ComboFix 14-06-27.01 - Administrator 2014-06-27 15:12:18.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1023.599 [GMT 2:00] Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: AVG Internet Security 2014 *Disabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Administrator\Dane aplikacji\HPSU_48BitScanUpdate.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\bProtector Web Data c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\lollipop c:\documents and settings\All Users\Dane aplikacji\TEMP c:\documents and settings\All Users\Dane aplikacji\TEMP\RAIDTest C:\END c:\program files\Java\jre7\bin\jp2ssv.dll c:\program files\Windows Service c:\windows\Icon_1.ico c:\windows\system32\install.exe c:\windows\system32\roboot.exe c:\windows\system32\scrnrdr.exe c:\windows\system32\SET2BB.tmp c:\windows\system32\system c:\windows\system32\tmp2BB.tmp c:\windows\system32\tmp2BC.tmp c:\windows\system32\VIRepair c:\windows\system32\VIRepair\vi.sif . . ((((((((((((((((((((((((( Pliki utworzone od 2014-05-27 do 2014-06-27 ))))))))))))))))))))))))))))))) . . 2014-06-27 12:33 . 2014-06-27 12:33 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache 2014-06-27 12:27 . 2008-04-14 19:41 53248 -c--a-w- c:\windows\system32\dllcache\i8042prt.sys 2014-06-27 12:27 . 2008-04-14 19:41 53248 ----a-w- c:\windows\system32\drivers\i8042prt.sys . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-05-14 09:22 . 2013-06-01 10:59 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-05-14 09:22 . 2013-06-01 10:59 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-05-13 12:19 . 2012-11-12 02:47 192280 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2014-05-13 12:17 . 2013-10-31 21:30 237848 ----a-w- c:\windows\system32\drivers\avglogx.sys 2014-05-13 12:17 . 2013-11-05 20:50 122136 ----a-w- c:\windows\system32\drivers\avgdiskx.sys 2014-05-13 12:17 . 2011-04-04 22:59 210200 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2014-05-13 12:17 . 2013-10-24 21:28 149784 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2014-05-13 12:17 . 2011-03-01 12:25 107288 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2014-05-13 12:09 . 2013-11-04 20:57 198936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2014-05-13 12:04 . 2011-03-16 14:03 27416 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2014-05-13 12:04 . 2013-09-16 23:57 21272 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2014-04-30 13:18 . 2014-04-30 13:18 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2014-04-30 13:18 . 2014-04-30 13:19 145408 ----a-w- c:\windows\system32\javacpl.cpl . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{D8278076-BC68-4484-9233-6E7F1628B56C}"= "c:\program files\AskPartnerNetwork\Toolbar\searchhook.dll" [2014-05-16 74704] . [HKEY_CLASSES_ROOT\clsid\{d8278076-bc68-4484-9233-6e7f1628b56c}] [HKEY_CLASSES_ROOT\TypeLib\{7C4EE486-5EA5-4683-8C23-BF520933BB5E}] . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{4F524A2D-5637-4300-76A7-7A786E7484D7}] 2014-05-16 00:02 12240 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{4F524A2D-5637-4300-76A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport.dll" [2014-05-16 12240] . [HKEY_CLASSES_ROOT\clsid\{4f524a2d-5637-4300-76a7-7a786e7484d7}] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay1] @="{E68D0A50-3C40-4712-B90D-DCFA93FF2534}" [HKEY_CLASSES_ROOT\CLSID\{E68D0A50-3C40-4712-B90D-DCFA93FF2534}] 2013-01-17 14:43 1232896 ----a-w- c:\documents and settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay2] @="{E68D0A51-3C40-4712-B90D-DCFA93FF2534}" [HKEY_CLASSES_ROOT\CLSID\{E68D0A51-3C40-4712-B90D-DCFA93FF2534}] 2013-01-17 14:43 1232896 ----a-w- c:\documents and settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay3] @="{E68D0A52-3C40-4712-B90D-DCFA93FF2534}" [HKEY_CLASSES_ROOT\CLSID\{E68D0A52-3C40-4712-B90D-DCFA93FF2534}] 2013-01-17 14:43 1232896 ----a-w- c:\documents and settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay4] @="{E68D0A53-3C40-4712-B90D-DCFA93FF2534}" [HKEY_CLASSES_ROOT\CLSID\{E68D0A53-3C40-4712-B90D-DCFA93FF2534}] 2013-01-17 14:43 1232896 ----a-w- c:\documents and settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^OpenOffice.org 3.4.1.lnk] path=c:\documents and settings\Administrator\Menu Start\Programy\Autostart\OpenOffice.org 3.4.1.lnk backup=c:\windows\pss\OpenOffice.org 3.4.1.lnkStartup . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2013-11-21 16:57 959904 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 7] 2013-10-28 09:39 2283296 ----a-w- c:\program files\IObit\Advanced SystemCare 7\ASCTray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnTBMon] 2014-05-16 00:02 1935824 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_UI] 2014-05-13 12:18 5181456 ----a-w- c:\program files\AVG\AVG2014\avgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-03-12 12:03 149040 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 20:51 15360 ----a-w- c:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer] 2013-08-21 09:19 450560 ----a-w- c:\program files\DivX\DivX Media Server\DivXMediaServer.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2013-08-29 00:23 1861968 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GG] 2014-05-02 06:16 4023360 ----a-w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\GG\Application\gghub.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2005-05-11 21:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair] 2004-12-14 16:57 458752 ----a-w- c:\program files\Logitech\Video\ISStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray] 2004-12-14 16:51 217088 ----a-w- c:\program files\Logitech\Video\LogiTray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX] 2004-12-14 16:19 221184 ----a-w- c:\windows\system32\LVCOMSX.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-12 12:23 161328 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony PC Companion] 2014-04-01 14:35 466144 ----a-w- c:\program files\Sony\Sony PC Companion\PCCompanion.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] 2007-04-16 13:28 577536 ----a-w- c:\windows\soundman.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2010-02-10 21:32 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2013-07-02 07:16 254336 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Documents and Settings\\Administrator\\Dane aplikacji\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"= "c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Sony Ericsson\\Update Engine\\Sony Ericsson Update Engine.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"= "c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"= "c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Zdalne zarządzanie systemem Windows . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2013-10-24 149784] R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2013-10-31 237848] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-03-16 27416] R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\drivers\AGPKX.SYS [2013-05-31 45056] R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [2013-11-05 122136] R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2013-11-04 198936] R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2013-09-17 21272] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-11-12 192280] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-04-05 210200] R2 AdvancedSystemCareService7;Advanced SystemCare Service 7;c:\program files\IObit\Advanced SystemCare 7\ASCService.exe [2014-04-10 878368] R2 APNMCP;Ask Update Service;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [2014-05-16 166352] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [2014-05-13 292424] R2 LiveUpdateSvc;LiveUpdate;c:\program files\IObit\LiveUpdate\LiveUpdate.exe [2014-04-10 2151200] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [2014-05-13 3644432] S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2013-07-02 12400] S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2014-04-10 27064] S3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [2013-07-02 155824] . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - PROCEXP111 *Deregistered* - PROCEXP111 . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-06-11 19:12 1091912 ----a-w- c:\program files\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe . Zawartość folderu 'Zaplanowane zadania' . 2014-06-21 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-01 09:22] . 2014-06-27 c:\windows\Tasks\ASC7_PerformanceMonitor.job - c:\program files\IObit\Advanced SystemCare 7\Monitor.exe [2014-04-10 16:19] . 2014-06-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-06-01 05:46] . 2014-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-06-01 05:46] . 2014-06-08 c:\windows\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job - c:\windows\system32\xp_eos.exe [2014-03-07 23:28] . 2014-06-27 c:\windows\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — logowanie.job - c:\windows\system32\xp_eos.exe [2014-03-07 23:28] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.search.ask.com/?tpid=ORJ-V7C&o=APN11412&pf=V7&trgb=CR&p2=%5EBBK%5EOSJ000%5EYY%5EPL&gct=hp&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EPL&apn_dbr=cr_33.0.1750.117&apn_uid=04F8AF9A-DB22-4FC0-90DD-FAB35AC74657&itbv=12.7.0.15&doi=2014-02-25&psv= mStart Page = hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=hp&from=cor&uid=WDCXWD800JB-00JJC0_WD-WCAM9F80673906739&ts=1384246570 uInternet Connection Wizard,ShellNext = iexplore TCP: DhcpNameServer = 192.168.1.1 . - - - - USUNIĘTO PUSTE WPISY - - - - . Toolbar-{10921475-03CE-4E04-90CE-E2E7EF20C814} - (no file) Toolbar-10 - (no file) ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2014-06-27 15:17 Windows 5.1.2600 Dodatek Service Pack 3 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-1454471165-287218729-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,12,5e,56,25,6f,58,43,95,c9,3a,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,12,5e,56,25,6f,58,43,95,c9,3a,\ . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > 'winlogon.exe'(1104) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2014-06-27 15:19:39 ComboFix-quarantined-files.txt 2014-06-27 13:19 . Przed: 7 101 796 352 bajtów wolnych Po: 7 572 082 688 bajtów wolnych . WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - 20D5A2E9CD7062CFCADA8FE392AC93BA 32052574BF9F325AE309ABC7BFD04460