System Check virus. How to restore missing files

andy | January 30, 2012

System Check program belongs to the category of fake hard drive defragmenters. This malware sample represents itself as some system optimization tool allegedly able to repair thousands of bugs, errors and problems it reports. But, in fact, it is personally the source of many problems. One of the most serious and disappointing amendments initiated by this hoax is hiding the files on your computer. The malware sets up the hidden attribute to all your personal data, shortcuts, icons, quick launch items. It even hides the list of programs in the Start menu. This would result in the entire desktop of your computer being totally black or blank (gone). Users would not actually see any other icons except for the ones having to do with System Check virus.


System Check virus

System Check virus

System Check malware does not ask your permission to enter into your computer. You would not see it in the section of “Add/ Remove Programs” of your Control Panel. Thus, it would not be so easy for you to remove it just with a couple of mouse clicks. You need to download certain reliable and powerful anti-virus program that can handle the removal job pretty well. However, there is another important job for you to perform. You would not be completely satisfied even with complete System Check virus removal unless you don’t recover your missing files, folders, icons, shortcuts and other important data. GridinSoft Trojan Killer, the powerful anti-virus application, can kill two birds with one stone. It is the effective solution to get rid of System Check malware and to restore the files hidden by it. Recently this new file restoring feature has been integrated into the program. Thus, users can restore their data with just one click. Below please find the screenshots of the buttons inside of Trojan Killer’s GUI you must click to implement this function. Restoration of files is the totally free option for users, whereas removal System Check malware is possible with fully licensed version of GridinSoft Trojan Killer. Good luck!


System Check automatic remover:

How to restore your missing data with GridinSoft Trojan Killer:

  1. Click “Tools” menu and select “Restore hidden files” option. Alternatively, you may simply use the hotkey “Ctrl + 4” while GridinSoft Trojan Killer is running.
  2. GridinSoft Tools to restore hidden files

    GridinSoft Tools to restore hidden files

  3. Click “Yes” in the window that appeared.

System Check removal video guide:

System Check manual removal:

Delete System Check files:

  • %LocalAppData%
  • %LocalAppData%.exe
  • %LocalAppData%~
  • %LocalAppData%~
  • %StartMenu%ProgramsSystem Check
  • %StartMenu%ProgramsSystem CheckSystem Check.lnk
  • %StartMenu%ProgramsSystem CheckUninstall System Check.lnk
  • %Temp%smtmp
  • %Temp%smtmp1
  • %Temp%smtmp1
  • %Temp%smtmp2
  • %Temp%smtmp3
  • %Temp%smtmp4
  • %UserProfile%DesktopSystem Check.lnk


Delete System Check registry entries:

  • HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Use FormSuggest" = 'Yes'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "CertificateRevocation" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnonBadCertRecving" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktop "NoChangingWallPaper" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" =
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments "SaveZoneInformation" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer "NoDesktop" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ".exe"
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ""
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "CheckExeSignatures" = 'no'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "Hidden" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "ShowSuperHidden" = '0'
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRU "MRUList"

1 Comment

  1. Alex says:

    what if the computer automatically shut down and you cant turn it back on?

1 Trackbacks

Leave a comment

*