Greetings. Avira (which I love dearly) has detected the TR/Dropper.Gen virus on my brand new Dell desktop computer. So sad.
Sure enough, the virus is messing with my homepage and not letting me access it even though I have cleared the cache/history/temp files in IE to see if it was hidden there. No luck. So, I am turning to you for help. I've been here before and know how the routine works. Below are my files and logs.
I can access the homepage if I google it first, so I know it isn't a problem with the website or the Internet. Plus, all my other IE websites and bookmarked sites work just fine. The virus seems to be messing with just my homepage. I noticed when running GMER that it
immediately picked up on a virus (or something problematic looking) in red under a system IE file. So I am guessing that's where the problem is.
Oh, and I had the free trial of McAfee as my old antivirus since it came with the desktop but I didn't remove it completely; I hope it didn't interfere iwth any scans. I saw it showed up in one of the logs because of course I haven't uninstalled it yet....I hope this is ok. As I said, Avira is my go-to program (SuprantiSpyware is also...which you can also see) but it was NOT running at the time of the scans.
Also, when running the GMER Rootkit Scan, I got the following pop-up when it was done: "Warning: GMER has found system modification caused by rootkit activity." There was an "ok" button to push and nothing else so I clicked it to exit out of that and was able to save the file. I read about Rootkit warnings from GMER here:
NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help
...but the pop-up I saw seemed different than that. Anyway, I clicked "ok" to close it? GMER scanned for about 20 minutes which seems sort of short to me (compared to last time I visited here, for virus help on my laptop, GMER took 2 hours!)....I've attached it anyway. I had the same pop-up message from GMER after I used it to help fix my laptop from my previous visit to this forum for help.
Java updates should be ok since the system is pretty new - that was an issue for me last time in here. Hope you can help, and thanks!
_________________________________________________________________
DDS (Ver_09-06-26.01) - NTFSx86
Run by Vanessa at 1:41:13.06 on Wed 07/01/2009
Internet Explorer: 8.0.6001.18783
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3325.2264 [GMT -7:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Dell Remote Access\ezi_ra.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Dell\apache\bin\httpd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe
C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe
c:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
C:\Program Files\Common Files\Dell\apache\bin\httpd.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\system32\regsvr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Vanessa\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://cgumail.cgu.edu/
uWindow Title = Internet Explorer provided by Dell
uInternet Settings,ProxyServer = ftp=127.0.0.1:9050;http=127.0.0.1:9050;https=127.0.0.1:9050
BHO: precisead search enhancer: {0b5b5ca3-3bec-e287-841a-52b690c5641a} - c:\windows\system32\drsqpwimruypmc.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: precisead browser enhancer: {8415b27c-0bd3-dcf3-6c9b-354472fd2f31} - c:\windows\system32\hokfklenusuebapl.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: precisead: {a09d0f21-af0a-aba8-16d7-6b8ffabcb6a0} - c:\windows\system32\nsxE4D8.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
EB: Search panel: {0fdf5e53-d06b-0726-7969-37193b59f953} - c:\windows\system32\drsqpwimruypmc.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Vidalia] "c:\program files\vidalia bundle\vidalia\vidalia.exe"
uRunOnce: [DeleteGrabPro] rundll32.exe advpack.dll,DelNodeRunDLL32 "c:\program files\orbitdownloader\GrabPro.dll"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [Dell DataSafe Online] "c:\program files\dell datasafe online\DataSafeOnline.exe" /m
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [iztcfgmowgboporyl] c:\windows\system32\regsvr32.exe /s "c:\windows\system32\hokfklenusuebapl.dll"
StartupFolder: c:\users\vanessa\appdata\roaming\micros~1\windows\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\dellre~1.lnk - c:\windows\installer\{f66a31d9-7831-4fba-ba02-c411c0047cc5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\privoxy.lnk - c:\program files\privoxy\privoxy.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
============= SERVICES / DRIVERS ===============
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-2-17 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-2-17 55024]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\avira\antivir desktop\avmailc.exe [2009-4-19 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-4-19 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\avira\antivir desktop\avwebgrd.exe [2009-4-19 432897]
R2 Apache2.2;Remote Access Media Server;c:\program files\common files\dell\apache\bin\httpd.exe [2007-9-21 15872]
R2 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-4-29 464264]
R2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-4-29 234888]
R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-9-23 155648]
R2 dsl-db;Remote Access DB;c:\program files\common files\dell\mysql\bin\mysqld.exe [2007-9-14 5730304]
R2 dsl-fs-sync;Remote Access File Sync Service;c:\program files\common files\dell\remote access file sync service\dsl_fs_sync.exe [2009-1-5 173296]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-2-17 7408]
=============== Created Last 30 ================
2009-06-30 15:29 <DIR> --d----- c:\users\vanessa\appdata\roaming\GrabPro
2009-06-30 15:29 <DIR> --d----- C:\downloads
2009-06-30 15:29 <DIR> --d----- c:\program files\Orbitdownloader
2009-06-30 15:01 60,026 a------- c:\windows\system32\drsqpwimruypmc.dll-uninst.exe
2009-06-30 15:00 85,733 a------- c:\windows\system32\49d4d15b-b73e-d8c8-ebb2-bed655e9c1cf.exe
2009-06-30 14:59 48,273 a------- c:\windows\system32\kxzubfhuxew.exe
2009-06-30 14:34 237,568 a------- c:\windows\system32\rmc_rtspdl.dll
2009-06-30 14:34 156,672 a------- c:\windows\system32\rmc_fixasf.exe
2009-06-30 14:33 323,584 a------- c:\windows\system32\AUDIOGENIE2.DLL
2009-06-30 14:33 <DIR> --d----- c:\windows\Replay Media Catcher
2009-06-30 14:33 <DIR> --d----- c:\program files\Replay Media Catcher
2009-06-29 17:11 <DIR> --d----- c:\users\vanessa\appdata\roaming\Avira
2009-06-28 13:34 <DIR> --d----- c:\programdata\Google
2009-06-18 09:44 376 a------- c:\windows\ODBC.INI
2009-06-16 08:10 <DIR> --d----- c:\program files\iPod
2009-06-16 08:10 <DIR> --d----- c:\program files\iTunes
2009-06-16 06:15 428,544 a------- c:\windows\system32\EncDec.dll
2009-06-16 06:15 293,376 a------- c:\windows\system32\psisdecd.dll
2009-06-16 06:15 217,088 a------- c:\windows\system32\psisrndr.ax
2009-06-16 06:15 177,664 a------- c:\windows\system32\mpg2splt.ax
2009-06-16 06:15 80,896 a------- c:\windows\system32\MSNP.ax
2009-06-16 06:15 69,632 a------- c:\windows\system32\Mpeg2Data.ax
2009-06-16 06:15 57,856 a------- c:\windows\system32\MSDvbNP.ax
2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-06-05 11:42 39,424 a------- c:\windows\system32\drivers\usbaapl.sys
==================== Find3M ====================
2009-07-01 01:24 8,736 a------- c:\users\vanessa\appdata\roaming\wklnhst.dat
2009-06-16 08:07 143,360 a------- c:\windows\inf\infstrng.dat
2009-06-16 08:07 86,016 a------- c:\windows\inf\infstor.dat
2009-06-16 08:07 51,200 a------- c:\windows\inf\infpub.dat
2009-05-08 22:50 915,456 a------- c:\windows\system32\wininet.dll
2009-05-08 22:34 71,680 a------- c:\windows\system32\iesetup.dll
2009-05-06 02:31 563,200 a------- c:\windows\system32\drsqpwimruypmc.dll
2009-05-06 02:31 563,200 a------- c:\windows\system32\_drsqpwimruypmc.dll
2009-05-05 01:04 480,256 a------- c:\windows\system32\hokfklenusuebapl.dll
2009-05-05 01:04 480,256 a------- c:\windows\system32\_hokfklenusuebapl.dll
2009-04-24 19:20 56 a---h--- c:\programdata\ezsidmv.dat
2009-04-24 19:20 56 a---h--- c:\progra~2\ezsidmv.dat
2009-04-23 05:43 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-04-23 05:42 636,928 a------- c:\windows\system32\localspl.dll
2009-04-21 04:55 2,033,152 a------- c:\windows\system32\win32k.sys
2009-04-14 04:16 665,600 a------- c:\windows\inf\drvindex.dat
2009-04-14 04:15 26,112 a------- c:\windows\system32\hidserv.dll
2009-04-14 04:15 22,016 a------- c:\windows\system32\hid.dll
2009-04-14 04:15 1,191,936 a------- c:\windows\system32\msxml3.dll
2009-04-14 04:13 565,248 a------- c:\windows\system32\emdmgmt.dll
2009-04-14 04:13 36,864 a------- c:\windows\system32\cdd.dll
2009-04-14 04:13 45,056 a------- c:\windows\system32\dataclen.dll
2009-04-14 04:13 1,645,568 a------- c:\windows\system32\connect.dll
2009-04-14 04:12 296,960 a------- c:\windows\system32\gdi32.dll
2009-04-14 04:12 2,927,104 a------- c:\windows\explorer.exe
2009-04-14 04:11 738,304 a------- c:\windows\system32\inetcomm.dll
2009-04-14 04:11 269,312 a------- c:\windows\system32\es.dll
2009-04-14 04:08 2,048 a------- c:\windows\system32\tzres.dll
2009-04-14 04:08 361,984 a------- c:\windows\system32\IPSECSVC.DLL
2009-04-14 04:06 303,616 a------- c:\windows\system32\wmpeffects.dll
2009-04-14 04:05 885,248 a------- c:\windows\system32\RacEngn.dll
2009-04-14 04:05 1,314,816 a------- c:\windows\system32\quartz.dll
2009-04-14 04:04 712,704 a------- c:\windows\system32\WindowsCodecs.dll
2009-04-14 04:04 425,472 a------- c:\windows\system32\PhotoMetadataHandler.dll
2009-04-14 04:04 347,648 a------- c:\windows\system32\WindowsCodecsExt.dll
2009-04-14 04:03 12,240,896 a------- c:\windows\system32\NlsLexicons0007.dll
2009-04-14 04:03 2,644,480 a------- c:\windows\system32\NlsLexicons0009.dll
2009-04-14 04:03 801,280 a------- c:\windows\system32\NaturalLanguage6.dll
2009-04-14 04:01 443,392 a------- c:\windows\system32\win32spl.dll
2009-04-14 04:01 15,360 a------- c:\windows\system32\pacerprf.dll
2009-04-14 04:00 988,216 a------- c:\windows\system32\winload.exe
2009-04-14 04:00 927,288 a------- c:\windows\system32\winresume.exe
2009-04-14 04:00 378,368 a------- c:\windows\system32\srcore.dll
2009-04-14 04:00 318,464 a------- c:\windows\system32\rstrui.exe
2009-04-14 04:00 40,960 a------- c:\windows\system32\srclient.dll
2009-04-14 04:00 14,848 a------- c:\windows\system32\srdelayed.exe
2009-04-14 04:00 6,656 a------- c:\windows\system32\kbd106n.dll
2009-04-14 04:00 615,992 a------- c:\windows\system32\ci.dll
2009-04-14 04:00 46,592 a------- c:\windows\system32\setbcdlocale.dll
2009-04-14 04:00 19,000 a------- c:\windows\system32\kd1394.dll
2009-04-14 03:59 1,334,272 a------- c:\windows\system32\msxml6.dll
2009-04-14 03:59 2,868,736 a------- c:\windows\system32\mf.dll
2009-04-14 03:59 996,352 a------- c:\windows\system32\WMNetMgr.dll
2009-04-14 03:59 94,720 a------- c:\windows\system32\logagent.exe
2009-04-14 03:59 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-04-14 03:59 2,154,496 a------- c:\windows\apppatch\AcGenral.dll
2009-04-14 03:59 1,695,744 a------- c:\windows\system32\gameux.dll
2009-04-14 03:59 541,696 a------- c:\windows\apppatch\AcLayers.dll
2009-04-14 03:59 460,288 a------- c:\windows\apppatch\AcSpecfc.dll
2009-04-14 03:59 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-04-14 03:59 52,736 a------- c:\windows\apppatch\iebrshim.dll
2009-04-14 03:59 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-04-14 03:57 408,064 a------- c:\windows\system32\msinfo32.exe
2009-04-14 03:57 15,872 a------- c:\windows\system32\hcrstco.dll
2009-04-14 03:57 8,704 a------- c:\windows\system32\hccoin.dll
2009-04-14 03:57 2,560 a------- c:\windows\apppatch\AcRes.dll
2009-04-14 03:57 246,840 a------- c:\windows\system32\clfs.sys
2009-04-14 03:57 320,512 a------- c:\windows\system32\imapi2.dll
2009-04-14 03:57 1,312,256 a------- c:\windows\system32\WMALFXGFXDSP.dll
2009-04-14 03:57 338,944 a------- c:\windows\system32\SysFxUI.dll
2009-04-14 03:56 177,208 a------- c:\windows\system32\halmacpi.dll
2009-04-14 03:56 141,880 a------- c:\windows\system32\halacpi.dll
2009-04-14 01:32 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-10 02:58 711,680 a------- c:\windows\system32\nsxE4D8.dll
2008-01-20 19:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 1:41:48.40 ===============