SMART HDD Virus/Trojan

[JohnRoss]

 

Just to warn you we had a Trojan or Virus called SMART HDD appear on our machine yesterday. We have no idea where this came from it just appeared. What it does is put up a window which shows a scan of your computer and suggests you have problems with the hard drive and then invites you to purchase the appropriate software to get rid of the hard drive problems. The text was in English. I noted that several desktop icons had disappeared.

 

Now from what I have found out this is a scam. There is nothing wrong with your hard drive other than this virus/trojan. It was found using our virus scanner but normal deletion methods prove ineffective. I got rid of it in the end by starting the computer up in safe mode, holding down F8 during start up, and then doing a search for SMART HDD in the search box you get on clicking the Start button. Having found and deleted several related files and then checking the run on start-up progam list using CCleaner and running the virus scanner again to confirm that the Smart HDD sofware had gone I used system Restore to set the computer back a few days. All the missing icons reappeared. After that Updates were done on the virus scanner and Windows and repeat scans were run to make sure all traces of the bug had gone. A hard disk Defrag was then initiated. What worries me is that we had not done any downloads or clicked on any new links that could have resulted in this infection so where it came from is a bit of a puzzle. Has anybody else had this bug here in France of late?.....JR

 

PS Microsoft Security Essentials finds it so might be worth doing a scan of your machine. Spybot did not find it.

[pachapapa]

If MSE is up to date not much will escape it.

A lot of it around since start of April.

I usually do a System Restore to finally resolve the possibility of hidden files still lurking.

http://www.youtube.com/watch?v=dRwDGsNdf6k

[JohnRoss]

Yes MSE seems quite good but whilst it found the bug it could not delete it. It appeared to do so but then SMART HDD started up again. Interesting video by the way so thanks for that. If it is that recent then maybe Spybot will be updated so that it can also find it soon. I update Spybot and run it and CCleaner about once a week. Full scans on MSE take for ever but I run a quick scan everyday. MSE updates seem to be automatic on a daily basis. I think that SMART must get into the run on startup list which must be why I could kill it in Safe Mode as it would not have been running...........JR 

[pachapapa]

Not new dates from 2010 when it offered a defragmenter.

The french web gives lots and lots of problems with your new version from the beginning of april.

[JohnRoss]

Sorry a bit confused, which software has no new dates and offered a defragmenter and new version of what? I did run another MSE full scan and 2.5 hours later it reported finding another trojan WIN32/ALUREON.FE which has some worrying characteristics however that seems to have been deleted  by MSE ok. I wonder that and the SMART HDD trojan are related in some way. I must do full scans more often methinks!...........JR

[AnOther]

The current version of this piece of malware seems to require quite a bit of effort to eradicate completely:

http://malwaretips.com/blogs/uninstall-smart-hdd

Once again I extol the virtues or HD imaging.

Regardless of what problem has occurred or what nasty deep rooted virus or malware you may have contracted with imaging you can COMPLETELY RECOVER from ANYTHING in a matter of minutes. There is simply nothing else which can achieve this and if practiced by everybody then it would probably put 50% of computer repair techs out of work overnight !

http://www.acronis.eu/homecomputing/products/trueimage/

[cooperlola]

AnO: My Control Panel on W7 has a "Create a System Image" option which I do, from time to time, onto an external hard drive.  I assume this works as well as anything doesn't it?  Or do you think Aconis is better?  I'm useless at this sort of stuff but have always assumed (hoped) that what I assume is in effect a copy of my system in an unconnected (as it were) place would cover me.

I was targetted by the earlier version of this horrible bit of whatever once but was alerted by AVG so happily did not get sucked in.  However, when I subsequently googled it there were some nasty tales about it even then.

[AnOther]

I've never used the Win 7 imaging facility but according to this you need to have access to the Control Panel or have the image on a bootable CD or DVD, or use a windows startup disc to kick it off. If the machine were totally goosed you would not be able to restore directly from an external HD without first using some sort of bootable device.

http://windows.microsoft.com/en-US/windows7/Restore-your-computer-from-a-system-image-backup

It's also described in Win7 help under 'imaging'.

Acronis has the facility to create bootable media and after booting from that you can access images on external devices or even from a network.

[cooperlola]

There's a "create a system repair disc" option (which I also do.)  I take it that's the thing?  I'll read your link, thanks.

[AnOther]

I guess that would be it, must give it a whirl sometime.

[cooperlola]

[quote user="AnOther"] must give it a whirl sometime.
[/quote]I've read the link you left, plus the related ones on creating the image in the first place and it does indeed apear that I am doing what I thought I was!  While we're on this subject, how reliable do you reckon external hard drives are?  I get the impression that one will never know until one goes wrong and loses all the data.  A bit like anti-virus software really - it's always the best one until it misses the bug which gets into your system.[;-)] Not that it's happened to me - yet - but I have had a major computer failure which is why I jumped at the system image option when I went over to 7.

[AnOther]

The thing about hard drives is that being mechanical devices they WILL eventually fail, the only question is when !

External drives are exactly the same as those used inside laptops so notwithstanding the increased risk of physical damage due to dropping or other poor handling should be equally robust. Over the years I have had dozens of external drives both 3.5" and 2.5" and can only recall one 2.5" drive actually failing of it's own accord and that was early in its life and was replaced under guarantee.

I create my images on a second partition on the machine's HD initially but then copy them off to a NAS (Network Attached Storage) HD.

For those who are still not onboard I cannot emphasis strongly enough that imaging is an absolute lifesaver which effectively make you immune from just about anything and everything !

[Quillan]

That does rather assume that there are no trojans in your image which you can never garentee. They may be so new that your virus software may not have found them before you made the image.

[JohnRoss]

Thanks for the interesting comments. One thing I have noticed is that since deleting these trojans I have received no scam or spam messages. Until today I have been receiving two or three emails from Nigeria every day for months now offering me vast sums of money if I give personal information. Not to mention people who want to send me compensation from the UN or an ATM card worth millions if I pay a fee in advance. They really must think that I came down in the last shower of rain but sadly some folk are taken in.  Any connection do you think or just coincidence?......................JR

PS Spam and scam emails started up again today so guess they all decided to have a day off, i.e  indeed just coincidence.