1. Manual restoration – http://restore-point.blogspot.com/2012/12/how-to-manually-restore-files-after.html
2. Automatic restoration – http://restore-point.blogspot.com/2012/10/how-to-restore-hidden-and-missing-files.html

How to reboot your PC into safe mode with networking:

• Restart your PC through “Start” menu by selecting the respective command.
• Before Windows OS starts booting press “F8” button of your keyboard repeatedly by hitting it and releasing several times simultaneously.
• The following windows comes up:



• Using the arrow keys on your keyboard select the “Safe Mode with Networking” option.

Optional way to terminate the process of System Care Antivirus scam:

1. Make sure you can see hidden files on your PC depending on the operating system of your computer.

How to view hidden files in Windows XP:

• Open “My Computer”, go to “Tools” tab and select “Folder Options”.


XP folder options

• In the window that appeared select “View” tab and choose the option “Show hidden files and folders”. Click “Apply” and “OK”.


Show hidden files in XP

How to view hidden files in Windows Vista/7:

• Open “My Computer”, go to “Organize” tab and select “Folder and search options”.


Windows Vista / 7 folder and search options

• In the window that appeared select “View” tab and choose the option “Show hidden files, folders, and drives”. Click “Apply” and “OK”.


Windows Vista / 7 show hidden files

2. Find the location of System Care Antivirus malware’s executable.

Typical location for Windows XP:

C:/Documents and Settings/All Users/Application Data/[Random.exe]

Typical location for Windows Vista/Windows 7:

C:/Program Data/[Random.exe]

3. Remove the executable of the rogue into other random name (virus.exe or malware.exe) and restart your PC.
4. Upon reboot the malware should no longer be active. Thus, you can download the security application that will remove all remnants of System Care Antivirus scareware.

Note: To see the correct location of System Care Antivirus executable, right-click its desktop icon, click “Properties” and look for the information in “Target” field. It will tell the exact place where the rogue dwells on your PC.

Warning! Your computer has been locked.
The following violations were revealed:
Please wait. Your data is being verified. If you entered the correct code and pay the fine you will regain access to your computer. If you entered a wrong code, this message will reappear. If you entered a wrong code three times, your hard drive will be completely erased. Your computer will be totally damaged and unusable. Your IP-address will be stored in our database. If you go with your IP address back to pornographic web pages, your case will be transferred to special department for further investigation!
Estimated verification time is 4 hours. Your computer was used for illegal purposes. Your Windows license number has been identified. Your Windows license number was involved in violation of UK laws. Your IP address was used for the following illicit activities: visiting web pages or pornographic nature, including child pornography, sadomasochism and child abuse. As it has been determined that your computer contains video or pornographic nature, child pornography, and child abuse, it has been blocked to prevent further violation of law. You will regain access to your computer after paying a fine of 100 pounds.

In order to successfully remove this scareware from your computer you first must ignore the faulty statements you get from this malware. It will lock your screen, without giving you a chance to unlock it even after repeated reboots of your system. However, do not panic! There are ways how you may get rid of this hoax effectively! So, do not pay any fine of 100 pounds. You may remove this malware for free and spend this money for something far more decent. Here is how you can do it.

Ransomware removal sequence of steps:

1. Restart your system into Safe Mode with Command Prompt. While your PC is booting hit “F8 key” on your keyboard repeatedly. This will lead you to “Windows Advanced Options Menu” as depicted below. Apply your arrow keys to go to Safe Mode with Command Prompt and then hit Enter key. Important! You need to login as the same user you were previously logged in with in the normal Windows mode. Please find more detailed information on rebooting into safe mode in this guide.



2. While Windows boots the Windows command prompt will appear as depicted in the screenshot below. In the command prompt you need to type “regedit” (without quotation marks) and hit Enter. The Registry Editor window comes up.



3. Find the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

In the righthand panel select the registry key named Shell. Right click on this registry key and select Modify.



The default value is Explorer.exe.



Now you must amend the value data to iexplore.exe. Click OK to save your changes and now quit (shut down) the Registry editor.



Now return to “Normal Mode“. In order to reboot your PC, at the command prompt, type “shutdown /r /t 0” (without quotation marks) and hit Enter.



4. Once Windows OS boots you will not see any desktop icons. Do not panic, this problem will be resolved soon. First of all, use the key combination “Ctrl+Alt+Del” or “Ctrl+Shift+Esc” (recommended) and launch Task Manager. Click File → New Task (Run…)



Type in iexplore and hit OK or click Enter keyboard button.



5. This would open Internet Explorer broswer. Now you must download clean explorer.exe file and over-write the existing one which is infected. Please make sure you download the correct file for your version of Windows OS:
• Windows XP SP2
• Windows XP SP3
• Windows Vista SP2
• Windows 7 SP1

Click on the link to download the file. Select Save. Then go to C:\Windows folder and select available explorer.exe file. Click Save to overwrite the malicious explorer.exe file.



6. Important! At this stage it is also strongly recommended that you download and scan your PC with realiable anti-virus software.
7. Remove all detected infections but do not reboot PC yet.
8. Open up Task Manager once again. For this purpose click File → New Task (Run…) as you made in previous steps.



9. Type in regedit and click OK to open Registry Editor.



Find the same registry entry referred to in the step 3 of this tutorial.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

In the righthand panel choose the registry entry with the name Shell. Right click on this registry entry and select Modify. Delete iexplore.exe and type in Explorer.exe as it was initially. Click OK to save performed amendments.



Shut down Registry Editor and reboot your PC now. This should reslove your problem. The last but not the least – make sure to scan your PC with reliable and powerful anti-virus software.

Important! If this ransomware removal solution did not help you please consider another similar guide available here.

Once installed successfully (yet without your consent) the hoax modifies the PC considerably and then makes sure it gets launched automatically together with every system startup. Don’t forget that this means you will face this nasty program each time you launch it. As soon as you actually see it successfully started you see the bunch of fake system error messages, in particular:

• Data Error Reading Drive C:\ – fake error alert
• Critical Error – Drive sector not found error
• This device cannot find enough free resources that it can use – fake HDD error
• Device initialization failed – fake HDD error
• Seek Error – Sector not found fake HDD error
• Serious Disk Error Writing Drive C:\ – fake system error
• System message – Write Fault Error fake warning
• System Error. Hard disk failure detected fake alert

In addition to the above-mentioned, the rogue hides the majority of all your files, pictures and other important documents. This is so far one of the most scary events for all users whose computers became infected with this malicious tool. Even though this hoax names itself “File Recovery” it cannot do what it promises (unless you are tricked by the malware makers to buy its so-called licensed version of activation key). The fact is that the program creates the above-mentioned problems of hidden files and missing data and then literally prompts you into buying its full version supposedly able to unhide all data that was concealed by it. This is obviously a very unfair way chosen by malware makers, and in reality their program is good for nothing.

Removal of File Recovery virus is a feasible task for powerful security applications. You are strongly recommended to choose the program recommended in this blog. Remember to install powerful anti-virus program that will be able to assist you in the future in terms of online and permanent anti-malware protection.

Once this scam is actually implanted into infected computer the malware starts annoying users with plenty of fictitious messages, such as this one:

Error. Potential malware detected.
It is recommended to activate the protection and perform a thorough system scan to remove the malware.

As we’ve said already, the contents of all such notifications is quite scary, nevertheless, the information contained in all of them is totally misleading, bogus and does not coincide with the truth. This is why the only logical and correct solution in this case is to first ignore these deceitful statements and then to delete this malware using the reliable anti-virus programs. Some of them are recommended in this blog, so why don’t you try to get rid of all types of infections with their help?

Screenshot of fake warning:

How to reboot your PC into safe mode with networking:

• Restart your PC through “Start” menu by selecting the respective command.
• Before Windows OS starts booting press “F8” button of your keyboard repeatedly by hitting it and releasing several times simultaneously.
• The following windows comes up:



• Using the arrow keys on your keyboard select the “Safe Mode with Networking” option.

Screenshot of fake warning:

How to reboot your PC into safe mode with networking:

• Restart your PC through “Start” menu by selecting the respective command.
• Before Windows OS starts booting press “F8” button of your keyboard repeatedly by hitting it and releasing several times simultaneously.
• The following windows comes up:



• Using the arrow keys on your keyboard select the “Safe Mode with Networking” option.

Warning! Spambot detected!
Attention! A spambot sending viruses from your e-mail has been detected on your PC.

And here is how the screenshot of this problem looks like:

In fact, there are many other misleading and scary statements that should be disregarded by you in the same manner. The only purpose of them is to make users really scared for the condition of the PC. The hoax reports various infections allegedly revealed during its fake scans of your system. It then brings you to the page where you will be asked by the malware to buy the license version of it, so-called ultimate protection. Be careful not to let these malware developers trick or fool you. Remove this rogue antispyware from your system immediately using the decent and proven security programs. Some of them are recommended in this virus removal toolbox and can be downloaded via the direct links in the right-hand section of it.

Speaking about the way the hoax called Best Antivirus Software acts, we can see several similarities between this rogue and many other similar system destructors. First, the scam enters your computer when you don’t expect it to come. It does not ask for your permission, but still some day or another it will let you know about its presence. Its real plan is totally disclosed when the malware starts arranging (running) its fake scan of your computer. The program reports tons of infections, saying that your system desperately needs some solution for the soonest recovery. No doubt, Best Antivirus Software offers its so-called full version to you, but such full version simply doesn’t exist. This is just the trick used by hackers to make you waste your funds. So, instead of obeying the instructions of this malware please download legitimate antivirus software available for download via the links you see in the right sidebar of this blog.

Rogue’s screenshot:

Apart from the fake warning like “Data Error Reading Drive C:\” and other samples, these fake HDDs substantially amend your personalized settings by hiding the majority of your files, folders, desktop icons, shortcuts, etc. Even the list of programs in the start menu is also hidden, whereas many files are relocated by the scareware into other specifically designated location (the folder named “smtmp”). They are also often removed (deleted) from their initial location, whereas the backup copy is still available. If such type of malware entered your machine, please consider installing one of recommended anti-spyware programs listed in the right panel of this blog, to clear your system from malware bondage. Finally, take the necessary steps to restore your hidden data as reviewed below.

Fake HDD error screenshot:

Guidelines to restore your system after fake HDD (rogue) program:

1. Guide to remove malicious (virus) application that causes such fake notice to appear – http://www.deletevirus.net/remove-smart-hdd-virus/
2. Guide to restore your missing (hidden) files and folders manually – http://www.deletevirus.net/how-to-restore-files-missing-because-of-virus/