System Check malware removal tool

andy | December 30, 2011

System Check virus is what we are going to talk in our today’s article. Among all the malwares and viruses nowadays available in the world wide web System Check is quite a new one, even though such similar fake HDD programs were first traced in spring of 2011. At that time they had quite a different interface and GUI. However, being amended as per today, these fake hard drive defragmenters are quite capable of scaring so many users nowadays. We regret to inform you that this hoax called SystemCheck has already been able to scare some people, and even up to the extent that they purchased its so-called full version. They have just lost their money, because this is just the malware and that’s it. It cannot do any good thing for your computer. The tactics applied by System Check virus to scare unwary users are as follows: the rogue after successful installation runs plenty of fake system scans and report plenty of fake PC problems and errors. However, things seem in such a manner that the malware represents them as real problems and errors requiring immediate fixing. This is when System Check offers itself as a solution, however, it tells you to first pay for its full version. Do not purchase this malady and do not spend any cent for it. We recommend you to remove this malware using certain decent anti-virus program. This blog represents GridinSoft Trojan Killer anti-virus application, and we are confident that it will be able to recover your computer from this type of infection. Please carefully watch the video guide showing how to get rid of this hoax.

System Check

System Check

System Check automatic remover:

System Check removal video guide:

System Check manual removal:

Delete System Check files:

  • %LocalAppData%
  • %LocalAppData%.exe
  • %LocalAppData%~
  • %LocalAppData%~
  • %StartMenu%ProgramsSystem Check
  • %StartMenu%ProgramsSystem CheckSystem Check.lnk
  • %StartMenu%ProgramsSystem CheckUninstall System Check.lnk
  • %Temp%smtmp
  • %Temp%smtmp1
  • %Temp%smtmp1
  • %Temp%smtmp2
  • %Temp%smtmp3
  • %Temp%smtmp4
  • %UserProfile%DesktopSystem Check.lnk


Delete System Check registry entries:

  • HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Use FormSuggest" = 'Yes'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "CertificateRevocation" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnonBadCertRecving" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktop "NoChangingWallPaper" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" =
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments "SaveZoneInformation" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer "NoDesktop" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ".exe"
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ""
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "CheckExeSignatures" = 'no'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "Hidden" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "ShowSuperHidden" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRU "MRUList"

15 Comments

  1. P Tomlinson says:

    I was at my wits end today trying to find a solution to this problem, with no success. Till I stumbled onto this page. I followed the instructions carefully and voila! My computer seems to be back in good working order. Thank you very much!

  2. D. Tran says:

    I’ve followed the steps of getting the restore.exe and unhider.exe
    However not all my files were recovered.
    When I run the restore.exe file, the window just pops up and tells me to press any key. I don’t see nothing like the window in the tutorial youtube vid (copying files).
    I appreciate any help.
    Thanks.

  3. Mitch says:

    I’m having the same problem as D.Tran. My computer is working normally now as the system check virus is definitely gone but I am unable to restore or unhide my files.

  4. andy says:

    You need to run Restore.exe and unhider.exe with Administrator rights

  5. Kelly says:

    I too have followed the above steps and removed the malware however; like others Im unable to restore and do not see a place to type in the restore link in “My Computer” tab. Im still unable to get on-line also. Please help me.

  6. Phillip says:

    @ Kelly
    press your home key and “R” at the same time. it will pop up your run screen, and then type the link in.

  7. Khooleo says:

    Worked like a charm but it was definately stressful before i found this site. Memories of a past experience came to mind. Thank you very much!!

  8. Khooleo says:

    Huh, but now my bookmarks are missing……go figure. Any thoughts?

  9. BlackMagic says:

    Windows has a nice feature, called System Restore. Worked perfectly for me.

  10. Djorkboy says:

    The files are not gone or even moved

    The malware has hidden them

    Just go to folder options and choose to show hidden files and system files and you will now be able to see all your files, right click them and uncheck the ‘hidden’ option, then when you are done go back to folder options and uncheck the show hidden files box.

  11. sardoggy says:

    Mine got stuck somewhere in the middle of the scan and whole computer froze. Definitely not hardware related as I already tested for that.

  12. Steve says:

    I had the same problem. Was able to get the files unhidden but not my programs, including Outlook. Any ideas on how to fix this? Thanks!!!

  13. Luc Filiatrault says:

    I got a system check malware in a WinXP laptop.
    I am not able to open any application nor the task manager. Normally I right click the taskbar and call taskmanager from there but it is grayed out. I did this in safe mode also and it is not acessible.I used Knoppix to access the file system and to remove the links as per the manual instructions.
    Normal mode or safe mode: I cannot run any local tools or regedit.
    What can I try next?

  14. Phil says:

    I’m in the process of removing this from a customer’s PC.

    To Luc:
    As you noticed, System Check makes a number of changes to your system. None of which are simple to fix unless you have some patience or some handy programs/scripts.

    Using Knoppex to delete the links was good and bad. Good because if you deleted all of the links, you MAY HAVE prevented the program from restarting.

    Under XP, some of the executable files were installed under C:\Documents and Settigs\All Users\Application Data. You will want to look there for *.exe files and others that have a random garbage name.

    As for deleting the smtmp folder, that, IMHO, was bad because that is where the original Start Menu and Desktop folders were saved. Moving them back into place would have recovered all of your program links and Desktop items.

    I’ve seen this with other viruses and it appears to be a common “feature”. After all, the bogus program has to restore the function of your PC.

    To get the Task Manager back, get into Safe Mode and start regedit. Change the value for the following key to zero (0).
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

    I would recommend using the scripts to unhide your Desktop and Documents folders. Not everything within those folders is intended to be unhidden so you’ll want to be a bit careful.

  15. LDEJRuff says:

    Is it free? I currently have a trojan virus on mine.

1 Trackbacks

Leave a comment

*