Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

blue screen during boot xp media center


  • Please log in to reply
25 replies to this topic

#1 oh ok

oh ok

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 03:28 AM

i'm on a laptop running xp media center edition, and i was having a browser redirect problem. i scanned the computer with mbam, which picked up one infection. a reboot was required, at which point it started blue screens during the windows boot process. the blue screen doesn't name the issue.

the technical information:
STOP: 0x00000024 (0x001902FE, 0xF795E3D4, 0xF795E0D0, 0x86E32805)

this occurs for safe mode and last recovery point as well.

i am currently running ubuntu from a cd on the laptop.

BC AdBot (Login to Remove)

 


#2 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,113 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:44 AM

Posted 10 January 2010 - 06:42 AM

Hello, I moved your topic to a more appropriate forum.

Using you Ubuntu live cd, can you please verify if the following file exists?

c:\windows\system32\drivers\ntfs.sys

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#3 oh ok

oh ok
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 07:00 AM

yes, it does

#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,113 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:44 AM

Posted 10 January 2010 - 07:41 AM

Can you access the internet using Ubuntu?

If so, do the following:

UPLOAD A FILE
--------------------
We need to check a file. Please click this link VirusTotal

When the page has finished loading, click the Choose file button and navigate to the following file and click Send file.

c:\windows\system32\drivers\ntfs.sys

If you get the message that the file has already been scanned before, please click Reanalyse file now.
Please post back the results of the scan in your next post.


After this, please look for the following folder:

C:\Documents and Settings\<your user name>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

There should be two folders in there, Quarantine and Logs. Please let me know what both of these folders contain.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 oh ok

oh ok
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 08:02 AM

from virustotal:

File ntfs.sys received on 2010.01.10 12:50:47 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/40 (0%)
Loading server information...
Your file is queued in position: 1.
Estimated start time is between 40 and 57 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.5.0.48 2010.01.10 -
AhnLab-V3 5.0.0.2 2010.01.10 -
AntiVir 7.9.1.130 2010.01.08 -
Antiy-AVL 2.0.3.7 2010.01.08 -
Authentium 5.2.0.5 2010.01.09 -
Avast 4.8.1351.0 2010.01.10 -
AVG 8.5.0.430 2010.01.04 -
BitDefender 7.2 2010.01.10 -
CAT-QuickHeal 10.00 2010.01.09 -
ClamAV 0.94.1 2010.01.09 -
Comodo 3534 2010.01.10 -
DrWeb 5.0.1.12222 2010.01.10 -
eSafe 7.0.17.0 2010.01.07 -
eTrust-Vet 35.2.7226 2010.01.08 -
F-Prot 4.5.1.85 2010.01.09 -
F-Secure 9.0.15370.0 2010.01.10 -
Fortinet 4.0.14.0 2010.01.09 -
GData 19 2010.01.10 -
Ikarus T3.1.1.80.0 2010.01.10 -
Jiangmin 13.0.900 2010.01.10 -
K7AntiVirus 7.10.943 2010.01.09 -
Kaspersky 7.0.0.125 2010.01.10 -
McAfee 5856 2010.01.09 -
McAfee+Artemis 5856 2010.01.09 -
McAfee-GW-Edition 6.8.5 2010.01.10 -
Microsoft 1.5302 2010.01.10 -
NOD32 4757 2010.01.09 -
Norman 6.04.03 2010.01.10 -
nProtect 2009.1.8.0 2010.01.10 -
Panda 10.0.2.2 2010.01.09 -
PCTools 7.0.3.5 2010.01.10 -
Rising 22.29.06.04 2010.01.10 -
Sophos 4.49.0 2010.01.10 -
Sunbelt 3.2.1858.2 2010.01.09 -
Symantec 20091.2.0.41 2010.01.10 -
TheHacker 6.5.0.3.145 2010.01.10 -
TrendMicro 9.120.0.1004 2010.01.10 -
VBA32 3.12.12.1 2010.01.09 -
ViRobot 2010.1.8.2128 2010.01.08 -
VirusBuster 5.0.21.0 2010.01.09 -
Additional information
File size: 574976 bytes
MD5...: 78a08dd6a8d65e697c18e1db01c5cdca
SHA1..: c40f3c1fcbd8a61ad5f36e16971feb64407bbc66
SHA256: e0e6f3ed05068e32f1d5c2d2b38cdef4536b8656db6756c66cf6b40b60c8f3da
ssdeep: 12288:CosOm5JqnuiIT8j4l7yT68kdUDzAGOjICueFWI0m9:eJ+uiIQ4kTTkdUDE
PflFWI0
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x85384
timedatestamp.....: 0x48025be5 (Sun Apr 13 19:15:49 2008)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x17879 0x17880 6.57 7a0cc809877394dcb00f251125cde1d0
.rdata 0x17b80 0x7078 0x7080 6.30 95baacb27e75d4140da94f3e43c659d6
.data 0x1ec00 0x1b10 0x1b80 0.74 9cb37a38036e823a0152bb209239dffd
PAGE 0x20780 0x64b6b 0x64b80 6.51 7de1f4c3a0a474314fe86e158e01cd73
INIT 0x85300 0x36fe 0x3700 6.07 ded61bc7fa643b884fdf69cc4d48c308
.rsrc 0x88a00 0x3e0 0x400 3.34 7153f5b12fab0213e839e612df3320ab
.reloc 0x88e00 0x37a0 0x3800 6.73 5db2361b4571130ef61ec5a1deac3e22

( 3 imports )
> HAL.dll: KeAcquireInStackQueuedSpinLock, ExAcquireFastMutex, KeReleaseQueuedSpinLock, KeAcquireQueuedSpinLock, KfReleaseSpinLock, ExTryToAcquireFastMutex, ExReleaseFastMutex, KeReleaseInStackQueuedSpinLock, KfAcquireSpinLock
> ksecdd.sys: GenerateSessionKey, EfsGenerateKey, GenerateDirEfs, InitSecurityInterfaceW, EfsDecryptFek
> ntoskrnl.exe: ExRaiseStatus, FsRtlNormalizeNtstatus, CcFlushCache, ExIsResourceAcquiredExclusiveLite, RtlInitUnicodeString, InterlockedPopEntrySList, InterlockedPushEntrySList, KeQuerySystemTime, RtlCompareMemory, FsRtlAreNamesEqual, FsRtlCheckLockForWriteAccess, FsRtlOplockIsFastIoPossible, FsRtlCheckOplock, CcSetDirtyPinnedData, MmSetAddressRangeModified, MmCanFileBeTruncated, RtlGenerate8dot3Name, RtlUpcaseUnicodeString, CcCopyWrite, CcCanIWrite, CcMdlWriteComplete, MmMapLockedPagesSpecifyCache, CcPrepareMdlWrite, IoGetTopLevelIrp, _aullshr, _allshl, IoGetStackLimits, RtlSetBits, RtlClearBits, FsRtlGetNextLargeMcbEntry, RtlAreBitsSet, RtlFindLastBackwardRunClear, RtlNumberOfClearBits, _allmul, RtlAreBitsClear, RtlFindClearBits, RtlFindClearRuns, FsRtlRemoveLargeMcbEntry, FsRtlLookupLargeMcbEntry, FsRtlAddLargeMcbEntry, KeReleaseMutant, ObfDereferenceObject, CcUninitializeCacheMap, CcSetLogHandleForFile, CcInitializeCacheMap, IoCreateStreamFileObjectLite, KeWaitForSingleObject, CcMapData, CcPinMappedData, CcPinRead, CcPreparePinWrite, CcMdlReadComplete, KeBugCheckEx, CcZeroData, FsRtlIsNtstatusExpected, DbgBreakPoint, DbgPrint, KdDebuggerEnabled, FsRtlNotifyVolumeEvent, RtlDeleteElementGenericTableAvl, IoRemoveShareAccess, FsRtlAddToTunnelCache, FsRtlFastUnlockAll, IoGetRequestorProcess, FsRtlNotifyFilterReportChange, FsRtlDeleteKeyFromTunnelCache, FsRtlNotifyCleanup, FsRtlNotifyFilterChangeDirectory, MmFlushImageSection, KeLeaveCriticalRegion, IoSetTopLevelIrp, KeEnterCriticalRegion, IofCompleteRequest, ExQueueWorkItem, IoGetCurrentProcess, FsRtlIsNameInExpression, FsRtlDoesNameContainWildCards, IoCheckEaBufferValidity, ExIsResourceAcquiredSharedLite, KeSetEvent, IoSetInformation, FsRtlOplockFsctrl, IoUpdateShareAccess, IoSetShareAccess, IoCheckShareAccess, FsRtlCurrentBatchOplock, ObReleaseObjectSecurity, ObGetObjectSecurity, SePrivilegeCheck, CcWaitForCurrentLazyWriterActivity, RtlGetOwnerSecurityDescriptor, FsRtlFindInTunnelCache, SeSinglePrivilegeCheck, KeClearEvent, FsRtlDissectName, _alloca_probe, IoCancelIrp, KeSetKernelStackSwapEnable, KeInitializeEvent, IoIsOperationSynchronous, IofCallDriver, MmUnmapLockedPages, IoBuildPartialMdl, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, KeGetCurrentThread, RtlDecompressBuffer, RtlDecompressFragment, RtlGetCompressionWorkSpaceSize, MmBuildMdlForNonPagedPool, IoFreeIrp, ExReleaseResourceForThreadLite, CcUnpinDataForThread, CcSetBcbOwnerPointer, FsRtlIsTotalDeviceFailure, IoMakeAssociatedIrp, ObfReferenceObject, ExGetExclusiveWaiterCount, KeDelayExecutionThread, ObReferenceObjectByHandle, IoFileObjectType, _local_unwind2, RtlCompressBuffer, MmUnlockPages, IoBuildAsynchronousFsdRequest, RtlLookupElementGenericTableAvl, SeCaptureSubjectContext, RtlUpperString, RtlCompareString, RtlInitString, FsRtlLegalAnsiCharacterArray, NlsOemLeadByteInfo, NlsMbOemCodePageTag, SeDeleteObjectAuditAlarm, ObQueryObjectAuditingByHandle, CcPurgeCacheSection, _allrem, SeAuditHardLinkCreation, SeAuditingHardLinkEventsWithContext, IoBuildDeviceIoControlRequest, CcMdlRead, KeNumberProcessors, CcDeferWrite, ZwClose, ZwCreateFile, ProbeForRead, IoBuildSynchronousFsdRequest, IoGetRelatedDeviceObject, MmPrefetchPages, ProbeForWrite, _alldiv, RtlLengthSid, SeReleaseSubjectContext, SeUnlockSubjectContext, SeAccessCheck, SeLockSubjectContext, RtlMapGenericMask, IoGetFileObjectGenericMapping, CcSetAdditionalCacheAttributes, FsRtlBalanceReads, ObQueryNameString, wcslen, IoCreateDevice, FsRtlIncrementCcFastReadResourceMiss, FsRtlIncrementCcFastReadNotPossible, CcFastCopyRead, FsRtlIncrementCcFastReadNoWait, FsRtlIncrementCcFastReadWait, CcFastCopyWrite, CcFastMdlReadWait, FsRtlUninitializeLargeMcb, FsRtlInitializeLargeMcb, FsRtlPrivateLock, FsRtlFastUnlockSingle, FsRtlFastUnlockAllByKey, FsRtlProcessFileLock, ExDeleteResourceLite, ExInitializeResourceLite, KeInitializeSpinLock, FsRtlResetLargeMcb, KeSetTimer, ExAcquireSharedStarveExclusive, CcGetDirtyPages, KeSetPriorityThread, FsRtlLookupLastLargeMcbEntry, FsRtlNumberOfRunsInLargeMcb, FsRtlSplitLargeMcb, FsRtlTruncateLargeMcb, CcRemapBcb, RtlFreeOemString, RtlUnicodeStringToCountedOemString, FsRtlIsFatDbcsLegal, FsRtlFastCheckLockForWrite, FsRtlFastCheckLockForRead, IoRaiseInformationalHardError, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, IoVolumeDeviceToDosName, IoReleaseCancelSpinLock, IoAcquireCancelSpinLock, CcMdlWriteAbort, IoIsSystemThread, RtlLengthSecurityDescriptor, SeAssignSecurity, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, ExInitializePagedLookasideList, ExInitializeNPagedLookasideList, MmIsThisAnNtAsSystem, MmQuerySystemSize, ZwQueryValueKey, ZwOpenKey, RtlVerifyVersionInfo, VerSetConditionMask, IoRegisterDriverReinitialization, KeInitializeDpc, KeInitializeTimer, IoRegisterFileSystem, KeBugCheck, KeInitializeMutant, FsRtlMdlWriteCompleteDev, FsRtlMdlReadCompleteDev, ExUuidCreate, RtlDelete, RtlSplay, RtlValidSid, RtlInsertElementGenericTableFullAvl, RtlLookupElementGenericTableFullAvl, SeQueryInformationToken, RtlEqualSid, SeExports, IoCheckQuotaBufferValidity, RtlInitializeGenericTableAvl, CcSetReadAheadGranularity, FsRtlCheckLockForReadAccess, ExAcquireSharedWaitForExclusive, FsRtlPostStackOverflow, FsRtlPostPagingFileStackOverflow, IoReleaseVpbSpinLock, IoAcquireVpbSpinLock, SeValidSecurityDescriptor, SeFreePrivileges, SeDeassignSecurity, SeSetSecurityDescriptorInfo, SeQuerySecurityDescriptorInfo, SeOpenObjectAuditAlarm, SeOpenObjectForDeleteAuditAlarm, SeAppendPrivileges, SeAuditingFileEventsWithContext, RtlEnumerateGenericTableWithoutSplayingAvl, FsRtlFreeFileLock, FsRtlAllocateFileLock, ExReinitializeResourceLite, FsRtlNotifyInitializeSync, FsRtlInitializeTunnelCache, RtlInsertElementGenericTableAvl, FsRtlUninitializeOplock, FsRtlInitializeOplock, FsRtlTeardownPerStreamContexts, IoDeleteDevice, FsRtlDeleteTunnelCache, FsRtlNotifyUninitializeSync, RtlEnumerateGenericTableAvl, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, IoSetDeviceToVerify, KeTickCount, _abnormal_termination, _except_handler3, RtlFindNextForwardRunClear, ExAcquireFastMutexUnsafe, ExAllocatePoolWithTag, RtlInitializeBitMap, ExFreePoolWithTag, memmove, ExReleaseFastMutexUnsafe, ExReleaseResourceLite, _allshr, ExAcquireResourceSharedLite, ExAcquireResourceExclusiveLite, CcUnpinData, CcCopyRead, CcSetFileSizes, RtlFillMemoryUlong, IoPageRead, IoFreeErrorLogEntry, IoSynchronousPageWrite, ExDeletePagedLookasideList, ExDeleteNPagedLookasideList, IoGetDeviceObjectPointer, KeUnstackDetachProcess, KeStackAttachProcess, PsLookupProcessByProcessId, ZwWaitForSingleObject, PsCreateSystemThread, ZwCreateEvent, PoQueueShutdownWorkItem, ZwFreeVirtualMemory, PsRevertToSelf, PsDereferenceImpersonationToken, PsImpersonateClient, PsReferenceImpersonationToken, ZwAllocateVirtualMemory, ObReferenceObjectByPointer

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: © Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: NT File System Driver
original name: ntfs.sys
internal name: ntfs.sys
file version.: 5.1.2600.5512 (xpsp.080413-2111)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned





the quarantine folder for mbam contains two files, named "quar1.39505", and "backup1.39505"



the logs folder is of course logs. the contents of the scan that triggered this problem is here:

Malwarebytes' Anti-Malware 1.42

Database version: 3443

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702



12/28/2009 9:34:57 AM

mbam-log-2009-12-28 (09-34-57).txt



Scan type: Quick Scan

Objects scanned: 114055

Time elapsed: 5 minute(s), 17 second(s)



Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1



Memory Processes Infected:

(No malicious items detected)



Memory Modules Infected:

(No malicious items detected)



Registry Keys Infected:

(No malicious items detected)



Registry Values Infected:

(No malicious items detected)



Registry Data Items Infected:

(No malicious items detected)



Folders Infected:

(No malicious items detected)



Files Infected:

C:\Documents and Settings\Dad\Local Settings\Temp\AC.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.



#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,113 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:44 AM

Posted 10 January 2010 - 09:07 AM

the quarantine folder for mbam contains two files, named "quar1.39505", and "backup1.39505"


Can you please tell me from both files when they were created/last modified?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 oh ok

oh ok
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 09:11 AM

all four dates for both files is "Mon 28 Dec 2009 02:34:56 PM UTC"

#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,113 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:44 AM

Posted 10 January 2010 - 09:25 AM

Can you also please check the creation/modification date of the ntfs.sys file?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#9 oh ok

oh ok
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 09:33 AM

ntfs.sys

Accessed: Mon 28 Dec 2009 01:02:51 PM UTC
Modified: Sun 13 Apr 2008 07:15:53 PM UTC

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,113 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:44 AM

Posted 10 January 2010 - 09:49 AM

Can you please tell me on what date you did the last MBAM scan (the one directly before the BSOD started)?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#11 oh ok

oh ok
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 09:57 AM

i ran a quick scan the day before, 12-27. i cancelled the operation after about 3 minutes in and it found nothing. the scan prior to it is dated from 10-25.

#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,113 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:44 AM

Posted 10 January 2010 - 09:59 AM

Sorry if I don't understand things here, but I mean, what diate did the problems start, the day you could no longer boot into windows.

Edited by elise025, 10 January 2010 - 10:00 AM.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 oh ok

oh ok
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 10:11 AM

after the mbam scan on 12-28, i was prompted to restart by mbam. this was the first failed boot.

#14 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,113 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:44 AM

Posted 10 January 2010 - 10:25 AM

Okay, lets see if we can figure out what is causing this.

1. Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
2. Select “Enable Boot Logging” option and press enter.
3. Windows prompts for you to select a Windows Installation (even if there is only one windows installation)
This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows (%systemroot%) folder which can later be accessed to see if there was a troublesome driver.

Please access c:\windows\bootlog.txt and post its contents in your next reply. Note, it might be a loooong list, you can spread it over more posts if needed.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#15 oh ok

oh ok
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:44 PM

Posted 10 January 2010 - 11:01 AM

after two boots with logging enabled, there does not appear to be any log made

just to be sure, here is a (big) screenshot of my current c\windows files

http://i49.tinypic.com/2d0o2ko.png

Edited by oh ok, 10 January 2010 - 11:01 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users