ComboFix 09-01-21.04 - Greg Masie 2009-01-25 15:33:12.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.400 [GMT -7:00] Running from: c:\documents and settings\Greg Masie\My Documents\Downloads\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Greg Masie\Start Menu\Programs\System Security c:\windows\IE4 Error Log.txt c:\windows\system32\bbfaeededfbfcddc.dll c:\windows\system32\ntnet.drv c:\windows\system32\sysaudio.sys c:\windows\system32\vumer.dll c:\windows\system32\wdmaud.sys . ((((((((((((((((((((((((( Files Created from 2008-12-25 to 2009-01-25 ))))))))))))))))))))))))))))))) . 2009-01-25 14:46 . 2009-01-25 14:49 250 --a------ c:\windows\gmer.ini 2009-01-25 13:36 . 2009-01-25 13:36 d-------- c:\windows\LastGood.Tmp 2009-01-25 12:31 . 2009-01-25 12:31 d-------- c:\program files\Trend Micro 2009-01-21 18:46 . 2009-01-21 18:46 d-------- C:\VundoFix Backups 2009-01-21 17:58 . 2009-01-25 13:30 d-------- c:\program files\Spybot - Search & Destroy 2009-01-21 17:58 . 2009-01-25 13:30 d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-20 20:41 . 2009-01-20 20:41 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-01-20 20:40 . 2009-01-20 20:40 d-------- c:\program files\Java 2009-01-20 20:40 . 2009-01-20 20:40 0 --a------ c:\windows\system32\REN71.tmp 2009-01-20 20:40 . 2009-01-20 20:40 0 --a------ c:\windows\system32\REN70.tmp 2009-01-20 20:40 . 2009-01-20 20:40 0 --a------ c:\windows\system32\REN6F.tmp 2009-01-20 20:32 . 2009-01-20 20:38 d-------- c:\documents and settings\Greg Masie\.SunDownloadManager 2009-01-20 18:10 . 2009-01-25 13:24 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-20 18:10 . 2009-01-20 18:10 d-------- c:\documents and settings\Greg Masie\Application Data\Malwarebytes 2009-01-20 18:10 . 2009-01-20 18:10 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-14 18:19 . 2009-01-14 18:19 d-------- c:\windows\ie8updates 2009-01-12 20:55 . 2009-01-12 20:55 d--hs---- c:\documents and settings\Greg Masie\PrivacIE 2009-01-12 20:45 . 2009-01-12 20:47 d--h-c--- c:\windows\ie8 2009-01-12 20:13 . 2009-01-20 20:41 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-30 10:48 . 2009-01-21 18:00 d-------- c:\program files\Norton Security Scan 2008-12-29 18:35 . 2008-12-29 18:43 d-------- c:\windows\system32\Adobe 2008-12-29 12:41 . 2008-12-29 12:42 d-------- c:\program files\iTunes 2008-12-29 12:41 . 2008-12-29 12:41 d-------- c:\program files\iPod 2008-12-29 12:41 . 2008-12-29 12:42 d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-29 12:38 . 2008-12-29 12:39 d-------- c:\program files\QuickTime . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-25 22:35 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-25 20:37 --------- d-----w c:\documents and settings\Greg Masie\Application Data\OpenOffice.org2 2009-01-25 20:32 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-25 20:20 --------- d-----w c:\program files\Hewlett-Packard 2009-01-11 19:17 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF 2009-01-11 19:17 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS 2009-01-11 19:17 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT 2009-01-11 19:17 --------- d-----w c:\program files\Symantec 2009-01-07 03:14 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2008-12-29 23:59 --------- d-----w c:\program files\PokerStars 2008-12-29 19:41 --------- d-----w c:\program files\Common Files\Apple 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-10 18:05 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-12-05 00:44 --------- d-----w c:\documents and settings\Greg Masie\Application Data\Move Networks 2007-08-30 16:15 0 ----a-w c:\documents and settings\Greg Masie\Application Data\wklnhst.dat 2006-09-21 02:01 90,112 ----a-w c:\documents and settings\Greg Masie\IDHWTSS1.dll 2006-09-21 02:01 81,920 ----a-w c:\documents and settings\Greg Masie\hobjni.dll 2006-09-08 02:29 36,868 ----a-w c:\documents and settings\Greg Masie\PrtDLL.dll 2008-09-03 01:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090220080903\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "Google Update"="c:\documents and settings\Greg Masie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-29 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-11-23 163840] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054] "hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528] "Home Theater SchSvr"="c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2004-11-02 106496] "WINREMOTE"="c:\program files\InterVideo\Common\Bin\WinRemote.exe" [2004-11-02 233472] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-01 53248] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-06 718704] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 172032] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 49152] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-20 136600] "AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 c:\windows\AGRSMMSG.exe] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 c:\windows\system32\bthprops.cpl] c:\documents and settings\Greg Masie\Start Menu\Programs\Startup\ OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-06-08 169472] Windows Desktop Search.lnk - c:\program files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\en-us\bin\WindowsSearch.exe [2005-09-20 18:10:04 238080] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"= wdmaud.sys [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R1 eabfiltr;EABFiltr;c:\windows\system32\drivers\eabfiltr.sys [2005-01-25 7432] R1 eeCtrl;Symantec Eraser Control driver;c:\program files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-03-17 371248] R1 SPBBCDrv;SPBBCDrv;c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2008-01-16 447024] R1 SRTSPX;SRTSPX;c:\windows\system32\drivers\srtspx.sys [2008-01-31 43696] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;c:\windows\system32\drivers\wmiacpi.sys [2004-08-03 8832] R3 aeaudio;aeaudio;c:\windows\system32\drivers\aeaudio.sys [2004-10-06 129280] R3 ApfiltrService;Alps Pointing-device Filter Driver;c:\windows\system32\drivers\Apfiltr.sys [2005-01-25 105831] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-02 99376] R3 hpqwmi;HP WMI Interface;c:\program files\HPQ\Shared\hpqwmi.exe [2005-01-25 98304] R3 Iviaspi;IVI ASPI Shell;c:\windows\system32\drivers\iviaspi.sys [2005-05-15 10752] R3 MxlW2k;MxlW2k;c:\windows\system32\drivers\MxlW2k.sys [2005-06-08 28256] R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver;c:\windows\system32\drivers\Rtlnicxp.sys [2004-06-28 69760] R3 sdbus;sdbus;c:\windows\system32\drivers\sdbus.sys [2004-08-04 79232] R3 senfilt;senfilt;c:\windows\system32\drivers\senfilt.sys [2004-04-26 381056] R3 smwdm;smwdm;c:\windows\system32\drivers\smwdm.sys [2004-09-01 259648] R3 SRTSP;SRTSP;c:\windows\system32\drivers\srtsp.sys [2008-01-31 279088] R3 SymIMMP;SymIMMP;c:\windows\system32\drivers\SymIM.sys [2008-02-06 31280] R3 SYMNDIS;SYMNDIS;c:\windows\system32\drivers\symndis.sys [2008-06-13 37424] R3 tifm21;tifm21;c:\windows\system32\drivers\tifm21.sys [2005-01-25 147840] R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP;c:\windows\system32\drivers\w29n51.sys [2004-09-20 3210496] R4 Apple Mobile Device;Apple Mobile Device;c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424] R4 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2008-02-09 238968] R4 BthServ;Bluetooth Support Service;c:\windows\system32\svchost.exe -k bthsvcs [2004-08-04 14336] R4 CLTNetCnService;Symantec Lic NetConnect service;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352] R4 JavaQuickStarterService;Java Quick Starter;c:\program files\Java\jre6\bin\jqs.exe [2009-01-20 152984] R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352] S0 2201ced6d30a29e038061eb6d9f15452;2201ced6d30a29e038061eb6d9f15452;c:\windows\system32\2201ced6d30a29e038061eb6d9f15452.sys --> c:\windows\system32\2201ced6d30a29e038061eb6d9f15452.sys [?] S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA;c:\windows\system32\drivers\tosrfcom.sys [2005-08-01 64896] S3 BthEnum;Bluetooth Enumerator Service;c:\windows\system32\drivers\bthenum.sys [2006-08-06 17024] S3 BTHPORT;Bluetooth Port Driver;c:\windows\system32\drivers\bthport.sys [2006-08-06 272128] S3 BTHUSB;Bluetooth Radio USB Driver;c:\windows\system32\drivers\bthusb.sys [2006-08-06 18944] S3 BVRPMPR5;BVRPMPR5 NDIS Protocol Driver;\??\d:\instal~e\Core\BVRPMPR5.SYS --> d:\instal~e\Core\BVRPMPR5.SYS [?] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888] S3 comHost;COM Host;c:\program files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-08-22 55640] S3 eabusb;eabusb;c:\windows\system32\drivers\EabUsb.sys [2005-01-25 5220] S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?] S3 MidiSyn;MidiSyn;c:\windows\system32\drivers\MidiSyn.sys --> c:\windows\system32\drivers\MidiSyn.sys [?] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;c:\windows\system32\nsndis5.sys [2004-03-23 17280] S3 odserv;Microsoft Office Diagnostics Service;c:\program files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776] S3 Rasirda;WAN Miniport (IrDA);c:\windows\system32\drivers\rasirda.sys [2001-08-17 19584] S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI);c:\windows\system32\drivers\rfcomm.sys [2006-08-06 59136] S3 SMCIRDA;SMC IrCC Miniport Device Driver;c:\windows\system32\drivers\smcirda.sys [2001-08-17 35913] S3 SRTSPL;SRTSPL;c:\windows\system32\drivers\srtspl.sys [2008-01-31 317616] S3 SymIM;Symantec Network Security Intermediate Filter Service;c:\windows\system32\drivers\SymIM.sys [2008-02-06 31280] S3 toshidpt;TOSHIBA Bluetooth HID port driver;c:\windows\system32\drivers\toshidpt.sys [2005-07-11 3712] S3 tosporte;Bluetooth Port Driver from Toshiba;c:\windows\system32\drivers\tosporte.sys [2005-11-24 47104] S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA;c:\windows\system32\drivers\tosrfbd.sys [2005-11-22 108800] S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA;c:\windows\system32\drivers\tosrfbnp.sys [2005-09-15 36480] S3 Tosrfhid;Bluetooth RFHID from TOSHIBA;c:\windows\system32\drivers\tosrfhid.sys [2005-12-01 62848] S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA;c:\windows\system32\drivers\tosrfnds.sys [2005-01-06 18612] S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA;c:\windows\system32\drivers\tosrfsnd.sys [2005-11-11 52864] S3 Tosrfusb;Bluetooth USB Controller;c:\windows\system32\drivers\tosrfusb.sys [2005-11-15 36736] S3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl.sys [2008-07-24 32000] S3 usbbus;LGE CDMA Composite USB Device;c:\windows\system32\drivers\lgusbbus.sys [2008-08-12 12672] S3 UsbDiag;LGE CDMA USB Serial Port;c:\windows\system32\drivers\lgusbdiag.sys [2008-08-12 21248] S3 USBModem;LGE CDMA USB Modem;c:\windows\system32\drivers\lgusbmodem.sys [2008-08-12 22912] S3 WpdUsb;WpdUsb;c:\windows\system32\drivers\wpdusb.sys [2006-10-18 38528] S4 MCSTRM;MCSTRM; [x] S4 pciinfo;HP Pci Information;\??\c:\docume~1\GREGMA~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys --> c:\docume~1\GREGMA~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys [?] --- Other Services/Drivers In Memory --- *NewlyCreated* - COMHOST [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5aa3dbcb-5587-11dc-9aef-0012f035d7d0}] \Shell\AutoRun\command - E:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2008-10-12 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-01-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4175463211-170456199-81732586-1006.job - c:\documents and settings\Greg Masie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-29 17:01] 2009-01-20 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Greg Masie.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 07:05] 2009-01-22 c:\windows\Tasks\Norton Security Scan for Greg Masie.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18] . - - - - ORPHANS REMOVED - - - - BHO-{2502BBD0-D73B-11DD-B4EC-CEBF56D89593} - (no file) WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) HKLM-Run-ChangeResolution - c:\hp\bin\ChangeResolution.exe HKLM-Run-1640814211 - c:\documents and settings\All Users\Application Data\1260062919\1640814211.exe . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local IE: &MSN Search - c:\program files\MSN Toolbar Suite\TB\[u]0[/u]2.05.0001.1119\en-us\msntb.dll/search.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-25 15:38:27 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????j?P??|?????? ???B???????????????B? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(1612) c:\program files\Logitech\MouseWare\System\LgWndHk.dll c:\windows\system32\ieframe.dll c:\progra~1\WINDOW~1\wmpband.dll c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Canon\CAL\CALMAIN.exe c:\program files\Apoint2K\ApntEx.exe c:\windows\system32\rundll32.exe c:\program files\Logitech\MouseWare\system\EM_EXEC.EXE c:\program files\OpenOffice.org 2.4\program\soffice.exe c:\program files\iPod\bin\iPodService.exe c:\program files\OpenOffice.org 2.4\program\soffice.bin c:\program files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\en-us\bin\WindowsSearchIndexer.exe c:\program files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\en-us\bin\WindowsSearchFilter.exe c:\windows\system32\imapi.exe . ************************************************************************** . Completion time: 2009-01-25 15:45:57 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-25 22:45:43 Pre-Run: 66,915,495,936 bytes free Post-Run: 67,004,018,688 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 262 --- E O F --- 2009-01-15 01:20:42