Smart Engine

[jameson]

A friend has innocently downloaded Smart Engine a rogue anti spyware

and it has done bad things to her computer. She did a system restore and the computer Windows 7 is back to normal as far as we know. However, we have searched for Smart Engine on her computer through "Program Files" and "Computer/Program files and can`t find it to remove. Could you help please to find where it is?

 

[Tews]

Here ya go...

Automatic removal instructions for Smart Engine

1. Reboot your computer in Safe mode with networking.
1.1 Restart your computer.
1.2 After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
1.3 Instead of Windows loading as normal, a menu should appear.
1.4 Select “Safe mode with networking” and press Enter.

2. Reset Internet Explorer proxy settings.
2.1 Run Internet Explorer.
2.2 Click Tools -> Internet Options.
2.3 Select Connections Tab and click to Lan Settings button.
2.4 Uncheck “Use a proxy server” box.
2.5 Click OK and click OK again.

3. Remove Smart Engine and associated malware.
3.1 Download Malwarebytes Anti-malware or SuperAntispyware.
3.2 Install it.
3.3 Perform a full scan. The scan may take some time to finish,so please be patient.
3.4 Remove what it found.
3.5 Reboot your computer.

4. Reset HOSTS file
4.1 Download OTM by OldTimer from here.
4.2 Run OTM, paste the following text in “Paste Instructions for Items to be Moved” box:
:Commands
[resethosts]
4.3 Click the red Moveit! button. Close OTM.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated Smart Engine files and registry keys:

C:\Documents and Settings\All Users\Application Data\da2933\SMda2_2121.exe
%UserProfile%\Application Data\Smart Engine
%UserProfile%\Application Data\Smart Engine\cookies.sqlite
%UserProfile%\Desktop\Smart Engine.lnk
%UserProfile%\Start Menu\Smart Engine.lnk
%UserProfile%\Application Data\Smart Engine\Instructions.ini
%UserProfile%\Start Menu\Programs\Smart Engine.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Engine.lnk

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Smart Engine
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download | RunInvalidSignatures = “1″
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”

source

 

[jameson]

Smart engine

Here ya go...

Automatic removal instructions for Smart Engine

1. Reboot your computer in Safe mode with networking.
1.1 Restart your computer.
1.2 After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
1.3 Instead of Windows loading as normal, a menu should appear.
1.4 Select “Safe mode with networking” and press Enter.

2. Reset Internet Explorer proxy settings.
2.1 Run Internet Explorer.
2.2 Click Tools -> Internet Options.
2.3 Select Connections Tab and click to Lan Settings button.
2.4 Uncheck “Use a proxy server” box.
2.5 Click OK and click OK again.

3. Remove Smart Engine and associated malware.
3.1 Download Malwarebytes Anti-malware or SuperAntispyware.
3.2 Install it.
3.3 Perform a full scan. The scan may take some time to finish,so please be patient.
3.4 Remove what it found.
3.5 Reboot your computer.

4. Reset HOSTS file
4.1 Download OTM by OldTimer from here.
4.2 Run OTM, paste the following text in “Paste Instructions for Items to be Moved” box:
:Commands
[resethosts]
4.3 Click the red Moveit! button. Close OTM.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated Smart Engine files and registry keys:

C:\Documents and Settings\All Users\Application Data\da2933\SMda2_2121.exe
%UserProfile%\Application Data\Smart Engine
%UserProfile%\Application Data\Smart Engine\cookies.sqlite
%UserProfile%\Desktop\Smart Engine.lnk
%UserProfile%\Start Menu\Smart Engine.lnk
%UserProfile%\Application Data\Smart Engine\Instructions.ini
%UserProfile%\Start Menu\Programs\Smart Engine.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Engine.lnk

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Smart Engine
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download | RunInvalidSignatures = “1″
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”

source

Thank You for your extensive reply. However, my friend lives quite a long distance away from me and also she is not technically minded so it would be difficult to explain to her over the phone. I told her to download Internet Security and it found Smart Engine and deleted it. So, hopefully that will get rid of this thing.

 

[Jacee]

Hi jameson, send her this link Remove Smart Engine (Uninstall Guide)

If she can't get through this by herself, then tell her to register at Bleeping Computers here. It's completely free with no hidden strings attached.
And post her problem in the Malware forum
Virus, Trojan, Spyware, and Malware Removal Logs - BleepingComputer.com
One of our Malware Response Team members will guide her through the removal.

 

[jameson]

Hi jameson, send her this link Remove Smart Engine (Uninstall Guide)

If she can't get through this by herself, then tell her to register at Bleeping Computers here. It's completely free with no hidden strings attached.
And post her problem in the Malware forum
Virus, Trojan, Spyware, and Malware Removal Logs - BleepingComputer.com
One of our Malware Response Team members will guide her through the removal.

I sent her that link and when she tried to run StopZilla it shut down her computer

.

 

[Corrine]

Hi, jameson.

I suggest you emphasize to her the importance of following the exact instructions in the provided link and not go off on her own.

 

[Jacee]

She doesn't want or need StopZilla!

She needs to read the instructions and follow them carefully.

 

[jameson]

She doesn't want or need StopZilla!

She needs to read the instructions and follow them carefully.

You could be right there but i tried it on my Windows XP and after saving it i clicked on run and found later that the volume on my computer was gone, so i had to system restore to get it back. She doesn`t want or need StopZilla???

 

[Jacee]

Are you saying that you ran StopZilla on your XP, and it caused you to lose the sound?

 

[jameson]

Are you saying that you ran StopZilla on your XP, and it caused you to lose the sound?

Yes that`s what i said.

 

[Jacee]

LOL! ... that has nothing to do with the link I posted to Bleeping Computers Tutorial to help your friend

 

[jameson]

LOL! ... that has nothing to do with the link I posted to Bleeping Computers Tutorial to help your friend

I`m not suggesting that but there`s something in StopZilla that is not safe particularly when something strange happened on two different computers. She`ll have to try something else.

 

[PandaCloudAntiv]

Hey Tews thanks for your descriptive explanation on how to remove software if its not appear in program file.Safe mode is really a good zone where only required software are running and nothing else this way safe mode can be used to remove some viruses, Trojans. If you know exact location of your computer virus file then you can remove that .exe or .bat(virus file) by using safe mode.