Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article

Skip to comments.

S.M.A.R.T. HDD Virus Removal
5/4/12 | EQAndyBuzz

Posted on 05/04/2012 1:49:50 PM PDT by EQAndyBuzz

Last night, my lovely's computer started kicking out messages about her disk being unreadable and she needed to run diagnostics. Thankfully she didn't.

I ran RKILL to get rid of the processes and am currently running a Malwarebytes full scan to hunt this thing down.

I checked Internet Options to see if there was a proxy server involved, but there does not appear to be any.

Problem I am having is I cannot 1) boot up to safe mode (it is asking for operating system to use) and 2)from Start tab, I cannot get to any screens to do a system restore.

Any ideas?


TOPICS: Computers/Internet
KEYWORDS: computervirus; malware; virus
Navigation: use the links below to view more comments.
first previous 1-2021-4041-50 last
To: MARTIAL MONK

Or, he just likes to talk a lot. :-)


41 posted on 05/04/2012 6:17:49 PM PDT by ataDude (Its like 1933, mixed with the Carter 70s, plus the books 1984 and Animal Farm, all at the same time.)
[ Post Reply | Private Reply | To 20 | View Replies]

To: liege; All

Some of the newer BIOS’s have log files. He should boot into BIOS setup mode and see if it has any error reports logged. I doubt it’s a virus. I think it’s a real hardware alert.

The drive is hosed.

Just as an fyi, if a drive starts giving failure alerts like this you can sometimes rescue them for long enough to copy important data - put it in a plastic bag and put it IN YOUR FREEZER for an hour or so!

True! It works! Been there!

Bot recommended for very humid climates...

and if it is truly a hardware failure, running a hundred virus scans is just about the worst thing you could do...


42 posted on 05/04/2012 7:22:45 PM PDT by djf (Life's a play, we're actors not authors, and nobody even cared to give us the script!)
[ Post Reply | Private Reply | To 31 | View Replies]

To: Bloody Sam Roberts

What’s a backup? You mean I am supposed to do something with all that file stuff that is sitting on that spinning thingy inside that big black box under my desk?

Seriously. Everything is backed up.


43 posted on 05/04/2012 9:36:33 PM PDT by EQAndyBuzz (Would you rather eat dog food or cat food? Guess it's Romney 2012.)
[ Post Reply | Private Reply | To 32 | View Replies]

To: djf

Concur. If there’s truly an imminent hard drive failure, GET THAT DATA OFF!

You can always scan it on another machine, and you can always delete the copied data if we’re wrong about failure and nothing’s infected, but it sounds to me like your OS install was ruined when the hard drive began to fail. Seen it before, got damn lucky that it was only the OS eaten. Managed to save every relevant file including game saves from the user directory, and stuff on the desktop.

But, use it as little as possible in the process of simply getting the data off the drive, and prioritize. The less that’s done to the drive, the more chance you’ll be able to save more/everything before complete failure.


44 posted on 05/05/2012 12:01:01 AM PDT by Fire_on_High (WTB new tagline, PST!)
[ Post Reply | Private Reply | To 42 | View Replies]

To: EQAndyBuzz

I got hit with a couple viruses in the past year on Windows XP that mimicked an “imminent hard drive failure” but it was all fake. The virus bypassed fully updated virus scanners and installed itself just by me going to a web page. It didn’t do any permanent damage, but was somewhat difficult to clean up. The first step I think was to download and run TDSS Killer. I don’t think you need to be in safe mode to do that, but some of these viruses will try to stop you from running that program, so you may need to rename the file. I think the virus may try to stop you from running any .exes, so that might require you to boot into safe mode and/or run the other RKill program to kill running processes. You should pick Windows XP with Networking when booting into Safe Mode. The TDSS Killer very quickly erases “rootkit” viruses which are difficult for normal virus scanners to find.

The virus’s main function was to make Google searches redirect to advertisement sites. Fixing that required me finding the hosts file and deleting the hacked entries. One version of the virus also made all files on the computer “hidden” so that it looked like they had been deleted. I think I had to highlight my entire hard drive and check off not to hide anything. And then I ran the Malwarebytes which I believe deleted some virus files and registry entries. Another thing I might have had to do is clear the whole browser cache and history, because the virus was hiding in some flash files or something like that. I also used a date-sorted search on the PC’s files to find when the virus installed itself and its location on the hard drive. I don’t remember if I needed to do that to track down the files and delete them myself or if the virus scanner was able to do that.


45 posted on 05/05/2012 12:15:25 AM PDT by JediJones (From the makers of Romney, Bloomberg/Schwarzenegger 2016. Because the GOP can never go too far left.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: John Galt's cousin
Could he take the hard drive out and install it into another computer

Yes...I have done that in order to get data from one in such condition. It ought to work. But as a boot drive...it's toast.

46 posted on 05/05/2012 5:25:39 AM PDT by Bloody Sam Roberts (I will not comply. I will NEVER submit.)
[ Post Reply | Private Reply | To 37 | View Replies]

To: djf

I had this thing a few months ago.

The virus is only emulating a SMART failure warning. There is most likely nothing wrong with his hardware.

I had to pay our IT shop to fix mine. They ran combofix, malwarebytes, superspyremover, spybot, AVG.


47 posted on 05/05/2012 5:42:25 AM PDT by 2111USMC (Not a hard man to track. Leaves dead men wherever he goes.)
[ Post Reply | Private Reply | To 42 | View Replies]

To: EQAndyBuzz
Seriously. Everything is backed up.

Excellent. Then it's time for a new drive, a cup of coffee and about an hour or so at the workbench.

"A lick of paint, she's good as new. Now give us a muffin."


48 posted on 05/05/2012 5:45:18 AM PDT by Bloody Sam Roberts (I will not comply. I will NEVER submit.)
[ Post Reply | Private Reply | To 43 | View Replies]

To: Bloody Sam Roberts

Actually, I have Kaspersky hidden on the computer in the event of this. I am going to try that one time and if it works, great. If not, my wife will have to wait a bit till I get back to fix it.


49 posted on 05/05/2012 7:27:59 AM PDT by EQAndyBuzz (Would you rather eat dog food or cat food? Guess it's Romney 2012.)
[ Post Reply | Private Reply | To 48 | View Replies]

To: Fire_on_High
I concur.
Take the drive out and don't plug it in until you are ready
to directly extract the data. Been there and lost some really
important business files. Now I have two backup drives, one for backup directly
and one to back up the backup separately and not connected to the main computer or net..
50 posted on 05/05/2012 7:40:51 AM PDT by MaxMax
[ Post Reply | Private Reply | To 44 | View Replies]


Navigation: use the links below to view more comments.
first previous 1-2021-4041-50 last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson