insufficient system error

[evilfantasy]

No. You were supposed to download the attached file. (look at the bottom of this post)

Download the attached beep.zip file (at the bottom of this post) to your desktop and then unzip it to your desktop.

Let me know when the beep.sys file is on your desktop.

[Saving space, attachment deleted by admin]

[godsize71]

its there

[evilfantasy]

Yours is missing so now we need to move it to where it should be.

Download The Avenger by Swandog46 and save it to your desktop.

* Extract avenger.exe from the Zip file and save it to your desktop
* Run avenger.exe by double-clicking on it.
* Do not change any check box options!!
* Copy everything in the Code box below, and paste it into the Input script here window:

Code: [Select]

Comment:

Files to move:
c:\documents and settings\Compaq_Owner\Desktop\beep.sys | c:\windows\System32\drivers\beep.sys
* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the "Reboot now?" question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

* Add the Avenger log in your next post.


Also let me know how the computer is running now.

[godsize71]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "c:\documents and settings\Compaq_Owner\Desktop\beep.sys|c:\windows\System32\drivers\beep.sys" completed successfully.

Completed script processing.

*******************

Finished!  Terminate.
  its running ok lil slow but the insufficient error hasnt been on but then again i have been rebooting...i will let you know in the morning time

[evilfantasy]

Looks good.

When you get back run GMER. We need to make sure everything is gone.


Download GMER Rootkit Detector and save it your desktop.
 
* Extract it to your desktop and double-click GMER.exe
* Make sure all of the boxes on the right of the screen are checked, EXCEPT for "Show All".
* Click the Rootkit tab and then Scan.
* Don't check the Show All box while scanning in progress!
* When scanning is finished click Copy.
* This copies the log to clipboard
* Post the log in your reply.

[godsize71]

i have it but cant find clipboard where is it

[evilfantasy]

The clipboard is when you copy text. Just right click in the reply box and choose Paste.

[godsize71]

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-02-19 21:19:03
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\uwlcraoc.sys


---- Disk sectors - GMER 1.0.15 ----

Disk            \Device\Harddisk0\DR0        sector 00: MBR rootkit code detected

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs       InCDrec.SYS (InCD File System Recognizer/Nero AG)
AttachedDevice  \FileSystem\Fastfat \Fat     InCDrec.SYS (InCD File System Recognizer/Nero AG)

Device          \Driver\Tcpip \Device\Ip     vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device          \Driver\Tcpip \Device\Tcp    vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device          \Driver\Tcpip \Device\Udp    vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device          \Driver\Tcpip \Device\RawIp  vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

---- EOF - GMER 1.0.15 ----

[evilfantasy]

MBR rootkit code detected

We need to fix that.

Download the MBR Rootkit Detector to your desktop.

Go to Start > Run then copy and paste the following red text into the Open field then click OK:

"%userprofile%\desktop\mbr.exe" -f

Next, double click on the mbr.exe file.

Post the contents of the mbr.log

[godsize71]

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
MBR rootkit code detected !

[evilfantasy]

Download DeFogger by jpshortstuff and save it to your desktop.
 
* Double click DeFogger.exe to run the tool.
* The application window will appear.
* Click the Disable button to disable your CD Emulation drivers
* Click Yes to continue.
* A 'Finished!' message will appear.
* Click OK.
* DeFogger will now ask to reboot the machine...click OK.
 
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
 
Do not re-enable these drivers until otherwise instructed.

----------

Go to Start > Run then copy and paste the following red text into the Open field then click OK:

"%userprofile%\desktop\mbr.exe" -f

Next, double click on the mbr.exe file.

Post the contents of the mbr.log

[godsize71]

it just kept asking me to disable cd i did it like 4 times but never asked to reboot, just kept the disable cd window

[godsize71]

defogger_disable by jpshortstuff (29.01.10.1)
Log created at 13:12 on 20/02/2010 (Compaq_Owner)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
MBR rootkit code detected !



this is what i got from logs...didnt reboot like i said

[evilfantasy]

Download Dr.Web CureIt and save it to your desktop.

 Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start
  
• An information notice will appear, click OK.
  
• This starts a short scan that will scan the files currently running in memory.
• If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
  
• If or when something is found, click the Yes button when it asks you if you want to cure it.

• Once the short scan has finished, Click Settings > Change Settings
  
• Under the Scanning tab UNcheck Heuristic analysis and click OK
  
• Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
  
• Click Yes to all if it asks if you want to cure/move any file(s).
  
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

.
* After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
* Copy and paste that log in the next reply

[godsize71]

this thing is still scanning almost 2 hrs now