At present time many users worldwide experience a lot of problems with their PC due to the malware persistency on their computers. In particular, they have the problem of missing files, disappeared icons, empty, black or blank desktop, without the ability to actually see any files or folders in order to use them. In addition, the entire list of the programs in the Start menu would also seem to be gone. All the above-mentioned problems are caused by viruses originating from the same family that “gave birth” to System Fix, System Restore, Data Restore, Data Repair and Data Recovery hoaxes. The list could be much longer, of course. These malwares belong to the category of fake hard drive defragmenters. They first started to attack computers quite a long time ago, this first happened in the autumn of the year 2010. Once these pests penetrate into the attacked computer they do their job of scaring user whose PC got infected. First of all they do the job of hiding all important data, making files and folders actually invisible. However, they are not deleted. They are simply relocated to another folder specially designated by this rogue program. Then, once the job of hiding the data is accomplished, the very virus program appears, saying that it will fix the PC if you pay for its full version.

We will not delve into many details of how exactly these fake HDD program works and what else they do and who developed them. Much has been told about this already in our previous post on System Fix virus, for example. You may remove this malware as described in that article, using GridinSoft Trojan Killer or other program of your choice. This post is designed to specifically assist you in restoring your missing files and other important data like the list of your programs and other customized settings. For this purpose you will need to run two free application – GridinSoft Unhider and GridinSoft Restore. It is also recommended that you run Kaspersky TDSS Killer after you’ve successfully removed System Fix virus using the powerful anti-virus program. Below please find the important download links to help you get rid of this virus and to restore your important information after the malware attack. The video guide is aimed to simplify the removal process for you, so please take your time and carefully watch it and follow our instructions step-by-step.

System Fix removal video guide:

It is also strongly recommended that you run Kaspersky TDSS Killer after you’ve run GridinSoft Trojan Killer.

GridinSoft Unhider download link:
www.trojan-killer.net/download/unhider.exe

GridinSoft Restore download link:
www.trojan-killer.net/download/restore.exe

System Fix manual removal:

Delete System Fix files:

  • %LocalAppData%\
  • %LocalAppData%\.exe
  • %LocalAppData%\~
  • %LocalAppData%\~
  • %StartMenu%\Programs\System Fix\
  • %StartMenu%\Programs\System Fix\System Fix.lnk
  • %StartMenu%\Programs\System Fix\Uninstall System Fix.lnk
  • %Temp%\smtmp\
  • %Temp%\smtmp\1
  • %Temp%\smtmp\1
  • %Temp%\smtmp\2
  • %Temp%\smtmp\3
  • %Temp%\smtmp\4
  • %UserProfile%\Desktop\System Fix.lnk


Delete System Fix registry entries:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" =
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU "MRUList"

Automatic remover:

DOWNLOAD TROJAN KILLER

Tested removal solution for 64/32-bit Windows 7/Vista/XP/2000 Kaspersky Lab Trusted Files help keep you safe from...