Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

After trying to remove Hard Drive Diagnostic, my computer is seriously messed up


  • Please log in to reply
1 reply to this topic

#1 XciteMe83

XciteMe83

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:07:30 AM

Posted 15 June 2011 - 10:22 PM

OK I'll try to be as clear and direct as I can.

Running: Windows Vista Home Premium

The first sign of trouble came when I got a "hard disk failure" warning and Windows crashed. I restarted the computer and to my horror, the desktop was black, with only an Internet Explorer icon. Everything else was gone, even the Start Menu was blank. Then the fake antivirus popups and this message popped up: "The system has found problems with one or more installed IDE/SATA hard disks." I first ran a full scan on my PC with McAfee AntiVirus Plus, which I have. It found 2 problems and I restarted, but got the same popups/warnings/missing files upon rebooting. Crap.

I Googled and found out it's a trojan called Hard Drive Diagnostic, so I used bleepingcomputer's official thread about removing it, found here: (http://www.bleepingcomputer.com/virus-removal/remove-hard-drive-diagnostic) and followed the steps first in Safe Mode with Networking (I've been told this is what you do to remove viruses). However RKill found no processes to stop, so I rebooted in Normal mode and ran Rkill again. This time it stopped a malware process, and I proceeded to run a full MalwareBytes scan (without rebooting, as instructed). After a 2 hr 30 minute scan, it found 10 Objects Infected (never had a number this high before!) and I Quarantined/erased and rebooted.

To my dismay, the fake virus scanning popups/warnings popped up. Still, I proceeded with the next step and downloaded Unhide.exe, ran it. So some of the desktop icons re-appeared, except a few are still missing (like the Recycle Bin). The Start menu is STILL blank - I have to click "All Programs" to get a list. But here's the worst part that has me worried/dismayed: Several key files/apps on my PC are not launching. Double clicking the Microsoft Word desktop icon brings up the message: "C:\Program Files\Microsoft Works\WksWP.exe - Application not found". Double clicking Firefox or iTunes brings up a window asking me to choose from a list of programs to open it with... and the only option available is Adobe Reader 9.3, which cannot open the files.

Please help me! Something seriously screwed my computer up and even though the fake antivirus popups have stopped, my files are not working correctly and I can't launch key programs. I'd like to know if I screwed something up during the removal process, or if I still have nasty malware/viruses on my PC that haven't been found!

Thank you. :(

Edited by Blade Zephon, 15 June 2011 - 10:29 PM.
Moved from Vista to AII. ~BZ


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:30 AM

Posted 16 June 2011 - 06:49 AM

Please download exeHelper by Raktor from one of the two links below and save it to your Desktop.

Link 1
Link 2
  • Double-click on exeHelper.com (or exeHelper.scr) to run the fix tool.
    If using Vista, right-click on exeHelper and select Run As Administrator.
  • A black window should pop up, press any key to close once the fix is completed.
  • A log file called exehelperlog.txt will be created and should open at the end of the scan)
  • A copy of that log will also be saved in the directory where you ran exeHelper.com
  • Copy and paste the contents of exehelperlog.txt in your next reply.
Note: If the window shows a message that says "Error deleting file", please re-run the tool again before posting a log and then post the two logs together (they both will be in the one file).


This is a manual fix for Vista/Windows 7 users:

1. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\1
and paste it to this folder:
C:\Program Data\Start Menu

2. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\2
and paste it to this folder:
C:\Users\user_name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

3. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\3
and paste it to this folder:
C:\Users\user-name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

4. Copy the entire content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\4
and paste it to this folder:
C:\Program Data\Desktop

-- Note: The "Start Menu", "Quick Launch" and "Desktop" folders are system folders. In order to see them, you need to Reconfigure Windows to show hidden files, folders. In Windows Explorer go to Tools > Folder Options and click on the View tab. Under Advanced settings > Files and Folders > Hidden Files and Folders, uncheck "Hide Protected operating system Files (recommended)" and hit Apply > OK. In order to access the "Start Menu" folder, you may need to "take ownership" of that folder as shown here.

If the above does not work, then you can restore the defaults for the Start Menu and Administrative Tools as follows:
For any other missing program shortcuts you will probably need to reinstall the application or manually create new shortcuts.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users