S.M.A.R.T. HDD Program: Who Are These Jokers ?

Hello,

Boy, talk about being annoyed.

All of a sudden some "program" by S.M.A.R.T. HDD (or something like that) appeared and keeps doing scans of my PC with msgs that my HD has loads of faults, etc.

Kept coming back.
No way to close it out. Won't allow itself to be closed out.
Doesn't appear in my list when I go to Remove Programs.

They want $ to effect a cure of the 7 "problems" it supposedly found.

Totally corrupted everything.
Had to do a System Restore, with about a weeks worth of stuff lost.

Be advised.
Who are these jokers ?

How do I keep it from coming back, again ?

Anyone that you can report this too, who might actually do something about ?

Thanks,
Bob

What AV/AM are you running?

Robert11 said:

Hello,

Boy, talk about being annoyed.

All of a sudden some "program" by S.M.A.R.T. HDD (or something like that) appeared and keeps doing scans of my PC with msgs that my HD has loads of faults, etc.

Kept coming back.
No way to close it out. Won't allow itself to be closed out.
Doesn't appear in my list when I go to Remove Programs.

They want $ to effect a cure of the 7 "problems" it supposedly found.

Totally corrupted everything.
Had to do a System Restore, with about a weeks worth of stuff lost.

Be advised.
Who are these jokers ?

How do I keep it from coming back, again ?

Anyone that you can report this too, who might actually do something about ?

Thanks,
Bob

Click to expand...

i just got that one last night and its a B**** to get ridof. but there are some simple steps to help.

first go into safe mode with networking
second install loaris trojan remover
third install malwarebytes
fourth run loaris
fifth run malwarebytes

for the most part that will clean it up, it hides all your files... ALL OF THEM. to make you believe it is hard disk corruption. i used to know a script for cmd that will show all hidden files (that arent meant to be hidden that is). if you dont wnat to manually show them, there are applications to do it specifically designed for use after getting this virus


EDIT: i missed a step, sry:
before downloading the antivirus, install SysInternals, the virus will prevent you from using task manager, so instead use process explorer from sys internals suite, if you search by "private bytes" than it will be near the top with a random numeric value (example: Al2848aDfl%34.exe)

From OP: For bbear...

Hi,

Thanks for help.

What is AV / AM please ?

Bob

Hi Robert,

That sounds like rogueware/malware...if you recall the exact name, we can do some research for you. In the meantime, please run this online scan by ESET. Report back on all the threats it finds, if any:

ESET Online Scanner

Post back here if you need more assistance with this.

Regards,
Golden

Nothing should have been corrupted. Those "programs" hold your system hostage, making you think you need to pay for something. As long as people out there continue to be fooled by it and pay...they will exist.

The easiest way to remove this type of malware is to pull the drive an attach it to another system. Scan the drive and clean it...then return it to the original system and run another scan to be sure.

From OP:

Hi,

Any simpler way than pulling the internal HD ?

Bob

Robert11 said:

What is AV / AM please ?

Click to expand...

Anti - Virus / Anti - Malware

I use Microsoft Security Essentials; it's free, and quite good.

Not that's completely effective. Pulling the internal hard drive is the simple part. You could spend days fighting it on the active system, or less than an hour to completely remove it.

DeaconFrost said:

Nothing should have been corrupted. Those "programs" hold your system hostage, making you think you need to pay for something. As long as people out there continue to be fooled by it and pay...they will exist.

Click to expand...

This type of malware is sometimes picked up by simply loading a web page. They can also be picked up by clicking OK on a dialog box that offers to close a popup web page.

DeaconFrost said:

The easiest way to remove this type of malware is to pull the drive an attach it to another system. Scan the drive and clean it...then return it to the original system and run another scan to be sure.

Click to expand...

That's one of the main reasons I dual boot from a second drive. I can boot to the other OS if necessary and perform all necessary cleanup/de-lousing.
I've helped a number of folks with difficult infections in XP by walking them through a parallel installation and doing all the scrubbing from there.

DeaconFrost said:

Nothing should have been corrupted. Those "programs" hold your system hostage, making you think you need to pay for something. As long as people out there continue to be fooled by it and pay...they will exist.

The easiest way to remove this type of malware is to pull the drive an attach it to another system. Scan the drive and clean it...then return it to the original system and run another scan to be sure.

Click to expand...

i got ridof it without having to attatch it to another drive. its just a gazillian steps to go through though, i will poset here my updated steps.

1. download sys internals
2. use process explorer from sysint, to delete anything using excessive memory with a random numeric value
3. search for you browser in the start menu, because things are hidden it wont show up unless searched or if you view hidden files
4. download loaris trojan remover, and malwarebytes
5. run malwarebytes first, then run loaris trojan remover
6. run unhide.exe, OR what i would recomend is to open elevated command prompt, and type in "attrib /d /s -h [directory name]" if that doesnt work try -h -s instead of just -h
7. reset your background
8. right click on start menu, properties, customize, and place everything back in your start menu
9. refil task bar... tada

to be safe i would run your primary anti virus 1 more time before restarting incase remence of the virus are still there, also i would clear your temp file... for EVERYTHING POSSIBLE, this will ensure that the download it came in through is not still lingering.

Thornton said:

i got ridof it without having to attatch it to another drive. its just a gazillian steps to go through though, i will poset here my updated steps.

Click to expand...

I didn't mean it as the only method. It's just the easiest and most straight-forward....especially if someone isn't compfrtable with downloading more programs and running those commands. On top of that, the infections I've had to clean...you couldn't perform those steps on the system anyway, as all .exes are normally blocked.

bbearren said:

That's one of the main reasons I dual boot from a second drive. I can boot to the other OS if necessary and perform all necessary cleanup/de-lousing.
I've helped a number of folks with difficult infections in XP by walking them through a parallel installation and doing all the scrubbing from there.

Click to expand...

Dual-booting requires a second license, which most people don't have. Setting up a parallel install also takes quite a bit longer than just removing the infection. For people who aren't physically located around me, I just send them a bootable AV rescue disc and walk them through booting from that disc.

DeaconFrost said:

Thornton said:

i got ridof it without having to attatch it to another drive. its just a gazillian steps to go through though, i will poset here my updated steps.

Click to expand...

I didn't mean it as the only method. It's just the easiest and most straight-forward....especially if someone isn't compfrtable with downloading more programs and running those commands. On top of that, the infections I've had to clean...you couldn't perform those steps on the system anyway, as all .exes are normally blocked.

bbearren said:

That's one of the main reasons I dual boot from a second drive. I can boot to the other OS if necessary and perform all necessary cleanup/de-lousing.
I've helped a number of folks with difficult infections in XP by walking them through a parallel installation and doing all the scrubbing from there.

Click to expand...

Dual-booting requires a second license, which most people don't have. Setting up a parallel install also takes quite a bit longer than just removing the infection. For people who aren't physically located around me, I just send them a bootable AV rescue disc and walk them through booting from that disc.

Click to expand...

but just deleting the virus doesnt fix much, doing it manually would still be easier, becose its the same steps minus attatching it to another computer, you still have to remove it from the regestry, delete the files which hide, mind i say, EXTREEMLY WELL, there are a number of random numeric exes and dlls and no extension files that are needed for windows operations that you do not want to accidently delete, then you still have to run virus scan again to be safe, and you still have to unhide files, fix theme, fix task bar and start menu etc, its not saving you steps, if anything its adding a step that you could achieve by just entering safe mode with networking. ive spent the last couple days looking into this, and ive thought the same thing you did, but just deleting the virus isnt going to fix the damage its done, so you can run 3 virus checks, or , spend 2 hours looking for files you dont even know the names of... im not saying your method doesnt work, especially if its about just being malicious, but in this case, it is easier to use my method, but if someone else knows of an even faster method, im sure sharing would be appreciated by all.

Robert11 said:

Hi,

Any simpler way than pulling the internal HD ?

Bob

Click to expand...

1. download sys internals
2. use process explorer from sysint, to delete anything using excessive memory with a random numeric value
3. search for you browser in the start menu, because things are hidden it wont show up unless searched or if you view hidden files
4. download loaris trojan remover, and malwarebytes
5. run malwarebytes first, then run loaris trojan remover
6. run unhide.exe, OR what i would recomend is to open elevated command prompt, and type in "attrib /d /s -h [directory name]" if that doesnt work try -h -s instead of just -h
7. reset your background
8. right click on start menu, properties, customize, and place everything back in your start menu
9. refil task bar... tada

i also use security essentials, and i would do this after all these steps to run one final check of your machine before rebooting and finalizing most of these settings

edit: incase you are wondering why i chose sys internals, this virus prevents you from using task manager, also you may find you like sys internals more. the latest stable release on msdn should work nicely

DeaconFrost said:

Thornton said:

i got ridof it without having to attatch it to another drive. its just a gazillian steps to go through though, i will poset here my updated steps.

Click to expand...

I didn't mean it as the only method. It's just the easiest and most straight-forward....especially if someone isn't compfrtable with downloading more programs and running those commands. On top of that, the infections I've had to clean...you couldn't perform those steps on the system anyway, as all .exes are normally blocked.

bbearren said:

I've helped a number of folks with difficult infections in XP by walking them through a parallel installation and doing all the scrubbing from there.

Click to expand...

Dual-booting requires a second license, which most people don't have. Setting up a parallel install also takes quite a bit longer than just removing the infection. For people who aren't physically located around me, I just send them a bootable AV rescue disc and walk them through booting from that disc.

Click to expand...

I've assisted in complete malware removal via parallel installation in instances where so-called "Malware Experts" (not on these forums, mind you) had instructed the OP, after numerous and unsuccessful attempts at using various AM tools, insisted that the only recourse was to reformat/reinstall, the infection was too deep to be removed.
Here is an example. We had to finish via email - the Admins closed the thread.

As an aside, if malware appears to persistently return, even though you've removed all traces of it on the system, you need to consider that it may have copied itself to the MBR and is restoring itself upon boot. The only way to get rid of that is to re-write the MBR or do a full format (which will obviously re-write the MBR then).

bbearren said:

I've assisted in complete malware removal via parallel installation in instances where so-called "Malware Experts" (not on these forums, mind you) had instructed the OP, after numerous and unsuccessful attempts at using various AM tools, insisted that the only recourse was to reformat/reinstall, the infection was too deep to be removed.

Click to expand...

That doesn't change the caveats of the parallel install I mentioned above. Pulling the drive is an easier, much more simple method..and allows cleaning of the MBR as well. If a person suggests a reformat before pulling the drive...they aren't a malware expert in any sense of the term. Why do you think the "docks" have been so popular to purchase? I use mine religiously at home and at work for backing up drives, recovering data, and cleaning persistent malware infections.

RE: Docks, I have two that I use for drive imaging, and they are certainly useful for other purposes, as well.

But when helping folks through forums like this, there may well be limitations on their end. One good thing about a parallel install is that it is free if the person needing the help has the installation media available, or a friend/relative from whom they can borrow it temporarily.

FliGi7 said:

As an aside, if malware appears to persistently return, even though you've removed all traces of it on the system, you need to consider that it may have copied itself to the MBR and is restoring itself upon boot. The only way to get rid of that is to re-write the MBR or do a full format (which will obviously re-write the MBR then).

Click to expand...

I recall one persistently nasty one that would replicate itself from two innocent-looking text files over the course of 4 reboots of the PC. It's been a few years and I can't remember the name of the variant, but the two text files (once found) proved to be its Achilles heel.
It also involved a bunch of registry work, too.

It's been a while since I've had to do a parallel OS install, but it usually leaves the system in a temporary state. At least that's how it used to be. A parallel install would always allow the person in to backup their data, but then they'd be doing a clean install afterwards. Doing so also wouldn't get to any boot viruses that remain and would only reinfect the new install.

I understand your point about doing what's easiest and best for people on the forums...and that's why I am recommending the drive pull. You don't need a dock to do so. For example, given your post. If you were to head over to a friend or relative's house for the media...you could just bring your drive and pop it in their case. Anyone who would be a "go to person" for cleaning malware would be equipped for this. Most mom and pop shops would clean the virus in this method for a very small fee as well. Aside from being easier, it guarantees a clean drive...as the drive isn't running or boot any OSes.

bbearren said:

innocent-looking text files over the course of 4 reboots of the PC.

Click to expand...

Not to sound like I am hounding on the same point...but those kinds of malware are easily removed when the drive is connected to another system. That was the point I was trying to make from the beginning. Instead of poking around with a system and trying different scans and apps...I go right to the solution.