System Restore (Rogue)

System Restore (Rogue) Interface

**System Restore** is a fake computer analysis and optimization program from the FakeHDD family of rogues. This rogue displays false alerts that are designed to make the user their computer has hard disk problems that have lead to corrupt and missing data. It displays these alerts in order to scare people into purchasing the program so they can "fix" these issues.

System Restore is installed through hacked sites that exploit vulnerabilities in software that may be installed on your computer or through fake online scanner pages. Once installed, System Restore will display false error messages and security warnings on the infected computer. These messages will state that there is something wrong with your computer's hard drive and then suggests that you download and install a program that can fix the problem. When you click on of these alerts, System Restore will automatically be started.

System Restore will be configured to start automatically when you login to Windows. Once started, it will display numerous error messages when you attempt to launch programs or delete files. System Restore will then prompt you to scan your computer, which will then find a variety of errors that it states it cannot fix until you purchase the program. It will then prompt you to repair your PC, where it will pretend to fix fake problems on your computer and state that it was unable to repair some of them in order to make you feel there is a problem with your computer.

If you are infected with System Restore it is important that you do not delete any files from your Temp folder or use any temp file cleaners. This is because when this infection is installed it will delete shortcuts found in various locations and store backups of them in the %Temp%\smtmp folder. It does this so that you when try to launch a program from your start menu, none of your shortcuts will appear and thus making you think that your computer has a serious problem. Therefore, you do not want to delete any of the files in your Temp folder as it will remove the backups that we will use later in the guide to restore your Windows Start Menu. For a list of folders that shortcuts are deleted and the corresponding directories where they are stored, please see this topic: Unhide.exe - A introduction as to what this program does.

To further make it seem like your computer is not operating correctly, System Restore will also make it so that certain folders on your computer display no contents. When opening these folders, such as C:\Windows\System32\ or various drive letters, instead of seeing the normal list of files it will instead display a different folder's contents or make it appear as if the folder is empty. This is done to make it seem like there is corruption on your hard drive that is causing your files to not be displayed. It does this by adding the +H, or hidden, attribute to all of your files, which causes your files to become hidden. It will then change your Windows settings so that you cannot view hidden and system files. Once the rogue's processes are terminated you can enable the setting to view hidden files, and thus be able to see your files and folders again, by following the instructions in this tutorial:

> How to see hidden files in Windows
>
>

System Restore also attempts to make it so you cannot run any programs on your computer. If you attempt to launch a program it may terminate it and state that the program or hard drive is corrupted. It does this to protect itself from anti-virus programs you may attempt to run and to make your computer unusable so that you will be further tempted to purchase the rogue. The messages that will randomly be displayed are:

>
> * Windows - Delayed Write Failed
> * Failed to save all the components for the file \System32\00004823. The file is corrupted or unreadable. This error may be caused by a PC hardware problem.
> * Windows detected a hard disk problem
> * A potential disk failure may cause loss of files, applications and documents stored on the hard disk. Please try not to use this computer until the hard disk is fixed or replaced.
> * Windows detected a hard disk problem
> * A potential disk failure may cause loss of files, applications and documents store on the hard disk. It's highly recommended to scan and solve HDD problems before continue using this PC.
> * Hard Drive Failure
> * The system has detected a problem with one or more installed IDE / SATA hard disks. It is recommended that you restart the system.
> * System Error
> * An error occurred while reading system files. Run a system diagnostic utility to check your hard disk drive for errors.
> * Critical Error
> * Hard drive critical error. Run a system diagnostic utility to check your hard disk drive for errors. Windows can't find hard disk space. Hard drive error.
> * Critical Error
> * Hard drive clusters are partly damaged. Segment load failure.
>

After you close this alert you will be presented with another alert that pretends to be for a program that will attempt to fix your hard drive.

>
> - Fix Disk
>
> - System Restore Diagnostics will scan the system to identify performance problems.
>
> - Start or Cancel
>

If you press the Start button, it will pretend to scan your computer and then state that there is something wrong with it. This message that you may see is:

>
> - System Restore Diagnostics
>
> - Windows detected a hard disk error.
>
> - A problem with the hard drive sectors has been detected. It is recommended to download the following sertified *<sic>* software to fix the detected hard drive problems. Do you want to download recommended software?
>

These are just further alerts trying to make you think your computer has a serious hard drive problem. It should be noted that if you attempt to run a program enough times it will eventually work. When you perform the scan or use the fake System Restore it will state that there are numerous problems on your computer, but that you first need to purchase it before it can fix any of them. Some examples of the fake problems it detects on your computer are:

>
> - Requested registry access is not allowed. Registry defragmentation required
>
> - Hard Drive rotational speed decreased by 20%
>
> - Disk drive C:\ is unreadable.
>
> - System files are damaged. System is unstable.
>
> - The problem may cause errors while loading operating system.
>
> - Ram memory speed decreased significantly and may cause system failure.
>
> - Read time of hard drive clusters less than 500 ms
>
> - 32% of HDD space is unreadable
>
> - Bad sectors on hard drive or damaged file allocation table
>
> - GPU RAM temperature is critically high. Urgent RAM memory optimization is required to prevent system crash
>
> - Drive C initializing error
>
> - Ram Temperature is 83 C. Optimization is required for normal operation.
>
> - Hard drive doesn't respond to system commands
>
> - Data Safety Problem. System integrity is at risk.
>
> - Registry Error - Critical Error
>

While System Restore is running it will also display fake alerts from your Windows taskbar. These alerts are designed to further scare you into thinking that your computer has an imminent hardware failure. The text of some of the alerts you may see include:

>
> - Critical Error!
>
> - Damaged hard drive clusters detected. Private data is at risk.
>
> - Critical Error
>
> - Hard Drive not found. Missing hard drive.
>
> - Critical Error
>
> - RAM memory usage is critically high. RAM memory failure.
>
> - Critical Error
>
> - Windows can't find hard disk space. Hard drive error
>
> - Critical Error!
>
> - Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.
>
> - Critical Error
>
> - A critical error has occurred while indexing data stored on hard drive. System restart required.
>
> - System Restore
>
> - The system has been restored after a critical error. Data integrity and hard drive integrity verification required.
>
> - Activation Reminder
>
> - System Restore Activation
>
> - Advanced module activation required to fix detected errors and performance issues. Please purchase Advanced Module license to activate this software and enable all features.
>
> - Low Disk Space
>
> - You are running very low disk space on Local Disk (C:).
>
> - Windows - No Disk
>
> - Exception Processing Message 0x0000013
>
> - Critical Error
>
> - Hard drive clusters are partly damaged. Segment load failure.
>

Just like the fake corruption messages and fake scan results, these alerts are only designed to scare people into purchasing the program.