The family of bogus hard drive defragmenters and fake system optimizers like System Check are known to produce various types of fabricated system error messages. Primarily they have to do with hard drive, memory and other system problems. Nevertheless, all of such notifications you encounter are fake. They are the warnings of unreal problems if they are produced by the rogue programs like System Check. The notice about your RAM memory temperature being 83 degrees is also completely fictitious in its essence. Here is the quote of what the message says:
RAM memory temperature is 83° C. Optimization is required for normal RAM functioning
In addition to the above-mentioned notice there are many other fake popups, warnings and ads that come up quite frequently at the desktop of the infected computer. By the way, the very desktop would become totally blank. You would not see any icons on in, except for those having to do with fake HDD tool. Similarly, users would not be able to see their data. The files, folders, icons, shortcuts and even the list of program files would become hidden and invisible. Some people whose PCs got infected with this malware think that their data was completely lost, but this is not true. The hidden attribute was set for these files by the virus. In addition, the hoax relocated them all to specific folder created by it in the %Temp% directory of your computer. By the way, the name of this specific folder is “smtmp”. Here is the complete guide to help you restore your missing data, but first you must remove the virus that caused all such problems of your missing data. For this purpose please follow this removal guide, download some powerful anti-malware scanner and remover and get rid of the infection with its help. Ignore all bogus messages of this virus, including the one about your PC’s RAM memory temperature being 83 degrees. It is totally fake and must not be trusted. Do not ever purchase the malware programs like System Check or other hoax optimization tools similar to it.
Screenshot of fake error presented by malware:
Fake HDD problem
List of fake HDD virus files:
- %CommonAppData%\~[random]
- %CommonAppData%\~[random]
- %CommonAppData%\[random]
- %CommonAppData%\[random].exe
- %AppData%\Microsoft\Internet Explorer\Quick Launch\[Fake HDD name].lnk
- %Desktop%\[Fake HDD name].lnk
- %StartMenu%\Programs\[Fake HDD name]\
- %StartMenu%\Programs\[Fake HDD name]\[Fake HDD name].lnk
- %StartMenu%\Programs\[Fake HDD name]\Uninstall [Fake HDD name].lnk
- %Temp%\smtmp\
- %Temp%\smtmp\1
- %Temp%\smtmp\1
- %Temp%\smtmp\2
- %Temp%\smtmp\3
- %Temp%\smtmp\4
List of fake HDD virus entries:
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;’
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
File Location Implications:
%Desktop% implies that the file is located straight on your PC’s desktop. The full and detailed location is C:\DOCUMENTS AND SETTINGS\Current User\Desktop\ for Windows 2000/XP, and C:\Users\Current User\Desktop\ for Windows Vista and Windows 7.
%Temp% stands for the Windows Temp folder. By default, it has the location C:\Windows\Temp for Windows 95/98/ME, C:\DOCUMENTS AND SETTINGS\Current User\LOCAL SETTINGS\Temp for Windows 2000/XP, and C:\Users\Current User\AppData\Local\Temp for Windows Vista and Windows 7.
%AppData% means the current users Application Data folder. By default, it has the location C:\Documents and Settings\Current User\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\Current User\AppData\Roaming.
%StartMenu% stands for the Windows Start Menu. For Windows 95/98/ME the location is C:\windows\start menu\, for Windows XP, Vista, NT, 2000 and 2003 it stands for C:\Documents and Settings\Current User\Start Menu\, and for Windows Vista/7 it is C:\Users\Current User\AppData\Roaming\Microsoft\Windows\Start Menu.
%CommonAppData% means the Application Data folder in the All Users profile. For Windows XP, Vista, NT, 2000 and 2003 it has the location C:\Documents and Settings\All Users\Application Data\, and for Windows Vista/7 it is C:\ProgramData.
