Remove fake System Restore

Removal instructions

Severity scale:  (80 / 100)

System restore is a legitimate Microsoft Windows program that restores windows functionality when needed. However, there is a fake System Restore as well - a rogue system optimizer. This corrupt optimization program displays various warnings that  PCs hard disk, video card or registry is in bad state and requires repair with a help of System Restore program. While actual System restore can repair software errors after unsuccessful installation, the rogue version of System Restore claims to be able to fix hardware errors. This is simply not true.

System Restore will try to prevent user from running legitimate software. Each executable is blocked randomly explaining that it resides in bad part of hard disk. Eventually, they will launch. Additionally, some internet pages might get blocked. This is done to prevent downloading programs that assist in System Restore's removal.

To remove System Restore, we recommend launching the application and leaving it running while you open browser windows to download anti-malware programs. We recommend downloading process explorer first, and killing System Restore processes. Then download legitimate anti-spyware program to identify actual System Restore's files and delete these. These files should reside in AllUsers Application Data folder.

Automatic fake System Restore removal:

Malwarebytes Anti Malware

Download | review

We are testing Malwarebytes Anti Malware's efficiency at removing fake System Restore (2011-10-26 19:08:20)

Spyware Doctor

Download | review | tutorial

We are testing Spyware Doctor's efficiency at removing fake System Restore (2011-10-26 19:08:20)

STOPzilla

Download | review

We are testing STOPzilla's efficiency at removing fake System Restore (2011-10-26 19:08:20)

XoftSpySE Anti Spyware

Download | review

fake System Restore manual removal:

FORUM:
Discuss fake System Restore in
spyware removal forum

Kill processes:
[random].exe
6DSS92c31Apgjk.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'

HELP:
how to remove registry entries

Delete files:
[random].exe from AllUsers\AppData
6DSS92c31Apgjk.exe

HELP:
how to remove harmful files

QR code for fake System Restore removal instructions:

QR is short for Quick Response. They can be read quickly by the mobile phones. QR codes can store more data than standard barcodes, including url links, geo coordinates, and text.

The reason we add QR code to the website is that parasites like fake System Restore are really hard to remove on infected computer. you can quicly scan the QR code with your mobile device and have manual removal instructions to uninstall fake System Restore right in your pocket.

Simply use the QR scanner and read removal instructions from mobile device.

Additional resources:

Post Comment:

Attention: Use this form only if you have additional information about fake System Restore parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«


* All field required