File Restore virus description and removal

File Restore stands for the new version of fake hard drive defragmentation utility, being the direct successor of File Recovery malware previously reviewed by us. Both of these applications are typically alike, sharing the same interface, having the same evil goals and fraudulent intentions. These bogus system optimizers bear in mind to scare users with imitation of PC system scan and its subsequent report that gives a lot of deceitful information about the condition of your system. Removal of such fake HDD tools is surely a challenge for many security blogs and online malware removal platforms, including our site. The mission of this article is to explain to you the basic features and peculiarities of File Restore malware, to give you the effective guidelines on removal of this scam and on restoration of your files and other important data that was hidden by this malicious utility. Please carefully follow the instructions below and you will face no difficulty removing File Restore virus from your system.

File Restore virus
File Restore virus

File Restore trojan follows the same pattern of behavior that is inherent to File Recovery malware. The virus implants itself into the infected system without asking for permission and without even letting users know about this. Thus, the very infiltration process of this scareware is hidden from user’s sight. For this reason nobody can actually stop the procedure during which the infected files and registry entries of this hoax are entering the computer. The appearance of this malware is first preceded by the following scary notification:

System message – Write Fault Error
A write command during the test has failed to complete. This may be due to a media or read/write error. The system generates an exception error when using a reference to an invalid system memory address.

Write Fault Error

It then suddenly happens that all files, folders, desktop icons, shortcuts, documents, programs and other data at the computer turns out to be missing. However, it hasn’t been deleted. The virus simply set up the hidden attributes to all the above-mentioned data and, in addition, relocated it to other specifically designated locations on your hard drive (which are also hidden, by the way). As you see, the moment of initial launching of File Restore malware is very scary for all users who can’t find their important files that are missing by the fault of this nasty trojan.

Later on, after the above-mentioned scary notification, another alert comes up, saying this:

System Error. Hard disk failure detected
It’s highly recommended to run complete HDD scan to prevent loss of personal files.
Scan and repair, Cancel and restart

Finally, after you encounter several of such scary alerts preceding the appearance of the rogue, the very GUI of File Restore virus comes up. This is when the rogue begins to perform the fake scan of your system and to tell a lot of lies about various errors detected. Just as a way to satisfy your curiosity, we’ve decided to quote some examples of the above-mentioned bogus error messages, alerts and notifications of File Restore malware:

Fake HDD’s alert screenshot fake HDD’s alert quotation
This device cannot find enough free resources that it can use This device cannot find enough free resources that it can use
Drive sector not found error Critical error. Drive sector not found error
Data error reading drive C Data error reading drive C:\
Hard drive controller failure Critical Error. Hard drive controller failure
Serious disk error writing drive C Serious disk error writing drive C
Seek error. Sector not found Seek error. Sector not found
Device initialization failed Device initialization failed

As you see, the bunch of such scary alerts, warnings and popups of File Restore is very pushy. The reason for such a brainwashing campaign being run by this hoax is to convince you to buy its licensed version (so called activation code of File Restore) in order to fix all those above-said problems. You do have a problem of missing data, but remember that it was caused by this File Restore virus. Thus, this application acts totally opposite to its name. Instead of restoring your file it hides them, relocates them to other hidden destinations and doesn’t allow you use your PC in a convenient and common manner anymore. As for those system, hard drive and memory errors reported by File Restore virus – these errors are simply invented and do not really and fairly characterize your system. So, buying the full version of this malicious utility is the total waste of your funds. So, be wise and do not obey the misleading instructions of File Restore malware utility. In order to get rid of its components effectively and restore your missing and hidden data please follow the guidelines you see below. If you have any questions or difficulties while deleting this virus please do not hesitate to get in touch with us at any time of your convenience, through all available customer support channels.


In order to remove File Restore malware from your PC it is strongly recommended that you first run GridinSoft Trojan Killer. Use Win + E” hotkey combination to open “My Computer” window. From this stage (in the address field) you may insert the address of GridinSoft Trojan Killer’s site http://trojan-killer.net and download our recommended software. Install and update it, run the scan and remove all threats it finds. Then download two additional free applications called Unhider.exe and restore.exe . The download links are as follows:

Run both of them and reboot your PC. Good luck!

File Restore automatic remover:

Removal video at YouTube:

File Restore manual remover:

Delete File Restore files:
%AppData%\Microsoft\Internet Explorer\Quick Launch\File_Restore.lnk
%Desktopdir%\File_Restore.lnk
%Programs%\File Restore\File Restore.lnk
%Programs%\File Restore\Uninstall File Restore.lnk
%CommonAppData%\[rnd_0].exe
%CommonAppData%\[rnd_1]
%CommonAppiData%\[rnd_1].exe
Delete File Restore registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[rnd_0].exe %CommonAppData%\[rnd_0].exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr 0

16 thoughts on “File Restore virus description and removal

  1. Thank you very much, guys, for your great help! My system got infected with this virus and I didn’t know what to do. I then found your site and this helped me to restore my missing files according to your instructions.

  2. Dear Ian, it is recommended that you run these applications (Unhider and Restore) as Administrator (with Administrator’s rights). Please try again in this mode. Also, you may open Trojan Killer, then click “Tools” and select “Restore hidden files”. This should also help.

Leave a Comment

*