Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: SAMSUNG_HD103SJ rev.1AJ10001 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0xB7E0D864
user & kernel MBR OK
Bootkit Remover
(c) 2009 eSage Lab
http://www.esagelab.com
Program version: 1.2.0.0
OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
System volume is \\.\H:
\\.\H: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
Boot sector MD5 is: ee7fe9f24bc949ea3a78cf7064fbe50b
Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Unknown boot code
Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
Done;
Press any key to quit...
.... sláva už jsem rozjel ten "H:\mbr.exe -f"
ja jsem jelito
