Hard Drive Diagnostic is a piece of malware that deliberately reports numerous non-existent hard drive, Windows registry and system errors. It's from the same family as HDD Scan and Disk Doctor. So, it's basically the same malicious software with a new name. I'm pretty sure we'll see more rip-off rogues with the same graphical user interface and false computer problems. Hard Drive Diagnostic malware usually comes from fake online scanners and other bogus websites. However, the scammers can use the other ways of promoting this bogus and useless disk defragmenter, e.g. spam, infected Ads and software vulnerabilities. Once Hard Drive Diagnostic is installed, it will change your Desktop and hide some of your icons. Then it will display a fake error message and begin its fake system scan. After the fake scan, the rogue program will give you a list of supposedly detected system errors and will recommend you to run defragmentation.
- Drive C initializing error
- 32% of HDD space is unreadable
- Read time of hard drive clusters less than 500 ms
- Ram Temperature is 83 C. Optimization is required for normal operation.
- Registry Error - Critical Error
- GPU RAM temperature is critically high. Urgent RAM memory optimization is required to prevent system crash
While running, HardDrive Diagnostic will block some fo your programs and state that there is a hard drive disk error or something. The fake message reads:
Windows detected a hard drive problem.
A hard drive error occurred while starting the application.
Windows cannot find [program]. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.Hard Drive Diagnostic will also displat fake alerts and notifications from Windows taskbar:
Critical Error!
Damaged hard drive clusters detected. Private data is at risk.
Critical Error
Hard Drive not found. Missing hard drive.
Critical Error
RAM memory usage is critically high. RAM memory failure.
Critical ErrorIt goes without saying that you should remove Hard Drive Diagnostic malware from your computer as soon as possible. Do not fall victim to this fake program and do not bay it! It's a scam. If you have already purchased this bogus program then please contact your credit card company and dispute the charges. Then restart your computer in safe mode and do system restore. If that won't help then please follow step by step Hard Drive Diagnostic removal instructions below. If you have any questions or additional information about this malware, please leave a comment. Good luck and be safe online!
Windows can't find hard disk space. Hard drive error
Hard Drive Diagnostic removal instructions:
1. Open Task Manager (Ctrl+Alt+Delete).
2. Click on the Processes tab.
3. Click to highlight [SET OF RANDOM NUMBERS].exe, e.g. 1254875695.exe, aVdfrGdkeF.exe and click End Task. If it asks you "Are you sure you want to terminate the process?" click yes. This will stop Hard Drive Diagnostic.
4. Click to highlight explorer.exe and end it too. Then click the File -> "New Task (Run...)" from the menu on the bottom right. Type in explorer.exe and click OK.
5. Open directory:
C:\Documents and Settings\[UserName]\Local Settings\Temp (in Windows 2000/XP)
C:\Users\[UserName]\AppData\Local\Temp (in Windows Vista & Windows 7)
Delete all files from this directory.
NOTE: Local Settings folder is hidden by default so you will have to change folder options to see hidden files.
6. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
7. Follow this removal guide: TDSS, Alureon, Tidserv, TDL3 removal instructions using TDSSKiller utility
8. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Hard Drive Diagnostic removal instructions (in Safe Mode with Networking):
1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm
NOTE: Login as the same user you were previously logged in with in the normal Windows mode.
2. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Hard Drive Diagnostic associated files and registry values:
Files:
- %Temp%\[SET OF RANDOM NUMBERS]
- %Temp%\[SET OF RANDOM NUMBERS].exe
- %Temp%\dfrg
- %Temp%\dfrgr
- %Temp%\[SET OF RANDOM CHARACTERS].dll
- %UserProfile%\[SET OF RANDOM CHARACTERS].DAT
- %UserProfile%\Desktop\Hard Drive Diagnostic.lnk
- %UserProfile%\Start Menu\Programs\Hard Drive Diagnostic\
- %UserProfile%\Start Menu\Programs\Hard Drive Diagnostic\Hard Drive Diagnostic.lnk
- %UserProfile%\Start Menu\Programs\Hard Drive Diagnostic\Uninstall Hard Drive Diagnostic.lnk
C:\Documents and Settings\[UserName]\Local Settings\Temp (in Windows 2000/XP)
C:\Users\[UserName]\AppData\Local\Temp (in Windows Vista & Windows 7)
%UserProfile% refers to:
C:\Documents and Settings\[UserName]\ (in Windows 2000/XP)
C:\Users\[UserName]\ (in Windows Vista & Windows 7)
Registry values:
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\USE FORMSUGGEST = Yes
- HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet Settings\WARNONZONECROSSING = 0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Internet Settings\Zones\3\1601 = 0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[SET OF RANDOM NUMBERS] = %TEMP%\[SET OF RANDOM NUMBERS].exe
0 comments:
Post a Comment