Modified version of System Restore virus. How to delete it

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

System Restore malware program goes after Data Restore virus program. But do you realize that we’ve had already once published the article about System Restore fake HDD tool? This was quite a long time ago, however, the program has been outwardly amended considerably, not having the totally new interface. For this very reason we have decided to publish this post in order to update you about successful removal of this cyber pest attacking so many computers nowadays. We hope that you will never become its victim. If your system has been attacked with it then please carefully follow this removal tutorial.


System Restore virus
System Restore virus

Symptoms of System Restore threat and scam aggression.

Here is what System Restore does once it attacks your workstation:

  • Hiding files and folders of your system, making them all non-viewable (invisible)
  • Turning your desktop into the black color theme mode without the option to amend it
  • Making the list of programs in the Start menu seem to disappear (empty or gone)
  • Hiding the icons of your desktop, inability to use the desktop at all
  • Permanent notices about all kinds of errors on your computer
  • Asking you to pay for System Restore fake system utility in order to get rid of fake errors

How to get rid of System Restore rogue automatically?

It is really obvious that System Restore is the fake HDD program. Its reports about problems and errors are all fake. Its offer to buy its so-called full version has the only goal so far – to make the developers of such malware happier and, of course, rich. System Restore tool will not help you. Even if you obtain its full version the problems made by System Restore virus will remain. The goal of this post is primarily to warn you not to buy such virus program. Finally, get rid of it using decent anti-virus program or anti-malware scanner. GridinSoft Trojan Killer is a good program for this purpose. It is not free, however, it is capable of deleting this scam. At the same time, you may ask for the free trial activation code of the program valid for 15 days and remove this hoax at once and for free. To restore your files and folders after virus attack please watch the video guide provided below. Manual removal of this virus program is quite a difficult process, so we do not recommend it.

It is also strongly recommended that you run Kaspersky TDSS Killer after you’ve run GridinSoft Trojan Killer.

GridinSoft Unhider download link:
www.trojan-killer.net/download/unhider.exe

GridinSoft Restore download link:
www.trojan-killer.net/download/restore.exe

System Restore manual removal:

Delete System Restore files:

  • %LocalAppData%\
  • %LocalAppData%\.exe
  • %LocalAppData%\~
  • %LocalAppData%\~
  • %StartMenu%\Programs\System Restore\
  • %StartMenu%\Programs\System Restore\System Restore.lnk
  • %StartMenu%\Programs\System Restore\Uninstall System Restore.lnk
  • %Temp%\smtmp\
  • %Temp%\smtmp\1
  • %Temp%\smtmp\1
  • %Temp%\smtmp\2
  • %Temp%\smtmp\3
  • %Temp%\smtmp\4
  • %UserProfile%\Desktop\System Restore.lnk


Delete System Restore registry entries:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" =
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU "MRUList"

(Visited 693 times, 1 visits today)

Related posts:

11 thoughts on “Modified version of System Restore virus. How to delete it

  1. la versione del virus si è aggiornata. ora per accedere a explorer occorre andare sulla barra delle applicazioni in basso a destra dato che tutto il resto scompare.

  2. Gridinsoft

    I am contacting you to thank you for the explanation elimination and restoration of my computer folloing a disc scan virus. I found many “solutuions” on the web but yours was the successful solution in the end, assisted by the tutorial. My system is up and running thanks to your software

    Many Thanks

    Malcolm Gill

  3. bonjour, comment fais t’on pour obtenir le code d’activation ?
    je ne le trouve pas….
    urgent !
    un grand merci pour ce qui me reponde!

  4. The tutorials are helpful…. This is the same exact problem which happened to my laptop today !!! i’m trying the steps mentioned in the video …. Let me see what happens…

  5. Ho lo stesso problema… non so neanche come sia successo sto casino sul mio pc…
    ho seguito le istruzioni del video, ma ora nn riesco a trovare la chiave di attivazione per la versione prova del programma…. cioè l’avrei anche trovata ma non funzionaaa
    HELPPP PLEASEE

  6. hello…my computer have problem such as Hiding files and folders of your system, making them all non-viewable (invisible)
    Turning your desktop into the black color theme mode without the option to amend it
    Making the list of programs in the Start menu seem to disappear (empty or gone)
    Hiding the icons of your desktop, inability to use the desktop at all
    Permanent notices about all kinds of errors on your computer
    Asking you to pay for System Restore fake system utility in order to get rid of fake errors
    so what i can do???

Leave a Comment

*