My Disk

10 January 2011 Rogue 0 Comment

My Disk is an addition to the lists of clone rogue security application that will disguise itself as a hard drive defragmentation tool. Emerging from the same group of rogue programs where HDD Ok and HDD Fix originated, this most up-to-date variant also bears the same graphical user interface. Method of spreading is unchanged and also utilizes a Trojan to get into victims computer. A fake online scanner that will automatically run a system performance test on visitors computer is another routine to have My Disk installed on the computer. These malicious web sites are part of its expansion program to infect as many computers as it could. Once an online scan is finished, My Disk will report certain irregularities on the system and prompt visitors to download and install the said rogue application so that errors can be fixed. But instead of doing repairs when installed, My Disk will execute its purpose – that is to show up additional fake system errors and this time it will prompt users to obtain the registered version of the program. A clever tactics to sell this useless application.

Remove My Disk from the computer and never pay for the unwanted program. A recommended removal tool and step-by-step procedure is provided on this page so that infected users can remove My Disk without having to purchase the registration key. This automatic procedure will help users to save money, time and effort in getting rid of rogue applications from a compromised system.

Screen Shot Image:

When defrag is performed using My Disk, it will show a graphical user interface very much similar to Windows tool.

Alias: MyDisk

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

My Disk Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “My Disk”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to My Disk Virus.
4. Registry entries created by My Disk must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of My Disk start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

My Disk Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

If My Disk is installed, it will begin to display fake alerts as an scare tactics to mislead victims:

Critical Error
Windows can’t find hard disk space. Hard drive error

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

After showing fake alerts, an advise to fix the errors follows. But before any troubleshooting can be performed, a licensed version of My Disk must be purchased first:

Activation Reminder
My Disk Activation
Advanced module activation required to fix detected errors and performance issues. Please purchase Advanced Module license to activate this software and enable all features.

Malicious Files Added by My Disk:

For Windows Vista & 7:
%UserProfile%\Desktop\My Disk.lnk
%UserProfile%\Start Menu\Programs\My Disk\
%UserProfile%\Start Menu\Programs\My Disk\My Disk.lnk
%UserProfile%\Start Menu\Programs\My Disk\Uninstall My Disk.lnk
%AllUsersProfile%\~[random] %AllUsersProfile%\~[random]r
%AllUsersProfile%\[random].dll
%AllUsersProfile%\[random].exe
%AllUsersProfile%\[random] %AllUsersProfile%\[random].exe

For Windows XP:
%UserProfile%\Desktop\My Disk.lnk
%UserProfile%\Start Menu\Programs\My Disk\
%UserProfile%\Start Menu\Programs\My Disk\My Disk.lnk
%UserProfile%\Start Menu\Programs\My Disk\Uninstall My Disk.lnk
%AllUsersProfile%\Application Data\~[random] %AllUsersProfile%\Application Data\~[random]r
%AllUsersProfile%\Application Data\[random].dll
%AllUsersProfile%\Application Data\[random].exe
%AllUsersProfile%\Application Data\[random] %AllUsersProfile%\Application Data\[random].exe

My Disk Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“