infected with smart hdd, tried everything i could think of... help!

[libo]

I think that my laptop has been infected with smart hdd. I tried running malwarebytes, but i can't install any new program anymore, not even in safe mode.

Can anybody help me?

thanks in advance,

Libo

[Maniac]

Hello Libo! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

• If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
  
• I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
  
• Make sure you read all of the instructions and fixes thoroughly before continuing with them.
  
• Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
  
• Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
  

Step 1

Follow the instructions here and post the log file if there is success.

http://forums.malwarebytes.org/index.php?showtopic=85715&view=findpost&p=434002

Step 2

In both cases, follow the instructions here and post both log files:

http://forums.malwarebytes.org/index.php?showtopic=9573

In your next reply, post the following log files:

• Malwarebytes' Anti-Malware log
  
• DDS log with Attach.txt

[libo]

Hello Maniac. Thanx for replying to my post.

I can't run any program at the moment, because my programs folder isn't visable anymore. I can't download DDS, as i cannot connect to the internet anymore, as all programs are hidden somewhere.

I've then transferred DDS from another computer unto a flash disk, and then onto the infected machine. I ran it in safe mode, as that was the only possibilty. No report was given, and everything froze. I've tried to restart, but now the laptop doesn't do anything anymore.

I think this is one for a proffesional now, as i've tried everything i can.

Anyway, thanx for wanting to help me!

[Maniac]

I've tried to restart, but now the laptop doesn't do anything anymore.

By this I understand that the laptop is not boot.

You need another clean PC for the next instructions. Do you have a empty CD or USB?

[libo]

It gives me the screen on wich i can choose wether i want to start in Safe mode, in safe mode with networking or normal start up.

But regardless of wich i choose, i always get the same screen again.

Yes, i have an empty stick or an empty cd, and i have a computer that is not infected.

[libo]

Oh, btw, i've already tried booting from a CD, with Kaspersky rescue disk 10, that worked, i was able to run kaspersky scan, but it turned up with nothing. i was unable to update kaspersky however...

[Maniac]

Which Windows OS is yours? Windows XP or Vista/7?

[libo]

it's XP

[Maniac]

1. Download OTLPEStd.exe to your desktop
   
2. Download OTLPENet.exe to your desktop
   
3. Ensure that you have a blank CD in the drive
   
4. Double click OTLPEStd.exe and this will then open imgburn to burn the file to CD
   
5. Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
   
6. Reboot your system using the boot CD you just created.
   Note : If you do not know how to set your computer to boot from CD follow the steps here
   
7. As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
   
8. Your system should now display a Reatogo desktop.
   Note : as you are running from CD it is not exactly speedy
   
9. Double-click on the OTLPE icon.
   
10. Select the Windows folder of the infected drive if it asks for a location
    
11. When asked "Do you wish to load the remote registry", select Yes
    
12. When asked "Do you wish to load remote user profile(s) for scanning", select Yes
    
13. Ensure the box "Automatically Load All Remaining Users" is checked and press OK
    
14. OTL should now start.
    
15. Press Quick Scan to start the scan.
    
16. When finished, the file will be saved in drive C:\OTL.txt
    
17. Copy this file to your USB drive if you do not have internet connection on this system.
    
18. Right click the file and select send to : select the USB drive.
    
19. Confirm that it has copied to the USB drive by selecting it
    
20. You can backup any files that you wish from this OS
    
21. Please post the contents of the C:\OTL.txt file in your reply.
    

[libo]

Do i download both OTLPEStd.exe and OTLPENet.exe, or just one of them? And does this bootcd has to be written on a computer with OS XP (the infected pc has OS XP, the pc on wich ? Because i'm in another location right now, and if i start up the second .exe, it asks if i want to delete the disk first.

[Maniac]

It is necessary to download both files. No matter what operating system will be burned, but it is important not to be the infected one.

[libo]

Then i have a problem: i burn the first one to cd, and then try to burn the second one, but then imageburner wants to delete the cd first, before wanting to burn.

[Maniac]

Do this only with OTLPENet.exe and proceed further.

[libo]

Hey Maniac, i've tried the above, and i got to point 10. i can't open the c-drive, i get the message "C:\ is not accessible. The file or directory is corrupted and unreadable".

What do i do next?

[Maniac]

Boot back into the OTLPE CD. Bring the computer to a command prompt.

At the command type you will want to type the following followed by ENTER:

CHKDSK C: /F

This command may time a considerable amount of time to complete. Please be patient while it is running.

Finally, try again with OTLPE.

[libo]

Hey Maniac,

had to call in help from someone, he managed to format the c-drive, and to re-install all programs. I've only lost a few pictures, none of them of importance.

Thanx for your help and patience,

Grtz,

Libo

[Maniac]

Thanks for letting me know, Libo!

Some malware prevention tips:

http://forums.malwarebytes.org/index.php?showtopic=104379&pid=515983&st=0entry515983

Safe surfing!

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!