File restore virus, also known as file recovery virus, is a kind of virus that pretends to be a legitimate program finding fake issues in your system. It prompts to rid your system of any malware that hinders smooth functioning and opening of various programs and files. It poses like antivirus software, but actually prompts you to take a downloading action by sending out fake random pop-up ads. It tries to convince you that you need to download and run a file restore program for removing viruses or corrupt files. Once you will download such a program to remove file restore virus, it will attempt to take classified information from your system.
How to know if my system has been attacked by file restore virus?
If you are unable to open certain programs in your computer, like task manager, to avoid being detected and removed. You will receive messages like these and more:
“Hard drive boot sector reading error.”
“System blocks were not found.”
“Error 0x00000024 – NTFS_FILE_SYSTEM.”
At the end, it will ask you to have a free trial of the file recovery program and fix the listed issues. So, you can guess that this kind of program is actually a virus which is presenting fake hardware and software issues. All it wants is downloading a particular thing. Do not fall for its fake messages or download any such software. Please do not download anything you know nothing of. Read further to know how you can remove file restore virus.
How to remove file restore virus?
Caution: These steps should be followed only if you have partial or complete knowledge about how Windows Registry works and you are comfortable about editing it. Any wrong step would lead to serious consequences.
Editing Windows Registry
1. Run your computer in safe mode. To do this, restart your computer and press F2 to enter setup. Then press F8 to enter windows advanced options. Navigate through the options by pressing up and down arrow keys and select “safe mode with networking.” Press Enter.
Note: Keyboard shortcut for entering windows advanced options might be different in different versions of Windows. This applies to Windows 7.
2. When you reach desktop, Click open Start menu and select control panel.
3. Now select “folder options”, go to “view” tab, and do two things under Hidden files and folders. First check “show hidden files, folders and drives” and uncheck “Hide protected operating system files (Recommended).” Click OK.
4. Now press “Windows + R” keys together. When run command box opens, type “regedit.” Or click open start menu and type “regedit” in the search box. Click on regedit. You will be prompted for permission. Click YES.
5. Open the following keys and delete each one of them.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[RANDOM CHARACTERS].exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ‘Inspector’
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_CURRENT_USER\Software\Win 7 Antispyware 2013
HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Policies\System ‘DisableTaskMgr’ = 0
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall \File Restore
For instance, in the last key mentioned, you will expand HKEY_LOCAL_MACHINE. Then go to Software. Under Software, you will find Microsoft and so on. When you reach the respective key, right click on it and click delete.
6. Restart your computer in normal mode and go to control panel> folder options and reverse the changes you made in step#3.
Bottom line:
You can always choose to run antivirus software you may or may not have already installed. Download any preferred software for free from internet. If you cannot access internet or software installation doesn’t complete, install it through an external storage device like USB.