BleepingComputer.com: After trying to remove Hard Drive Diagnostic, my computer is seriously messed up

OK I'll try to be as clear and direct as I can.

Running: Windows Vista Home Premium

The first sign of trouble came when I got a "hard disk failure" warning and Windows crashed. I restarted the computer and to my horror, the desktop was black, with only an Internet Explorer icon. Everything else was gone, even the Start Menu was blank. Then the fake antivirus popups and this message popped up: "The system has found problems with one or more installed IDE/SATA hard disks." I first ran a full scan on my PC with McAfee AntiVirus Plus, which I have. It found 2 problems and I restarted, but got the same popups/warnings/missing files upon rebooting. Crap.

I Googled and found out it's a trojan called Hard Drive Diagnostic, so I used bleepingcomputer's official thread about removing it, found here: (http://www.bleepingcomputer.com/virus-removal/remove-hard-drive-diagnostic) and followed the steps first in Safe Mode with Networking (I've been told this is what you do to remove viruses). However RKill found no processes to stop, so I rebooted in Normal mode and ran Rkill again. This time it stopped a malware process, and I proceeded to run a full MalwareBytes scan (without rebooting, as instructed). After a 2 hr 30 minute scan, it found 10 Objects Infected (never had a number this high before!) and I Quarantined/erased and rebooted.

To my dismay, the fake virus scanning popups/warnings popped up. Still, I proceeded with the next step and downloaded Unhide.exe, ran it. So some of the desktop icons re-appeared, except a few are still missing (like the Recycle Bin). The Start menu is STILL blank - I have to click "All Programs" to get a list. But here's the worst part that has me worried/dismayed: Several key files/apps on my PC are not launching. Double clicking the Microsoft Word desktop icon brings up the message: "C:\Program Files\Microsoft Works\WksWP.exe - Application not found". Double clicking Firefox or iTunes brings up a window asking me to choose from a list of programs to open it with... and the only option available is Adobe Reader 9.3, which cannot open the files.

Please help me! Something seriously screwed my computer up and even though the fake antivirus popups have stopped, my files are not working correctly and I can't launch key programs. I'd like to know if I screwed something up during the removal process, or if I still have nasty malware/viruses on my PC that haven't been found!

Thank you.

This post has been edited by Blade Zephon: 15 June 2011 - 10:29 PM
Reason for edit: Moved from Vista to AII. ~BZ

Please download exeHelper by Raktor from one of the two links below and save it to your Desktop.

Link 1
Link 2

• Double-click on exeHelper.com (or exeHelper.scr) to run the fix tool.
  If using Vista, right-click on exeHelper and select Run As Administrator.
  
• A black window should pop up, press any key to close once the fix is completed.
  
• A log file called exehelperlog.txt will be created and should open at the end of the scan)
  
• A copy of that log will also be saved in the directory where you ran exeHelper.com
  
• Copy and paste the contents of exehelperlog.txt in your next reply.

Note: If the window shows a message that says "Error deleting file", please re-run the tool again before posting a log and then post the two logs together (they both will be in the one file).


This is a manual fix for Vista/Windows 7 users:

1. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\1
and paste it to this folder:
C:\Program Data\Start Menu

2. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\2
and paste it to this folder:
C:\Users\user_name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

3. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\3
and paste it to this folder:
C:\Users\user-name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

4. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\4
and paste it to this folder:
C:\Program Data\Desktop

-- Note: The "Start Menu", "Quick Launch" and "Desktop" folders are system folders. In order to see them, you need to Reconfigure Windows to show hidden files, folders. In Windows Explorer go to Tools > Folder Options and click on the View tab. Under Advanced settings > Files and Folders > Hidden Files and Folders, uncheck "Hide Protected operating system Files (recommended)" and hit Apply > OK. In order to access the "Start Menu" folder, you may need to "take ownership" of that folder as shown here.

If the above does not work, then you can restore the defaults for the Start Menu and Administrative Tools as follows:

• Windows 7: Restore Default Shortcuts in Start Menu All Programs
  
• Vista: Restore Default Shortcuts in Start Menu Programs
  
• Restore the Administrative Tools folder with vista_ultimate_admintools.zip

For any other missing program shortcuts you will probably need to reinstall the application or manually create new shortcuts.