Severity scale:  

File Restore virus. How to remove? (Uninstall guide)

removal by Jake Doevan - -   Also known as FileRestore | Type: Rogue Antispyware

File Restore is a fraudulent application that belongs to WinWebSec – a family, which is already known for such threats as File Recovery, S.M.A.R.T Repair and similar. Be sure that File Restore won’t act like a regular antivirus solution or a hard drive optimization tool, although it will pose to have such ability. In reality, all those hard drive errors, that are reported by it, are invented issues that should make you scared. Basically, File Restore seeks to make its victims buy its licensed version, so after creating a need of it, it redirects its victims to the purchase page. We do NOT recommend spending your money on File Restore because you will simply be ripped off and leaved without nothing (scammers may also use your credit card details for their future crimes). You must remove File Restore as soon as you start receiving its misleading notifications.

How can I get infected with File Restore?

File Restore infiltrates computers without notifying users or asking for their permission. This scamware uses a method, which is called ‘backdoor trespassing’, and exploits software vulnerabilities and other security splits to get on its victim’s machine undetected. As soon as File Restore is downloaded, it begins ‘running’ through user’s drives and actively ‘seeks’ to find potentially unsafe items there. Be sure that File Restore WILL find some problems on your hard drive and then will report all these items on its annoying alerts and notifications. Instead of falling for them, you are highly recommended to remove File Restore.

Here’s what this sneaky application reports:

Windows Security alert
Your system might be at risk now.
Windows reports that computer is infected.
Antivirus software helps to protect your computer against viruses and other
security threats. Click here for the scan your computer using

Windows cannot find chrome. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

Hard drive boot sector reading error
System blocks were not found
Error while relocating TARE sectors
The storage device has failed a self-test
The self-test procedure of the storage device has detected an irreparable errors.
SMART state is “Out of order” before the disk scan


In order to stop File Restore's processes, you should use Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware. You can be disabled from getting online and downloading one of these softwares, so reboot your infected PC to safe mode with networking first or use another PC and transfer it with a help of flash drive. Additionally, scan your PC with anti-malware program when on normal mode to remove File Restore's files completely.

Another way to disable File Restore malware is to enter this registration code that has been helping with previous File Restore's versions: 08869246386344953972969146034087. Or you can try entering this code as well: 08467206738602987934024759008355. After making your virus think you have purchased licensed version, run a full system scan with Reimage or Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus to remove all infected files from your computer.

UPDATE! File Restore virus seeks to infect as many PC users as possible. For that, scammers keep updating this malware. Now this threat has started to use such alerts: 'Device initialization failed' and Serious disk error writing drive C:\ If you see such pop-ups, run a full system scan with updated Reimage and remove infected files from the system!

The latest parasite names used by FakeHDD:
[newest id=”fakehdd”]

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove File Restore virus you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall File Restore virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
File Restore virus snapshot
File Restore virus

File Restore virus manual removal:

Kill processes:



Delete registry values:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Use FormSuggest" = 'Yes'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "CertificateRevocation" = '0'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnonBadCertRecving" = '0'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktop "NoChangingWallPaper" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments "SaveZoneInformation" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer "NoDesktop" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ".exe"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ""

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem "DisableTaskMgr" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "CheckExeSignatures" = 'no'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "Hidden" = '0'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "ShowSuperHidden" = '0'

Delete files:
%AppData%MicrosoftInternet ExplorerQuick LaunchFile_Restore.lnk


%Programs%File RestoreFile Restore.lnk

%Programs%File RestoreUninstall File Restore.lnk




About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions

Removal guides in other languages