Smart Engine - How to remove

May 9, 2012 By Giedrius Majauskas

Smart engine is a new nickname for My Security Shield rogue antivirus. This rogue is known of crippling user PC by blocking execution of regular computer program including antiviruses and browsers. All this is done to convince user into buying full versions of scareware Smart Engine, which will re-sell and reuse gathered credit card details.

One gets infected by Smart Engine by visiting various faked video portals or infected sites. You may be even redirected to this kind of domain without asking. Faked video portals offer “free videos” that require specific codecs or flash updates. All of updates that are not downloaded from manufacturers websites are infected with trojans. Thus instead of videos or useful programs you get popups and advertisements of Smart Engine. This malware might be distributed by fake computer scan websites too offering to download an executable. Once it gets on board, it will create fake harmless files that will be dropped in the system and later will be “discovered” as cyber threats:

%UserProfile%\Recent\ANTIGEN.dll
%UserProfile%\Recent\ANTIGEN.drv
%UserProfile%\Recent\cid.tmp
%UserProfile%\Recent\CLSV.exe
%UserProfile%\Recent\CLSV.sys
%UserProfile%\Recent\DBOLE.drv
%UserProfile%\Recent\delfile.sys
%UserProfile%\Recent\eb.sys
%UserProfile%\Recent\energy.exe
%UserProfile%\Recent\exec.exe
%UserProfile%\Recent\fan.drv
%UserProfile%\Recent\kernel32.dll
%UserProfile%\Recent\pal.exe
%UserProfile%\Recent\PE.dll
%UserProfile%\Recent\ppal.drv
%UserProfile%\Recent\tempdoc.tmp

On each reboot Smart Engine will produce a fake system scan that will show various infections. Although scan window is similar to system folder view of Microsoft Windows, the results are completely made up. The computer is not infected with these parasites, and most of files reported are the ones that Smart Engine invented earlier. Ignore its reported threats because they are harmless, either planted by malware itself or required for normal operation of system. Thus it is good idea to remove Smart Engine before it tries to completely brick your PC or convinces someone into paying for its full version ($49.95 for 6 Month Guard Subscription, $69.95 for 1 Year Guard Subscription, $89.95 for a Lifetime Guard Subscription).

For ripping users off, it will display tons of security alerts as well. They usually look like that:

System Alert
malicious applications, which may contain Trojans, were found on your computer and are to be removed immediately. Click here to remove these potentially harmful items using Smart Engine.

Warning
Warning! Virus detected
Threat Detected: Trojan-PSW.Win32.Delf.d

System Alert
Firewall has blocked a program from accessing the Internet.
Internet Explorer
C:\Program Files\Internet Explorer\Iexplore.exe
Lsas.Trojan-Spy.DOS.Keycopy is suspected to have infected your PC. This type of virus intercepts entered data and transmits it to a remote server. Data interception was detected while visiting a website.

For Smart engine removal we recommend rebooting into safe mode with networking and then scanning PC with reputable anti-malware tools like spyhunter or Malwarebytes anti-Malware. If you want to delete manually, take care to edit out all affected registry keys. Smart Engine might come with several rootkits that reinstall, block internet connection and removal attempts during manual removal.

Automatic Malware removal tools

Download Spyhunter for Malware detection
(Win)

Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,

Download Combo Cleaner for Malware detection
(Mac)

Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,

Manual removal

Processes:

Files:

%Documents and Settings%\\All Users\\Application Data\\[random]\\ (e.g. 17acbd)
%Documents and Settings%\\All Users\\Application Data\\[random]\\853.mof
%Documents and Settings%\\All Users\\Application Data\\[random]\\SmartEngine.exe
%Documents and Settings%\\All Users\\Application Data\\[random]\\SM[random].exe
%Documents and Settings%\\All Users\\Application Data\\[random]\\SM[random].exe e.g. SM17a_2211.exe
%Documents and Settings%\\All Users\\Application Data\\[random]\\SME.ico
%Documents and Settings%\\All Users\\Application Data\\[random]\\SMYEFE\\
%Documents and Settings%\\All Users\\Application Data\\[random]\\SMYEFE\\SMYEFE.cfg
%Documents and Settings%\\All Users\\Application Data\\[random]\\Quarantine Items
%Documents and Settings%\\[UserName]\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\Smart Engine.lnk
%Documents and Settings%\\[UserName]\\Application Data\\Smart Engine\\
%Documents and Settings%\\[UserName]\\Application Data\\Smart Engine\\Instructions.ini
%Documents and Settings%\\[UserName]\\Desktop\\Smart Engine.lnk
%Documents and Settings%\\[UserName]\\StartMenu\\Smart Engine.lnk
%Documents and Settings%\\[UserName]\\StartMenu\\Programs\\Smart Engine.lnk

on Windows 7 check AppData, AppData\\Local or AppData\\Roaming folders instead of Application Data

Registers:

HKEY_CURRENT_USER\\Software\\3
HKEY_CLASSES_ROOT\\MSSSys.DocHostUIHandler
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run “Smart Engine”
HKEY_CLASSES_ROOT\\CLSID\\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\SearchScopes \"URL\" = \"http://findgala.com/?&uid=2129&q={searchTerms}\"
HKEY_CURRENT_USER\\Software\\Classes\\Software\\Microsoft\\Internet Explorer\\SearchScopes \"URL\" = \"http://findgala.com/?&uid=2129&q={searchTerms}\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer \"PRS\" = \"http://127.0.0.1:27777/?inj=%ORIGINAL%\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Download \"RunInvalidSignatures = \"1\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \"ProxyServer\" = \"http=127.0.0.1:25437\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform \"Version/10.02129\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer \"DisallowRun\" = \"1\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \"Smart Engine\"
HKEY_CLASSES_ROOT\\Software\\Microsoft\\Internet Explorer\\SearchScopes \"URL\" = \"http://findgala.com/?&uid=2129&q={searchTerms}\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Download \"CheckExeSignatures\" = \"no\"
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \"ProxyEnable\" = \"1\"

Smart Engine facts

Type: Rogue Anti-Spyware