Remove System Restore

What is System Restore?

System Restore is also known as Smart HDD, S.M.A.R.T. Virus or S.M.A.R.T. Check; all from the very same malware family Win32/FakeSysdef. It is a rogue software application that creates disturbing redirection errors. Generally you will have the ability to figure out if your computer system is attacked with System Restore when you view an error that states "A Major Hard drive Error Writing Drive C: /" alert on your display. Likewise, it will erase all your shortcuts and keep them in your temporary folder (% Temp % smtmp), so that none of them will show up on your start menu, this way you will not have the ability to start any kind of application from the start menu, making you assume that your system has severe problems.

Some System Restore screenshots:
System Restore

This bogus software program is often from corrupted internet sites that you could have visited or from malware software program that you have actually downloaded. System Restore will immediately invade your system and will make untrue alerts and pop ups that state your system has actually been threatened by a severe infection or there are hard disk problems identified. It will recommend you to stop utilizing the trial version and pay for a certified complete version of System Restore to activate threat elimination features yet once you click "Buy license now" you will put your private as well as financial details at risk.

Some of the System Restore fake security alerts and warnings that users may get:
Hard Drive Boot Sector Reading Error During I/O system initialization, the boot device driver might have failed to initialize the boot device. File system initialization might have failed because it did not recognize the data on boot device.
System blocks were not found This is most likely occurred because of hard disk failure. This may also lead to a potential loss of data.

System Restore could make use of a TDSS rootkit to shield and disguise its malware data, and to prevent you from starting any kind of anti-malware software program, hence making itself even more difficult to remove. There are bogus registration codes to stop irritating pop ups however these will never ever eliminate the rogue software application. You must make use of a reputable anti - malware and anti spyware application to get rid of this threat. You also have to run a total system scan to identify any kind of damages that System Restore has actually created.

Associated System Restore System Entries and files

System Restore Processes

System Restore Files

System Restore Registry Entries


How to Stop System Restore Fake Alerts

To register System Restore and stop its fake warnings, use the following fake license key.

System Restore registration code: 1203978628012489708290478989147 with any email address

NOTE: this code will NOT remove System Restore from your computer, it will JUST stop the annoying alerts and messages.


System Restore Removal Instructions

Step 1: Reboot in Safe Mode with Networking

To restart your computer in Safe Mode with networking:

  1. Restart your computer.

  2. When you see the computer manufacturer's logo, press and hold the F8 key.

  3. On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking, and then press Enter.
    Safe Mode with Networking Screen

  4. Log on to your computer with a user account that has administrator rights.


Step 2: Disable System Restore Proxy Server

System Restore may add a proxy to its package. Its goal is to get the information through the Web connection (password etc).
It also helps to block the connection to certain sites (eg malware removal help sites) or to block the download of trustworthy antispyware and antivirus programs.

The following steps reset the Internet Explorer proxy settings in the Windows registry so that you can access the Internet again:

  1. Click Start, and then click Run. (Keyboard Shortcut: Windows logo + R)

  2. Copy and paste or type the following text in the Open box in the Run dialog box:

    Run dialog box

  3. Click OK.

  4. click Start, and then click Run.

  5. Copy and paste or type the following text in the Open box in the Run dialog box:

  6. Click OK.

Now that you have disabled System Restore proxy server, you will be able to browse the web again with Internet Explorer.

  1. Click Start, and then click Run. (Keyboard Shortcut: Windows logo + R)

  2. Type in iexplore.exe.
    Run iexplore.exe


Step 3: Remove the System Restore rootkit

System Restore may be bundled with the TDSS rootkit. A rootkit is a program that hides the presence of malware in the system.
Kaspersky offers a free utility, TDSSKiller, that removes malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon).

So to find out if your system is infected with any rootkits that make System Restore hidden and very difficult to remove, follow the steps below:

  1. Download Kaspersky TDSSKiller to your desktop from the following link:
    Kaspersky TDSSKiller Download link

  2. System Restore may block all executable files, so when you launch the TDSSKiller file, it will execute itself.
    So Rename tdsskiller.exe to tdsskiller.com or winlogon.exe or iexplore.exe
    Rename tdsskiller.exe

  3. After you run TDSSKiller (or the renamed version), in the welcome screen click on Start Scan.
    Kaspersky TDSSKiller Start Scan

  4. TDSSKiller will now scan your computer.
    Kaspersky TDSSKiller Scan Progress

  5. If any infection was found, TDSSKiller will display a screen results like the following one:
    Kaspersky TDSSKiller Scan Results
    Then click on the Continue button and TDSSKiller will clean the infections.

  6. A reboot might require after disinfection. In this case, click on Reboot Computer
    Kaspersky TDSSKiller Reboot Computer

  7. After the reboot, start your computer again in Safe Mode with Networking and then disable any System Restore Proxy Server (See Step 1&2).


Step 4: Stop System Restore processes

In order to stop System Restore from interfering with our removal procedure, we need to end and kill its processes. For this, we will use a FREE powerful utility called RogueKiller.

RogueKiller (by Tigzy) is a tool written in C++, which scans the running processes, and kills those which are malicious. This tool was developed based on speed execution, which will clean the running processes before being killed.

To terminate System Restore process:

  1. Always in Safe Mode Download RogueKiller to your desktop from the following link:

    RogueKiller Download link
    RogueKiller Setup Icon
    RogueKiller is a portable application, so you don't need to install anything.

  2. System Restore may block all executable files, so when you launch the RogueKiller file, it will execute itself. So Rename RogueKiller.exe to RogueKiller.com or winlogon.exe or iexplore.exe

  3. At this point a "pre-scan" will complete and stop any malicious process. Also a list of options will appear along the right-hand side.
    RogueKiller Pre-Scan


Step 5: Remove System Restore registry keys

To remove System Restore malicious registry entries, we will need RogueKiller again.
RogueKiller also checks for rogue Registry entries, rogue drivers, and Master Boot Record (MBR) issues, so rootkits will be cut.
RogueKiller can also fix and restore a Host file, delete any Proxy entries, repair shortcut problems and unhide files.

CAUTION: This tool is not for beginners. In this step we will ONLY use the Registry tab.

To Delete System Restore Registry entries:

  1. Always in Safe Mode run a scan, open RogueKiller and click on Scan.
    RogueKiller Scan Progress

  2. After a while, you should see a screen with scan results like the following one:
    RogueKiller Scan Results

  3. Click on the Registy tab, then click on the Delete button.
    RogueKiller Delete Registry Entries


Don't Reboot you computer yet, please stay in Safe Mode.


Step 6: Remove System Restore files

Malwarebytes Anti-Malware is simply the best known FREE malware removal tools online.

To remove System Restore files:

  1. Download Malwarebytes to your desktop from the following link:
    Malwarebytes Anti-Malware Download link
    MBAM Setup Icon

  2. Just Follow the easy setup process. Do not make any changes to the default settings
    When the setup is finished, make sure you leave both the Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware checked.
    You can check or uncheck the Enable free trial of Malwarebytes Anti-Malware PRO as the malware removal is FREE.
    Then click on the Finish button. If Malwarebytes prompts you to reboot, please do not do so.
    Malwarebytes Anti-Malware Setup Wizard

  3. When Malwarebytes is launched, it will ask you to update the databse. Just click OK.
    Malwarebytes Anti-Malware Updating

  4. On the Scanner tab,select Quick scan and then click on the Scan.
    Malwarebytes Anti-Malware Quick Scan Screen

  5. When the scan is finished a message box will appear, click OK to continue.
    Then the screen results will show the various malware infections including System Restore that Malwarebytes has found on your computer.
    the image below is just an example, your results will be different.
    Click on the Remove Selected button.
    Malwarebytes Anti-Malware Quick Scan Results Screen

  6. After Malwarebytes has finished the removal of System Restore, you will get a message stating that you need to reboot your computer.
    Just Do so, and restart your computer in Normal Mode.
    Malwarebytes Anti-Malware Quick Reboot Message


Step 7: Unhide your files

As System Restore is from the family of FakeHDD, it will make you shortcuts unsuable and hide your files from your desktop, Start menu and discs.

To Fix this issue:

  1. In Normal Mode run a RogueKiller scan.

  2. When the scan is complete, go to the Shortcuts tab, and click on the Fix Shortcuts button on the right.
    RogueKiller Unhide Fix


Step 8: Check for any System Restore left over

To make sure that your computer is now completely free of System Restore, redo a Malwarebytes scan in Normal Mode.
After your are finished, Reboot your PC as asked by Malwarebytes anti-malware.


About

Sarah MelbenchI am Sarah Melbench and I am an Anti-Malware Enthusiast! I created this website to spread the word about the lastest malware infections. I write guides and tutorials about malware removal as well as reviews of anti-malware programs.Follow me on G+

Tagged with: ,
Posted in Manual Malware Removal

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>