Spyware, viruses, & security forum: S.M.A.R.t HDD virus

Ralph..

Did you try the instructions in the below removal guide?

Remove Smart HDD (Uninstall Guide)

I would suggest scanning with Malwarebytes' Anti-Malware in addition to SUPERAntiSpyware, as indicated in the guide. It's free. And there's never harm in another opinion.

Best of luck..
Carol

Ralph..

I just now noticed you posted at another forum. As I just mentioned to a another member, creating duplicate posts, creates confusion and duplicate work.

The only further suggestion I will make is to start from scratch and follow ALL the steps in the guide. To include making use of the Rkill and Unhide tools.

System restore will help in some instances. In my opinion, it should only be used as a last resort.

Best of luck..
Carol

Please follow Carol's advice to the letter.

Be aware that there is a possibility that a rootkit has been installed as well. Alureon-K is one such. RogueKiller is a good antimalware app to unhide folders that are hidden as it will stop the processes running by HDD S.M.A.R.T rogue program. It is important to not reboot after running RogueKilller as rebooting will cause the rogue processes to start up once again.

Proceed with your cleaning process as described above in Carol's first post.

It is also important to not run any temporary file cleaners, as doing that may remove some files/folders you may want to keep. If you do, it may be difficult to restore these files later. A popular temp cleaner is CCleaner, for example.

Again, do not run a temp file cleaner until your system is clean of this infection

Ralph...

>>..may have been from having multiple antivirus programs nig at one time<<

That "changes the picture"...

Have you uninstalled ALL anti-virus software, with the exception of the one which you plan to keep? Microsoft Security Essentials (MSE) especially, does not "play well" with other's. By uninstalling the other's, It should eliminate any problems which were due to conflicts. Make use of the A/V uninstall utilities listed below. It is in your best interest to remove all other A/V's. Not just disabling them.

See Microsoft Security Essentials - Installation Checklist and Frequently Asked Questions

Take special note to #3 where it states:

Remove ALL real-time anti-malware products that were ever installed on your PC (Norton, McAfee, TM, AVG, Avast, Avira, ESET, etc.) Uninstall your previous real-time anti-malware. Then, use the removal/cleanup tools in this article. Not only should you remove your current anti-malware product(s), you should also uninstall any free or trial anti-malware products that may have been installed on your PC when purchased, even if never activated. Some anti-malware products have their own firewall. Removing/uninstalling these products will (or should) enable the Windows Firewall. MSE will use the Windows Firewall by default. After removal and cleanup of all other anti-malware products, restart your PC and check that the Windows Firewall is ON. You can check the status of the Windows Firewall in the Action Center (or Security Center if XP) of your PC, or via the Control Panel.

I'm questioning 4 instances of Alureon K. Did MSE report it? How did you go about removing it. It involves more than just a "quick scan" with A/V or A/S software.

Carol

udscbt..

Did you follow Step #19? Please read "Unhide.exe - A introduction as to what this program does" Sometimes it's necessary to run it more than once. (See Unhide Download )

Note where Larry Abrams (Grinler) writes:

This infection will also delete shortcuts in various folders on your computer so that you can no longer find them pinned to the taskbar, in the quick launch, or in your Start Menu. When the infection deletes the shortcuts it will store a backup copy of them in the folder %Temp%\smtmp. Using this backup, we can then restore the files to their proper location so you can find them once again under your Start Menu and in other locations. It is very important, though, that if you are infected with this family of infections that you do not delete any of the files in your %Temp% folder and that you do not run any temp file cleaners as they will delete this backup folder. With this folder removed, we will not be able to restore the shortcuts back to their proper location.

Just below the above, you will find instructions to (manually) restore the Start Menu and Desktop items. Also see "updates", which includes links for those of you who no longer have the %Temp%\Smtmp folders.

You stated (#2) you downloaded Secunia's Personal Software Inspector (PSISetup.exe) but can't find it on your desktop. Following with there are no icons are your desktop. Did you check your Program Files folder, to see if it's located there? And did you download it from here? http://secunia.com/vulnerability_scanning/personal/download_psi/

At this point in time, I would recommend against making use of System Restore.

I would further suggest you run a scan with Hitman Pro to make sure you're completely clean. It's free to use without a license. If a virus is found, you will receive a free 30-day license to remove the threat.

http://www.surfright.nl/en/home/

If you're continuing to encounter problems, let us know.

Best of luck..
Carol

udscbt..

My apologoes for not getting back to you sooner. I'm having a problem understanding a couple of things. In addition to "digesting" some of what you included in your post. /

• You indicated (#2) you manually restored the Start Menu items. Yet in your first response, you didn't know what to do with the "Documents and Settings\My Name\Local Settings\Temp\smtmp" folder, and the two sub-folders. Does this mean you didn't copy what was in the %Temp%\smtmp\ folders, and place them in the C:\Documents and Settings\All Users\Start Menu folder?

Did you find folders numbered 1, 2 and 4? It's my understanding the 4 folder holds your desktop items, which would be copied to C:\Documents and Settings\All Users\Desktop. Were the icons the only problem you had with your desktop, after the disinfection process? No background issues?

Quite frankly, I'm more concerned about what Hitman Pro found. In addition to what Secunia Software Inspector reported. Not to mention, the fact you have 'several anti-virus applications' installed.

• Let's start with Hitman Pro. A bootkit is nothing to be scoff at. It's a rather serious infection. I'm surprised none of your other scanners detected it. Did Hitman Pro eventually give you "a clean bill of health"?

Just to be sure, run a scan with the Kaspersky's TDSSKiller. Instructions are listed below. (Additional instructions can be found here)

http://support.kaspersky.com/viruses/solutions?qid=208280684

• Please post a list of the anti-virus applications you have installed. Even if you haven't used them, or if they're only trial versions. I'll provide a list of utilities for each, for you to use to (completely) remove them from your system. If it's McAfee you wish to keep, you're going to have uninstall the other's. You're doing yourself a disservice, by having more than ONE.

• Personal Software Inspector: 9 were reported as "insecure"? Do you update the software you have installed? Some are more important than other's, as they pose a security risk. (Two examples being, Java and Adobe Flash Player. Also Adobe's Reader, if installed.) I would suggest putting aside some time, to update whatever PSI deems insecure. If you have any questions, please ask.

I don't have PSI installed, only because I update on a constant basis. But I do make use of Secunia's Online Software Inspector (OSI) periodically. PSI should provide download links, as does their OSI. 12 End-of-Life? Are these programs you use? It may be a good time to re-evaluate the software you're using. (Or not using)

Again, if you have any questions or doubts, just ask.
Carol

History shows.......

Whether it be 2 weeks or 2 months, I'll still be here.

Carol

Hi "udscbt aka georges" ..

I too found London a little damp. I also found Harrod's to be a great place to take shelter.

You wrote, "Should I do something about a. and/or b.?". I'm not sure what PSI constitutes as "insecure". I've personally found what Secunia reports (at times) to be lacking in certain areas. IF you applied all the Microsoft patches for Internet Explorer 8, it should be as secure as IE can be. The same holds true for the other Microsoft products.

• You asked if you should continue to run PSI. It may not be a bad idea, considering what history has proved. You can either keep PSI, or uninstall it and use their "Online Software Inspector (OSI)".

• In regard to Java:

Test your version here: http://www.java.com/en/download/testjava.jsp

You have the option of updating to the most recent version of Java JRE 6, which I believe will reach "end of life" in November of this year. Or.. you can update to Java 7 now. Your choice.

See: http://www.oracle.com/technetwork/java/javase/downloads/index.html

Remove all old versions of Java. These instructions should be of help with the above. I make use of JavaRa which removes leftover files. Again, your choice. It's not a necessity.

• Adobe Flash Player

To verify which version is installed, go to the About Flash Player page. If you're using Opera in addition to Internet Explorer, it's necessary to check both browsers.

Flash Player v11.3.300.257 is the latest version for Internet Explorer. And v11.3.300.262 for Opera.

You can use the built-in background updater to upgrade to the new releases, or download them from the Adobe Flash Player Download Center. The direct links for the installer can be found at the Adobe Flash Player Distribution.

• If you are using the Adobe Reader, make sure it's updated! There are critical updates released periodically. They're usually posted at this forum. Otherwise, you always have the option of using the built-in updater. Open the Reader then go to "Help" > "Check for Updates." The updates are also available here: http://www.adobe.com/products

You also asked if you need to buy Hitman Pro. I don't see the need to at this point. You can always use the free versions of Malwarebytes' Anti-Malware and/or SUPERAntiSpyware as stand-alone scanners.

McAfee? That's up to you. But don't sell the free A/V's short. There are a few good one's, which many of our members use. For instance:

• Avira Free Antivirus
• Microsoft Security Essentials (MSE) - Should you select MSE see: "Checklist for installing Microsoft Security Essentials"
• Avast Free Antivirus

Lastly, you might want to consider using the Firefox browser. The only time I use Internet Explorer is to install the monthly updates. Just something to consider.

And another book has come to an end...
Carol