ComboFix 09-04-20.A0 - Owner 04/20/2009 7:16.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.223 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090419-0] *On-access scanning disabled* (Updated) FW: Defender Pro Firewall *disabled* * Created a new restore point . [i] ADS - svchost.exe: deleted 68 bytes in 1 streams. [/i] [i] ADS - explorer.exe: deleted 100 bytes in 1 streams. [/i] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\windows\Downloaded Program Files\ODCTOOLS c:\windows\syssvc.exe c:\windows\system32\ahaditam.ini c:\windows\system32\drivers\npf.sys c:\windows\system32\ICON.ico c:\windows\system32\Packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\WanPacket.dll c:\windows\system32\wpcap.dll ----- BITS: Possible infected sites ----- hxxp://bondsoul.com . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF -------\Service_NPF ((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 ))))))))))))))))))))))))))))))) . 2009-04-08 03:40 . 2009-04-08 03:40 113120 ----a-w C:\regbackup.reg 2009-04-03 20:47 . 2009-04-03 20:47 25740144 ----a-w C:\wmp11-windowsxp-x86-enu.exe 2009-04-01 09:35 . 2009-04-01 09:35 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\wlvsouqo 2009-04-01 09:35 . 2009-04-01 09:35 -------- d-----w c:\documents and settings\Owner\Application Data\wlvsouqo 2009-04-01 09:33 . 2009-04-01 09:33 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\wlvsouqo 2009-04-01 09:33 . 2009-04-01 09:33 -------- d-----w c:\documents and settings\NetworkService\Application Data\wlvsouqo 2009-04-01 03:11 . 2009-04-01 03:11 -------- d-----w c:\program files\Trend Micro 2009-03-30 00:13 . 2009-03-30 00:13 -------- d-----w c:\documents and settings\Owner\LocalLow 2009-03-30 00:13 . 2009-03-30 00:13 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\TVU Networks 2009-03-30 00:13 . 2009-03-30 00:13 -------- d-----w c:\documents and settings\All Users\Application Data\TVU Networks 2009-03-30 00:09 . 2009-03-30 01:26 -------- d-----w c:\documents and settings\Owner\Application Data\Winamp 2009-03-29 23:47 . 2009-04-01 05:34 -------- d-----w c:\documents and settings\Owner\Application Data\mp3rocket 2009-03-29 23:47 . 2009-03-29 23:48 -------- d-----w c:\program files\MP3 Rocket 2009-03-29 23:47 . 2009-03-30 00:10 -------- d-----w c:\program files\AskBarDis 2009-03-29 23:23 . 2009-03-29 23:36 -------- d-----w c:\program files\GRETECH 2009-03-29 23:15 . 2009-03-29 23:16 -------- d-----w c:\program files\Paint.NET 2009-03-29 23:15 . 2009-03-29 23:20 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Paint.NET 2009-03-26 16:07 . 2009-03-26 16:07 59904 ----a-w c:\windows\system32\zlib1.dll 2009-03-26 16:03 . 2009-03-26 16:03 286720 ----a-w c:\windows\system32\libcurl.dll 2009-03-26 16:03 . 2009-03-26 16:03 143360 ----a-w c:\windows\system32\libexpatw.dll 2009-03-25 04:54 . 2009-03-25 04:54 -------- d-----w c:\documents and settings\Administrator\Application Data\PC Tools 2009-03-25 04:52 . 2009-03-25 04:52 -------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2009-03-25 04:18 . 2009-03-25 05:54 -------- d-----w C:\HostsXpert 2009-03-24 07:48 . 2009-04-11 13:33 54156 ---ha-w c:\windows\QTFont.qfn 2009-03-24 07:48 . 2009-03-24 07:48 1409 ----a-w c:\windows\QTFont.for 2009-03-24 05:26 . 2009-03-24 05:26 -------- d-----w c:\program files\Common Files\PC Tools . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-20 12:08 . 2009-03-03 13:53 -------- d-----w c:\program files\Vuze 2009-04-20 11:55 . 2005-03-26 17:29 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-04-20 11:55 . 2005-03-26 17:29 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-20 11:55 . 2004-09-03 01:07 -------- d-----w c:\program files\Kazaa Lite K++ 2009-04-15 05:15 . 2008-09-28 23:17 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-13 21:01 . 2009-01-13 21:00 69632 --sha-w c:\windows\system32\dowurumi.dll 2009-04-11 16:56 . 2009-03-03 13:54 -------- d-----w c:\documents and settings\Owner\Application Data\Azureus 2009-04-11 15:29 . 2009-01-11 15:28 62464 --sha-w c:\windows\system32\mibevilo.exe 2009-04-06 20:32 . 2008-09-28 23:17 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 20:32 . 2008-09-28 23:17 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-02 05:20 . 2008-07-15 18:23 -------- d-----w c:\program files\Coupons 2009-04-01 10:24 . 2009-03-19 03:46 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools 2009-04-01 09:29 . 2002-02-15 16:51 -------- d-----w c:\program files\Common Files\Mozilla Shared 2009-04-01 09:19 . 2008-11-26 08:45 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-03-30 00:14 . 2009-02-26 07:32 3532 ----a-w C:\drmHeader.bin 2009-03-30 00:08 . 2009-01-21 17:08 -------- d-----w c:\documents and settings\Owner\Application Data\Move Networks 2009-03-27 19:22 . 2008-11-26 19:04 -------- d-----w c:\program files\SUPERAntiSpyware 2009-03-26 16:03 . 2003-01-08 20:15 196608 ----a-w c:\windows\system32\ssleay32.dll 2009-03-26 16:03 . 2003-01-08 20:15 1028096 ----a-w c:\windows\system32\libeay32.dll 2009-03-25 05:02 . 2009-01-17 02:36 -------- d-----w c:\documents and settings\All Users\Application Data\eFax Messenger 4.4 Setup 2009-03-24 06:50 . 2005-03-01 01:47 -------- d-----w c:\program files\ActMon-Password-Recovery 2009-03-24 06:30 . 2005-03-03 06:47 -------- d-----w c:\program files\Ethereal 2009-03-24 04:33 . 2009-03-16 19:00 -------- d-----w c:\program files\Wordster 2009-03-14 20:38 . 2009-01-05 13:04 -------- d-----w c:\documents and settings\Owner\Application Data\foobar2000 2009-03-14 17:10 . 2009-03-14 17:10 -------- d-----w c:\documents and settings\Owner\Application Data\SanDisk 2009-03-13 18:19 . 2009-03-13 18:18 -------- d-----w c:\program files\Rhapsody 2009-03-13 18:19 . 2002-02-15 18:15 -------- d-----w c:\program files\Real 2009-03-11 19:44 . 2009-03-11 19:44 -------- d-----w c:\documents and settings\All Users\Application Data\2B177 2009-03-04 01:50 . 2009-03-04 01:50 -------- d-----w c:\program files\PixiePack Codec Pack 2009-03-04 01:48 . 2009-03-04 01:46 -------- d-----w c:\documents and settings\All Users\Application Data\RapidSolution 2009-03-04 01:46 . 2009-03-04 01:46 -------- d-----w c:\program files\RapidSolution 2009-03-04 01:18 . 2009-03-04 01:18 -------- d-----w c:\program files\Daniusoft 2009-03-03 13:54 . 2009-03-03 13:54 -------- d-----w c:\documents and settings\All Users\Application Data\Azureus 2009-03-03 00:31 . 2009-03-03 00:31 -------- d-----w c:\documents and settings\Owner\Application Data\Amazon 2009-03-03 00:27 . 2009-03-03 00:27 -------- d-----w c:\program files\Amazon 2009-02-28 03:12 . 2009-02-16 12:25 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2009-02-24 02:08 . 2007-05-06 04:31 -------- d-----w c:\documents and settings\Owner\Application Data\U3 2009-02-23 13:49 . 2004-09-02 09:36 546928 -c--a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-02-16 08:52 . 2004-11-12 02:51 8224 -c--a-w c:\documents and settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 2009-02-09 11:13 . 2002-02-15 16:51 1846784 ----a-w c:\windows\system32\win32k.sys 2005-05-10 03:58 . 2005-05-10 03:09 279984 -c--a-w c:\program files\msbb.log 2005-05-10 03:11 . 2005-05-10 03:10 11624848 -c--a-w c:\program files\msbb_kyf.dat 2005-05-10 03:10 . 2005-05-10 03:09 2073900 -c--a-w c:\program files\msbbau.dat 2005-03-01 02:03 . 2005-03-01 02:03 128 -c--a-w c:\documents and settings\Owner\Local Settings\Application Data\fusioncache.dat 2009-01-13 21:01 . 2009-01-13 21:01 69632 --sha-w c:\windows\system32\yasijote.dll.tmp . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SansaDispatch"="c:\documents and settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-03-24 79872] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-05-03 98304] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-01-04 21:23 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.DLL [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Defender Pro Defrag.lnk] backup=c:\windows\pss\Defender Pro Defrag.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniMavis.lnk] backup=c:\windows\pss\MiniMavis.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpySubtract.lnk] backup=c:\windows\pss\SpySubtract.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^10864.exe.exe] backup=c:\windows\pss\10864.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^17965.exe.exe] backup=c:\windows\pss\17965.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^52B5D.exe.exe] backup=c:\windows\pss\52B5D.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^6D7F8.exe.exe] backup=c:\windows\pss\6D7F8.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^7B436.exe.exe] backup=c:\windows\pss\7B436.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^84816.exe.exe] backup=c:\windows\pss\84816.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^9E0F7.exe.exe] backup=c:\windows\pss\9E0F7.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^A4DB1.exe.exe] backup=c:\windows\pss\A4DB1.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^A9D8C.exe.exe] backup=c:\windows\pss\A9D8C.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^C54A0.exe.exe] backup=c:\windows\pss\C54A0.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^D77D5.exe.exe] backup=c:\windows\pss\D77D5.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^DB512.exe.exe] backup=c:\windows\pss\DB512.exe.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^kill.bat] backup=c:\windows\pss\kill.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat040409 PM.bat] backup=c:\windows\pss\mel.bat040409 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat103020 PM.bat] backup=c:\windows\pss\mel.bat103020 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat103032 PM.bat] backup=c:\windows\pss\mel.bat103032 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat103047 PM.bat] backup=c:\windows\pss\mel.bat103047 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat182311 PM.bat] backup=c:\windows\pss\mel.bat182311 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat240426 PM.bat] backup=c:\windows\pss\mel.bat240426 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat240428 PM.bat] backup=c:\windows\pss\mel.bat240428 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat440444 PM.bat] backup=c:\windows\pss\mel.bat440444 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat540356 PM.bat] backup=c:\windows\pss\mel.bat540356 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^mel.bat580057 PM.bat] backup=c:\windows\pss\mel.bat580057 PM.batStartup [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Memento.lnk] backup=c:\windows\pss\Memento.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "avast! Web Scanner"=3 (0x3) "avast! Mail Scanner"=3 (0x3) "WUSB54GCSVC"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "TuneUp.Defrag"=3 (0x3) "rpcapd"=3 (0x3) "PCTAVSvc"=2 (0x2) "ose"=3 (0x3) "odserv"=3 (0x3) "MSCamSvc"=2 (0x2) "JavaQuickStarterService"=2 (0x2) "idsvc"=3 (0x3) "IDriverT"=3 (0x3) "defenderProDefragService"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "mmtask"=c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiHacker] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"= "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"= R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408] S0 hotcore;hotcore;c:\windows\system32\drivers\hotcore.sys [2004-12-28 18208] S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544] S1 aswSP;avast! Self Protection; [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-27 9968] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-11-17 55024] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs tgqnqydb UxTuneUp [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC}] c:\program files\PixiePack Codec Pack\InstallerHelper.exe . Contents of the 'Scheduled Tasks' folder 2009-04-20 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-29 14:59] 2009-02-11 c:\windows\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job - c:\windows\vVX1000.exe [2009-02-11 21:46] 2009-04-19 c:\windows\Tasks\User_Feed_Synchronization-{92C02AEF-39E3-4954-B1DE-160E84FD2EAA}.job - c:\windows\system32\msfeedssync.exe [2007-08-13 23:36] . - - - - ORPHANS REMOVED - - - - SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://www.google.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/ mSearch Bar = hxxp://www.google.com/ mSearchMigratedDefaultURL = hxxp://www.google.com/ uInternet Settings,ProxyServer = actsvr.comcastonline.com:8100 uInternet Settings,ProxyOverride = cdn uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchURL = hxxp://www.google.com/ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-20 07:21 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NPF] "ImagePath"="system32\drivers\npf.sys" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-604989122-1283460115-496195412-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InprocServer32] @DACL=(02 0000) @="c:\\windows\\system32\\wugakuwa.dll" "ThreadingModel"="Both" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(696) c:\program files\SUPERAntiSpyware\SASWINLO.DLL - - - - - - - > 'explorer.exe'(2040) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-04-20 7:24 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-20 12:24 Pre-Run: 160,900,943,872 bytes free Post-Run: 160,874,586,112 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 300 --- E O F --- 2009-03-25 06:05