Troijalaiset eivät lähde kulumallakaan

Moro!

Elikkäs apua kaivattaisiin,saanut tapella troijalaisten (ainakin virtumonde/vundo) kanssa jo pitkät tovit,koneella nortonin internet security 2008 ja latasin vundofixin, mutta kumpikaan ei löydä paheitten pesää.

Eilen troijalaiset aloittivat suurhyökkäyksen ja mm. poistivat task managerin käytöstä hetkellisesti.Jos löytyisi keinoja,joilla nuo nilviäiset saisi pois lopullisesti,nyt tuntuvat iskevän aina uudestaan koneen käynnistäessä.

Latasin ja ajoin Combofixin ja tuloksena oli seuraavanlainen loki:

* Uusi palautuspiste luotu
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\setup.inf
c:\windows\system32\cfeOVvut.ini
c:\windows\system32\cfeOVvut.ini2
c:\windows\system32\hgGxUKeE.dll.vir
c:\windows\system32\jSDLonnn.ini
c:\windows\system32\jSDLonnn.ini2
c:\windows\system32\nnnoLDSj.dll
c:\windows\system32\slfoecgr.dll
c:\windows\system32\tuvVOefc.dll
c:\windows\system32\uniq.tll

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-12-06 to 2009-01-06 )))))))))))))))))
.

2009-01-06 15:25 . 2009-01-06 15:25 6,736 --a------ c:\windows\system32\drivers\PROCEXP90.SYS
2009-01-06 01:09 . 2009-01-06 01:09 <KANSIO> d--h----- c:\windows\system32\GroupPolicy
2009-01-05 23:24 . 2009-01-05 23:24 <KANSIO> d-------- c:\documents and settings\Arttu\Application Data\PC Tools
2009-01-05 23:24 . 2009-01-06 15:32 <KANSIO> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-01-05 23:24 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-01-05 23:24 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-01-05 23:24 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-01-05 23:24 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-01-05 22:58 . 2009-01-05 22:58 131,145 --a------ c:\windows\system32\acvkgrcf.dll
2009-01-05 22:58 . 2009-01-05 22:58 87,314 --a------ c:\windows\system32\ayhjtncx.dll
2009-01-05 22:50 . 2009-01-05 22:50 87,316 --a------ c:\windows\system32\utmhkjao.dll
2009-01-05 22:31 . 2009-01-05 22:31 <KANSIO> d-------- C:\VundoFix Backups
2009-01-05 21:09 . 2009-01-05 21:09 131,116 --a------ c:\windows\system32\wsaqflgd.dll
2009-01-05 21:07 . 2009-01-05 21:07 85,856 --a------ c:\windows\system32\btqrpmxm.dll
2009-01-05 17:42 . 2009-01-05 17:42 1,310,603 ---hs---- c:\windows\system32\wlyysotx.ini
2009-01-05 17:42 . 2009-01-05 18:06 3 --a------ c:\windows\sbacknt.bin
2009-01-05 17:36 . 2009-01-05 20:26 <KANSIO> d-------- c:\documents and settings\Arttu\Application Data\vghd
2009-01-05 17:36 . 2009-01-05 17:36 152,904 --a------ c:\windows\system32\vghd.scr
2008-12-25 01:45 . 2008-12-25 01:45 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\ATI
2008-12-25 01:43 . 2008-12-25 01:45 <KANSIO> d-------- c:\program files\ATI
2008-12-24 01:41 . 2009-01-06 15:31 6 --a------ c:\windows\system32\ANIWZCSUSERNAME{5D7783E5-B9DD-4028-8E0D-BB7FC3135941}
2008-12-18 02:28 . 2009-01-06 15:31 11,058 --a------ c:\windows\system32\OODBS.lor
2008-12-17 15:37 . 2008-12-17 15:50 <KANSIO> d-------- c:\windows\system32\oodag

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 13:32 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-06 13:32 --------- d-----w c:\documents and settings\Arttu\Application Data\skypePM
2009-01-06 13:32 --------- d-----w c:\documents and settings\Arttu\Application Data\Skype
2009-01-06 12:36 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-01-06 12:36 60,808 ----a-w c:\windows\system32\S32EVNT1.DLL
2009-01-06 12:36 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-06 12:36 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-01-06 12:36 --------- d-----w c:\program files\Symantec
2009-01-05 15:35 --------- d-----w c:\program files\eMule
2009-01-05 13:58 202,000 ----a-w c:\windows\system32\PnkBstrB.exe
2009-01-05 13:58 139,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-24 23:42 --------- d-----w c:\program files\ATI Technologies
2008-12-20 11:18 --------- d-----w c:\program files\Java
2008-12-10 11:26 22,272 ----a-w c:\documents and settings\Arttu\Application Data\GDIPFONTCACHEV1.DAT
2008-12-04 13:29 --------- d-----w c:\program files\MSECache
2008-12-02 21:26 --------- d-----w c:\program files\QuickTime
2008-12-02 21:26 --------- d-----w c:\program files\Common Files\Apple
2008-12-02 21:26 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-02 21:24 --------- d-----w c:\program files\Apple Software Update
2008-12-02 21:24 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-12-01 22:13 3,452,928 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2008-12-01 20:52 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
2008-12-01 20:51 318,464 ----a-w c:\windows\system32\ati2dvag.dll
2008-12-01 20:46 11,304,960 ----a-w c:\windows\system32\atioglxx.dll
2008-12-01 20:41 188,416 ----a-w c:\windows\system32\atipdlxx.dll
2008-12-01 20:40 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2008-12-01 20:40 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2008-12-01 20:40 147,456 ----a-w c:\windows\system32\Oemdspif.dll
2008-12-01 20:40 143,360 ----a-w c:\windows\system32\ati2evxx.dll
2008-12-01 20:38 598,016 ----a-w c:\windows\system32\ati2evxx.exe
2008-12-01 20:37 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2008-12-01 20:27 4,120,384 ----a-w c:\windows\system32\ati3duag.dll
2008-12-01 20:19 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2008-12-01 20:11 2,495,360 ----a-w c:\windows\system32\ativvaxx.dll
2008-12-01 19:57 48,640 ----a-w c:\windows\system32\amdpcom32.dll
2008-12-01 19:53 45,056 ----a-w c:\windows\system32\amdcalrt.dll
2008-12-01 19:53 45,056 ----a-w c:\windows\system32\amdcalcl.dll
2008-12-01 19:53 401,408 ----a-w c:\windows\system32\atikvmag.dll
2008-12-01 19:52 86,016 ----a-w c:\windows\system32\atiadlxx.dll
2008-12-01 19:52 17,408 ----a-w c:\windows\system32\atitvo32.dll
2008-12-01 19:51 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2008-12-01 19:50 3,252,224 ----a-w c:\windows\system32\Amdcaldd.dll
2008-12-01 19:50 286,720 ----a-w c:\windows\system32\atiok3x2.dll
2008-12-01 19:45 577,536 ----a-w c:\windows\system32\ati2cqag.dll
2008-12-01 12:35 593,920 ------w c:\windows\system32\ati2sgag.exe
2008-11-24 16:49 682,280 ----a-w c:\windows\system32\pbsvc.exe
2008-11-24 16:49 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-11-24 16:49 22,328 ----a-w c:\documents and settings\Arttu\Application Data\PnkBstrK.sys
2008-11-24 16:49 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-24 16:32 --------- d-----w c:\program files\Activision
2008-11-10 03:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-11-06 10:59 --------- d-----w c:\program files\Common Files\Skype
2008-10-23 12:38 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-21 18:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe
2008-10-21 17:40 81,920 ----a-w c:\windows\system32\ATIODE.exe
2008-10-21 17:40 45,056 ----a-w c:\windows\system32\ATIODCLI.exe
2008-10-16 12:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 12:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 12:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 01:01 666,112 ----a-w c:\windows\system32\wininet.dll
2008-04-09 08:33 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-06-30 10:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2008-12-27 21:29 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-27 21:29 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-27 21:29 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-27 21:29 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-27 21:29 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 94208]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-09-18 171464]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2007-03-05 1103480]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="c:\windows\RTHDCPL.EXE" [2007-03-21 16126464]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 77824]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-05-12 270336]
"snp2std"="c:\windows\vsnp2std.exe" [2007-05-10 344064]
"D-Link AirPlus G"="c:\program files\D-Link\AirPlus G\AirGCFG.exe" [2006-11-17 1552384]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2006-06-29 49152]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-07 718704]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-07-05 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"ISTray"="d:\spyware doctor\pctsTray.exe" [2008-08-25 1168264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0OODBS

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"sonera"="c:\program files\Sonera\InternetAvustaja\bin\sprtcmd.exe" /P Sonera

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\coh\\RelicCOH.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*isabledxpsp2res.dll,-22009

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
R4 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2008-02-09 238968]
R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R4 sdAuxService;PC Tools Auxiliary Service;d:\spyware doctor\pctsAuxs.exe [2009-01-05 356920]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
*Deregistered* - mchInjDrv
.
'Ajoitetut tehtävät'-kansion sisältö
.
- - - - POISTETUT JÄMÄRIVIT - - - -

BHO-{159CA1A9-143F-4F2A-8BE1-55B13119B65A} - c:\windows\system32\nnnoLDSj.dll


.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Arttu\Application Data\Mozilla\Firefox\Profiles\g6ypudjr.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-06 15:32:19
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*NULL*]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*NULL*]
"OODEFRAG08.00.00.01WORKSTATION"="D544D5AA0559B3CC270A36ED128607A012988172EDE773EDE065E21DB24DADFA6CCB99206744963107C664CE00AC5A107D7069C5E0293309A5D8FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC79338EDD5E5BE2F6E6678EDD5E5BE2F6E667BEBAA56122A4BC026A10B3C34299BA50A5077E51CC6A6AFAFB722E3F1B03112A9ACE38E204F3546FC56AED198FBF499B55E00B05430217DF4BDF619B805B1F45F7C18D82E832C2EE2875BD39DB44AA31E8B9089802082BF2DC9F511D67DA30E59868420322823A061FACD1369400EF74D7D1560C2E2BBB152D58AE4E4EA57989A4EE7A9C2A9F33709A5D5E9449E074FCFB3D59CE102C245BA0822FAE58F375E1A751DBFA9BD3E89B6FAB1ACC3166D19711E37BC918E2FE0DFBEA8E324C0F64551063123FB50059ABD48D424C25A76841B9812954D6B92EA76B3107BE15D8C47CB148CA7DDD984875E84E95F4204E5D317BA4523E822E57DB7BCBDDB042C2E0A5457A39BB1BA5BD84AA0DD79AC394194BBD326CC874D2620DA082D55485543FD0E3C9947899C20317FEBAD007D44FC62DD062EE2B2B4D7FD5AFF1B970B628AFB48E5696A12922A99FAFA0CB76BC62D6266440578D48D89B00630C57B8D1EF44BBA815FD1D3D0603C46657989A09467DB90EAB260F1244EE0EDA93015AF26CD301F7518DC06EC72661364F8A19E809331F47D76041F16FF13417248AF25FF5F6582AA88CDA79D36F03914A7A09334C34416DCE8EAA7553E15B00A74F967CF70DC6CC8B442BBBA87D6DD1DE43795EC400404269BC45D0F83E9EDEE0ABCB56713704D4420563BADD3316B37944EA0A3C5A706AD8FB7ED6FDCECF6263020E9A755C0019E321AE1F983828D5D6E0D0750F4C58F0A1E0B982951BF11E19B74B9D2CA65A54DFEDA63396F682BE0B02960530A2344119844B7306F0BF86BDB6E6D5CF04EAA57746DC68281FB5567C92974323EBF12D6D82FDE9A96024F662EC395D30273912410AD350B1238BE76602A55C817D37EB9EFC90CAEEBE40AEEC4B0DF3B0850300A59B85A5A9BB7B2556C48521F8EFDA147E18342256A7E8CD94479F7CC759B93BE261DBC29F63B5A1B05270864B9C67A5357B8E1D78F5A5DDE55C25FC022104720BC5B828B0D79C562B259225CC271D01BFD4BA8C7E4AB3C6C385C4217D9EBABA83386FF7139EC61F50BD0E3AE671F06AEDD346E7A68B045760C619B76ED7EB8907AA487C8D7CFC3C00A077271825070D62AEB2C844613AC246A4B1339B1858BAA2927EA07E7E40D3EB535870702D3E75159CF56CBB3BAE9F5228912BE0EBF58DB7ECC274D372C2EB1C632D3E163A241552DA7BB488476E67B460AFDA2CA76D277DB738AB936CE8F2E9DFE6DDC0407DC1B8A920A93A"
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'winlogon.exe'(1060)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Muut prosessit ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
d:\spyware doctor\pctsSvc.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Valmistumisajankohta: 2009-01-06 15:34:59 - kone käynnistettiin uudelleen
ComboFix-quarantined-files.txt 2009-01-06 13:34:54

Ennen ajoa: 21ÿ277ÿ007ÿ872 tavua vapaana
Ajon jõlkeen: 25,095,892,992 tavua vapaana

WindowsXP-KB310994-SP2-Pro-BootDisk-FIN.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

255 --- E O F --- 2008-12-11 10:28:03