S.M.A.R.T. HDD - Are we clean?

mommysews · Sep 18, 2012

Good evening!

Our daughter somehow managed to get the smart hdd nonsense on her laptop. She uses it daily for school (eLearning - High School), so it could have come from anywhere. ~sigh~

I tried the Read & Run, but the malware blocked the tools. I finally managed to get the thing shut down using the steps at www.bleepingcomputer.com/virus-removal/remove-smart-hdd
Malwarebytes yanked it out eventually.
I used unhide.exe to restore a visual on her files and shortcuts.

I then ran the steps of the Read & Run.

I am attaching the logs in the hopes that someone can give them a quick glance over to make sure that we haven't missed anything.

Still some personal settings to restore, but hopefully we are good to go again.

Can I revert the UAC and toggle Restore at this point?

With much thanks,
Julia

chaslang · Sep 18, 2012

You are in pretty good shape. Did you get all of your file unhidden? Did you run Unhide ?\

Shutdown Avira and Spybot's Teatimer and then do the below.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: (no name) - {ebd898f8-fcf6-4694-bc3b-eabc7271eeb1} - (no file)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

After clicking Fix, exit HJT.

Also delete the below files:
C:\ProgramData\-Yyr6I95qx0P0t6
C:\ProgramData\-Yyr6I95qx0P0t6r
C:\ProgramData\Yyr6I95qx0P0t6

mommysews · Sep 18, 2012

Thanks Chaslang,

I think that unhide.exe did make all of the files visible again. I suppose that I will know for sure if my teenager complains that she can't find something. She is a very serious student, so she'll notice quickly if there is a problem. Even the few hours that it took for me to get this issue fixed up caused her great concern.

As you suggested, I did run the hijackthis and deleted those files without any trouble at all.
Thank you for giving this a look so quickly.

Would it be useful to create any more logs? Or are we good to go as is?

I do really appreciate you putting the time and effort into creating and updating the Read & Run First pages. It makes the whole process so much more expedient.

I have given the "don't click on anything" lecture to our daughter again, as well.

Thanks again for sharing so generously of your time and experience.
Julia

chaslang · Sep 19, 2012

You're welcome.

mommysews said: ↑

I think that unhide.exe did make all of the files visible again. I suppose that I will know for sure if my teenager complains that she can't find something.
Click to expand...

Well I will provide final instructions below but do not run them until you are sure nothing else is missing. We don't need anymore logs.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.

Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

S.M.A.R.T. HDD - Are we clean?

mommysews Private E-2

Attached Files:

HitmanPro_20120918_1823.log

mbam-log-2012-09-18 (18-01-23).txt

MGlogs.zip

RKreport[1].txt

TDSSKiller.2.8.10.0_18.09.2012_18.11.01_log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

mommysews Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member