Remove Smart HDD / Smart Check

[Hermit]

Smart HDD is a rogue application that attempts to falsely detect problems on victim’s computer and prompts victim to pay in order to get those problems fixed.

You may be infected by Smart HDD thru other malware (which is already on your system) or may have accidentally downloaded and executed it.



Smart HDD works by performing a fake scan on your system. After the fake scan is complete, it reports that your computer is suffering from multiple problems.



If you attempt to click on Repair, the product activation prompt appears requesting you to activate the product or buy a license.



Clicking "Buy license now" will open up your web browser and brings you to the "customer support" page.



How to manually clean up Smart HDD

1) Check for suspicious processes.
Use either Windows Task Manager or any process monitoring application and check for any randomly named processes.



2) Right click and kill the running process. This should terminate Smart HDD and you will no longer see the Smart HDD icon on the system tray.



3) Then look for the following registry keys and remove them

-    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\SMART HDD
-    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\<random characters>

4) Then look for the following files in your system and remove them.

Windows XP:
-    c:\Documents and Settings\???????????\Start Menu\Programs\SMART HDD
-    c:\Documents and Settings\???????????\Application Data\Microsoft\Internet Explorer\Quick Launch\SMART_HDD.lnk
-    c:\Documents and Settings\??????????\Desktop\SMART_HDD.lnk
-    c:\Documents and Settings\All Users\Application Data\<random characters>
-    c:\Documents and Settings\All Users\Application Data\<random characters>.exe

Windows 7/Vista
-    c:\Users\???????????\Start Menu\Programs\SMART HDD
-    c:\Users\???????????\Application Data\Microsoft\Internet Explorer\Quick Launch\SMART_HDD.lnk
-    c:\Users\??????????\Desktop\SMART_HDD.lnk
-    c:\ProgramData\<random characters>
-    c:\ProgramData\<random characters>.exe

5. Missing Icons

The dropper of this infection also hides and moves some of your short cuts. To un-hide the icons, right-click on your user profile folder and make sure that the "Hidden" check box is unchecked.
User Profile folders are in the following locations below.

Windows XP: C:\Documents and Settings\
Windows Vista/Win7: C:\Users\ and C:\ProgramData

If un-hiding still does not restore your icons, they may have been moved to %temp%\smtmp\. You will find folders with number "1", "2" and "4" as their names. That is where your missing icons would be located. Just copy and paste them to your Start Menu folder.

Windows XP: C:\Documents and Settings\[username]\Start Menu
Windows 7/Vista: C:\Users\[username]\AppData\Microsoft\Windows\Start Menu\


More screenshots of Smart HDD