.js: extensions.https_everywhere.PreyProject - true
FF - user.js: extensions.https_everywhere.Priberam.pt - true
FF - user.js: extensions.https_everywhere.Princeton.edu - true
FF - user.js: extensions.https_everywhere.Privacy International - true
FF - user.js: extensions.https_everywhere.Privacy Rights Clearinghouse - true
FF - user.js: extensions.https_everywhere.PrivacyBox - true
FF - user.js: extensions.https_everywhere.PrivatePaste - true
FF - user.js: extensions.https_everywhere.PrivateWifi - true
FF - user.js: extensions.https_everywhere.ProPublica.org - true
FF - user.js: extensions.https_everywhere.Project Euler - true
FF - user.js: extensions.https_everywhere.Project Syndicate (broken) - false
FF - user.js: extensions.https_everywhere.Project Syndicate - true
FF - user.js: extensions.https_everywhere.ProjectHoneypot - true
FF - user.js: extensions.https_everywhere.Prolific.com.tw - false
FF - user.js: extensions.https_everywhere.Prometric - true
FF - user.js: extensions.https_everywhere.Proxify - true
FF - user.js: extensions.https_everywhere.Proxy.org - true
FF - user.js: extensions.https_everywhere.Public Citizen - true
FF - user.js: extensions.https_everywhere.Publicintelligence - true
FF - user.js: extensions.https_everywhere.Puma.com - true
FF - user.js: extensions.https_everywhere.PureHacking - true
FF - user.js: extensions.https_everywhere.Puritan.com - true
FF - user.js: extensions.https_everywhere.Pypi (default off) - false
FF - user.js: extensions.https_everywhere.Python.org SVN (default off) - false
FF - user.js: extensions.https_everywhere.QIP - true
FF - user.js: extensions.https_everywhere.Qualtrics (surveys) - true
FF - user.js: extensions.https_everywhere.Qualys - true
FF - user.js: extensions.https_everywhere.Quora - false
FF - user.js: extensions.https_everywhere.Quorks - false
FF - user.js: extensions.https_everywhere.Qxl - true
FF - user.js: extensions.https_everywhere.R00tshell.lighthouseapp.com - false
FF - user.js: extensions.https_everywhere.RAC - true
FF - user.js: extensions.https_everywhere.RFC-Editor - true
FF - user.js: extensions.https_everywhere.RIAA - true
FF - user.js: extensions.https_everywhere.RIS - true
FF - user.js: extensions.https_everywhere.ROBOXchange - true
FF - user.js: extensions.https_everywhere.RSA - true
FF - user.js: extensions.https_everywhere.RT.com - true
FF - user.js: extensions.https_everywhere.RT.ru - true
FF - user.js: extensions.https_everywhere.Rabobank - true
FF - user.js: extensions.https_everywhere.Rackerhacker - true
FF - user.js: extensions.https_everywhere.RadioShack (broken) - false
FF - user.js: extensions.https_everywhere.RadioShack - true
FF - user.js: extensions.https_everywhere.Raiffeisen.ch - true
FF - user.js: extensions.https_everywhere.Random.org (broken) - false
FF - user.js: extensions.https_everywhere.Random.org - true
FF - user.js: extensions.https_everywhere.RapidSSL - true
FF - user.js: extensions.https_everywhere.RatePoint (partial) - true
FF - user.js: extensions.https_everywhere.ReadItLaterList.com - true
FF - user.js: extensions.https_everywhere.ReadSpeaker - true
FF - user.js: extensions.https_everywhere.ReadWriteWeb (broken) - false
FF - user.js: extensions.https_everywhere.ReadWriteWeb - true
FF - user.js: extensions.https_everywhere.Reco.se - true
FF - user.js: extensions.https_everywhere.RedHat - true
FF - user.js: extensions.https_everywhere.RedIRIS.es - true
FF - user.js: extensions.https_everywhere.Redbox.com - true
FF - user.js: extensions.https_everywhere.Reddit (hackish) - false
FF - user.js: extensions.https_everywhere.Reddit - true
FF - user.js: extensions.https_everywhere.Reddit+ - false
FF - user.js: extensions.https_everywhere.Reformed Church - true
FF - user.js: extensions.https_everywhere.Regional Municipality of Peel, Canada - true
FF - user.js: extensions.https_everywhere.Register.com - true
FF - user.js: extensions.https_everywhere.Reichelt.de - true
FF - user.js: extensions.https_everywhere.RememberTheMilk - true
FF - user.js: extensions.https_everywhere.Resurs.se - true
FF - user.js: extensions.https_everywhere.Revsci.net - true
FF - user.js: extensions.https_everywhere.Ricardo.ch - true
FF - user.js: extensions.https_everywhere.Riga - true
FF - user.js: extensions.https_everywhere.Riksgalden.se - true
FF - user.js: extensions.https_everywhere.Riseup - true
FF - user.js: extensions.https_everywhere.RoadRunner - true
FF - user.js: extensions.https_everywhere.Robeco - true
FF - user.js: extensions.https_everywhere.Roccat.org - false
FF - user.js: extensions.https_everywhere.Roiservice.com - true
FF - user.js: extensions.https_everywhere.Rottentomatoes - true
FF - user.js: extensions.https_everywhere.RoyalGovUK - true
FF - user.js: extensions.https_everywhere.RubyGems.org - true
FF - user.js: extensions.https_everywhere.Rutgers - true
FF - user.js: extensions.https_everywhere.Ryanair.com - true
FF - user.js: extensions.https_everywhere.SAMBA - true
FF - user.js: extensions.https_everywhere.SANS - true
FF - user.js: extensions.https_everywhere.SBB.ch - true
FF - user.js: extensions.https_everywhere.SF.se - true
FF - user.js: extensions.https_everywhere.SGSStudentbostader.se - true
FF - user.js: extensions.https_everywhere.SH.se - true
FF - user.js: extensions.https_everywhere.SI.se - true
FF - user.js: extensions.https_everywhere.SICS.se - true
FF - user.js: extensions.https_everywhere.SJ.se - true
FF - user.js: extensions.https_everywhere.SL.se - true
FF - user.js: extensions.https_everywhere.SLF.se - true
FF - user.js: extensions.https_everywhere.SLU.se - true
FF - user.js: extensions.https_everywhere.SNS Bank - true
FF - user.js: extensions.https_everywhere.SPCA Los Angeles - true
FF - user.js: extensions.https_everywhere.SQLite - true
FF - user.js: extensions.https_everywhere.SSLlabs.com - true
FF - user.js: extensions.https_everywhere.SSLshopper - true
FF - user.js: extensions.https_everywhere.ST.org - true
FF - user.js: extensions.https_everywhere.SVGOpen - true
FF - user.js: extensions.https_everywhere.SVT.se - true
FF - user.js: extensions.https_everywhere.Sabnzbd Forum - true
FF - user.js: extensions.https_everywhere.Sac.se - true
FF - user.js: extensions.https_everywhere.Safari Books Online - true
FF - user.js: extensions.https_everywhere.Safe-mail.net - true
FF - user.js: extensions.https_everywhere.Sagernotebook.com - true
FF - user.js: extensions.https_everywhere.Salsa Labs - true
FF - user.js: extensions.https_everywhere.Samba.org - true
FF - user.js: extensions.https_everywhere.Sanitarium.se - true
FF - user.js: extensions.https_everywhere.Savannah - true
FF - user.js: extensions.https_everywhere.ScMagazineUS.com - true
FF - user.js: extensions.https_everywhere.Schneier on Security - true
FF - user.js: extensions.https_everywhere.SchooltoPrison.org - true
FF - user.js: extensions.https_everywhere.SchuelerVZ - false
FF - user.js: extensions.https_everywhere.Sciencemag.org - true
FF - user.js: extensions.https_everywhere.Scintilla.utwente.nl - true
FF - user.js: extensions.https_everywhere.Scottevest - true
FF - user.js: extensions.https_everywhere.Screen It! Movie Reviews - true
FF - user.js: extensions.https_everywhere.Scribd.com (buggy) - false
FF - user.js: extensions.https_everywhere.Scribd.com - true
FF - user.js: extensions.https_everywhere.Scroogle - true
FF - user.js: extensions.https_everywhere.Seagate.com (broken) - false
FF - user.js: extensions.https_everywhere.Seagate.com - true
FF - user.js: extensions.https_everywhere.Search www.google.com - false
FF - user.js: extensions.https_everywhere.Secular Coalition for America - true
FF - user.js: extensions.https_everywhere.Secunia - true
FF - user.js: extensions.https_everywhere.Secure.marketwatch.com - true
FF - user.js: extensions.https_everywhere.SecureList - true
FF - user.js: extensions.https_everywhere.Securepaynet.net - true
FF - user.js: extensions.https_everywhere.Secureserver.net (partial) - true
FF - user.js: extensions.https_everywhere.Security In A Box - true
FF - user.js: extensions.https_everywhere.Security.NL - true
FF - user.js: extensions.https_everywhere.SecurityFocus.com - true
FF - user.js: extensions.https_everywhere.SecurityMetrics - true
FF - user.js: extensions.https_everywhere.SecurityWeek.com - true
FF - user.js: extensions.https_everywhere.Securosis - true
FF - user.js: extensions.https_everywhere.Senate.gov - true
FF - user.js: extensions.https_everywhere.Sendmail - true
FF - user.js: extensions.https_everywhere.Serialist - true
FF - user.js: extensions.https_everywhere.Shannon Health - true
FF - user.js: extensions.https_everywhere.ShareThis (embedded widget) - true
FF - user.js: extensions.https_everywhere.Siemens.com - true
FF - user.js: extensions.https_everywhere.Siggraph.org - true
FF - user.js: extensions.https_everywhere.SigmaBeauty - true
FF - user.js: extensions.https_everywhere.Silicon.com - true
FF - user.js: extensions.https_everywhere.Simyo.de - true
FF - user.js: extensions.https_everywhere.Simyo.nl - true
FF - user.js: extensions.https_everywhere.Sinn Fein - true
FF - user.js: extensions.https_everywhere.Sipgate - true
FF - user.js: extensions.https_everywhere.Sivers - true
FF - user.js: extensions.https_everywhere.SixApart - true
FF - user.js: extensions.https_everywhere.Sixxs.net - true
FF - user.js: extensions.https_everywhere.Skandia - true
FF - user.js: extensions.https_everywhere.Skandiabanken - true
FF - user.js: extensions.https_everywhere.Skitch - true
FF - user.js: extensions.https_everywhere.Skydsl.eu - true
FF - user.js: extensions.https_everywhere.Slo-Tech - true
FF - user.js: extensions.https_everywhere.SlySoft - false
FF - user.js: extensions.https_everywhere.SmartFTP - true
FF - user.js: extensions.https_everywhere.SocietyForScience.org - true
FF - user.js: extensions.https_everywhere.Software Freedom Law Center - true
FF - user.js: extensions.https_everywhere.Sony-Europe.com - true
FF - user.js: extensions.https_everywhere.Sony.se - true
FF - user.js: extensions.https_everywhere.SonyMusic - true
FF - user.js: extensions.https_everywhere.Soton.ac.uk - true
FF - user.js: extensions.https_everywhere.Source Forge (partial) - true
FF - user.js: extensions.https_everywhere.SouthernElectric - true
FF - user.js: extensions.https_everywhere.SpamGourmet - true
FF - user.js: extensions.https_everywhere.Spanair - true
FF - user.js: extensions.https_everywhere.Sparked - true
FF - user.js: extensions.https_everywhere.Sparkfun - true
FF - user.js: extensions.https_everywhere.Sparkstudios.com - true
FF - user.js: extensions.https_everywhere.SpecialForces - true
FF - user.js: extensions.https_everywhere.Spin.de - true
FF - user.js: extensions.https_everywhere.Spirit Airlines - true
FF - user.js: extensions.https_everywhere.Springpad - true
FF - user.js: extensions.https_everywhere.Sprint.com - true
FF - user.js: extensions.https_everywhere.Spyderco - true
FF - user.js: extensions.https_everywhere.Srware - true
FF - user.js: extensions.https_everywhere.Stan Deyo - false
FF - user.js: extensions.https_everywhere.Starfield Technologies, Inc. - true
FF - user.js: extensions.https_everywhere.StartCom - true
FF - user.js: extensions.https_everywhere.Statcounter - true
FF - user.js: extensions.https_everywhere.StateBankOfIndia - true
FF - user.js: extensions.https_everywhere.StateFarm - true
FF - user.js: extensions.https_everywhere.StatistikamtBayern - true
FF - user.js: extensions.https_everywhere.StayFriends - true
FF - user.js: extensions.https_everywhere.Stevens - true
FF - user.js: extensions.https_everywhere.Stopbadware.org - true
FF - user.js: extensions.https_everywhere.Storebrand - true
FF - user.js: extensions.https_everywhere.StudentLoans.gov - true
FF - user.js: extensions.https_everywhere.StudiVZ (disabled) - false
FF - user.js: extensions.https_everywhere.StudiVZ - true
FF - user.js: extensions.https_everywhere.StumbleUpon (breaks plugin) - false
FF - user.js: extensions.https_everywhere.StumbleUpon - true
FF - user.js: extensions.https_everywhere.SunTrust - true
FF - user.js: extensions.https_everywhere.Sunbeltsoftware.com - true
FF - user.js: extensions.https_everywhere.SuperAntiSpyware - true
FF - user.js: extensions.https_everywhere.Superstart.se - true
FF - user.js: extensions.https_everywhere.SurveyGizmo.com - true
FF - user.js: extensions.https_everywhere.SurveyMonkey (buggy) - false
FF - user.js: extensions.https_everywhere.Surveydaddy - true
FF - user.js: extensions.https_everywhere.Svenskakyrkan - true
FF - user.js: extensions.https_everywhere.Svenskaspel.se - true
FF - user.js: extensions.https_everywhere.SverigesRadio - true
FF - user.js: extensions.https_everywhere.Swiss.com - true
FF - user.js: extensions.https_everywhere.Sycom.co.jp - true
FF - user.js: extensions.https_everywhere.Sydostran.se - true
FF - user.js: extensions.https_everywhere.Symbian Foundation - true
FF - user.js: extensions.https_everywhere.System76.com - true
FF - user.js: extensions.https_everywhere.Systembolaget.se - true
FF - user.js: extensions.https_everywhere.TAZ - true
FF - user.js: extensions.https_everywhere.TD Bank (partial) - true
FF - user.js: extensions.https_everywhere.TD Canada Trust - true
FF - user.js: extensions.https_everywhere.TT.se - true
FF - user.js: extensions.https_everywhere.TV.com (broken) - false
FF - user.js: extensions.https_everywhere.TV.com - true
FF - user.js: extensions.https_everywhere.TV4play.se - true
FF - user.js: extensions.https_everywhere.TYPO3 - true
FF - user.js: extensions.https_everywhere.Tandlakarforbundet.se - true
FF - user.js: extensions.https_everywhere.Target (broken) - false
FF - user.js: extensions.https_everywhere.Target - true
FF - user.js: extensions.https_everywhere.TataSky - true
FF - user.js: extensions.https_everywhere.Tchibo.de - true
FF - user.js: extensions.https_everywhere.Tcodevelopment.com - false
FF - user.js: extensions.https_everywhere.TeamCymru - true
FF - user.js: extensions.https_everywhere.Teamviewer - true
FF - user.js: extensions.https_everywhere.Teamxlink - false
FF - user.js: extensions.https_everywhere.TechHouse - true
FF - user.js: extensions.https_everywhere.Techcrunch - false
FF - user.js: extensions.https_everywhere.Technet.com - true
FF - user.js: extensions.https_everywhere.Techniker Krankenkasse - true
FF - user.js: extensions.https_everywhere.TechnologyReview - true
FF - user.js: extensions.https_everywhere.Techsupportalert - true
FF - user.js: extensions.https_everywhere.Tele2.se - true
FF - user.js: extensions.https_everywhere.Telfort - true
FF - user.js: extensions.https_everywhere.Telia.se - true
FF - user.js: extensions.https_everywhere.Tesco - true
FF - user.js: extensions.https_everywhere.Thawte - true
FF - user.js: extensions.https_everywhere.The Book Depository - true
FF - user.js: extensions.https_everywhere.The Book People - true
FF - user.js: extensions.https_everywhere.The Church of Jesus Christ of Latter-day Saints - true
FF - user.js: extensions.https_everywhere.The Cutest Site on the Block - true
FF - user.js: extensions.https_everywhere.The Document Foundation - true
FF - user.js: extensions.https_everywhere.The Jack and Jill Children's Foundation Charity - true
FF - user.js: extensions.https_everywhere.The Open University (buggy) - false
FF - user.js: extensions.https_everywhere.The Open University - true
FF - user.js: extensions.https_everywhere.The Pirate Bay - true
FF - user.js: extensions.https_everywhere.The Privacy Blog - true
FF - user.js: extensions.https_everywhere.TheAA - true
FF - user.js: extensions.https_everywhere.TheGlobeAndMail (cert warning) - false
FF - user.js: extensions.https_everywhere.TheGlobeAndMail - true
FF - user.js: extensions.https_everywhere.ThePermitStore.com - true
FF - user.js: extensions.https_everywhere.ThePirateBay - true
FF - user.js: extensions.https_everywhere.TheTrainLine - true
FF - user.js: extensions.https_everywhere.Thefind - true
FF - user.js: extensions.https_everywhere.ThinkGeek - true
FF - user.js: extensions.https_everywhere.This is my next - true
FF - user.js: extensions.https_everywhere.ThisIsMyNext - true
FF - user.js: extensions.https_everywhere.ThisWebHost - true
FF - user.js: extensions.https_everywhere.Thomas Cook - true
FF - user.js: extensions.https_everywhere.ThreatPost - true
FF - user.js: extensions.https_everywhere.Three - true
FF - user.js: extensions.https_everywhere.Thunder Ranch - true
FF - user.js: extensions.https_everywhere.TicketingNetworkEastMidlands - true
FF - user.js: extensions.https_everywhere.Timbro.se - true
FF - user.js: extensions.https_everywhere.TinEye - true
FF - user.js: extensions.https_everywhere.TinyChat - true
FF - user.js: extensions.https_everywhere.Tirerack - true
FF - user.js: extensions.https_everywhere.Tmcnet.com - true
FF - user.js: extensions.https_everywhere.Tmobile - true
FF - user.js: extensions.https_everywhere.TodoLy - true
FF - user.js: extensions.https_everywhere.Todoist - true
FF - user.js: extensions.https_everywhere.TofinoSecurity - true
FF - user.js: extensions.https_everywhere.Tokyo Toshokan - true
FF - user.js: extensions.https_everywhere.Toolserver - true
FF - user.js: extensions.https_everywhere.Tor Project - true
FF - user.js: extensions.https_everywhere.Tor2Web - true
FF - user.js: extensions.https_everywhere.Torproject - true
FF - user.js: extensions.https_everywhere.TorrentFreak.com - true
FF - user.js: extensions.https_everywhere.Torrentz - true
FF - user.js: extensions.https_everywhere.Torservers - true
FF - user.js: extensions.https_everywhere.Tradera - true
FF - user.js: extensions.https_everywhere.Trafficfacts.com - true
FF - user.js: extensions.https_everywhere.Transifex.net - true
FF - user.js: extensions.https_everywhere.Translatewiki.net - true
FF - user.js: extensions.https_everywhere.Transportstyrelsen.se - true
FF - user.js: extensions.https_everywhere.Trashmail - true
FF - user.js: extensions.https_everywhere.TreasuryDirect - true
FF - user.js: extensions.https_everywhere.Trisquel - true
FF - user.js: extensions.https_everywhere.Trustico - true
FF - user.js: extensions.https_everywhere.Trygghansa.se - true
FF - user.js: extensions.https_everywhere.Tumblr (partial) - true
FF - user.js: extensions.https_everywhere.TunnelBear - true
FF - user.js: extensions.https_everywhere.TunnelBroker - false
FF - user.js: extensions.https_everywhere.Turn.com - true
FF - user.js: extensions.https_everywhere.Tweakers.net - true
FF - user.js: extensions.https_everywhere.Tweetdeck - true
FF - user.js: extensions.https_everywhere.Twisted4Life - true
FF - user.js: extensions.https_everywhere.TwitPic - true
FF - user.js: extensions.https_everywhere.Twitter - true
FF - user.js: extensions.https_everywhere.Typepad (broken) - false
FF - user.js: extensions.https_everywhere.Typepad - true
FF - user.js: extensions.https_everywhere.U-blox.com - false
FF - user.js: extensions.https_everywhere.UCSB.edu - true
FF - user.js: extensions.https_everywhere.UCSD - true
FF - user.js: extensions.https_everywhere.UCSD.edu - true
FF - user.js: extensions.https_everywhere.UHH_Informatik - true
FF - user.js: extensions.https_everywhere.UIE - true
FF - user.js: extensions.https_everywhere.UK Local Government - true
FF - user.js: extensions.https_everywhere.UN.org - true
FF - user.js: extensions.https_everywhere.UNFPA.org - true
FF - user.js: extensions.https_everywhere.UNIDO.org - true
FF - user.js: extensions.https_everywhere.UNM - true
FF - user.js: extensions.https_everywhere.UNODC.org - true
FF - user.js: extensions.https_everywhere.UNSW - true
FF - user.js: extensions.https_everywhere.UOregon (Partial!) - true
FF - user.js: extensions.https_everywhere.UPC - true
FF - user.js: extensions.https_everywhere.UPU.int - true
FF - user.js: extensions.https_everywhere.UQ WiMAX - true
FF - user.js: extensions.https_everywhere.US Congressional Budget Office - true
FF - user.js: extensions.https_everywhere.US OSHA.gov - true
FF - user.js: extensions.https_everywhere.US Selective Service System - true
FF - user.js: extensions.https_everywhere.US Social Security Administration - true
FF - user.js: extensions.https_everywhere.US SocialSecAdmin - true
FF - user.js: extensions.https_everywhere.US-Cert.gov - true
FF - user.js: extensions.https_everywhere.USBank - true
FF - user.js: extensions.https_everywhere.USDA-ARS - true
FF - user.js: extensions.https_everywhere.USENIX - true
FF - user.js: extensions.https_everywhere.USPS - true
FF - user.js: extensions.https_everywhere.UU.se - true
FF - user.js: extensions.https_everywhere.Ubuntuone - true
FF - user.js: extensions.https_everywhere.UiO - true
FF - user.js: extensions.https_everywhere.Uma.es - true
FF - user.js: extensions.https_everywhere.Unbound - true
FF - user.js: extensions.https_everywhere.Underskog - true
FF - user.js: extensions.https_everywhere.Uni-kl.de - true
FF - user.js: extensions.https_everywhere.United Airlines - true
FF - user.js: extensions.https_everywhere.Universal Subtitles - true
FF - user.js: extensions.https_everywhere.University of Alaska (partial) - true
FF - user.js: extensions.https_everywhere.University of Alaska Jobs (uakjobs.com) - true
FF - user.js: extensions.https_everywhere.University of Illinois at Chicago (partial) - false
FF - user.js: extensions.https_everywhere.University of North Texas (partial) - true
FF - user.js: extensions.https_everywhere.University of Southern Indiana (partial) - true
FF - user.js: extensions.https_everywhere.University of Texas at Austin (partial) - true
FF - user.js: extensions.https_everywhere.University of Texas at Dallas - true
FF - user.js: extensions.https_everywhere.Unreal Development Kit - true
FF - user.js: extensions.https_everywhere.Upay - true
FF - user.js: extensions.https_everywhere.Upplandsvasby.se - true
FF - user.js: extensions.https_everywhere.User-agents.org - false
FF - user.js: extensions.https_everywhere.UserScripts.org - true
FF - user.js: extensions.https_everywhere.UsrJoy - true
FF - user.js: extensions.https_everywhere.VG.no - true
FF - user.js: extensions.https_everywhere.VR.se - true
FF - user.js: extensions.https_everywhere.VTunnel - true
FF - user.js: extensions.https_everywhere.Value Applications - true
FF - user.js: extensions.https_everywhere.VanillaMastercard - true
FF - user.js: extensions.https_everywhere.Verbraucher-sicher-online.de - true
FF - user.js: extensions.https_everywhere.Vereinigte IKK - true
FF - user.js: extensions.https_everywhere.VeriSign - true
FF - user.js: extensions.https_everywhere.Verified Voting - true
FF - user.js: extensions.https_everywhere.Verizon - true
FF - user.js: extensions.https_everywhere.VerticalResponse - true
FF - user.js: extensions.https_everywhere.Viaverio.com - true
FF - user.js: extensions.https_everywhere.VideoLAN - false
FF - user.js: extensions.https_everywhere.Vimeo login - true
FF - user.js: extensions.https_everywhere.Virgin Australia - true
FF - user.js: extensions.https_everywhere.Virgin Mobile AU - true
FF - user.js: extensions.https_everywhere.Virginia Mason Hospital & Medical Center - true
FF - user.js: extensions.https_everywhere.VirusTotal - true
FF - user.js: extensions.https_everywhere.Virusec.com - true
FF - user.js: extensions.https_everywhere.Vision Airlines - true
FF - user.js: extensions.https_everywhere.Vista Forums - true
FF - user.js: extensions.https_everywhere.VisualWebsiteOptimizer - true
FF - user.js: extensions.https_everywhere.Vitelity - true
FF - user.js: extensions.https_everywhere.Vizzit.se - true
FF - user.js: extensions.https_everywhere.Vodafone - true
FF - user.js: extensions.https_everywhere.Volcano eCigs - true
FF - user.js: extensions.https_everywhere.Volkswagen Bank - true
FF - user.js: extensions.https_everywhere.Vonage - true
FF - user.js: extensions.https_everywhere.Vueling - true
FF - user.js: extensions.https_everywhere.Vuze - true
FF - user.js: extensions.https_everywhere.WHO.int (broken) - false
FF - user.js: extensions.https_everywhere.WHO.int - true
FF - user.js: extensions.https_everywhere.WIPmania - true
FF - user.js: extensions.https_everywhere.WTFuzz.com - true
FF - user.js: extensions.https_everywhere.Wachovia - true
FF - user.js: extensions.https_everywhere.Waffles.fm - true
FF - user.js: extensions.https_everywhere.WashingtonPost (broken) - false
FF - user.js: extensions.https_everywhere.Web Faction - true
FF - user.js: extensions.https_everywhere.WebSense - true
FF - user.js: extensions.https_everywhere.Webropolsurveys.com - true
FF - user.js: extensions.https_everywhere.Webtrekk.net - true
FF - user.js: extensions.https_everywhere.Webtru.st Keyserver - true
FF - user.js: extensions.https_everywhere.Wells Fargo - true
FF - user.js: extensions.https_everywhere.Weltbild.ch - true
FF - user.js: extensions.https_everywhere.West Jet - true
FF - user.js: extensions.https_everywhere.WestlandUtrecht Bank - true
FF - user.js: extensions.https_everywhere.Westpac - true
FF - user.js: extensions.https_everywhere.WhatCD - true
FF - user.js: extensions.https_everywhere.WhatIsMyIP - true
FF - user.js: extensions.https_everywhere.Whatimg.com - true
FF - user.js: extensions.https_everywhere.Wiggle - true
FF - user.js: extensions.https_everywhere.Wigle - true
FF - user.js: extensions.https_everywhere.Wikipedia - true
FF - user.js: extensions.https_everywhere.WinPcap - true
FF - user.js: extensions.https_everywhere.Wippies Webmail - true
FF - user.js: extensions.https_everywhere.Wired for Change - true
FF - user.js: extensions.https_everywhere.Wireshark - true
FF - user.js: extensions.https_everywhere.WirtschaftsWoche - true
FF - user.js: extensions.https_everywhere.Wizards of the Coast - true
FF - user.js: extensions.https_everywhere.Wolfram.com - true
FF - user.js: extensions.https_everywhere.Woot (broken) - false
FF - user.js: extensions.https_everywhere.WordPress - true
FF - user.js: extensions.https_everywhere.World Community Grid - true
FF - user.js: extensions.https_everywhere.World Socialist Web Site - true
FF - user.js: extensions.https_everywhere.WorstPills.org - true
FF - user.js: extensions.https_everywhere.XFCE - true
FF - user.js: extensions.https_everywhere.XO Skins - true
FF - user.js: extensions.https_everywhere.XPD.se - true
FF - user.js: extensions.https_everywhere.XS4ALL (partial) - true
FF - user.js: extensions.https_everywhere.Xing - true
FF - user.js: extensions.https_everywhere.Xiph.org - true
FF - user.js: extensions.https_everywhere.Xmarks - true
FF - user.js: extensions.https_everywhere.YFrog - true
FF - user.js: extensions.https_everywhere.Yaha - true
FF - user.js: extensions.https_everywhere.Yahoo! Mail (buggy) - false
FF - user.js: extensions.https_everywhere.Yahoo! Mail 4 (experimental) - false
FF - user.js: extensions.https_everywhere.Yahoo! Mail - true
FF - user.js: extensions.https_everywhere.Yamli API - true
FF - user.js: extensions.https_everywhere.Yandex - true
FF - user.js: extensions.https_everywhere.Yemeksepeti - true
FF - user.js: extensions.https_everywhere.Yieldmanager.com - true
FF - user.js: extensions.https_everywhere.YouMail (buggy) - false
FF - user.js: extensions.https_everywhere.YouTube (buggy) - false
FF - user.js: extensions.https_everywhere.YouTube (partial) - true
FF - user.js: extensions.https_everywhere.YouTube - true
FF - user.js: extensions.https_everywhere.YouTube-nocookie - true
FF - user.js: extensions.https_everywhere.Your Freedom - true
FF - user.js: extensions.https_everywhere.Ytimg.com - true
FF - user.js: extensions.https_everywhere.Yubico - true
FF - user.js: extensions.https_everywhere.ZDNet (buggy) - false
FF - user.js: extensions.https_everywhere.ZDNet - true
FF - user.js: extensions.https_everywhere.ZTunnel - true
FF - user.js: extensions.https_everywhere.Zareason.com - true
FF - user.js: extensions.https_everywhere.Ziggo - true
FF - user.js: extensions.https_everywhere.Zimbra - true
FF - user.js: extensions.https_everywhere.Ziplist.com - true
FF - user.js: extensions.https_everywhere.Zocalopublicsquare (disabled) - false
FF - user.js: extensions.https_everywhere.Zoho - true
FF - user.js: extensions.https_everywhere.Zoosk.com - true
FF - user.js: extensions.https_everywhere.Zscaler - true
FF - user.js: extensions.https_everywhere._observatory.use_custom_proxy - true
FF - user.js: extensions.https_everywhere.associatedcontent.com - true
FF - user.js: extensions.https_everywhere.atdmt.com - true
FF - user.js: extensions.https_everywhere.bankrate.com - true
FF - user.js: extensions.https_everywhere.bit.ly - true
FF - user.js: extensions.https_everywhere.bittorrentdotorg - false
FF - user.js: extensions.https_everywhere.boots.com - true
FF - user.js: extensions.https_everywhere.boum.org - true
FF - user.js: extensions.https_everywhere.btjunkie - true
FF - user.js: extensions.https_everywhere.ccc.de - false
FF - user.js: extensions.https_everywhere.comdirect bank - true
FF - user.js: extensions.https_everywhere.coxnewsweb.net - true
FF - user.js: extensions.https_everywhere.cve.mitre.org - true
FF - user.js: extensions.https_everywhere.e621.net - true
FF - user.js: extensions.https_everywhere.eBid.net - true
FF - user.js: extensions.https_everywhere.eHarmony - true
FF - user.js: extensions.https_everywhere.eHow (broken) - false
FF - user.js: extensions.https_everywhere.eHow - true
FF - user.js: extensions.https_everywhere.ePay.bg - true
FF - user.js: extensions.https_everywhere.ehrensenf - false
FF - user.js: extensions.https_everywhere.examiner.com - true
FF - user.js: extensions.https_everywhere.firstrun_context_menu - false
FF - user.js: extensions.https_everywhere.georgetown.edu - true
FF - user.js: extensions.https_everywhere.go!Mokulele - true
FF - user.js: extensions.https_everywhere.hi5 - true
FF - user.js: extensions.https_everywhere.iPerceptions - true
FF - user.js: extensions.https_everywhere.krebsonsecurity.com - true
FF - user.js: extensions.https_everywhere.kuro5hin.org - true
FF - user.js: extensions.https_everywhere.leadback.advertising.com - true
FF - user.js: extensions.https_everywhere.lists.mindrot.org - true
FF - user.js: extensions.https_everywhere.meinVZ - false
FF - user.js: extensions.https_everywhere.mixx.com - true
FF - user.js: extensions.https_everywhere.net-security.org - true
FF - user.js: extensions.https_everywhere.netzclub - true
FF - user.js: extensions.https_everywhere.newsvine.com - true
FF - user.js: extensions.https_everywhere.one.com - true
FF - user.js: extensions.https_everywhere.partypoker - true
FF - user.js: extensions.https_everywhere.politisktinkorrekt.info - true
FF - user.js: extensions.https_everywhere.prq.se - true
FF - user.js: extensions.https_everywhere.quantserve.com - true
FF - user.js: extensions.https_everywhere.redmine.ruby-lang.org - true
FF - user.js: extensions.https_everywhere.ripe.net - true
FF - user.js: extensions.https_everywhere.romab.com - true
FF - user.js: extensions.https_everywhere.scounter.rambler.ru - true
FF - user.js: extensions.https_everywhere.secure-u e.V. (default off) - false
FF - user.js: extensions.https_everywhere.sidux e.V. (default off) - false
FF - user.js: extensions.https_everywhere.snagajob - true
FF - user.js: extensions.https_everywhere.so36.NET - true
FF - user.js: extensions.https_everywhere.switch.ch - true
FF - user.js: extensions.https_everywhere.terreActive - true
FF - user.js: extensions.https_everywhere.uTorrent (broken) - false
FF - user.js: extensions.https_everywhere.veracode.com - true
FF - user.js: extensions.https_everywhere.voterVOICE - true
FF - user.js: extensions.https_everywhere.web.de - true
FF - user.js: extensions.https_everywhere.webtrends.com - true
FF - user.js: extensions.https_everywhere.weoInvoice - true
FF - user.js: extensions.https_everywhere.wuala - true
FF - user.js: extensions.https_everywhere.wunderground.com (buggy) - false
FF - user.js: extensions.https_everywhere.wunderground.com - true
FF - user.js: extensions.https_everywhere.xkcd - true
FF - user.js: extensions.https_everywhere.yfrog - true
FF - user.js: extensions.installCache - [{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\c:\\\\program files\\\\mozilla firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1350156093253}}},{\name\:\app-profile\,\addons\:{\{27c60876-b5c9-4335-b4f3-52b26782220c}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi\,\mtime\:1349380511700},\{6614d11d-d21d-b211-ae23-815234e1ebb5}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{6614d11d-d21d-b211-ae23-815234e1ebb5}.xpi\,\mtime\:1349378186336},\{73a6fe31-595d-460b-a920-fcc0f8843232}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi\,\mtime\:1350664152262},\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\,\mtime\:1349209648947},\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\,\mtime\:1343388656867},\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi\,\mtime\:1327411041374},\{e001c731-5e37-4538-a5cb-8168736a2360}\:{\descriptor\:\c:\\\\documents and settings\\\\eigenaar\\\\application data\\\\mozilla\\\\firefox\\\\profiles\\\\6szjk2rx.default\\\\extensions\\\\{e001c731-5e37-4538-a5cb-8168736a2360}\,\mtime\:1350483551845}}}]
FF - user.js: extensions.lastAppVersion - 16.0.1
FF - user.js: extensions.lastPlatformVersion - 16.0.1
FF - user.js: extensions.pendingOperations - false
FF - user.js: extensions.shownSelectionUI - true
FF - user.js: extensions.ui.dictionary.hidden - true
FF - user.js: extensions.ui.lastCategory - addons://list/plugin
FF - user.js: extensions.ui.locale.hidden - true
FF - user.js: extensions.wrc.RulesVersion - 110712152532999
FF - user.js: extensions.wrc.SearchRules./v1/update/rule/foo.bar.style - some style
FF - user.js: extensions.wrc.SearchRules./v1/update/rule/foo.bar.url - testik.bb
FF - user.js: extensions.wrc.SearchRules.ask.com.style - .WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.ask.com.url - ^http(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*
FF - user.js: extensions.wrc.SearchRules.atlas.cz.style - .WRCN {display:none} .result .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.atlas.cz.url - ^http\\:\\/\\/searchatlas\\.centrum\\.cz\\/.+
FF - user.js: extensions.wrc.SearchRules.atlas.sk.style - .WRCN {display:none} .katalogSponsorItem .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.atlas.sk.url - ^http\\:\\/\\/hladaj\\.atlas\\.sk\\/.+
FF - user.js: extensions.wrc.SearchRules.baidu.com.style - .WRCN {display:none} .result .f .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.baidu.com.url - ^http\\:\\/\\/www\\.baidu\\.com\\/.*
FF - user.js: extensions.wrc.SearchRules.bing.com.style - .WRCN {display:none} .sb_tlst .WRCN, .sp_pss .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.bing.com.url - ^http(s)?\\:\\/\\/www\\.bing\\.com\\/(.)*
FF - user.js: extensions.wrc.SearchRules.centrum.cz.style - .WRCN {display:none} .results-list h3 > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.centrum.cz.url - ^http(s)?\\:\\/\\/search\\.centrum\\.cz\\/(.)*
FF - user.js: extensions.wrc.SearchRules.centrum.sk.style - .WRCN {display:none} .katalogSponsorItem .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.centrum.sk.url - ^http\\:\\/\\/search\\.centrum\\.sk\\/.+
FF - user.js: extensions.wrc.SearchRules.delicious.com.style - .WRCN {display:none} .taggedlink + .WRCN, .data .full-url .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.delicious.com.url - ^http\\:\\/\\/www\\.delicious\\.com\\/(.)*
FF - user.js: extensions.wrc.SearchRules.dmoz.org.style - .WRCN {display:none} ol.site li .WRCN{display:inline !important; background: url(\IMAGE\) right no-repeat} ol.site li .ref .WRCN {display:none!important}
FF - user.js: extensions.wrc.SearchRules.dmoz.org.url - ^http\\:\\/\\/www\\.dmoz\\.org\\/search(.)+
FF - user.js: extensions.wrc.SearchRules.excite.com.style - .WRCN {display:none} .listing .resultsLink + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.excite.com.url - ^http\\:\\/\\/msxml\\.excite\\.com\\/excite\\/ws\\/.+
FF - user.js: extensions.wrc.SearchRules.facebook.com.style - .WRCN {display:none} .WRCN {display:none} .uiAttachmentTitle .WRCN, .uiStreamMessage .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.facebook.com.url - ^http\\:\\/\\/www\\.facebook\\.com\\/.*
FF - user.js: extensions.wrc.SearchRules.fastweb.it.style - .WRCN {display:none} .gs-title .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.fastweb.it.url - ^http\\:\\/\\/www\\.fastweb\\.it\\/portale\\/google\\/.+
FF - user.js: extensions.wrc.SearchRules.gazeta.pl.style - .WRCN {display:none} .res_body .res_entry .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.gazeta.pl.url - ^http\\:\\/\\/szukaj\\.gazeta\\.pl\\/.+
FF - user.js: extensions.wrc.SearchRules.google.com.style - .WRCN {display:none} .r .WRCN, .osl .WRCN, .bc .WRCN, .fc .WRCN, #rhsline ol .WRCN {display:inline; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.google.com.url - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.*
FF - user.js: extensions.wrc.SearchRules.interia.pl.style - .WRCN {display:none} .row .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.interia.pl.url - ^http\\:\\/\\/(www\\.)?google\\.interia\\.pl\\/szukaj\\/.+
FF - user.js: extensions.wrc.SearchRules.lycos.com.style - .WRCN {display:none} .results .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .results .sponsored .WRCN {display: none!important}
FF - user.js: extensions.wrc.SearchRules.lycos.com.url - ^http\\:\\/\\/search\\.lycos\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+
FF - user.js: extensions.wrc.SearchRules.onet.pl.style - .WRCN {display:none} #main .link .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.onet.pl.url - ^http\\:\\/\\/szukaj\\.onet\\.pl\\/.+
FF - user.js: extensions.wrc.SearchRules.paginegialle.it.style - .WRCN {display:none} .lnkwww + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.paginegialle.it.url - ^http\\:\\/\\/www\\.paginegialle\\.it\\/pgol\\/.+
FF - user.js: extensions.wrc.SearchRules.public.avast.com.style - .WRCN {display:inline; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.public.avast.com.url - ^http(s)?\\:\\/\\/public\\.avast\\.com\\/(.)*
FF - user.js: extensions.wrc.SearchRules.rambler.ru.style - .WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.rambler.ru.url - ^http\\:\\/\\/nova\\.rambler\\.ru\\/.+
FF - user.js: extensions.wrc.SearchRules.scroogle.org.style - a + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.scroogle.org.url - ^http\\:\\/\\/www\\.scroogle\\.org\\/.*
FF - user.js: extensions.wrc.SearchRules.seznam.cz.style - .WRCN {display:none} #results .text .WRCN, .sklik-title > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.seznam.cz.url - ^http(s)?\\:\\/\\/search\\.seznam\\.cz\\/(.)*
FF - user.js: extensions.wrc.SearchRules.sky.com.style - .WRCN {display:none} #results h3 .WRCN, #sponsored_top h3 .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.sky.com.url - ^http\\:\\/\\/search\\.sky\\.com/.+
FF - user.js: extensions.wrc.SearchRules.slashdot.org.style - .WRCN {display:none} .body i .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.slashdot.org.url - ^http\\:\\/\\/slashdot\\.org\\/.*
FF - user.js: extensions.wrc.SearchRules.terra.com.br.style - .WRCN {display:none} .col-left-full .list-results .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.terra.com.br.url - ^http\\:\\/\\/buscador\\.terra\\.com\\.br\\/.+
FF - user.js: extensions.wrc.SearchRules.tiscali.it.style - .WRCN {display:none} .item .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.tiscali.it.url - ^http\\:\\/\\/search\\.tiscali\\.it\\/.+
FF - user.js: extensions.wrc.SearchRules.twitter.com.style - .WRCN {display:none} .entry-content .web + .WRCN, .twtr-tweet-text .twtr-hyperlink + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.twitter.com.url - ^hxxp://twitter\\.com\\/.*
FF - user.js: extensions.wrc.SearchRules.uol.com.br.style - .WRCN {display:none} #results dt .WRCN, #results .link .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} #results .link .similar .WRCN {display: none!important}
FF - user.js: extensions.wrc.SearchRules.uol.com.br.url - ^http\\:\\/\\/(.\\.)?busca\\.uol\\.com\\.br\\/.+
FF - user.js: extensions.wrc.SearchRules.virgilio.it.style - .WRCN {display:none} .risultati .record .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .risultati .record .sponsor + .WRCN {display: none!important}
FF - user.js: extensions.wrc.SearchRules.virgilio.it.url - ^http\\:\\/\\/ricerca\\.virgilio\\.it\\/.+
FF - user.js: extensions.wrc.SearchRules.virginmedia.com.style - .WRCN {display:none} .result-title .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.virginmedia.com.url - ^http\\:\\/\\/search\\.virginmedia\\.com\\/.+
FF - user.js: extensions.wrc.SearchRules.whereis.com.style - .WRCN {display:none} .priority_url .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.whereis.com.url - ^http\\:\\/\\/www\\.whereis\\.com\\/.*
FF - user.js: extensions.wrc.SearchRules.wp.pl.style - .WRCN {display:none} .rek big .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.wp.pl.url - ^http\\:\\/\\/szukaj\\.wp\\.pl\\/.+
FF - user.js: extensions.wrc.SearchRules.yahoo.com.style - .WRCN {display:none} .sm-hd .WRCN, .sm-links .WRCN, .res h3 > .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.yahoo.com.url - ^http(s)?\\:\\/\\/((.)+\\.)?search\\.yahoo\\.com\\/(.)*
FF - user.js: extensions.wrc.SearchRules.yandex.ru.style - .WRCN {display:none} .b-serp-item__title-link + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.yandex.ru.url - ^http\\:\\/\\/yandex\\.ru\\/.+
FF - user.js: extensions.wrc.SearchRules.yell.com.style - .WRCN {display:none} .advert-content .WRCN, .other-cta .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat} .advert-content .star + .WRCN, .advert-content .logoImg + .WRCN, .other-cta .shareLink + .WRCN {display: none!important}
FF - user.js: extensions.wrc.SearchRules.yell.com.url - ^http\\:\\/\\/www\\.yell\\.com\\/.+
FF - user.js: extensions.wrc.SearchRules.zoznam.sk.style - .WRCN {display:none} .box_content .link_right .link_title + .WRCN {display:inline !important; background: url(\IMAGE\) right no-repeat}
FF - user.js: extensions.wrc.SearchRules.zoznam.sk.url - ^http\\:\\/\\/www\\.zoznam\\.sk\\/.+
FF - user.js: general.autoScroll - false
FF - user.js: gfx.direct2d.disabled - true
FF - user.js: idle.lastDailyNotification - 1350599725
FF - user.js: intl.charsetmenu.browser.cache - windows-1252, ISO-8859-15, windows-1251, us-ascii, UTF-8
FF - user.js: layers.acceleration.disabled - true
FF - user.js: layout.spellcheckDefault - 0
FF - user.js: network.cookie.prefsMigrated - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.proxy.no_proxies_on -
FF - user.js: network.proxy.socks_version - 4
FF - user.js: network.proxy.type - 0
FF - user.js: noscript.ABE.migration - 1
FF - user.js: noscript.gtemp -
FF - user.js: noscript.options.tabSelectedIndexes - 5,5,0
FF - user.js: noscript.policynames -
FF - user.js: noscript.subscription.lastCheck - 2068954390
FF - user.js: noscript.temp -
FF - user.js: noscript.version - 2.5.8
FF - user.js: noscript.visibleUIChecked - true
FF - user.js: places.database.lastMaintenance - 1350166190
FF - user.js: places.history.expiration.transient_current_max_pages - 20089
FF - user.js: places.history.expiration.transient_optimal_database_size - 32142294
FF - user.js: plugin.expose_full_path - true
FF - user.js: pref.advanced.javascript.disable_button.advanced - false
FF - user.js: pref.browser.homepage.disable_button.current_page - false
FF - user.js: pref.general.disable_button.default_browser - false
FF - user.js: pref.privacy.disable_button.view_passwords - false
FF - user.js: privacy.cpd.extensions-betterprivacy - true
FF - user.js: privacy.cpd.offlineApps - true
FF - user.js: privacy.cpd.siteSettings - true
FF - user.js: privacy.donottrackheader.enabled - true
FF - user.js: privacy.sanitize.migrateFx3Prefs - true
FF - user.js: privacy.sanitize.timeSpan - 0
FF - user.js: security.disable_button.openDeviceManager - false
FF - user.js: security.enable_ssl3 - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: services.sync.clients.lastSync - 0
FF - user.js: services.sync.clients.lastSyncLocal - 0
FF - user.js: services.sync.globalScore - 0
FF - user.js: services.sync.lastversion - 1.17.0
FF - user.js: services.sync.migrated - true
FF - user.js: services.sync.nextSync - 0
FF - user.js: services.sync.tabs.lastSync - 0
FF - user.js: services.sync.tabs.lastSyncLocal - 0
FF - user.js: signon.rememberSignons - false
FF - user.js: spellchecker.dictionary - en-US
FF - user.js: storage.vacuum.last.index - 1
FF - user.js: storage.vacuum.last.places.sqlite - 1348604826
FF - user.js: toolkit.startup.last_success - 1350688674
FF - user.js: toolkit.telemetry.prompted - 2
FF - user.js: ui.submenuDelay - 0
FF - user.js: urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey - 1350770211
FF - user.js: weboftrust.automatic_updates - false
FF - user.js: weboftrust.button_created - true
FF - user.js: weboftrust.cookie_updated - 1350688678639
FF - user.js: weboftrust.extension_id - 6bfe6fcb9a4228a971b08ded8a77d2d00f4da816
FF - user.js: weboftrust.firstrun_guide - 2
FF - user.js: weboftrust.last_message - 20120222
FF - user.js: weboftrust.last_version - 20120926
FF - user.js: weboftrust.search.aolsearch.display - AOL Search
FF - user.js: weboftrust.search.aolsearch.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/
FF - user.js: weboftrust.search.aolsearch.pre0.match - 3
FF - user.js: weboftrust.search.aolsearch.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*redir\\\\?.*s_cu=(http.+)(&.*)?
FF - user.js: weboftrust.search.aolsearch.prestyle - .HL [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.aolsearch.style - a.find ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.aolsearch.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*search\\\\?.+
FF - user.js: weboftrust.search.ask.display - Ask.com Web Search
FF - user.js: weboftrust.search.ask.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/|^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.com\\/(pagead|aclk)
FF - user.js: weboftrust.search.ask.pre0.match - 4
FF - user.js: weboftrust.search.ask.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/(bar|r)\\\\?.*&u=(http[^&]+)
FF - user.js: weboftrust.search.ask.prestyle - .s_binoc2 ~ [ATTR], .nu ~ [ATTR], [ATTR=\safeweb.norton.com\] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.ask.style - a.title ~ [ATTR=\NAME\], a.L4 ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.ask.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/web\\\\?.+
FF - user.js: weboftrust.search.avg.display - AVG
FF - user.js: weboftrust.search.avg.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)avg\\.com\\/
FF - user.js: weboftrust.search.avg.style - .vsc a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 0px; position: relative; }
FF - user.js: weboftrust.search.avg.url - ^http(s)?\\:\\/\\/isearch\\.avg\\.com\\/search\\?
FF - user.js: weboftrust.search.baidu.display - Baidu
FF - user.js: weboftrust.search.baidu.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/
FF - user.js: weboftrust.search.baidu.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.baidu.style - .f a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.baidu.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/s\\\\?.+
FF - user.js: weboftrust.search.bing.display - Bing
FF - user.js: weboftrust.search.bing.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(msn(scache)?|live|bingj?|microsofttranslator)\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/
FF - user.js: weboftrust.search.bing.ninja - 1
FF - user.js: weboftrust.search.bing.prestyle - .rc_p [ATTR], .sb_vdl [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.bing.style - .nc_tc a ~ [ATTR=\NAME\], .sb_tlst a ~ [ATTR=\NAME\], .sn_rct a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.bing.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*bing\\.com\\/search\\\\?
FF - user.js: weboftrust.search.daum.display - Daum
FF - user.js: weboftrust.search.daum.dynamic - 1
FF - user.js: weboftrust.search.daum.ign - ^http(s)?:\\/\\/(.+\\.)?daum\\.net
FF - user.js: weboftrust.search.daum.pre0.match - 2
FF - user.js: weboftrust.search.daum.pre0.re - ^http(s)?:\\/\\/adtc.daum.net\\/clk\\?.+\\&s=(.+)$
FF - user.js: weboftrust.search.daum.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.daum.style - .tit > a ~ [ATTR=\NAME\], #sponColl a.urlLink ~ [ATTR=\NAME\], #twitterColl .f_link ~ [ATTR=\NAME\], #premColl a.urlLink ~ [ATTR=\NAME\], #splinkColl a.urlLink ~ [ATTR=\NAME\], .wrap_tit a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; } #vclipColl [ATTR=\NAME\] {visibility:hidden; position: absolute; }
FF - user.js: weboftrust.search.daum.url - ^http:\\/\\/search\\.daum\\.net\\/search
FF - user.js: weboftrust.search.dogpile.display - Dogpile
FF - user.js: weboftrust.search.dogpile.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/|^http\\:\\/\\/(.+\\.)?r\\.msn\\.com\\/
FF - user.js: weboftrust.search.dogpile.pre0.match - 3
FF - user.js: weboftrust.search.dogpile.pre0.re - ^http(s)?\\:\\/\\/cs\\.(dogpile|infospace)\\.com\\/ClickHandler.+ru=(http[^&]+)
FF - user.js: weboftrust.search.dogpile.prestyle - .paidSearchResult [ATTR] { display: none ! important; } .searchResultsPane { max-width: 44.08em; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.dogpile.style - a.resultTitle ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.dogpile.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/(info\\.[^\\/]+/)?(search\\/)?web.+
FF - user.js: weboftrust.search.duckduckgo.display - DuckDuckGo
FF - user.js: weboftrust.search.duckduckgo.dynamic - 1
FF - user.js: weboftrust.search.duckduckgo.ign - ^https?\\:\\/\\/([\\w\\-]+\\.)?duckduckgo\\.com\\/
FF - user.js: weboftrust.search.duckduckgo.prestyle - .icon_fav2 a[href*=\mywot.com\], .icon_fav img[src^=\/wot/\] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.duckduckgo.style - .links_main h2 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 5px; padding-top: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.duckduckgo.url - ^https?\\:\\/\\/duckduckgo\\.com\\/
FF - user.js: weboftrust.search.facebook.display - Facebook
FF - user.js: weboftrust.search.facebook.dynamic - 1
FF - user.js: weboftrust.search.facebook.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(facebook\\.(com|net)|fbcdn\\.net|bing\\.com|akamaihd\\.net)\\/
FF - user.js: weboftrust.search.facebook.match0.attribute0.flags - n
FF - user.js: weboftrust.search.facebook.match0.attribute0.name - class
FF - user.js: weboftrust.search.facebook.match0.attribute0.re - mceContentBody
FF - user.js: weboftrust.search.facebook.match0.element - body
FF - user.js: weboftrust.search.facebook.pre0.match - 3
FF - user.js: weboftrust.search.facebook.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?facebook\\.com\\/l\\.php\\?.*u=([^&]+)
FF - user.js: weboftrust.search.facebook.prestyle - ._8t ~ [ATTR], .ogAggregationAppIcon ~ [ATTR], a.fbImageContainer ~ [ATTR], a.ogObjectScaledImageLink ~ [ATTR], a.shareMediaLink ~ [ATTR], a.-cx-PRIVATE-uiImageBlock__image ~ [ATTR], a.ogAggregateTableRowImage ~ [ATTR], a.uiIconText ~ [ATTR], a.timelineRecentActivityThumb ~ [ATTR], .ogProfileGallery .mbs a ~ [ATTR], a.uiImageBlockImage ~ [ATTR], .uiHeader [ATTR], a.uiLinkSubtle ~ [ATTR], .profile-picture [ATTR], .HovercardContent td > a ~ [ATTR], .uiAttachmentTitle ~ a ~ [ATTR], a.UIImageBlock_Image ~ [ATTR], .UIMediaItem [ATTR], .UIStoryAttachment_Caption [ATTR], .uiStreamPassive [ATTR], #jewelContainer [ATTR], a.ogAggregationExpandedGridIcon ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; } .shareRedesign .attachmentText { max-height: 88px ! important; } .shareRedesign .attachmentText [ATTR] { margin-left: 0px ! important; margin-right: 4px; } .shareRedesignContainer .shareText { min-height: 50px ! important; }
FF - user.js: weboftrust.search.facebook.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.facebook.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*facebook\\.com\\/
FF - user.js: weboftrust.search.facebook.urlign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*facebook\\.com\\/(plugins|extern)\\/
FF - user.js: weboftrust.search.gmail.display - Gmail
FF - user.js: weboftrust.search.gmail.dynamic - 1
FF - user.js: weboftrust.search.gmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(google|googlesyndication)\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/
FF - user.js: weboftrust.search.gmail.match0.attribute0.flags - n
FF - user.js: weboftrust.search.gmail.match0.attribute0.name - class
FF - user.js: weboftrust.search.gmail.match0.attribute0.re - editable
FF - user.js: weboftrust.search.gmail.match0.element - body
FF - user.js: weboftrust.search.gmail.prestyle - .e ~ [ATTR], #gbd [ATTR], #gbi [ATTR], .vd ~ [ATTR], .Ni ~ [ATTR], .mr ~ [ATTR], .gbt [ATTR], [ATTR] { position: absolute; visibility: hidden; } .e:last-of-type ~ [ATTR] { position: relative; visibility: visible; } #message-area-container ~ #container .source-link ~ [ATTR], #message-area-container ~ #container .title-link ~ [ATTR] { display: none ! important; }
FF - user.js: weboftrust.search.gmail.searchlevel - 60
FF - user.js: weboftrust.search.gmail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 2px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.gmail.url - ^http(s)?\\:\\/\\/mail\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(mail|a)\\/.+
FF - user.js: weboftrust.search.gmail.urlign - &(name=htmlcompose|view=(js|cw)&)
FF - user.js: weboftrust.search.google.display - Google
FF - user.js: weboftrust.search.google.dynamic - 1
FF - user.js: weboftrust.search.google.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|support|docs|picasaweb|profiles|adwords|labs|investor|encrypted|code|services|checkout|trends|plus)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\:
FF - user.js: weboftrust.search.google.ninja - 1
FF - user.js: weboftrust.search.google.pre0.match - 9
FF - user.js: weboftrust.search.google.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|interstitial|product_url)\\\\?.*&?(q|url)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?
FF - user.js: weboftrust.search.google.prestyle - a.domainLink ~ [ATTR], #wotsafesearchlinks [ATTR], #gb [ATTR], #gbd [ATTR], .g > div > div > div span > a.l ~ [ATTR], .ts td > a ~ [ATTR], .result-image [ATTR], .cite ~ [ATTR], .gl [ATTR], .g > a:not([class]):first-child ~ [ATTR], a.f1 ~ [ATTR], a.fl ~ [ATTR], a[href^=\/\][href*=\&oi=video_result\] ~ [ATTR], a[href^=\/\][href*=\&ct=image\] ~ [ATTR], a[href^=\/\][href*=\&sa=X&\] ~ [ATTR], .slk [ATTR], #gbar [ATTR], #ssb [ATTR], #doc3 [ATTR], #sft [ATTR], .osl [ATTR], #rtr [ATTR], .bc [ATTR], #nycprv [ATTR], #tads .oslk [ATTR] { display: none !important; } a[creator=\SiteAdvisor\] img { position: relative !important; } [mclinkinfo] a ~ [ATTR], a[creator=\SiteAdvisor\] + [ATTR=\siteadvisor.com\], [id^=\BubbleLayer\] [ATTR] { display: none !important; } [ATTR] { display: none !important; } #res h3.r { overflow: visible !important; }
FF - user.js: weboftrust.search.google.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; display: inline-block ! important; }
FF - user.js: weboftrust.search.google.url - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/
FF - user.js: weboftrust.search.google.urlign - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(\\+|a\\/|accounts|ad(s|manager|planner|sense|words)|alerts|analytics|apps|appserve|base|calendar|chrome(frame)?|codesearch|comparisonads|corporate|crisisresponse|datacenter|dfp|dictionary|doodle|educators|enterprise|events|experimental|familysafety|finance|flutrends|friendconnect|goog411|googlebooks|googlenotebook|googlevoice|gwt|help|history|hostednews|images|imgres|ime|insights|landing|local|logos|mapmaker|maps|mobile|moon|music|newproducts|news|notebook|patents|phone|postini|powermeter|press|profiles|publicdata|puzzles|onlinechallenge|racing|reader|recaptcha|relief|services|s2|sitesearch|sky|smallbusinessnetwork|squared|submit|support|sync|talk|toolbar|ventures|voice|wallet|web(masters|elements)|intl\\/[^\\/]+\\/.+|search\\\\?.*tbm=isch)
FF - user.js: weboftrust.search.googleimages.display - Google Image Search
FF - user.js: weboftrust.search.googleimages.dynamic - 1
FF - user.js: weboftrust.search.googleimages.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|docs|picasaweb|adwords|labs|investor)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\:
FF - user.js: weboftrust.search.googleimages.pre0.match - 5
FF - user.js: weboftrust.search.googleimages.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/imgres\\\\?.*img(ref)?url=(.+)(&.*)?
FF - user.js: weboftrust.search.googleimages.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.googleimages.style - a.rg_l ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 5px; left: 5px; position: absolute; visibility: visible; } #ImgContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 0px; ; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.googleimages.url - ^http(s)?\\:\\/\\/(www|images)\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(images\\\\?.+|search\\\\?.*tbm=isch)
FF - user.js: weboftrust.search.goojp.display - goo
FF - user.js: weboftrust.search.goojp.ign - ^http:\\/\\/(.+)?goo\\.ne\\.jp\\/
FF - user.js: weboftrust.search.goojp.pre0.match - 6
FF - user.js: weboftrust.search.goojp.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?
FF - user.js: weboftrust.search.goojp.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.goojp.style - .res a.link ~ [ATTR=\NAME\], .sponser a.link + [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; margin-right:0.4em; top: 0.2em; position: relative; visibility: visible; opacity: 0.9; } .sponser a.link + [ATTR=\NAME\] { top: 0em; }
FF - user.js: weboftrust.search.goojp.url - ^http:\\/\\/(.+\\.)?search\\.goo\\.ne\\.jp\\/(web\\.jsp|search)
FF - user.js: weboftrust.search.hotmail.display - Windows Live Hotmail
FF - user.js: weboftrust.search.hotmail.dynamic - 1
FF - user.js: weboftrust.search.hotmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(live|(imagine-)?msn|microsoft)\\.com\\/
FF - user.js: weboftrust.search.hotmail.match0.element - #mp0_msgPartBody
FF - user.js: weboftrust.search.hotmail.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.hotmail.searchlevel - 60
FF - user.js: weboftrust.search.hotmail.style - .MsgPartBody a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.hotmail.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*mail\\.live\\.com\\/mail\\/
FF - user.js: weboftrust.search.ixquick.display - Ixquick
FF - user.js: weboftrust.search.ixquick.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/?
FF - user.js: weboftrust.search.ixquick.pre0.match - 6
FF - user.js: weboftrust.search.ixquick.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?
FF - user.js: weboftrust.search.ixquick.pre1.match - 4
FF - user.js: weboftrust.search.ixquick.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/highlight.*&u=(http[^&]*)
FF - user.js: weboftrust.search.ixquick.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.ixquick.style - a.title ~ [ATTR=\NAME\], a.title2 ~ [ATTR=\NAME\], .result h3 > a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.ixquick.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/(meta)?search
FF - user.js: weboftrust.search.libero.display - Libero Ricerca
FF - user.js: weboftrust.search.libero.ign - https?:\\/\\/(.+\\.)?libero\\.it\\/
FF - user.js: weboftrust.search.libero.pre0.match - 6
FF - user.js: weboftrust.search.libero.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?
FF - user.js: weboftrust.search.libero.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.libero.style - a.webItemTitle ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; } a.urlLink ~ [ATTR=\NAME\] {position: absolute; visibility: hidden;}
FF - user.js: weboftrust.search.libero.url - https?:\\/\\/arianna\\.libero\\.it\\/search\\/
FF - user.js: weboftrust.search.mailru.display - Mail.Ru
FF - user.js: weboftrust.search.mailru.ign - ^http(s)?\\:\\/\\/(.+\\.)?mail\\.ru\\/
FF - user.js: weboftrust.search.mailru.pre0.match - 9
FF - user.js: weboftrust.search.mailru.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?
FF - user.js: weboftrust.search.mailru.prestyle - a ~ [ATTR] ~ a ~ [ATTR], .video-thumb [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.mailru.style - .res-head a ~ [ATTR=\NAME\], .ttl a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; top: 0.15em; opacity: 0.9; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.mailru.url - ^http(s)?\\:\\/\\/go\\.mail\\.ru\\/search\\?.+
FF - user.js: weboftrust.search.naver.display - Naver
FF - user.js: weboftrust.search.naver.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/
FF - user.js: weboftrust.search.naver.prestyle - .thumb_wrap [ATTR], .thumb [ATTR], .mov_thumb [ATTR], .btn_area [ATTR], .txt_block [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.naver.style - #content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.naver.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/search.*\\\\?.+
FF - user.js: weboftrust.search.odnoklassniki.display - Odnoklassniki.ru
FF - user.js: weboftrust.search.odnoklassniki.dynamic - 1
FF - user.js: weboftrust.search.odnoklassniki.ign - ^http(s)?\\:\\/\\/((.+\\.)?odnoklassniki\\.ru)|((.+\\.)?mail\\.ru)\\/
FF - user.js: weboftrust.search.odnoklassniki.match0.attribute0.flags - n
FF - user.js: weboftrust.search.odnoklassniki.match0.attribute0.name - id
FF - user.js: weboftrust.search.odnoklassniki.match0.attribute0.re - rtaArea
FF - user.js: weboftrust.search.odnoklassniki.match0.element - div
FF - user.js: weboftrust.search.odnoklassniki.pre0.match - 6
FF - user.js: weboftrust.search.odnoklassniki.pre0.re - http(s)?\\:\\/\\/((.+\\.)?odnoklassniki\\.ru)\\/dk\\?cmd=logexternal&.*(st\\.link)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?
FF - user.js: weboftrust.search.odnoklassniki.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.odnoklassniki.style - #hook_Block_MainContainer a ~ [ATTR=\NAME\], .messageMarker a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.odnoklassniki.url - ^http(s)?\\:\\/\\/(.+\\.)?odnoklassniki\\.ru\\/
FF - user.js: weboftrust.search.onetpl.display - Onet Szukaj
FF - user.js: weboftrust.search.onetpl.ign - ^http(s)?:\\/\\/(.+\\.)?onet\\.pl\\/
FF - user.js: weboftrust.search.onetpl.pre0.match - 6
FF - user.js: weboftrust.search.onetpl.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*%26(q|url)%3D(.+)(&.*)?
FF - user.js: weboftrust.search.onetpl.prestyle - [ATTR] { position: absolute; visibility: hidden; } .linkGoogle a, .link a {display: inline !important; }
FF - user.js: weboftrust.search.onetpl.style - .link > a ~ [ATTR=\NAME\], .linkGoogle a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; margin-right:0.4em; top: 0.1em; position: relative; visibility: visible; opacity: 0.9; }
FF - user.js: weboftrust.search.onetpl.url - ^http(s)?:\\/\\/szukaj\\.onet\\.pl\\/.+\\.html
FF - user.js: weboftrust.search.pinterest.display - Pinterest
FF - user.js: weboftrust.search.pinterest.dynamic - 1
FF - user.js: weboftrust.search.pinterest.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*pinterest.com\\/)|(twitter\\.com\\/)|(facebook\\.com\\/)
FF - user.js: weboftrust.search.pinterest.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; opacity:0.9; visibility: visible; } a.facebook ~ [ATTR=\NAME\], a.twitter ~ [ATTR=\NAME\], #PinImageHolder a ~ [ATTR=\NAME\] {visibility: hidden; }
FF - user.js: weboftrust.search.pinterest.url - ^http(s)?\\:\\/\\/pinterest.com\\/
FF - user.js: weboftrust.search.rambler.display - Rambler
FF - user.js: weboftrust.search.rambler.ign - ^http(s)?\\:\\/\\/(.+\\.)?rambler\\.ru\\/
FF - user.js: weboftrust.search.rambler.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.rambler.style - .serp a[class^=\n_title\] ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.rambler.url - ^http(s)?\\:\\/\\/nova\\.rambler\\.ru\\/(search|srch)\\?.+
FF - user.js: weboftrust.search.reddit.display - reddit
FF - user.js: weboftrust.search.reddit.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/
FF - user.js: weboftrust.search.reddit.prestyle - .thumbnail ~ [ATTR], .footer [ATTR], #ad [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.reddit.style - .content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.reddit.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/
FF - user.js: weboftrust.search.reddit.urlign - ^http(s)?\\:\\/\\/blog\\.reddit\\.com\\/
FF - user.js: weboftrust.search.sapo.display - Pesquisa SAPO
FF - user.js: weboftrust.search.sapo.ign - ^https?:\\/\\/(.+\\.)?sapo\\.pt\\/
FF - user.js: weboftrust.search.sapo.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.sapo.style - .title a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.sapo.url - ^https?:\\/\\/pesquisa\\.sapo\\.pt\\/
FF - user.js: weboftrust.search.seznam.display - Seznam
FF - user.js: weboftrust.search.seznam.ign - ^http(s)?\\:\\/\\/(.+\\.)?(seznam|sklik)\\.cz\\/
FF - user.js: weboftrust.search.seznam.pre0.match - 3
FF - user.js: weboftrust.search.seznam.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?sklik\\.cz\\/click.*url=([^&]+)
FF - user.js: weboftrust.search.seznam.prestyle - .limiter > a ~ [ATTR], .hintImage a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.seznam.style - .result a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.seznam.url - ^http(s)?\\:\\/\\/search\\.seznam\\.cz\\/
FF - user.js: weboftrust.search.topsy.display - Topsy
FF - user.js: weboftrust.search.topsy.dynamic - 1
FF - user.js: weboftrust.search.topsy.ign - http\\:\\/\\/([\\w\\-]+\\.)topsy\\.com\\/
FF - user.js: weboftrust.search.topsy.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.topsy.style - a.x-result-link-title ~ [ATTR=\NAME\], a.trending-list-link ~ [ATTR=\NAME\], a.texturl ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 3px; padding-top: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.topsy.url - ^http\\:\\/\\/(plus\\.)?topsy\\.com\\/
FF - user.js: weboftrust.search.twitter.display - Twitter
FF - user.js: weboftrust.search.twitter.dynamic - 1
FF - user.js: weboftrust.search.twitter.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/
FF - user.js: weboftrust.search.twitter.prestyle - .meta a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.twitter.style - #content a ~ [ATTR=\NAME\], .tweet-text a ~ [ATTR=\NAME\], .message-content a ~ [ATTR=\NAME\], .js-tweet-text a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.twitter.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/
FF - user.js: weboftrust.search.twitter.urlign - ^http(s)?\\:\\/\\/platform\\.twitter\\.com\\/widgets\\/
FF - user.js: weboftrust.search.uolbr.display - UOL Busca
FF - user.js: weboftrust.search.uolbr.ign - ^http\\:\\/\\/(.*)uol\\.com\\.br\\/
FF - user.js: weboftrust.search.uolbr.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.uolbr.style - #main dt > a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; top: 0.2em; position: relative; visibility: visible; opacity: 0.9; }
FF - user.js: weboftrust.search.uolbr.url - ^http\\:\\/\\/busca\\.uol\\.com\\.br\\/web\\/
FF - user.js: weboftrust.search.vkontakte.display - VKontakte
FF - user.js: weboftrust.search.vkontakte.dynamic - 1
FF - user.js: weboftrust.search.vkontakte.ign - ^http(s)?\\:\\/\\/(.+\\.)?(vk\\.com|vkontakte\\.ru)\\/
FF - user.js: weboftrust.search.vkontakte.match0.condition - and
FF - user.js: weboftrust.search.vkontakte.match0.match0.attribute0.name - id
FF - user.js: weboftrust.search.vkontakte.match0.match0.attribute0.re - page_layout
FF - user.js: weboftrust.search.vkontakte.match0.match0.element - div
FF - user.js: weboftrust.search.vkontakte.match0.match1.attribute0.flags - n
FF - user.js: weboftrust.search.vkontakte.match0.match1.attribute0.name - class
FF - user.js: weboftrust.search.vkontakte.match0.match1.attribute0.re - editor_body
FF - user.js: weboftrust.search.vkontakte.match0.match1.element - body
FF - user.js: weboftrust.search.vkontakte.pre0.match - 5
FF - user.js: weboftrust.search.vkontakte.pre0.re - http(s)?\\:\\/\\/(vk\\.com|vkontakte\\.ru)\\/away\\.php\\?.*(to)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?
FF - user.js: weboftrust.search.vkontakte.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.vkontakte.style - #content a ~ [ATTR=\NAME\], #pv_box a ~ [ATTR=\NAME\], #wk_box a ~ [ATTR=\NAME\], a.lnk ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.vkontakte.url - ^http(s)?\\:\\/\\/(vkontakte\\.ru|vk\\.com)\\/
FF - user.js: weboftrust.search.webde.display - WEB.DE
FF - user.js: weboftrust.search.webde.ign - ^http(s)?\\:\\/\\/(.+\\.)?web\\.de\\/
FF - user.js: weboftrust.search.webde.pre0.match - 9
FF - user.js: weboftrust.search.webde.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3d)(https?(\\:|%3A)[^&]+)(&.*)?
FF - user.js: weboftrust.search.webde.prestyle - [ATTR] { position: absolute; visibility: hidden; } .sponsoredLink a { display: inline ! important; }
FF - user.js: weboftrust.search.webde.style - .resultContent h3 a ~ [ATTR=\NAME\], .sponsoredLink h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.webde.url - ^http(s)?\\:\\/\\/suche\\.web\\.de\\/search\\/(web|dir)
FF - user.js: weboftrust.search.wikipedia.display - Wikipedia
FF - user.js: weboftrust.search.wikipedia.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(wik(ipedia|ibooks|inews|imedia(foundation)?|iquote|isource|tionary|iversity)|mediawiki)\\.org|toolserver\\.org)\\/
FF - user.js: weboftrust.search.wikipedia.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.wikipedia.style - #bodyContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat ! important; margin-left: 4px ! important; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.wikipedia.url - ^http(s)?\\:\\/\\/.+\\.wiki(pedia|news)\\.org\\/
FF - user.js: weboftrust.search.wikipedia.urlign - \\/w\\/extensions\\/|&action=(edit|submit)
FF - user.js: weboftrust.search.wp.display - Wirtualna Polska Szukaj
FF - user.js: weboftrust.search.wp.ign - ^http(s)?\\:\\/\\/(.+\\.)?(wp|adkontekst|tanio|netsprint)\\.(pl|tv)\\/
FF - user.js: weboftrust.search.wp.pre0.match - 3
FF - user.js: weboftrust.search.wp.pre0.re - ^http(s)?\\:\\/\\/(.+\\.)?wp\\.pl\\/redir\\.html\\?u=(.+)\\&
FF - user.js: weboftrust.search.wp.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.wp.style - big a ~ [ATTR=\NAME\], .recCont h1 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; margin-right:0.4em; position: relative; visibility: visible; opacity: 0.9; } .recCont h1 a ~ [ATTR=\NAME\] {top: -0.3em;} a.fGray ~ [ATTR=\NAME\] {visibility: hidden; position: absolute; }
FF - user.js: weboftrust.search.wp.url - ^http(s)?\\:\\/\\/szukaj\\.wp\\.pl\\/szukaj
FF - user.js: weboftrust.search.yahoo.display - Yahoo!
FF - user.js: weboftrust.search.yahoo.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|^http(s)?\\:\\/\\/.+\\/search\\/cache\\\\?
FF - user.js: weboftrust.search.yahoo.ninja - 1
FF - user.js: weboftrust.search.yahoo.pre0.match - 4
FF - user.js: weboftrust.search.yahoo.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*http.+yahoo\\.[a-z]{2,}.+fu=(http.+)
FF - user.js: weboftrust.search.yahoo.pre1.match - 4
FF - user.js: weboftrust.search.yahoo.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*(http.+)
FF - user.js: weboftrust.search.yahoo.pre2.match - 4
FF - user.js: weboftrust.search.yahoo.pre2.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/click\\\\?u=(http.+)
FF - user.js: weboftrust.search.yahoo.prestyle - .bbox [ATTR], .right [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.yahoo.style - a.yschttl ~ [ATTR=\NAME\], .active a ~ [ATTR=\NAME\], .hd h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.yahoo.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/search[;\\\\?].+
FF - user.js: weboftrust.search.yahoomail.display - Yahoo! Mail
FF - user.js: weboftrust.search.yahoomail.dynamic - 1
FF - user.js: weboftrust.search.yahoomail.ign - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*(yahoo\\.(com|net)|ymailupdates\\.com)\\/
FF - user.js: weboftrust.search.yahoomail.match0.condition - or
FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.name - class
FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.re - msg-body
FF - user.js: weboftrust.search.yahoomail.match0.match0.element - div
FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.name - id
FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.re - ^(messageAreaIframe|ViewArea_.*)$
FF - user.js: weboftrust.search.yahoomail.match0.match1.element - $frame
FF - user.js: weboftrust.search.yahoomail.prestyle - [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.yahoomail.searchlevel - 60
FF - user.js: weboftrust.search.yahoomail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.yahoomail.url - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*mail\\.yahoo\\.(com|net)\\/(dc|neo|om\\/api)\\/
FF - user.js: weboftrust.search.yandex.display - Yandex
FF - user.js: weboftrust.search.yandex.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yandex\\.([a-z]{2,}|com\\.[a-z]{2})\\/
FF - user.js: weboftrust.search.yandex.prestyle - .redirect [ATTR], .show-player ~ [ATTR], .moreInfo [ATTR], .l-head [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }
FF - user.js: weboftrust.search.yandex.style - .b-serp-item__title-link ~ [ATTR=\NAME\], .b-serp-item__title__link ~ [ATTR=\NAME\], .agp ~ [ATTR=\NAME\], .title ~ [ATTR=\NAME\], .domain ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 0px; margin-right: 4px; position: relative; visibility: visible; }
FF - user.js: weboftrust.search.yandex.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yandex\\.(ru|com|com\\.tr|ua|kz|by)\\/(yand|family|school)?search\\\\?.+
FF - user.js: weboftrust.shared.1 - 4sq.com,abcn.ws,aol.it,apne.ws,bbc.in,bzfd.it,clck.ru,cs.pn,d3w.io,dlvr.it,eca.sh,engt.co,es.pn,exm.nr,f.ast.ly,fa.by,flpbd.it,gd.is,ht.ly,huff.to,ind.pn,is.gd,j.mp,lat.ms,lnkd.in,migre.me,n.pr,nblo.gs,nyr.kr,nyti.ms,on.cnn.com,on.mash.to,on.msnbc.com,ow.ly,pep.si,ping.fm,politi.co,post.ly,rww.to,su.pr,t.co,tcrn.ch,tgr.ph,thkpr.gs,tiny.ly,tinyurl.com,tl.gd,tldr.us,tr.im,twitter.com,usat.me,wapo.st,wp.me,x.co,yhoo.it
FF - user.js: weboftrust.shared.2 - bit.ly,bitly.com,goo.gl,gu.com,sites.google.com
FF - user.js: weboftrust.show_rating_frame - false
FF - user.js: weboftrust.update_checked - 1350688027786
FF - user.js: weboftrust.witness_id - f8d37a9672234490d5ed83254e06c2e59efde37d
FF - user.js: weboftrust.witness_key - f4e66c84eeb157a3a01832733def5fa91878378c
FF - user.js: xpinstall.whitelist.add -
FF - user.js: xpinstall.whitelist.add.36 -
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: dom.disable_window_status_change - true
FF - user.js: browser.xul.error_pages.enabled - True
FF - user.js: browser.blink_allowed - false
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-3-4 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-3-4 177864]
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-1-20 195296]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-1-20 770344]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-1-20 369584]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-1-20 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-3-4 66336]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-1-20 46808]
R2 PFNet;Privacyware network service;c:\program files\privacyware\privatefirewall 7.0\pfsvc.exe [2013-1-14 374600]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2012-11-25 173880]
R3 pwipf6;Privacyware Filter Driver;c:\windows\system32\drivers\pwipf6.sys [2013-1-22 135272]
S3 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-7-19 116608]
S3 mbamchameleon;mbamchameleon;\??\c:\windows\system32\drivers\mbamchameleon.sys --> c:\windows\system32\drivers\mbamchameleon.sys [?]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-11-30 22856]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-7-7 14904]
S4 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-11-30 418376]
S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-11-30 701512]
S4 Secunia PSI Agent;Secunia PSI Agent; [x]
S4 Secunia Update Agent;Secunia Update Agent; [x]
.
=============== File Associations ===============
.
FileExt: .txt: Applications\WINWORD.EXE="c:\program files\microsoft office\office11\WINWORD.EXE" /n /dde [UserChoice] [default=edit - 'Open' doesn't exist]
.
=============== Created Last 30 ================
.
2013-09-20 12:43:46    --------    dc-h--r-    c:\documents and settings\eigenaar\Onlangs geopend
2013-09-14 21:44:00    --------    dc----w-    c:\program files\Free Window Registry Repair
2013-09-14 17:52:07    144896    -c--a-w-    c:\windows\system32\javacpl.cpl
2013-09-14 17:51:43    94632    -c--a-w-    c:\windows\system32\WindowsAccessBridge.dll
2013-09-13 20:24:17    2560    -c--a-w-    c:\windows\_MSRSTRT.EXE
2013-09-05 14:04:02    209272    -c--a-w-    c:\program files\mozilla firefox\plugins\nppdf32.dll
2013-09-05 14:04:02    209272    -c--a-w-    c:\program files\internet explorer\plugins\nppdf32.dll
2013-09-02 09:11:07    14720    -c--a-w-    c:\windows\system32\drivers\kbdhid.sys
2013-09-02 09:11:07    14720    -c--a-w-    c:\windows\system32\dllcache\kbdhid.sys
2013-08-26 10:22:46    7166848    -c--a-w-    c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9787b9d3-65e5-4c01-a89c-e4f4a37e0b50}\mpengine.dll
2013-08-26 10:04:23    7143960    -c--a-w-    c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2013-08-26 09:49:36    --------    dc----w-    c:\windows\system32\wbem\repository\FS
2013-08-26 09:49:36    --------    dc----w-    c:\windows\system32\wbem\Repository
.
==================== Find3M  ====================
.
2013-09-14 17:50:32    868264    -c--a-w-    c:\windows\system32\npDeployJava1.dll
2013-09-14 17:50:31    790440    -c--a-w-    c:\windows\system32\deployJava1.dll
2013-08-30 07:48:13    177864    -c--a-w-    c:\windows\system32\drivers\aswVmm.sys
2013-08-30 07:48:12    770344    -c--a-w-    c:\windows\system32\drivers\aswSnx.sys
2013-08-30 07:48:12    49376    -c--a-w-    c:\windows\system32\drivers\aswRvrt.sys
2013-08-30 07:48:11    66336    -c--a-w-    c:\windows\system32\drivers\aswMonFlt.sys
2013-08-30 07:47:40    41664    -c--a-w-    c:\windows\avastSS.scr
2013-08-09 01:56:37    391168    -c--a-w-    c:\windows\system32\themeui.dll
2013-08-08 06:09:45    1877888    -c--a-w-    c:\windows\system32\win32k.sys
2013-08-08 06:05:46    920064    -c--a-w-    c:\windows\system32\wininet.dll
2013-08-08 06:05:45    43520    -c----w-    c:\windows\system32\licmgr10.dll
2013-08-08 06:05:45    18944    -c--a-w-    c:\windows\system32\corpol.dll
2013-08-08 06:05:45    1469440    -c----w-    c:\windows\system32\inetcpl.cpl
2013-08-08 00:04:27    385024    -c----w-    c:\windows\system32\html.iec
2013-08-05 13:30:18    1289216    -c--a-w-    c:\windows\system32\ole32.dll
2013-08-02 23:48:38    1543680    -c----w-    c:\windows\system32\wmvdecod.dll
2013-08-01 10:49:51    692104    -c--a-w-    c:\windows\system32\FlashPlayerApp.exe
2013-08-01 10:49:50    71048    -c--a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-10 10:37:49    406016    -c--a-w-    c:\windows\system32\usp10.dll
2013-07-04 07:34:02    2197888    -c--a-w-    c:\windows\system32\ntoskrnl.exe
2013-07-04 07:34:02    2074496    -c--a-w-    c:\windows\system32\ntkrnlpa.exe
2012-11-25 21:39:14    2024936    -c--a-w-    c:\program files\dixmlsetup.exe
.
============= FINISH: 15:00:10,94 ===============
 

 

 

Attached Files


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


#5 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,419 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:00 AM

Posted 22 September 2013 - 05:36 PM

Greetings SpyCatcher* and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that. :thumbup2:

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. :)
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
  • Now let's get started :thumbup2:
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. Please run these programs for me.

===================================================

AdwCleaner by Xplode - Delete Adware

-------------------
  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browser
  • Double click on AdwCleaner.exe, select OK, then Run
  • Click on Delete
  • Confirm each time with OK
  • Your computer will be rebooted automatically. A text file will open after the restart
  • Copy and paste the contents in your reply
  • You can find the logfile at C:\AdwCleaner[S1].txt
===================================================

Junkware Removal Tool by thisisu

-------------------
  • Please download Junkware Removal Tool and save it to your desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Right-mouse click JRT.exe and select Run as administrator (Windows XP double click the icon)
  • Please allow the program time to run
  • Once completed a Notepad document will open on your desktop
  • Copy and paste the contents in your reply
===================================================

Farbar Recovery Scan Tool (FRST)

--------------------
  • Download Farbar Recover Scan Tool for either 32 bit or 64 bit systems and save it to your desktop
  • If you are unsure if you have 32 bit or 64 bit simply download and try one. If that doesn't run properly the other one should
  • Double click the icon
  • Click Yes to the disclaimer
  • Click Scan and allow the program to run
  • Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
  • 2 Notepad documents should now be open on your desktop.
  • Please copy and paste the contents of both in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • AdwCleaner log
  • Junkware log
  • FRST results
  • Addition log

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#6 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 23 September 2013 - 03:46 PM

Hello Gary and many thanks already for your help.

 

Thomas

 

 

Note: Farbar Recover Scan generated only one log.

 

 

AdwCleaner Log:

 

 

# AdwCleaner v3.005 - Report created 23/09/2013 at 21:33:48

# Updated 22/09/2013 by Xplode

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

# Username : Eigenaar - CREATIEF

# Running from : C:\Documents and Settings\Eigenaar\Bureaublad\adwcleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\jetpack

File Deleted : C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\user.js

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKCU\Software\Ask.com

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v8.0.6001.18702

 

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]

 

-\\ Mozilla Firefox v24.0 (en-US)

 

[ File : C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\prefs.js ]

 

Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]

Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");

Line Deleted : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");

 

[ File : C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\kkayrnn2.default\prefs.js ]

 

 

*************************

 

AdwCleaner[R0].txt - [3140 octets] - [23/09/2013 21:29:43]

AdwCleaner[S0].txt - [2891 octets] - [23/09/2013 21:33:48]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2951 octets] ##########

 

 

..........................................................................................................................................................

 

 

 

JRT Log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.2 (09.22.2013:1)

OS: Microsoft Windows XP x86

Ran by Eigenaar on ma 23-09-2013 at 22:00:51,52

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on ma 23-09-2013 at 22:06:28,57

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

........................................................................................................................................................

 

 

FSS Log:

 

 

 

Farbar Service Scanner Version: 13-09-2013

Ran by Eigenaar (administrator) on 23-09-2013 at 22:09:46

Running from "C:\Documents and Settings\Eigenaar\Bureaublad"

Microsoft Windows XP Home Edition Service Pack 3 (X86)

Boot Mode: Normal

****************************************************************

 

Internet Services:

============

Dnscache Service is not running. Checking service configuration:

The start type of Dnscache service is set to Disabled. The default start type is Auto.

The ImagePath of Dnscache service is OK.

The ServiceDll of Dnscache service is OK.

 

 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.

 

 

Windows Firewall:

=============

sharedaccess Service is not running. Checking service configuration:

The start type of sharedaccess service is set to Disabled. The default start type is Auto.

The ImagePath of sharedaccess service is OK.

The ServiceDll of sharedaccess service is OK.

 

 

Firewall Disabled Policy:

==================

 

 

System Restore:

============

 

System Restore Disabled Policy:

========================

 

 

Security Center:

============

 

 

Windows Update:

============

 

Windows Autoupdate Disabled Policy:

============================

 

 

Other Services:

==============

 

 

File Check:

========

C:\WINDOWS\system32\dhcpcsvc.dll

[2003-07-23 23:03] - [2008-04-14 22:32] - 0126976 ____A (Microsoft Corporation) 146AB038F5DBB366122D28444999AB2C

 

C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit

C:\WINDOWS\system32\dnsrslvr.dll

[2003-07-23 23:03] - [2009-04-20 19:22] - 0045568 ___AC (Microsoft Corporation) DE6CDB6CBC5C27B9085CFA6DFE8E5025

 

C:\WINDOWS\system32\ipnathlp.dll

[2003-07-23 23:08] - [2008-04-14 22:32] - 0332288 ____A (Microsoft Corporation) 7579C4BE909D47F10F3D8D801CB13ED9

 

C:\WINDOWS\system32\netman.dll

[2003-07-23 23:16] - [2008-04-14 22:32] - 0198144 ____A (Microsoft Corporation) 5431FB616ECAE0D587C5B97D0B86CBD8

 

C:\WINDOWS\system32\wbem\WMIsvc.dll

[2011-09-09 12:45] - [2008-04-14 22:32] - 0145408 ____A (Microsoft Corporation) F9E105F369C18E4001E0C05AAF600D73

 

C:\WINDOWS\system32\srsvc.dll

[2011-09-09 12:47] - [2008-04-14 22:32] - 0171008 ____A (Microsoft Corporation) 81CBF363C414620CAA61BD6843D8FDB9

 

C:\WINDOWS\system32\Drivers\sr.sys

[2011-09-09 12:47] - [2008-04-14 22:13] - 0073472 ___AC (Microsoft Corporation) 64D2A7640E0767ECD3BCB38D3200E7CE

 

C:\WINDOWS\system32\wscsvc.dll

[2011-09-11 13:55] - [2008-04-14 22:32] - 0080896 ____N (Microsoft Corporation) 843F7FA8EA38E6A4262976DCC994C81A

 

C:\WINDOWS\system32\wbem\WMIsvc.dll

[2011-09-09 12:45] - [2008-04-14 22:32] - 0145408 ____A (Microsoft Corporation) F9E105F369C18E4001E0C05AAF600D73

 

C:\WINDOWS\system32\wuauserv.dll

[2011-09-09 12:45] - [2008-04-14 22:32] - 0006656 ____A (Microsoft Corporation) 1E8FDDDEF3FE260BADAB06DAE10D753A

 

C:\WINDOWS\system32\qmgr.dll

[2011-09-09 12:47] - [2008-04-14 22:32] - 0409088 ___AC (Microsoft Corporation) 5C0073A51C4873430FA8B262E92183FF

 

C:\WINDOWS\system32\es.dll

[2003-07-23 23:05] - [2008-07-07 22:30] - 0253952 ____A (Microsoft Corporation) 97912DC0679D2DA60CCE589BBC196D72

 

C:\WINDOWS\system32\cryptsvc.dll

[2003-07-23 23:02] - [2008-04-14 22:32] - 0062464 ____A (Microsoft Corporation) 0A9CF5D3CF63A8699F28C814EF821C7E

 

C:\WINDOWS\system32\svchost.exe

[2003-07-23 23:25] - [2008-04-14 22:33] - 0014336 ____A (Microsoft Corporation) E410EC73E2BE2A41D923B006F51C8427

 

C:\WINDOWS\system32\rpcss.dll

[2003-07-23 23:21] - [2009-02-09 12:56] - 0401408 ____A (Microsoft Corporation) D9883335CC1C17AFC3A09C8AC3E4DBE4

 

C:\WINDOWS\system32\services.exe

[2003-07-23 23:22] - [2009-02-09 13:27] - 0111104 ____A (Microsoft Corporation) 657B69389B893F440B07590C9E963F23

 

 

Extra List:

=======

aswTdi(10) Gpc(3) IPSec(5) NetBT(6) PSched(7) pwipf6(11) Tcpip(4)

0x0B00000005000000010000000200000003000000040000000A000000090000000600000007000000080000000B000000

IpSec Tag value is correct.

 

**** End of log ****

 

 

 


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


#7 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,419 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:00 AM

Posted 23 September 2013 - 03:55 PM

Hi Thomas,

Thank you for the information. You provided a log for Farbar Service Scanner rather than Farbar Recovery Scan Tool. Please run that program and you should get 2 logs.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#8 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 24 September 2013 - 08:29 AM

Hi Gary,

 

After running FRST Internet connection got broken. I got it fixed using SAS.

 

 

FRST.txt Log

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-09-2013

Ran by Eigenaar (administrator) on CREATIEF on 24-09-2013 11:56:14

Running from C:\Documents and Settings\Eigenaar\Bureaublad

Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Dutch Standard

Internet Explorer Version 8

Boot Mode: Normal

 

==================== Processes (Whitelisted) ===================

 

(Privacyware/PWI, Inc.) C:\Program Files\Privacyware\Privatefirewall 7.0\pfsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Microsoft Corporation) C:\WINDOWS\System32\locator.exe

(Lexmark International, Inc.) C:\WINDOWS\system32\LEXBCES.EXE

(Intel Corporation) C:\WINDOWS\System32\hkcmd.exe

(Lexmark International, Inc.) C:\WINDOWS\system32\LEXPPS.EXE

(Broadcom Corporation) C:\WINDOWS\BCMSMMSG.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastUI.exe

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [HotKeysCmds] - C:\WINDOWS\System32\hkcmd.exe [ ] ()

HKLM\...\Run: [BCMSMMSG] - C:\Windows\BCMSMMSG.exe [122880 2003-08-29] (Broadcom Corporation)

HKLM\...\Run: [WinPatrol] - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [363752 2012-09-20] (BillP Studios)

HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-08-30] (AVAST Software)

HKLM\...\Run: [Privatefirewall] - C:\Program Files\Privacyware\Privatefirewall 7.0\PFGUI.exe [3011400 2013-01-14] (Privacyware/PWI, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxsrvc.dll (Intel Corporation)

HKCU\...\Run: [ccleaner] - C:\Program Files\CCleaner\CCleaner.exe [3676952 2013-08-21] (Piriform Ltd)

Startup: C:\Documents and Settings\Eigenaar\Menu Start\Programma's\Opstarten\ERUNT AutoBackup.lnk

ShortcutTarget: ERUNT AutoBackup.lnk -> C:\WINDOWS\ERUNT\AUTOBACK.EXE ()

BootExecute: autocheck autochk * pgdfgsvc C 1

 

==================== Internet (Whitelisted) ====================

 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

SearchScopes: HKLM - DefaultScope value is missing.

BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU -&Adres - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\System32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU -&Koppelingen - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\Windows\system32\SHELL32.dll (Microsoft Corporation)

DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [113024 2011-07-19] (SuperAdBlocker.com)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.254

 

FireFox:

========

FF ProfilePath: C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default

FF DefaultSearchEngine: WOT Safe Search

FF SelectedSearchEngine: WOT Safe Search

FF NetworkProxy: "no_proxies_on", ""

FF NetworkProxy: "socks_version", 4

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\searchplugins\wot-safe-search.xml

FF Extension: No Name - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\collector@broceliand.fr

FF Extension: DoNotTrackMe - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\donottrackplus@abine.com

FF Extension: HTTPS-Everywhere - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\https-everywhere@eff(2).org

FF Extension: LastPass - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\support@lastpass.com

FF Extension: Dr.Web Anti-Virus Link Checker - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}

FF Extension: WOT - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF Extension: WOT - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}(2)

FF Extension: Bitdefender QuickScan - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF Extension: Evernote Web Clipper - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}

FF Extension: chylvina - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\chylvina@gmail.com.xpi

FF Extension: extension - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\extension@hidemyass.com.xpi

FF Extension: jid1-F9UJ2thwoAm5gQ - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi

FF Extension: xmldeveloper - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\xmldeveloper@rit.edu.xpi

FF Extension: No Name - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi

FF Extension: No Name - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{55ce2530-61df-4ddc-b287-feae64e70575}.xpi

FF Extension: No Name - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: No Name - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{D0AD45D6-8518-11DF-8AD2-3F67DFD72085}.xpi

FF Extension: No Name - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: No Name - C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\6szjk2rx.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBA}

FF HKLM\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] - 

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

 

========================== Services (Whitelisted) =================

 

S3 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [116608 2012-09-09] (SUPERAntiSpyware.com)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software)

R3 LexBceS; C:\WINDOWS\system32\LEXBCES.EXE [303104 2003-06-02] (Lexmark International, Inc.)

S4 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S4 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 PFNet; C:\Program Files\Privacyware\Privatefirewall 7.0\pfsvc.exe [374600 2013-01-14] (Privacyware/PWI, Inc.)

S4 iPod Service;

S4 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf"

S4 Secunia PSI Agent;

S4 Secunia Update Agent;

 

==================== Drivers (Whitelisted) ====================

 

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-08-30] (AVAST Software)

R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [66336 2013-08-30] (AVAST Software)

R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [49760 2013-08-30] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-08-30] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-08-30] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-08-30] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-08-30] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [177864 2013-08-30] ()

R3 BCMModem; C:\Windows\System32\DRIVERS\BCMSM.sys [1101696 2003-08-29] (Broadcom Corporation)

R3 ialm; C:\Windows\System32\DRIVERS\ialmnt5.sys [93979 2003-10-27] (Intel Corporation)

R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [173880 2011-12-15] (QFX Software Corporation)

S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)

S3 PSI; C:\Windows\System32\DRIVERS\psi_mf.sys [14904 2010-07-07] (Secunia)

R3 pwipf6; C:\Windows\System32\DRIVERS\pwipf6.sys [135272 2012-05-25] (Privacyware/PWI, Inc.)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R3 STAC97; C:\Windows\System32\drivers\stac97.sys [248752 2003-11-07] (SigmaTel, Inc.)

R3 {6080A529-897E-4629-A488-ABA0C29B635E}; C:\Windows\System32\drivers\ialmsbw.sys [120830 2003-10-27] (Intel Corporation)

R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}; C:\Windows\System32\drivers\ialmkchw.sys [98938 2003-10-27] (Intel Corporation)

S3 mbamchameleon; \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys [x]

S3 SABProcEnum; \??\C:\Program Files\internet explorer\SABProcEnum.sys [x]

U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

U3 TlntSvr;

 

========================== Drivers MD5 =======================

 

C:\Windows\System32\DRIVERS\ACPI.sys 02273A448BA21A7D447DAEB47810D40C

C:\Windows\System32\Drivers\ACPIEC.sys 63F517B1A87DABF3F5ACB8A7952FC1D1

C:\Windows\System32\drivers\aec.sys 8BED39E3C35D6A489438B8141717A557

C:\Windows\System32\drivers\afd.sys 1E44BC1E83D8FD2305F8D452DB109CF9

C:\Windows\System32\Drivers\aswFsBlk.sys B9FE438B3CAD82B2014710349A2022F7

C:\WINDOWS\system32\drivers\aswMonFlt.sys AE5549DD21F6DE06406031EF1D51ACC3

C:\Windows\System32\Drivers\AswRdr.sys D084D0A7A66619FC29776CBBB9D5FA55

C:\Windows\System32\Drivers\aswRvrt.sys FA72FA503F580C3C628DD8C7D7622E37

C:\Windows\System32\Drivers\aswSnx.sys 4D53349D848C6BADB3D4ACBE98C27676

C:\Windows\System32\Drivers\aswSP.sys 813024DFD54A41B3AFAE2B1E2796CB80

C:\Windows\System32\Drivers\aswTdi.sys 5E18413310134130D7772F0668698CB7

C:\Windows\System32\Drivers\aswVmm.sys A5F637D61719D37A5B4868C385E363C0

C:\Windows\System32\DRIVERS\asyncmac.sys B153AFFAC761E7F5FCFA822B9C4E97BC

C:\Windows\System32\DRIVERS\atapi.sys 9F3A2F5AA6875C72BF062C712CFA2674

C:\Windows\System32\DRIVERS\atmarpc.sys 9916C1225104BA14794209CFA8012159

C:\Windows\System32\DRIVERS\audstub.sys D9F724AA26C010A217C97606B160ED68

C:\Windows\System32\DRIVERS\bcm4sbxp.sys E727776A56A51B7E6B7C87C02EA8B405

C:\Windows\System32\DRIVERS\BCMSM.sys 41347688046D49CDE0F6D138A534F73D

C:\Windows\System32\Drivers\Beep.sys DA1F27D85E0D1525F6621372E7B685E9

C:\Windows\System32\Drivers\cbidf2k.sys 90A673FC8E12A79AFBED2576F6A7AAF9

C:\Windows\System32\Drivers\Cdaudio.sys C1B486A7658353D33A10CC15211A873B

C:\Windows\System32\Drivers\Cdfs.sys C885B02847F5D2FD45A24E219ED93B32

C:\Windows\System32\DRIVERS\cdrom.sys 1F4260CC5B42272D71F79E570A27A4FE

C:\Windows\System32\DRIVERS\CmBatt.sys 0F6C187D38D98F8DF904589A5F94D411

C:\Windows\System32\DRIVERS\compbatt.sys 6E4C9F21F0FAE8940661144F41B13203

C:\Windows\System32\DRIVERS\disk.sys 044452051F3E02E7963599FC8F4F3E25

C:\Windows\System32\drivers\dmboot.sys DEC123E0C75971D0CC7A6C6A75E28429

C:\Windows\System32\drivers\dmio.sys 7268E66259722F6228C730685B201092

C:\Windows\System32\drivers\dmload.sys E9317282A63CA4D188C0DF5E09C6AC5F

C:\Windows\System32\drivers\DMusic.sys 8A208DFCF89792A484E76C40E5F50B45

C:\Windows\System32\drivers\drmkaud.sys 8F5FCFF8E8848AFAC920905FBD9D33C8

C:\Windows\System32\Drivers\Fastfat.sys 38D332A6D56AF32635675F132548343E

C:\Windows\System32\Drivers\Fdc.sys 92CDD60B6730B9F50F6A1A0C1F8CDC81

C:\Windows\System32\Drivers\Fips.sys 8BFFFB5AC954E19DFDB96D56512AA518

C:\Windows\System32\Drivers\Flpydisk.sys 9D27E7B80BFCDF1CDD9B555862D5E7F0

C:\Windows\System32\drivers\fltmgr.sys B2CF4B0786F8212CB92ED2B50C6DB6B0

C:\Windows\System32\Drivers\Fs_Rec.sys 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A

C:\Windows\System32\DRIVERS\ftdisk.sys FA8CA22E70245C81FF29C36AF56292FC

C:\Windows\System32\DRIVERS\msgpc.sys 0A02C63C8B144BD8C86B103DEE7C86A2

C:\Windows\System32\DRIVERS\hidusb.sys CCF82C5EC8A7326C3066DE870C06DAF1

C:\Windows\System32\Drivers\HTTP.sys F80A415EF82CD06FFAF0D971528EAD38

C:\Windows\System32\DRIVERS\i8042prt.sys C43372D0682F8E32E4EC21117E089EC0

C:\Windows\System32\DRIVERS\ialmnt5.sys 7502A1CC0677B6577D6AB9E1776E2836

C:\Windows\System32\DRIVERS\imapi.sys 083A052659F5310DD8B6A6CB05EDCF8E

C:\Windows\System32\DRIVERS\intelide.sys 72C63AD984D427D34BD5B9DB838D88EB

C:\Windows\System32\DRIVERS\intelppm.sys 2D2254FAC267E6B1C7865E8EBEF60C6D

C:\Windows\System32\drivers\ip6fw.sys 3BB22519A194418D5FEC05D800A19AD0

C:\Windows\System32\DRIVERS\ipfltdrv.sys 731F22BA402EE4B62748ADAF6363C182

C:\Windows\System32\DRIVERS\ipinip.sys B87AB476DCF76E72010632B5550955F5

C:\Windows\System32\DRIVERS\ipnat.sys CC748EA12C6EFFDE940EE98098BF96BB

C:\Windows\System32\DRIVERS\ipsec.sys 23C74D75E36E7158768DD63D92789A91

C:\Windows\System32\DRIVERS\irenum.sys C93C9FF7B04D772627A3646D89F7BF89

C:\Windows\System32\DRIVERS\isapnp.sys 0B78E1A31340E1FB1E389D5633F7C3A0

C:\Windows\System32\DRIVERS\kbdclass.sys 380397621E94B32C744E7B2CC1330390

C:\Windows\System32\DRIVERS\kbdhid.sys B833B70FE639F01FB36CEDABE57EF031

C:\Windows\System32\drivers\keyscrambler.sys 1223A8B567FFDB4B8BB5F59E5F033FDB

C:\Windows\System32\drivers\kmixer.sys 692BCF44383D056AED41B045A323D378

C:\Windows\System32\Drivers\KSecDD.sys B467646C54CC746128904E1654C750C1

C:\WINDOWS\system32\drivers\mbam.sys 4470E3C1E0C3378E4CAB137893C12C3A

C:\Windows\System32\Drivers\mnmdd.sys 4AE068242760A1FB6E1A44BF4E16AFA6

C:\Windows\System32\Drivers\Modem.sys 8114EEAC353F549331AB73E9AF4219ED

C:\Windows\System32\DRIVERS\mouclass.sys 1A4E2214DD63E4A876463D3427EE8261

C:\Windows\System32\DRIVERS\mouhid.sys 18017899254E01371E1A39754D6BF98C

C:\Windows\System32\Drivers\MountMgr.sys A80B9A0BAD1B73637DBCBBA7DF72D3FD

C:\Windows\System32\DRIVERS\MpFilter.sys CF105EE42E3F71E648CEBB3F666E1CF0

C:\Windows\System32\DRIVERS\mrxdav.sys 11D42BB6206F33FBB3BA0288D3EF81BD

C:\Windows\System32\DRIVERS\mrxsmb.sys 7D304A5EB4344EBEEAB53A2FE3FFB9F0

C:\Windows\System32\Drivers\Msfs.sys C941EA2454BA8350021D774DAF0F1027

C:\Windows\System32\drivers\MSKSSRV.sys D1575E71568F4D9E14CA56B7B0453BF1

C:\Windows\System32\drivers\MSPCLOCK.sys 325BB26842FC7CCC1FCCE2C457317F3E

C:\Windows\System32\drivers\MSPQM.sys BAD59648BA099DA4A17680B39730CB3D

C:\Windows\System32\DRIVERS\mssmbios.sys AF5F4F3F14A8EA2C26DE30F7A1E17136

C:\Windows\System32\Drivers\Mup.sys DE6A75F5C270E756C5508D94B6CF68F5

C:\Windows\System32\Drivers\NDIS.sys 1DF7F42665C94B825322FAE71721130D

C:\Windows\System32\DRIVERS\ndistapi.sys 0109C4F3850DFBAB279542515386AE22

C:\Windows\System32\DRIVERS\ndisuio.sys F927A4434C5028758A842943EF1A3849

C:\Windows\System32\DRIVERS\ndiswan.sys EDC1531A49C80614B2CFDA43CA8659AB

C:\Windows\System32\Drivers\NDProxy.sys 9282BD12DFB069D3889EB3FCC1000A9B

C:\Windows\System32\DRIVERS\netbios.sys 5D81CF9A2F1A3A756B66CF684911CDF0

C:\Windows\System32\DRIVERS\netbt.sys 74B2B2F5BEA5E9A3DC021D685551BD3D

C:\Windows\System32\drivers\ccdcmb.sys F6C40E0A565EE3CE5AEEB325E10054F2

C:\Windows\System32\drivers\ccdcmbo.sys 2A394E9E1FA3565E4B2FEA470FFE4D6B

C:\Windows\System32\Drivers\Npfs.sys 3182D64AE053D6FB034F44B6DEF8034A

C:\Windows\System32\Drivers\Ntfs.sys 78A08DD6A8D65E697C18E1DB01C5CDCA

C:\Windows\System32\Drivers\Null.sys 73C1E1F395918BC2C6DD67AF7591A3AD

C:\Windows\System32\DRIVERS\nwlnkflt.sys B305F3FAD35083837EF46A0BBCE2FC57

C:\Windows\System32\DRIVERS\nwlnkfwd.sys C99B3415198D1AAB7227F2C88FD664B9

C:\Windows\System32\DRIVERS\omci.sys 1D98907D80461371437A7C898C58C8AE

C:\Windows\System32\Drivers\Parport.sys E3934CCC20A4D24F1924E13D36D2A5BD

C:\Windows\System32\Drivers\PartMgr.sys BEB3BA25197665D82EC7065B724171C6

C:\Windows\System32\Drivers\ParVdm.sys 1EADE28746A64C21E0A808BB12A63326

C:\Windows\System32\DRIVERS\pccsmcfd.sys F451DCACBAA67F3307305EBD4A39EA07

C:\Windows\System32\DRIVERS\pci.sys 3B166F9F753C21AEDAA9A6BD76B49655

C:\Windows\System32\DRIVERS\pciide.sys B31EDEBA4DA28283F6B8DC4756FB9585

C:\Windows\System32\DRIVERS\pcmcia.sys 2137FFD65F8E609A3A5ACD487C56CCE0

C:\Windows\System32\DRIVERS\raspptp.sys EFEEC01B1D3CF84F16DDD24D9D9D8F99

C:\Windows\System32\DRIVERS\processr.sys 82A17ECA34D801590A67C0A2244965ED

C:\Windows\System32\DRIVERS\psched.sys 09298EC810B07E5D582CB3A3F9255424

C:\Windows\System32\DRIVERS\psi_mf.sys 1DF21F001F3A94EBA4A2950C70CC358F

C:\Windows\System32\DRIVERS\ptilink.sys 80D317BD1C3DBC5D4FE7B1678C60CADD

C:\Windows\System32\DRIVERS\pwipf6.sys 944F9CA807FE9E1095FA894D5A7B018A

C:\Windows\System32\DRIVERS\rasacd.sys FE0D99D6F31E4FAD8159F690D68DED9C

C:\Windows\System32\DRIVERS\rasl2tp.sys 11B4A627BC9614B885C4969BFA5FF8A6

C:\Windows\System32\DRIVERS\raspppoe.sys 5BC962F2654137C9909C3D4603587DEE

C:\Windows\System32\DRIVERS\raspti.sys FDBB1D60066FCFBB7452FD8F9829B242

C:\Windows\System32\DRIVERS\rdbss.sys 7AD224AD1A1437FE28D89CF22B17780A

C:\Windows\System32\DRIVERS\RDPCDD.sys 4912D5B403614CE99C28420F75353332

C:\Windows\System32\Drivers\RDPWD.sys 43AF5212BD8FB5BA6EED9754358BD8F7

C:\Windows\System32\DRIVERS\redbook.sys 4173BC66E485FD77A03C4819F60BD0DA

C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 39763504067962108505BFF25F024345

C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 77B9FC20084B48408AD3E87570EB4A85

C:\Windows\System32\DRIVERS\secdrv.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Serial.sys 92C21762653BB2CE51147EB8A9AA654F

C:\Windows\System32\DRIVERS\sfloppy.sys 8E6B8C671615D126FDC553D1E2DE5562

C:\Windows\System32\drivers\splitter.sys AB8B92451ECB048A4D1DE7C3FFCB4A9F

C:\Windows\System32\DRIVERS\sr.sys 64D2A7640E0767ECD3BCB38D3200E7CE

C:\Windows\System32\DRIVERS\srv.sys 47DDFC2F003F7F9F0592C6874962A2E7

C:\Windows\System32\drivers\stac97.sys B86729404C681077CB862F4E3FB826CB

C:\Windows\System32\DRIVERS\swenum.sys 3941D127AEF12E93ADDF6FE6EE027E0F

C:\Windows\System32\drivers\swmidi.sys 8CE882BCC6CF8A62F2B2323D95CB3D01

C:\Windows\System32\DRIVERS\SynTP.sys 26FC9F8A6EF6F939D0A3E92AD6A0D6E8

C:\Windows\System32\drivers\sysaudio.sys 8B83F3ED0F1688B4958F77CD6D2BF290

C:\Windows\System32\DRIVERS\tcpip.sys 9AEFA14BD6B182D61E3119FA5F436D3D

C:\Windows\System32\Drivers\TDPIPE.sys 6471A66807F5E104E4885F5B67349397

C:\Windows\System32\Drivers\TDTCP.sys C56B6D0402371CF3700EB322EF3AAF61

C:\Windows\System32\DRIVERS\termdd.sys 88155247177638048422893737429D9E

C:\Windows\System32\Drivers\Udfs.sys 5787B80C2E3C5E2F56C2A233D91FA2C9

C:\Windows\System32\DRIVERS\update.sys 402DDC88356B1BAC0EE3DD1580C76A31

C:\Windows\System32\DRIVERS\usbser_lowerflt.sys 47F5F9D837D80FFD5882A14DB9DA0A67

C:\Windows\System32\DRIVERS\usbehci.sys 65DCF09D0E37D4C6B11B5B0B76D470A7

C:\Windows\System32\DRIVERS\usbhub.sys 1AB3CDDE553B6E064D2E754EFE20285C

C:\Windows\System32\DRIVERS\usbprint.sys A717C8721046828520C9EDF31288FC00

C:\Windows\System32\DRIVERS\usbscan.sys A0B8CF9DEB1184FBDD20784A58FA75D4

C:\Windows\System32\drivers\usbser.sys 1C888B000C2F9492F4B15B5B6B84873E

C:\Windows\System32\DRIVERS\usbser_lowerfltj.sys E44F0D17BE0908B58DCC99CCB99C6C32

C:\Windows\System32\DRIVERS\USBSTOR.SYS A32426D9B14A089EAA1D922E0C5801A9

C:\Windows\System32\DRIVERS\usbuhci.sys 26496F9DEE2D787FC3E61AD54821FFE6

C:\Windows\System32\drivers\vga.sys 0D3A8FAFCEACD8B7625CD549757A7DF1

C:\Windows\System32\Drivers\VolSnap.sys 8AB662B3C4691E6DDF61C96BB5B7D103

C:\Windows\System32\DRIVERS\wanarp.sys E20B95BAEDB550F32DD489265C1DA1F6

C:\Windows\System32\DRIVERS\Wdf01000.sys D918617B46457B9AC28027722E30F647

C:\Windows\System32\drivers\wdmaud.sys 6768ACF64B18196494413695F0C3A00F

C:\Windows\System32\drivers\ws2ifsl.sys 6ABE6E225ADB5A751622A9CC3BC19CE8

C:\Windows\System32\DRIVERS\WudfPf.sys EAA6324F51214D2F6718977EC9CE0DEF

C:\Windows\System32\DRIVERS\wudfrd.sys F91FF1E51FCA30B3C3981DB7D5924252

C:\Windows\System32\drivers\ialmsbw.sys 6E08E6C264C619D73D869F17F272C9C8

C:\Windows\System32\drivers\ialmkchw.sys 42482AEC379448454F800C64861B2121

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2013-09-24 11:55 - 2013-09-24 11:55 - 00000000 ____D C:\FRST

2013-09-24 11:54 - 2013-09-24 11:54 - 01088653 ____C (Farbar) C:\Documents and Settings\Eigenaar\Bureaublad\FRST.exe

2013-09-24 09:34 - 2013-09-24 11:55 - 00000000 _RHDC C:\Documents and Settings\Eigenaar\Onlangs geopend

2013-09-23 22:09 - 2013-09-23 22:09 - 00004237 ____C C:\Documents and Settings\Eigenaar\Bureaublad\FSS.txt

2013-09-23 21:48 - 2013-09-23 21:48 - 00000748 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Snelkoppeling naar Infected-Attachment-130920.doc.lnk

2013-09-23 21:46 - 2013-09-23 21:46 - 00000509 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Snelkoppeling naar 130903_BLEEPINGCOMPUTER.lnk

2013-09-23 21:27 - 2013-09-23 21:49 - 00000000 ____D C:\AdwCleaner

2013-09-23 21:25 - 2013-09-23 21:25 - 02115070 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-130923.html

2013-09-23 21:25 - 2013-09-23 21:25 - 00999392 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-2013-09-23.json

2013-09-23 21:24 - 2013-09-23 21:24 - 01030038 ____C (Thisisu) C:\Documents and Settings\Eigenaar\Bureaublad\JRT.exe

2013-09-23 21:23 - 2013-09-23 21:23 - 01042066 ____C C:\Documents and Settings\Eigenaar\Bureaublad\adwcleaner.exe

2013-09-23 21:23 - 2013-09-23 21:23 - 00358923 ____C (Farbar) C:\Documents and Settings\Eigenaar\Bureaublad\FSS.exe

2013-09-22 23:10 - 2013-09-22 23:11 - 02096473 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-130922.html

2013-09-22 23:10 - 2013-09-22 23:10 - 00992436 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-2013-09-22.json

2013-09-20 14:53 - 2013-09-20 14:54 - 00688992 ___RC (Swearware) C:\Documents and Settings\Eigenaar\Bureaublad\dds.com

2013-09-15 03:14 - 2013-09-15 03:14 - 00001611 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Attach-txt.zip

2013-09-15 02:06 - 2013-09-20 15:00 - 00168838 ____C C:\Documents and Settings\Eigenaar\Bureaublad\dds.txt

2013-09-15 02:06 - 2013-09-20 15:00 - 00006788 ____C C:\Documents and Settings\Eigenaar\Bureaublad\attach.txt

2013-09-15 01:52 - 2013-09-15 01:52 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Mijn documenten\130917-BC-UTILITY

2013-09-15 01:16 - 2013-09-15 01:17 - 113948486 ____C C:\Documents and Settings\Eigenaar\Bureaublad\130914-Registry-Backup.reg

2013-09-14 23:44 - 2013-09-15 00:24 - 00000000 ___DC C:\Program Files\Free Window Registry Repair

2013-09-14 23:44 - 2013-09-14 23:44 - 00000725 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Free Window Registry Repair.lnk

2013-09-14 23:44 - 2013-09-14 23:44 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Menu Start\Programma's\Free Window Registry Repair

2013-09-14 19:59 - 2013-09-14 19:59 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Application Data\Oracle

2013-09-14 19:52 - 2013-09-14 19:50 - 00264616 ____C (Oracle Corporation) C:\WINDOWS\system32\javaws.exe

2013-09-14 19:52 - 2013-09-14 19:50 - 00144896 ____C (Oracle Corporation) C:\WINDOWS\system32\javacpl.cpl

2013-09-14 19:51 - 2013-09-14 19:51 - 00000000 ___DC C:\Documents and Settings\All Users\Menu Start\Programma's\Java

2013-09-14 19:51 - 2013-09-14 19:50 - 00175016 ____C (Oracle Corporation) C:\WINDOWS\system32\javaw.exe

2013-09-14 19:51 - 2013-09-14 19:50 - 00175016 ____C (Oracle Corporation) C:\WINDOWS\system32\java.exe

2013-09-14 19:51 - 2013-09-14 19:50 - 00094632 ____C (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll

2013-09-13 22:24 - 2013-09-13 22:24 - 00002560 ____C C:\WINDOWS\_MSRSTRT.EXE

2013-09-04 06:13 - 2013-09-04 06:13 - 00087486 ____C C:\Documents and Settings\Eigenaar\Local Settings\Application Data\FASTWiz.log

2013-09-02 11:11 - 2008-04-14 22:09 - 00014720 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys

2013-09-02 11:11 - 2008-04-14 22:09 - 00014720 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\kbdhid.sys

 

==================== One Month Modified Files and Folders =======

 

2013-09-24 11:56 - 2011-12-05 18:21 - 00000000 ___SD C:\Documents and Settings\Administrator

2013-09-24 11:55 - 2013-09-24 11:55 - 00000000 ____D C:\FRST

2013-09-24 11:55 - 2013-09-24 09:34 - 00000000 _RHDC C:\Documents and Settings\Eigenaar\Onlangs geopend

2013-09-24 11:54 - 2013-09-24 11:54 - 01088653 ____C (Farbar) C:\Documents and Settings\Eigenaar\Bureaublad\FRST.exe

2013-09-24 11:54 - 2011-09-09 12:58 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Bureaublad

2013-09-24 09:34 - 2011-09-09 12:58 - 00000000 ___DC C:\Documents and Settings\Eigenaar

2013-09-24 09:31 - 2013-05-29 23:37 - 01766243 ____C C:\WINDOWS\WindowsUpdate.log

2013-09-24 09:30 - 2012-10-13 16:34 - 00000159 ____C C:\WINDOWS\wiadebug.log

2013-09-24 09:30 - 2011-12-09 02:07 - 00000000 ___DC C:\WINDOWS\system32\NtmsData

2013-09-24 09:30 - 2011-09-09 12:47 - 00000000 ___DC C:\WINDOWS\Registration

2013-09-24 09:29 - 2012-10-13 16:34 - 00000049 ____C C:\WINDOWS\wiaservc.log

2013-09-23 22:52 - 2011-09-09 12:58 - 00000188 __SHC C:\Documents and Settings\Eigenaar\ntuser.ini

2013-09-23 22:09 - 2013-09-23 22:09 - 00004237 ____C C:\Documents and Settings\Eigenaar\Bureaublad\FSS.txt

2013-09-23 22:00 - 2012-11-26 00:03 - 00000000 ___DC C:\WINDOWS\ERUNT

2013-09-23 21:49 - 2013-09-23 21:27 - 00000000 ____D C:\AdwCleaner

2013-09-23 21:48 - 2013-09-23 21:48 - 00000748 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Snelkoppeling naar Infected-Attachment-130920.doc.lnk

2013-09-23 21:46 - 2013-09-23 21:46 - 00000509 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Snelkoppeling naar 130903_BLEEPINGCOMPUTER.lnk

2013-09-23 21:25 - 2013-09-23 21:25 - 02115070 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-130923.html

2013-09-23 21:25 - 2013-09-23 21:25 - 00999392 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-2013-09-23.json

2013-09-23 21:24 - 2013-09-23 21:24 - 01030038 ____C (Thisisu) C:\Documents and Settings\Eigenaar\Bureaublad\JRT.exe

2013-09-23 21:23 - 2013-09-23 21:23 - 01042066 ____C C:\Documents and Settings\Eigenaar\Bureaublad\adwcleaner.exe

2013-09-23 21:23 - 2013-09-23 21:23 - 00358923 ____C (Farbar) C:\Documents and Settings\Eigenaar\Bureaublad\FSS.exe

2013-09-22 23:11 - 2013-09-22 23:10 - 02096473 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-130922.html

2013-09-22 23:10 - 2013-09-22 23:10 - 00992436 ____C C:\Documents and Settings\Eigenaar\Bureaublad\bookmarks-2013-09-22.json

2013-09-22 16:26 - 2003-07-23 23:31 - 00002206 ____C C:\WINDOWS\system32\wpa.dbl

2013-09-21 16:37 - 2012-07-08 22:26 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Application Data\Macromedia

2013-09-21 11:34 - 2013-01-20 16:54 - 00000316 ___HC C:\WINDOWS\Tasks\avast! Emergency Update.job

2013-09-21 11:34 - 2011-09-09 12:50 - 00002845 ____C C:\WINDOWS\system32\CONFIG.NT

2013-09-20 15:00 - 2013-09-15 02:06 - 00168838 ____C C:\Documents and Settings\Eigenaar\Bureaublad\dds.txt

2013-09-20 15:00 - 2013-09-15 02:06 - 00006788 ____C C:\Documents and Settings\Eigenaar\Bureaublad\attach.txt

2013-09-20 14:54 - 2013-09-20 14:53 - 00688992 ___RC (Swearware) C:\Documents and Settings\Eigenaar\Bureaublad\dds.com

2013-09-20 09:45 - 2013-08-22 21:23 - 00000000 ___DC C:\Program Files\Mozilla Firefox

2013-09-19 12:32 - 2011-12-23 23:12 - 00000737 ____C C:\Documents and Settings\All Users\Menu Start\Programma's\Mozilla Firefox.lnk

2013-09-19 12:32 - 2011-12-23 23:12 - 00000731 ____C C:\Documents and Settings\All Users\Bureaublad\Mozilla Firefox.lnk

2013-09-17 15:35 - 2013-01-01 11:19 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Mijn documenten\130917-BC-SECURITY

2013-09-15 03:14 - 2013-09-15 03:14 - 00001611 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Attach-txt.zip

2013-09-15 01:52 - 2013-09-15 01:52 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Mijn documenten\130917-BC-UTILITY

2013-09-15 01:17 - 2013-09-15 01:16 - 113948486 ____C C:\Documents and Settings\Eigenaar\Bureaublad\130914-Registry-Backup.reg

2013-09-15 00:43 - 2011-09-09 14:41 - 00000000 __RDC C:\Documents and Settings\All Users\Menu Start\Programma's

2013-09-15 00:24 - 2013-09-14 23:44 - 00000000 ___DC C:\Program Files\Free Window Registry Repair

2013-09-14 23:44 - 2013-09-14 23:44 - 00000725 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Free Window Registry Repair.lnk

2013-09-14 23:44 - 2013-09-14 23:44 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Menu Start\Programma's\Free Window Registry Repair

2013-09-14 23:44 - 2011-09-09 12:58 - 00000000 __RDC C:\Documents and Settings\Eigenaar\Menu Start\Programma's

2013-09-14 19:59 - 2013-09-14 19:59 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Application Data\Oracle

2013-09-14 19:51 - 2013-09-14 19:51 - 00000000 ___DC C:\Documents and Settings\All Users\Menu Start\Programma's\Java

2013-09-14 19:50 - 2013-09-14 19:52 - 00264616 ____C (Oracle Corporation) C:\WINDOWS\system32\javaws.exe

2013-09-14 19:50 - 2013-09-14 19:52 - 00144896 ____C (Oracle Corporation) C:\WINDOWS\system32\javacpl.cpl

2013-09-14 19:50 - 2013-09-14 19:51 - 00175016 ____C (Oracle Corporation) C:\WINDOWS\system32\javaw.exe

2013-09-14 19:50 - 2013-09-14 19:51 - 00175016 ____C (Oracle Corporation) C:\WINDOWS\system32\java.exe

2013-09-14 19:50 - 2013-09-14 19:51 - 00094632 ____C (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll

2013-09-14 19:50 - 2012-09-06 22:22 - 00868264 ____C (Oracle Corporation) C:\WINDOWS\system32\npDeployJava1.dll

2013-09-14 19:50 - 2012-09-06 22:22 - 00790440 ____C (Oracle Corporation) C:\WINDOWS\system32\deployJava1.dll

2013-09-14 18:55 - 2011-11-01 17:11 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Apple Computer

2013-09-14 18:55 - 2011-09-09 14:41 - 00000000 ___DC C:\Documents and Settings\All Users\Bureaublad

2013-09-14 18:21 - 2013-01-17 21:04 - 00002347 ____C C:\Documents and Settings\All Users\Menu Start\Programma's\Adobe Reader XI.lnk

2013-09-14 18:15 - 2011-09-12 00:41 - 00002265 ____C C:\Documents and Settings\All Users\Menu Start\Programma's\Apple Software Update.lnk

2013-09-14 18:12 - 2013-03-30 23:33 - 00000000 ___DC C:\Program Files\SpywareBlaster

2013-09-14 18:03 - 2011-12-23 20:30 - 00002057 ____C C:\WINDOWS\epplauncher.mif

2013-09-14 12:13 - 2011-09-10 14:50 - 00000000 ___DC C:\WINDOWS\ie8updates

2013-09-14 10:41 - 2013-08-11 19:44 - 00000000 ___DC C:\WINDOWS\system32\MRT

2013-09-13 22:24 - 2013-09-13 22:24 - 00002560 ____C C:\WINDOWS\_MSRSTRT.EXE

2013-09-13 22:10 - 2011-12-15 00:08 - 00000932 ____C C:\Documents and Settings\Eigenaar\Bureaublad\Revo Uninstaller.lnk

2013-09-13 21:45 - 2012-11-06 19:36 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Mijn documenten\SECURITY TOOLS 120212

2013-09-13 21:44 - 2012-02-12 20:02 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Mijn documenten\FIX TOOLS 120212

2013-09-13 21:39 - 2013-01-01 11:24 - 00000000 ___DC C:\Documents and Settings\Eigenaar\Mijn documenten\130101 Backup

2013-09-13 21:16 - 2011-09-12 00:41 - 00000000 ___DC C:\Program Files\Common Files\Apple

2013-09-13 20:59 - 2011-09-09 14:39 - 00000212 ___SH C:\boot.ini

2013-09-13 20:59 - 2003-07-23 23:29 - 00000538 ____C C:\WINDOWS\win.ini

2013-09-13 20:59 - 2003-07-23 23:25 - 00000227 ____C C:\WINDOWS\system.ini

2013-09-07 11:00 - 2013-08-01 14:30 - 00000689 ____C C:\Documents and Settings\All Users\Bureaublad\CCleaner.lnk

2013-09-07 11:00 - 2011-09-11 20:18 - 00000000 ___DC C:\Program Files\CCleaner

2013-09-04 06:13 - 2013-09-04 06:13 - 00087486 ____C C:\Documents and Settings\Eigenaar\Local Settings\Application Data\FASTWiz.log

2013-09-01 16:57 - 2011-09-11 14:42 - 76725432 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-08-30 09:48 - 2013-03-04 20:19 - 00177864 ____C C:\WINDOWS\system32\Drivers\aswVmm.sys

2013-08-30 09:48 - 2013-03-04 20:19 - 00066336 ____C (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys

2013-08-30 09:48 - 2013-03-04 20:19 - 00049376 ____C C:\WINDOWS\system32\Drivers\aswRvrt.sys

2013-08-30 09:48 - 2013-01-20 16:54 - 00770344 ____C (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys

2013-08-30 09:48 - 2013-01-20 16:54 - 00369584 ____C (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys

2013-08-30 09:48 - 2013-01-20 16:54 - 00056080 ____C (AVAST Software) C:\WINDOWS\system32\Drivers\aswTdi.sys

2013-08-30 09:48 - 2013-01-20 16:54 - 00049760 ____C (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr.sys

2013-08-30 09:48 - 2013-01-20 16:54 - 00029816 ____C (AVAST Software) C:\WINDOWS\system32\Drivers\aswFsBlk.sys

2013-08-30 09:47 - 2013-01-20 16:51 - 00229648 ____C (AVAST Software) C:\WINDOWS\system32\aswBoot.exe

2013-08-30 09:47 - 2013-01-20 16:51 - 00041664 ____C (AVAST Software) C:\WINDOWS\avastSS.scr

2013-08-28 15:26 - 2011-09-10 17:18 - 00000000 ___DC C:\Program Files\SUPERAntiSpyware

2013-08-26 12:14 - 2013-01-20 16:54 - 00001696 ____C C:\Documents and Settings\All Users\Bureaublad\avast! Free Antivirus.lnk

2013-08-26 11:50 - 2011-12-05 19:29 - 00000000 ____D C:\Documents and Settings\Administrator.CREATIEF

2013-08-26 11:50 - 2011-09-09 12:58 - 00000000 _SHDC C:\Documents and Settings\NetworkService

2013-08-26 11:50 - 2011-09-09 12:58 - 00000000 _SHDC C:\Documents and Settings\LocalService

2013-08-26 11:38 - 2013-06-26 14:36 - 00065536 ____C C:\WINDOWS\system32\config\SpybotSD.evt

 

==================== Bamital & volsnap Check =================

 

C:\Windows\explorer.exe

[2003-07-23 23:05] - [2008-04-14 22:33] - 1037312 ____A (Microsoft Corporation) aa04f042a820bf1868e643575887e1a6

 

C:\Windows\System32\winlogon.exe

[2003-07-23 23:30] - [2008-04-14 22:33] - 0510464 ____A (Microsoft Corporation) 1247d4d5444e28519bbe31be8ab4c029

 

C:\Windows\System32\svchost.exe

[2003-07-23 23:25] - [2008-04-14 22:33] - 0014336 ____A (Microsoft Corporation) e410ec73e2be2a41d923b006f51c8427

 

C:\Windows\System32\services.exe

[2003-07-23 23:22] - [2009-02-09 13:27] - 0111104 ____A (Microsoft Corporation) 657b69389b893f440b07590c9e963f23

 

C:\Windows\System32\User32.dll

[2003-07-23 23:27] - [2008-04-14 22:32] - 0580096 ____A (Microsoft Corporation) 4cf588d2f2363b73eb4af57967d46dff

 

C:\Windows\System32\userinit.exe

[2003-07-23 23:27] - [2008-04-14 22:33] - 0026112 ___AC (Microsoft Corporation) 6818a533ed3b2fa9936df3daf45352df

 

C:\Windows\System32\Drivers\volsnap.sys

[2003-07-23 23:28] - [2008-04-14 22:03] - 0053504 ___AC (Microsoft Corporation) 8ab662b3c4691e6ddf61c96bb5b7d103

 

 

==================== End Of Log ============================

 

 

 

Addition.txt Log

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-09-2013

Ran by Eigenaar at 2013-09-24 11:57:28

Running from C:\Documents and Settings\Eigenaar\Bureaublad

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

AV: AVG Anti-Virus Free Edition 2012 (Disabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Microsoft Security Essentials (Disabled - Up to date) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: avast! Antivirus (Disabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: Privatefirewall (Disabled) {AF0CFAAE-AAB5-450a-8C74-0DEEB429DF4F}

 

==================== Installed Programs ======================

 

ABBYY FineReader 5.0 Sprint (Version: 5.0.482.3421)

Adobe Flash Player 11 Plugin (Version: 11.8.800.94)

Adobe Reader XI (11.0.04) (Version: 11.0.04)

Apple Application Support (Version: 2.2.2)

Apple Software Update (Version: 2.1.3.127)

Auslogics Disk Defrag (Version: 3.6)

avast! Free Antivirus (Version: 8.0.1497.0)

BCM V.92 56K Modem

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2510531) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2544521) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2559049) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2586448) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2618444) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2647516) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2675157) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2699988) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2722913) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2744842) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2761465) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2792100) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2797052) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2799329) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2817183) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2829530) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2846071) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2847204) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB2870699) (Version: 1)

Beveiligingsupdate voor Windows Internet Explorer 8 (KB982381) (Version: 1)

Beveiligingsupdate voor Windows Media Player (KB2834904-v2)

Beveiligingsupdate voor Windows XP (KB2849470) (Version: 1)

Beveiligingsupdate voor Windows XP (KB2850869) (Version: 1)

Beveiligingsupdate voor Windows XP (KB2859537) (Version: 1)

Beveiligingsupdate voor Windows XP (KB2864063) (Version: 1)

Beveiligingsupdate voor Windows XP (KB2876217) (Version: 1)

Beveiligingsupdate voor Windows XP (KB2876315) (Version: 1)

Blueline 1.1.1

Broadcom 440x 10/100 Integrated Controller (Version: 5.03.02)

CCleaner (Version: 4.05)

Dell AIO Printer A920

Dell ResourceCD

DriveImage XML (Private Edition) (Version: 2.44.000)

ERUNT 1.1j

ESET Online Scanner v3

FaxTools (Version: 5.10)

FileASSASSIN (Version: 1.06)

Free Window Registry Repair

Intel® Extreme Graphics 2 Driver

Java 7 Update 40 (Version: 7.0.400)

Java Auto Updater (Version: 2.1.9.0)

Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)

Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)

Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - NLD (Version: 2.2.30729)

Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)

Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - NLD (Version: 3.2.30729)

Microsoft .NET Framework 3.5 Language Pack SP1 - nld (Version: 3.5.30729)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)

Microsoft Application Error Reporting (Version: 12.0.6012.5000)

Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)

Microsoft Office Professional Editie 2003 (Version: 11.0.8173.0)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft_VC100_CRT_SP1_x86 (Version: 10.0.40219.1)

Mozilla Firefox 24.0 (x86 en-US) (Version: 24.0)

Mozilla Maintenance Service (Version: 23.0.1)

MSVC80_x86_v2 (Version: 1.0.3.0)

MSVC90_x86 (Version: 1.0.1.2)

Nokia Connectivity Cable Driver (Version: 7.1.78.0)

Nokia PC Suite (Version: 7.1.180.94)

Opera 12.12 (HKCU Version: 12.12.1707)

PC Connectivity Solution (Version: 12.0.27.0)

Privatefirewall 7.0 (Version: 7.0.29.1)

Revo Uninstaller 1.95 (Version: 1.95)

SigmaTel AC97 audiostuurprogramma's (Version: 4023)

Sophos Virus Removal Tool (Version: 2.2)

SUPERAntiSpyware (Version: 5.0.1108)

Synaptics Pointing Device Driver (Version: 7.9.3.0)

SyncBack

Taalpakket voor Microsoft .NET Framework 3.5 SP1 - NL

Tweak UI

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)

Update voor Windows Internet Explorer 8 (KB2447568) (Version: 1)

Update voor Windows Internet Explorer 8 (KB2598845) (Version: 1)

Update voor Windows Internet Explorer 8 (KB2632503) (Version: 1)

Update voor Windows XP (KB2863058) (Version: 1)

WebFldrs XP (Version: 9.50.6513)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 8 (Version: 20090308.140743)

Windows Media Format 11 runtime

Windows Media Player 11

Windows-stuurprogrammapakket - Nokia Modem  (02/25/2011 4.7) (Version: 02/25/2011 4.7)

Windows-stuurprogrammapakket - Nokia Modem  (02/25/2011 7.01.0.9) (Version: 02/25/2011 7.01.0.9)

Windows-stuurprogrammapakket - Nokia pccsmcfd “LegacyDriver”  (05/31/2012 7.1.2.0) (Version: 05/31/2012 7.1.2.0)

WinPatrol (Version: 25.6.2012.1)

 

==================== Restore Points  =========================

 

04-09-2013 06:34:27 Made by Regsofts

13-09-2013 19:01:34 Revo Uninstaller's restore point - Secunia PSI

13-09-2013 19:15:43 Revo Uninstaller's restore point - iTunes

13-09-2013 19:23:35 Revo Uninstaller's restore point - Bonjour

13-09-2013 19:25:00 Verwijderd: Bonjour

13-09-2013 19:57:32 Revo Uninstaller's restore point - Agics Hashscan 1.9.2.0

13-09-2013 20:13:11 Revo Uninstaller's restore point - Free Window Registry Repair

13-09-2013 21:34:30 Software Distribution Service 3.0

14-09-2013 08:29:26 Software Distribution Service 3.0

14-09-2013 10:01:40 Software Distribution Service 3.0

14-09-2013 16:03:03 Revo Uninstaller's restore point - Microsoft Security Essentials

14-09-2013 16:54:01 Revo Uninstaller's restore point - QuickTime

14-09-2013 17:08:11 Revo Uninstaller's restore point - Nitro Reader 2

14-09-2013 17:10:50 Removed Nitro Reader 2

14-09-2013 17:48:45 Removed Java 7 Update 25

14-09-2013 21:16:34 Revo Uninstaller's restore point - FileHippo.com Update Checker

14-09-2013 21:19:38 Revo Uninstaller's restore point - FileHippo.com Update Checker

 

==================== Hosts content: ==========================

 

2003-07-23 23:07 - 2013-06-27 10:13 - 00000786 ___AC C:\WINDOWS\system32\Drivers\etc\hosts

      127.0.0.1         localhost

 

==================== Scheduled Tasks (whitelisted) =============

 

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\AppleSoftwareUpdate.job => C:\Program Files\Apple Software Update\SoftwareUpdate.exe

Task: C:\WINDOWS\Tasks\ASC6_PerformanceMonitor.job => C:\Program Files\IObit\Advanced SystemCare 6\Monitor.exe

Task: C:\WINDOWS\Tasks\avast! Emergency Update.job => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe

Task: C:\WINDOWS\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe

Task: C:\WINDOWS\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe

Task: C:\WINDOWS\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe

 

==================== Loaded Modules (whitelisted) =============

 

2013-09-24 09:37 - 2013-09-23 22:07 - 02103296 ____C () C:\Program Files\AVAST Software\Avast\defs\13092301\algo.dll

2003-06-02 17:55 - 2003-06-02 17:55 - 00192512 ____C (Lexmark International, Inc.) C:\WINDOWS\system32\LEXLMPM.DLL

2003-06-02 17:57 - 2003-06-02 17:57 - 00147456 ____C (Lexmark International, Inc.) C:\WINDOWS\system32\LexBce.dll

2003-04-30 21:43 - 2003-04-30 21:43 - 00078336 ____C () C:\WINDOWS\System32\spool\PRTPROCS\W32X86\DLBKPP5C.dll

2011-09-09 14:34 - 2007-04-09 13:23 - 00028552 ____C (Microsoft Corporation) C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll

2012-03-19 21:35 - 2008-07-06 14:06 - 00089088 ____C (Microsoft Corporation) C:\WINDOWS\System32\spool\PRTPROCS\W32X86\filterpipelineprintproc.dll

2011-09-18 22:49 - 2002-05-14 16:50 - 00011264 ____C (BVRP Software) C:\WINDOWS\System32\spool\PRTPROCS\W32X86\WfxPrint2000.dll

2003-06-02 20:17 - 2003-06-02 20:17 - 00073728 ____C (Dell Computer Corporation) C:\WINDOWS\system32\DLBKpwr.dll

2003-06-02 17:54 - 2003-06-02 17:54 - 00201216 ____C (Lexmark International, Inc.) C:\WINDOWS\system32\lexp2p32.dll

2003-06-02 18:05 - 2003-06-02 18:05 - 00196096 ____C (Lexmark International, Inc.) C:\WINDOWS\system32\lex2kusb.dll

2003-06-02 17:57 - 2003-06-02 17:57 - 00147456 ____C (Lexmark International, Inc.) C:\WINDOWS\system32\LEXBCE.DLL

2003-07-23 23:10 - 2010-01-29 16:45 - 00307260 ____C (Fraunhofer Institut Integrierte Schaltungen IIS) C:\WINDOWS\System32\l3codeca.acm

 

==================== Alternate Data Streams (whitelisted) =========

 

AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

 

==================== Safe Mode (whitelisted) ===================

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90917403.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\90917403.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

 

==================== Faulty Device Manager Devices =============

 

Name: Synaptics PS/2 Port Pointing Device

Description: Synaptics PS/2 Port Pointing Device

Class Guid: {4D36E96F-E325-11CE-BFC1-08002BE10318}

Manufacturer: Synaptics

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (09/23/2013 09:46:04 PM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/23/2013 03:23:20 PM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/21/2013 10:32:03 AM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/20/2013 09:46:41 AM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/19/2013 04:35:58 PM) (Source: Application Error) (User: )

Description: Vastgelopen toepassing: plugin-container.exe, versie: 24.0.0.5001, vastgelopen module: mozalloc.dll, versie: 24.0.0.5001, vastgelopen op: 0x0000119c.

Verwerken van mediaspecifieke gebeurtenis voor [plugin-container.exe!ws!]

 

Error: (09/19/2013 00:09:32 PM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/18/2013 03:30:41 PM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/17/2013 11:17:29 AM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/16/2013 11:18:34 AM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/15/2013 11:53:00 AM) (Source: COM+) (User: )

Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

 

System errors:

=============

Error: (09/18/2013 03:54:07 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:54:02 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:57 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:57 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:52 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:47 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:47 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:42 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:37 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

Error: (09/18/2013 03:53:36 PM) (Source: DCOM) (User: NT AUTHORITY)

Description: DCOM kreeg foutmelding '%%1058' bij het starten van de ServiceLayer-service met de argumenten ''

om de server

{ACF50018-41F8-476D-85FD-CD953DAE4A49} te starten

 

 

Microsoft Office Sessions:

=========================

Error: (09/23/2013 09:46:04 PM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/23/2013 03:23:20 PM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/21/2013 10:32:03 AM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/20/2013 09:46:41 AM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/19/2013 04:35:58 PM) (Source: Application Error)(User: )

Description: plugin-container.exe24.0.0.5001mozalloc.dll24.0.0.50010000119c

 

Error: (09/19/2013 00:09:32 PM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/18/2013 03:30:41 PM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/17/2013 11:17:29 AM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/16/2013 11:18:34 AM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

Error: (09/15/2013 11:53:00 AM) (Source: COM+)(User: )

Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

 

 

==================== Memory info ===========================

 

Percentage of memory in use: 40%

Total physical RAM: 766.33 MB

Available physical RAM: 452.71 MB

Total Pagefile: 1872.59 MB

Available Pagefile: 1643.25 MB

Total Virtual: 2047.88 MB

Available Virtual: 1948.74 MB

 

==================== Drives ================================

 

Drive c: (planten) (Fixed) (Total:18.78 GB) (Free:4.27 GB) NTFS ==>[Drive with boot components (Windows XP)]

Drive d: (overtollige) (Fixed) (Total:11.71 GB) (Free:6.84 GB) NTFS

Drive e: (tuin & enz) (Fixed) (Total:0.98 GB) (Free:0.11 GB) NTFS

Drive f: (reserve) (Fixed) (Total:0.97 GB) (Free:0.97 GB) NTFS

Drive g: (bloemen ) (Fixed) (Total:17.58 GB) (Free:17.14 GB) NTFS

Drive i: (etc...) (Fixed) (Total:5.85 GB) (Free:5.49 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 56 GB) (Disk ID: 9DC96E9E)

Partition 1: (Not Active) - (Size=8 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=6 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=31 GB) - (Type=OF Extended)

Partition 4: (Active) - (Size=19 GB) - (Type=07 NTFS)

 

==================== End Of Log ============================

 

 

 

 

 

 


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


#9 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,419 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:00 AM

Posted 24 September 2013 - 12:31 PM

Hi Thomas,

We will have to keep an eye on that because it is not related to FRST. We simply ran a scan which does not modify anything.

Please do this.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
SearchScopes: HKLM - DefaultScope value is missing.
AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Farbar's MiniRegTool

--------------------
  • Please download MiniRegTool.zip (for 32 bit systems) or MiniRegTool64.zip (for 64 bit systems) and save it to your desktop
  • Unzip the folder and double click the icon
  • When you run the tool this is what you will see

MiniReg.gif

  • Copy and paste the following into the edit box:

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90917403.sys
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\90917403.sys

  • Check the Export keys radio button.
  • Press the Go button and post the result.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Fixlog
  • MiniRegTool report
  • How is your computer running?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#10 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 25 September 2013 - 01:52 AM

Hi Gary,

 


We will have to keep an eye on that because it is not related to FRST. We simply ran a scan which does not modify anything.

 

 

 

Of course I’ve no doubt about your expertise or the integrity of the program; its just that when I was finished scanning with FRST, then opened Firefox to reply the internet connections were all of a sudden broken (also with google.com & Yahoo.com). I just wanted to let you know what happened... I also had never problems with internet connections before.

 

Another thing happened just a couple of hours ago, and I really don’t know if its related:

 

I opened www.online-tech-tips.com then clicked on this link inside: www.online-tech-tips.com/computer-tips/ott-explains-why-isps-assign-dynamic-vs-static-ip-addresses when all of a sudden the top of the page disappeared except the address bar, followed by the disappearance of the task bar completely. I thought I might had acute infection so I ran quick scan using MBAM and SAS but they both came clean. I verified it with WOT, Virusotal and Dr Web Link Scanner. I then fixed it with Reset in Firefox, after rebooting didn’t help. It really was a dilemma because of the ground rules.

 

 

Besides these 2 issues I didn’t notice any further changes.

 

...

 

I really don’t know what is going on; I was about to reply with the 2 logs you requested, that I already had ready; just to realize that the internet connections were broken again. I hope that I can fix it once more so I can post my reply.

 

...

 

 

Fixlog.txt

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-09-2013

Ran by Eigenaar at 2013-09-25 05:24:34 Run:1

Running from C:\Documents and Settings\Eigenaar\Bureaublad

Boot Mode: Normal

 

==============================================

 

Content of fixlist:

*****************

SearchScopes: HKLM - DefaultScope value is missing.

AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

*****************

 

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

C:\Documents and Settings\All Users\Application Data\TEMP => ":5C321E34" ADS removed successfully.

 

==== End of Fixlog ====

 

 

Result.txt

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90917403.sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\90917403.sys]

@="Driver"

 

 

 

Best Regards,

 

Thomas

 

 


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


#11 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 25 September 2013 - 07:46 AM

Hi Gary,

 

Internet connections broke again after being online for about 2 hours, about the same period when it broke the other times. I’ve no bad feelings about it; other than it is slowing my online activity. Then while I was in the middle of troubleshooting the problem the connection was restored, but before applying what I was working on!    

 

 

Thomas


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,419 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:00 AM

Posted 25 September 2013 - 08:35 AM

Hi Thomas,

Can you tell me if you can successfully boot into Safe Mode and Safe Mode with Networking?

----------
 

I then fixed it with Reset in Firefox, after rebooting didnt help.

Does this mean you attempted to reset settings in Firefox but it didn't fix it? Was that the only time that happened with the screen?

----------
 

Then while I was in the middle of troubleshooting the problem

While troubleshooting were any modifications being made to the system either by you or automatic troubleshooting (like repair connection)? If yes, do you know what was being done, like renewing ip address?

Please do this.

===================================================

Farbar's Service Scanner

--------------------
  • Please download Farbar Service Scanner, save it to your desktop, and run it.
  • Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender
Other Services

  • Press Scan
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.
===================================================

Farbar's MiniToolBox

--------------------
  • Please download MiniToolBox, save it to your desktop
  • Please close any Firefox browsers you may have open
  • Double click the icon to launch the program
  • Make sure the following options are checked:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log

  • Click Go and once the scan is completed a Result.txt Notepad document will open on your desktop
  • Please copy and paste the contents in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Answers to questions
  • FSS log
  • Result log

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#13 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 25 September 2013 - 04:57 PM

Hello Gary,

 

Can you tell me if you can successfully boot into Safe Mode and Safe Mode with Networking?

 

I booted successfully into Safe Mode. I also was able to boot into Safe Mode with networking, but I was not able to browse the web. Then when I rebooted back to Normal Mode the networking connections was good.

 

 

Does this mean you attempted to reset settings in Firefox but it didn't fix it?

 

 

First I rebooted to see if the issue would get corrected after the reboot. But when that didn’t help I opened a second Firefox Tap which opened as a small screen, allowing me to access Firefox top menu bar. I opened View then clicked on Reset via Zoom.

 

 

Was that the only time that happened with the screen?

 

Yes.

 

 

While troubleshooting were any modifications being made to the system either by you or automatic troubleshooting (like repair connection)? If yes, do you know what was being done, like renewing ip address?

 

2 Troubleshooting:

 

1. I reset TCP/IP by running: netsh int ip reset c:\resetlog.txt off the Run Box on Start Menu.

But after rebooting there was no networking; so I went on to another method:

 

2. I was trying to edit the TCP/IP network protocols according to a printed Microsoft material (Q314053) in the following Registry Key:

 

HKLM\System\CurrentControlSet\Services

 

But before I finished I opened Firefox again to see if there is still no internet; but there was and I was able to connect to the web. So I undid the changes I made in the registry and closed it.

 

 

FSS.txt

 

Farbar Service Scanner Version: 13-09-2013

Ran by Eigenaar (administrator) on 25-09-2013 at 22:10:39

Running from "C:\Documents and Settings\Eigenaar\Bureaublad"

Microsoft Windows XP Home Edition Service Pack 3 (X86)

Boot Mode: Normal

****************************************************************

 

Internet Services:

============

Dnscache Service is not running. Checking service configuration:

The start type of Dnscache service is set to Disabled. The default start type is Auto.

The ImagePath of Dnscache service is OK.

The ServiceDll of Dnscache service is OK.

 

 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.

 

 

Windows Firewall:

=============

sharedaccess Service is not running. Checking service configuration:

The start type of sharedaccess service is set to Disabled. The default start type is Auto.

The ImagePath of sharedaccess service is OK.

The ServiceDll of sharedaccess service is OK.

 

 

Firewall Disabled Policy:

==================

 

 

System Restore:

============

 

System Restore Disabled Policy:

========================

 

 

Security Center:

============

 

 

Windows Update:

============

 

Windows Autoupdate Disabled Policy:

============================

 

 

Other Services:

==============

 

 

File Check:

========

C:\WINDOWS\system32\dhcpcsvc.dll

[2003-07-23 23:03] - [2008-04-14 22:32] - 0126976 ____A (Microsoft Corporation) 146AB038F5DBB366122D28444999AB2C

 

C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit

C:\WINDOWS\system32\dnsrslvr.dll

[2003-07-23 23:03] - [2009-04-20 19:22] - 0045568 ___AC (Microsoft Corporation) DE6CDB6CBC5C27B9085CFA6DFE8E5025

 

C:\WINDOWS\system32\ipnathlp.dll

[2003-07-23 23:08] - [2008-04-14 22:32] - 0332288 ____A (Microsoft Corporation) 7579C4BE909D47F10F3D8D801CB13ED9

 

C:\WINDOWS\system32\netman.dll

[2003-07-23 23:16] - [2008-04-14 22:32] - 0198144 ____A (Microsoft Corporation) 5431FB616ECAE0D587C5B97D0B86CBD8

 

C:\WINDOWS\system32\wbem\WMIsvc.dll

[2011-09-09 12:45] - [2008-04-14 22:32] - 0145408 ____A (Microsoft Corporation) F9E105F369C18E4001E0C05AAF600D73

 

C:\WINDOWS\system32\srsvc.dll

[2011-09-09 12:47] - [2008-04-14 22:32] - 0171008 ____A (Microsoft Corporation) 81CBF363C414620CAA61BD6843D8FDB9

 

C:\WINDOWS\system32\Drivers\sr.sys

[2011-09-09 12:47] - [2008-04-14 22:13] - 0073472 ___AC (Microsoft Corporation) 64D2A7640E0767ECD3BCB38D3200E7CE

 

C:\WINDOWS\system32\wscsvc.dll

[2011-09-11 13:55] - [2008-04-14 22:32] - 0080896 ____N (Microsoft Corporation) 843F7FA8EA38E6A4262976DCC994C81A

 

C:\WINDOWS\system32\wbem\WMIsvc.dll

[2011-09-09 12:45] - [2008-04-14 22:32] - 0145408 ____A (Microsoft Corporation) F9E105F369C18E4001E0C05AAF600D73

 

C:\WINDOWS\system32\wuauserv.dll

[2011-09-09 12:45] - [2008-04-14 22:32] - 0006656 ____A (Microsoft Corporation) 1E8FDDDEF3FE260BADAB06DAE10D753A

 

C:\WINDOWS\system32\qmgr.dll

[2011-09-09 12:47] - [2008-04-14 22:32] - 0409088 ___AC (Microsoft Corporation) 5C0073A51C4873430FA8B262E92183FF

 

C:\WINDOWS\system32\es.dll

[2003-07-23 23:05] - [2008-07-07 22:30] - 0253952 ____A (Microsoft Corporation) 97912DC0679D2DA60CCE589BBC196D72

 

C:\WINDOWS\system32\cryptsvc.dll

[2003-07-23 23:02] - [2008-04-14 22:32] - 0062464 ____A (Microsoft Corporation) 0A9CF5D3CF63A8699F28C814EF821C7E

 

C:\WINDOWS\system32\svchost.exe

[2003-07-23 23:25] - [2008-04-14 22:33] - 0014336 ____A (Microsoft Corporation) E410EC73E2BE2A41D923B006F51C8427

 

C:\WINDOWS\system32\rpcss.dll

[2003-07-23 23:21] - [2009-02-09 12:56] - 0401408 ____A (Microsoft Corporation) D9883335CC1C17AFC3A09C8AC3E4DBE4

 

C:\WINDOWS\system32\services.exe

[2003-07-23 23:22] - [2009-02-09 13:27] - 0111104 ____A (Microsoft Corporation) 657B69389B893F440B07590C9E963F23

 

 

Extra List:

=======

aswTdi(10) Gpc(3) IPSec(5) NetBT(6) PSched(7) pwipf6(11) Tcpip(4)

0x0B00000005000000010000000200000003000000040000000A000000090000000600000007000000080000000B000000

IpSec Tag value is correct.

 

**** End of log ****

 

 

 

Result.txt

 

 

MiniToolBox by Farbar  Version: 13-07-2013
Ran by Eigenaar (administrator) on 25-09-2013 at 22:14:06
Running from "C:\Documents and Settings\Eigenaar\Bureaublad"
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================


Windows IP-configuratie



Kan de DNS-omzettingscache niet leegmaken: Functie is mislukt tijdens uitvoering.




========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"network.proxy.no_proxies_on", ""
"network.proxy.socks_version", 4
"network.proxy.type", 0

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================


    
    127.0.0.1        localhost

========================= IP Configuration: ================================

Broadcom 440x 10/100 Integrated Controller = LAN-verbinding (Connected)


# ----------------------------------
# IP-configuratie van interface         
# ----------------------------------
pushd interface ip


# IP-configuratie van interface voor "LAN-verbinding"

set address name="LAN-verbinding" source=dhcp
set dns name="LAN-verbinding" source=dhcp register=PRIMARY
set wins name="LAN-verbinding" source=dhcp


popd
# Einde van IP-configuratie van interface




Windows IP-configuratie



        Host-naam  . . . . . . . . . . . .: creatief

        Primair DNS-achtervoegsel. . . . .:

        Knooppunttype: . . . . . . . . . .: onbekend

        IP-routering ingeschakeld. . . . .: nee

        WINS-proxy ingeschakeld . . . . . : nee



Ethernet-adapter LAN-verbinding:



        Verbindingsspec. DNS-achtervoegsel:

        Beschrijving . . . . . . . . . . .:

          Broadcom 440x 10/100 Integrated Controller

        Fysiek adres. . . . . . . . . . . : 00-0F-1F-14-AB-8F

        DHCP ingeshakeld. . . . . . . . . : ja

        Autom. configuratie ingeschakeld. : ja

        IP-adres. . . . . . . . . . . . . : 192.168.2.100

        Subnetmasker. . . . . . . . . . . : 255.255.255.0

        Standaardgateway. . . . . . . . . : 192.168.2.254

        DHCP-server . . . . . . . . . . . : 192.168.2.254

        DNS-servers . . . . . . . . . . . : 192.168.2.254

        Lease verkregen . . . . . . . . . : woensdag 25 september 2013 20:52:31

        Lease verlopen . . . . . . . . .  : donderdag 26 september 2013 20:52:31

Server:  mijnmodem.kpn
Address:  192.168.2.254

Name:    google.com
Address:  74.125.132.113



Pingen naar google.com [74.125.132.113] met 32 byte gegevens:



Antwoord van 74.125.132.113: bytes=32 tijd=25 ms TTL=50

Antwoord van 74.125.132.113: bytes=32 tijd=25 ms TTL=50



Ping-statistieken voor 74.125.132.113:

    Pakketten: verzonden = 2, ontvangen = 2, verloren = 0

    (0% verlies).De gemiddelde tijd voor het uitvoeren van ‚‚n bewerking in milliseconden:

    Minimum = 25ms, Maximum = 25ms, Gemiddelde = 25ms

Server:  mijnmodem.kpn
Address:  192.168.2.254

Name:    yahoo.com
Address:  98.138.253.109



Pingen naar yahoo.com [98.138.253.109] met 32 byte gegevens:



Antwoord van 98.138.253.109: bytes=32 tijd=218 ms TTL=44

Antwoord van 98.138.253.109: bytes=32 tijd=175 ms TTL=47



Ping-statistieken voor 98.138.253.109:

    Pakketten: verzonden = 2, ontvangen = 2, verloren = 0

    (0% verlies).De gemiddelde tijd voor het uitvoeren van ‚‚n bewerking in milliseconden:

    Minimum = 175ms, Maximum = 218ms, Gemiddelde = 196ms



Pingen naar 127.0.0.1 met 32 byte gegevens:



Antwoord van 127.0.0.1: bytes=32 tijd<1 ms TTL=64

Antwoord van 127.0.0.1: bytes=32 tijd<1 ms TTL=64



Ping-statistieken voor 127.0.0.1:

    Pakketten: verzonden = 2, ontvangen = 2, verloren = 0

    (0% verlies).De gemiddelde tijd voor het uitvoeren van ‚‚n bewerking in milliseconden:

    Minimum = 0ms, Maximum = 0ms, Gemiddelde = 0ms

===========================================================================
Interfacelijst
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0f 1f 14 ab 8f ...... Broadcom 440x 10/100 Integrated Controller - Pakketplanner-minipoort
===========================================================================
===========================================================================
Actieve routes:
Netwerkadres               Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.2.254   192.168.2.100      20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1      1
      192.168.2.0    255.255.255.0    192.168.2.100   192.168.2.100      20
    192.168.2.100  255.255.255.255        127.0.0.1       127.0.0.1      20
    192.168.2.255  255.255.255.255    192.168.2.100   192.168.2.100      20
        224.0.0.0        240.0.0.0    192.168.2.100   192.168.2.100      20
  255.255.255.255  255.255.255.255    192.168.2.100   192.168.2.100      1
Standaard-gateway:     192.168.2.254
===========================================================================
Permanente routes:
  Geen
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\system32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 01 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\system32\mswsock.dll [247296] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (09/25/2013 10:02:59 PM) (Source: Application Error) (User: )
Description: Vastgelopen toepassing: plugin-container.exe, versie: 24.0.0.5001, vastgelopen module: mozalloc.dll, versie: 24.0.0.5001, vastgelopen op: 0x0000119c.
Verwerken van mediaspecifieke gebeurtenis voor [plugin-container.exe!ws!]

Error: (09/25/2013 08:54:14 PM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 00:29:55 PM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 10:26:32 AM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 08:03:21 AM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 06:03:06 AM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/24/2013 06:38:15 PM) (Source: Application Error) (User: )
Description: Vastgelopen toepassing: plugin-container.exe, versie: 24.0.0.5001, vastgelopen module: mozalloc.dll, versie: 24.0.0.5001, vastgelopen op: 0x0000119c.
Verwerken van mediaspecifieke gebeurtenis voor [plugin-container.exe!ws!]

Error: (09/24/2013 02:48:37 PM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/24/2013 01:00:37 PM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/23/2013 09:46:04 PM) (Source: COM+) (User: )
Description: De runtime-omgeving kan niet worden geïnitialiseerd voor transacties die vereist zijn voor de ondersteuning van transactionele onderdelen. Controleer of MS-DTC wordt uitgevoerd.(DtcGetTransactionManagerEx(): hr = 0x8004d01b)


System errors:
=============
Error: (09/25/2013 08:45:02 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de EventSystem-service met de argumenten ''
om de server
{1BE1F766-5536-11D1-B726-00C04FB926AF} te starten

Error: (09/25/2013 08:41:35 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de EventSystem-service met de argumenten ''
om de server
{1BE1F766-5536-11D1-B726-00C04FB926AF} te starten

Error: (09/25/2013 08:41:21 PM) (Source: DCOM) (User: CREATIEF)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de StiSvc-service met de argumenten ''
om de server
{A1F4E726-8CF1-11D1-BF92-0060081ED811} te starten

Error: (09/25/2013 08:41:21 PM) (Source: DCOM) (User: CREATIEF)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de StiSvc-service met de argumenten ''
om de server
{A1F4E726-8CF1-11D1-BF92-0060081ED811} te starten

Error: (09/25/2013 08:30:13 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de EventSystem-service met de argumenten ''
om de server
{1BE1F766-5536-11D1-B726-00C04FB926AF} te starten

Error: (09/25/2013 08:28:30 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de EventSystem-service met de argumenten ''
om de server
{1BE1F766-5536-11D1-B726-00C04FB926AF} te starten

Error: (09/25/2013 08:28:23 PM) (Source: DCOM) (User: CREATIEF)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de StiSvc-service met de argumenten ''
om de server
{A1F4E726-8CF1-11D1-BF92-0060081ED811} te starten

Error: (09/25/2013 08:28:22 PM) (Source: DCOM) (User: CREATIEF)
Description: DCOM kreeg foutmelding '%%1084' bij het starten van de StiSvc-service met de argumenten ''
om de server
{A1F4E726-8CF1-11D1-BF92-0060081ED811} te starten

Error: (09/25/2013 05:47:23 AM) (Source: NetDDE) (User: )
Description: Listen mislukt: 15:

Error: (09/25/2013 05:37:00 AM) (Source: PlugPlayManager) (User: )
Description: Het apparaat WAN-minipoort (IP) - Privacyware Filter Miniport (Root\PWIPF6MP\0001) is uit het systeem verdwenen zonder dat de verwijdering is voorbereid.


Microsoft Office Sessions:
=========================
Error: (09/25/2013 10:02:59 PM) (Source: Application Error)(User: )
Description: plugin-container.exe24.0.0.5001mozalloc.dll24.0.0.50010000119c

Error: (09/25/2013 08:54:14 PM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 00:29:55 PM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 10:26:32 AM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 08:03:21 AM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/25/2013 06:03:06 AM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/24/2013 06:38:15 PM) (Source: Application Error)(User: )
Description: plugin-container.exe24.0.0.5001mozalloc.dll24.0.0.50010000119c

Error: (09/24/2013 02:48:37 PM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/24/2013 01:00:37 PM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (09/23/2013 09:46:04 PM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)


**** End of log ****
 

 

 

 


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone


#14 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,419 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:00 AM

Posted 25 September 2013 - 07:09 PM

Greetings,

If you could refrain from making or attempting to make any modifications unless requested that will help us to work together without confusion.
 

I also dont understand the so many explicit terms next to FF, e.g.:
Regional Municipality of Peel, Canada true

Do you recognize any of those entries as being ones you added?


Please do this for me.

===================================================

Farbar's MiniRegTool

--------------------
  • Please launch MiniRegTool
  • Copy and paste the following into the edit box:

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90917403.sys
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\90917403.sys

  • Check the Delete Keys/Values including Locked/Null embedded radio button.
  • Press the Go button and post the result.
===================================================

Services Repair

----------
  • Please download ServicesRepair and save it to your desktop.
  • Double-click ServicesRepair.exe
  • Click Run and then click Yes on any security notifications that appear
  • Click Yes to restart your computer
  • Double click on the CCSupport folder on your desktop, double click the Logs folder, then copy and paste the log in your reply
  • Reboot your computer once more then run Farbar Service Scanner and post the results
===================================================

Please boot into Safe Mode with Networking and tell me if you can get online.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • MiniRegTool log
  • Services Repair log
  • FSS log
  • Internet behavior including Safe Mode

Edited by Oh My, 26 September 2013 - 06:21 PM.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#15 SpyCatcher*

SpyCatcher*
  • Topic Starter

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:hi
  • Local time:04:00 PM

Posted 26 September 2013 - 05:04 PM

Hi Gary,

 

 

 

If you could refrain from making or attempting to make any modifications unless requested that will help us to work together without confusion.

 

I do understand your concern, but as I said in an earlier post it was a dilemma. However with a broken network connection I wouldn’t be able to connect to you for further help.

 

 

 

Do you recognize any of those entries as being ones you added?

 

 

Why should I be adding things like that!? Could you please clarify your question?

 

 

 

Please download ServicesRepair

 

 

Link is not working. When I click on it I get this message:

 

The requested resource (/library/ESET/KB) is not available.

 

 

 

 

Please launch MiniRegTool

 

 

 

There is no link.

 

 

Internet is working.


in the middle of the night

i found my self awake

floating in a void

i was so happy

and realized was not alone





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users