Remove File Recovery virus (Uninstall Guide)

File Recovery is a malicious program that will display fake alerts, claiming that several hard drive errors and computer issues were detected on your machine.
In reality, none of the reported issues are real, and are only used to scare you into purchasing File Recovery and stealing your personal financial information.
Apart from the bogus alerts and warning,this rogue software has changed your desktop background to a solid black color,has hidden your files and folders and it’s causing browser redirects.
As part of its self-defense mechanism,File Recovery  has disabled the Windows system utilities, including Task Manager and Windows Registry and is block you from running certain programs that could lead to its removal.

If your computer is infected with File Recovery virus,then you are seeing this images:

File Recovery

File Recovery fake scan

File Recovery Image

We strongly advise you to follow our File Recovery virus removal guide and ignore any alerts that this malicious software might generate.
Under no circumstance should you buy this rogue security software as this could lead to identity theft,and if you have, you should contact your credit card company and dispute the charge stating that the program is a scam and a computer virus.

Registration codes for File Recovery
As an optional step,you can use the following license key to register File Recovery virus and stop the fake alerts.
File Recovery activation code: 56723489134092874867245789235982
Please keep in mind that entering the above registration code will NOT remove File Recovery from your computer , instead it will just stop the fake alerts so that you’ll be able to complete our removal guide more easily.

File Recovery Removal Instructions

STEP 1 : Start your computer in Safe Mode with Networking

  1. Remove all floppy disks, CDs, and DVDs from your computer, and then restart your computer.
  2. Press and hold the F8 key as your computer restarts.Please keep in mind that you need to press the F8 key before the Windows start-up logo appears.
    Note: With some computers, if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the “F8 key”, tap the “F8 key” continuously until you get the Advanced Boot Options screen.
  3. On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking , and then press ENTER.
    [Image: Safemode.jpg]

STEP 2: Remove File Recovery malicious proxy server

File Recovery  may add a proxy server which prevents the user from accessing the internet,follow the below instructions to remove the proxy.

  1. Start the Internet Explorer browser and if you are using Internet Explorer 9 ,click on the gear icon [Image: IE gear icon] (Tools for Internet Explorer 8 users) ,then select Internet Options.
    [Image: Internet-options-IE.png]
  2. Go to the tab Connections.At the bottom, click on LAN settings.
    [Image: Remove-proxy-server2.png]
  3. Uncheck the option Use a proxy server for your LAN. This should remove the malicious proxy server and allow you to use the internet again.
    [Image: Remove-proxy-server3.png]

If you are a Firefox users, go to Firefox(upper left corner) → Options → Advanced tab → Network → Settings → Select No Proxy

STEP 3: Run RKill to terminate known malware processes associated with File Recovery.

RKill is a program that will attempt to terminate all malicious processes associated with File Recovery virus,so that we will be able to perform the next step without being interrupted by this malicious software.
Because this utility will only stop File Recovery running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again.

  1. While your computer is in Safe Mode with Networking ,please download the latest official version of RKill.Please note that we will use a renamed version of RKILL so that File Recovery won’t block this utility from running.
    RKILL DOWNLOAD LINK (This link will automatically download RKILL renamed as iExplore.exe)
  2. Double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with File Recovery.
    [Image: run-rkill-1.png]
  3. RKill will now start working in the background, please be patient while the program looks for various malware programs and tries to terminate them.
    [Image: run-rkill-2.png]
    IF you are having problems starting or running RKill, you can download any other renamed versions of RKill from here.
  4. When Rkill has completed its task, it will generate a log. You can then proceed with the rest of the guide.
    [Image: File Recovery virus rkill3.jpg]

WARNING: Do not reboot your computer after running RKill as the malware process will start again , preventing you from properly performing the next step.

STEP 4: Remove File Recovery malicious files with Malwarebytes Anti-Malware FREE

  1. Download the latest official version of Malwarebytes Anti-Malware FREE.
    MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK (This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
  2. Start the Malwarebytes’ Anti-Malware installation process by double clicking on mbam-setup file.
    [Image: Malwarebytes Installer]
  3. When the installation begins, keep following the prompts in order to continue with the setup process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware checked. Then click on the Finish button. If Malwarebytes’ prompts you to reboot, please do not do so.
    [Image: Finishing Malwarebytes installation]
  4. Malwarebytes Anti-Malware will now start and you’ll be prompted to start a trial period , please select ‘Decline‘ as we just want to use the on-demand scanner.
    [Image: Decline Malwarebytes trial]
  5. On the Scanner tab,select Perform full scan and then click on the Scanbutton to start scanning your computer.
    [Image: Starting a full system sca]
  6. Malwarebytes’ Anti-Malware will now start scanning your computer for File Recovery malicious files as shown below.
    [Image: Malwarebytes scanning for malicious files]
  7. When the scan is finished a message box will appear, click OK to continue.[Image: Malwarebytes scan results]
  8. You will now be presented with a screen showing you the malware infections that Malwarebytes’ Anti-Malware has detected.Please note that the infections found may be different than what is shown in the image.Make sure that everything is Checked (ticked) and click on the Remove Selected button.
    [Image: Infections found by Malwarebytes]
  9. Malwarebytes’ Anti-Malware will now start removing the malicious files.After completing this task it will display a message stating that it needs to reboot,please allow this request and then let your PC boot in Normal mode.

STEP 5: Double check your system for any left over infections with HitmanPro

  1. This step can be performed in Normal Mode ,so please download the latest official version of HitmanPro.
    HITMANPRO DOWNLOAD LINK (This link will open a download page in a new window from where you can download HitmanPro)
  2. Double click on the previously downloaded fileto start the HitmanPro installation.
    [Image: HitmanPro Icon]
    IF you are experiencing problems while trying to starting HitmanPro, you can use the “Force Breach” mode.To start this program in Force Breach mode, hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including the malware process. (How to start HitmanPro in Force Breach mode – Video)
  3. Click on Next to install HitmanPro on your system.
    [Image: Starting HitmanPro]
  4. The setup screen is displayed, from which you can decide whether you wish to install HitmanPro on your machine or just perform a one-time scan, select a option then click on Next to start a system scan.
    [Image: HitmanPro installation screen]
  5. HitmanPro will start scanning your system for malicious files as seen in the image below.
    [Image: HitmanPron scanning for File Recovery virus]
  6. Once the scan is complete,you’ll see a screen which will display all the malicious files that the program has found.Click on Next to remove this malicious files.
    [Image: HitmanPro scan results]
  7. Click Activate free license to start the free 30 days trial and remove the malicious files.
    [Image: Activate HitmanPro license]
  8. HitmanPro will now start removing the infected objects.If this program will ask you to restart your computer,please allow this request.

STEP 6 : Restore your shortcuts and remove any left over malicious registry keys

File Recovery has moved your shortcuts files in the Temporary Internet folder and added some malicious registry keys to your Windows installation , to restore your files we will need to perform a scan with RogueKiller.

  1. Please download the latest official version of RogueKiller.
    ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer)
  2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
    RogueKiller scanning after File Recovery virus virus
  3. After the scan has completed, press the Delete button to remove any malicious registry keys.
    Remove File Recovery virus  infection with RogueKiller
  4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
    Remove residual damage from File Recovery virus virus

STEP 7: Unhide your files and folders

File Recovery modifies your file system in such a way that all files and folders become hidden, to restore the default settings , you’ll need to run the below program.

  1. Download the Unhide utility, to unhide your files and folders.
    UNHIDE.EXE DOWNLOAD LINK (This link will automatically download the Unhide utility on your computer)
  2. Double-click on the Unhide.exe icon on your desktop and allow the program to run.The whole process should not take more than 10 minutes to complete,and at the end this utility will generate a report.
    Restore files after File Recovery virus infection

STEP 8: Get your desktop look back!

File Recovery changes your desktop background to a solid black color,to change it back to default one follow the below instruction.

    • Windows XP : Click on the Start button and then select Control Panel. When the Control Panel opens, please click on the Display icon. From this screen you can now change your Theme and desktop background.
    • Windows 7 and Vista : Click on the Start button and then select Control Panel. When the Control Panel opens, please click on the Appearance and Personalization category. Then select Change the Theme or Change Desktop Background to revert back to your original Theme and colors.

If you are still experiencing problems while trying to remove File Recovery from your machine, please start a new thread in our Malware Removal Assistance forum.

IT’S YOUR TURN TO HELP!

If we have managed to help you with your computer issues, then it's your duty to let other people know that this article will help them!
You can share this article on Facebook,Twitter or Google Plus by using the below buttons.

THE 411 ON ME

FC Barcelona fan, Starbucks addicted and super geek.
I am the creator and owner of MalwareTips.com
My area of expertise includes malware removal and computer forensics. I'm active in the various online anti-malware communities where I do researches for new malware threats as they are released.
I live in Bucharest (Romania), where I run my own local computer repair shop.
I repair both hardware and other operating systems related issues, however most of my business is malware related problems.

Follow me on Google Plus

You can follow me on Google Plus, and I will try to keep you informed with the latest computer infections and malware threats!

SUPPORT MALWARETIPS! (OPTIONAL)

All our malware removal guides and utilities are completely free of charge.
We do not request any kind of money in exchange for our services, however if you like to support us with our hardware maintenance costs, you can make a small donation. Any amount is appreciated, and will support our fight against malware.
  • http://malwaretips.com/ Stelian Pilici

    Hello Grace,
    If the File Recovery infection isn’t active on your computer, then you can run a scan with Malwarebytes Anti-Malware and HitmanPro to check for malware.

  • Elizabeth Mikki McComb

    This is the SECOND time in 10 days that I have had to use this site to fix my husbands computer! I am still having issues with pop ups and the computer being slow(this time). I’m sure I’ll be able to fix these issues also with some more help from this site. Last time (on Aug 21st, 2013), the computer ran like new after I ran the suggested scans. I’m absolutely NOT a computer genius so if I can fix a computer, anyone can! I will absolutely be donating and subscribing to and following the blogs in this site from now on.
    I BELIEVE http://WWW.GUNTRADER.COM IS THE SITE RESPONSIBLE FOR THE ALL THE COMPUTER ISSUES BOTH TIMES…..BEWARE!!

  • Hal

    thanks so much, this guide is as good as gold!

  • Lanny Quintel

    Thanks Stelian!!

  • Matt

    Thanks for the information! I have my computer back except for connecting to the internet. I took care of the LAN settings but still no connection. Any helpful suggestions on that?

    • Stelian Pilici

      Hello Matt,
      What Firewall are you using?By any chance are you using McAfee,if yes, then try to disable this firewall and then try to connect to the Internet.
      Next,can you please run a scan with Combofix and Complete Internet Repair utility, and post the logs here so that I can get an idea on what’s going on:
      STEP 1 : Run a scan with Combofix
      Download ComboFix from the below link:
      COMBOFIX DOWNLOAD LINK (This link will automatically download Combofix on your computer)
      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important!Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with Complete Internet Repair utility

      1. Download Complete Internet Repair utilityto your desktop
      2. Unzip all the files to their own folder on the desktop
      3. Within the folder double click CIntRep
      4. Select the following items,then press the GO button.
        • Reset Interent Protocol (TCP/IP)
        • Repair Winsock (Reset Catalog)
        • Renew Internet Connection
        • Flush DNS Resolver Cache
        • Reset Windows Firewall Configuration
        • Reset the default hosts fie

      Please add the Combofix log in your next post.

  • Scott

    It’s hard to believe anyone would write such a good guide and offer it free. It worked, thank you. Too bad we can’t transfer some of MS ill gotten gains to you. This is the kind of site they should have.

  • Mike Korger

    Your instructions were spot on. Everything worked great, thanks

  • Sergio Guillen Rodriguez

    Great guide—I was able to completely remove the virus from my PC.
    Thank you!

  • canuck

    Thanks for the Excellent instructions!

  • Beth

    Thanks so much! It took hours but it worked and I have my computer back!!!

  • wkwkwkwk1

    Thank you so much! May my God and Yours bless you and your family.

  • Mario Ontiveros

    Muchas gracias…!!! toda esta guia me fue de mucha utilidad. Gracias por su valiosa ayuda. :-)

  • Dan Sturgeon

    I got all my files back and unhidden but now my file associations are all messed up…Word docs are file type word.document.8 and have the notepad icon associated to it…other files on desktop do not work or open properly…lot of new file type…how can I correct this?

    • Stelian Pilici

      Hello Dan,
      You can use this utility to reset your file association.
      If you would like to open file with a certain program instead of another one, you can right click on the program icon and Open with , then select Chose default program. A new window will open from where you can select the program you want to open this file in the future or if it’s not on the list, you can browse to it.
      Stay safe!

  • James Sumpter

    Thank you so very much for your generous help and knowledge in restoring my daughter’s computer to its original condition.She goes to school online and your webpage hit the nail on the head to get rid of File Restore Virus and we also found additional Trogans during the various processes. We thank you from the bottom of our hearts, you sir are a true genius. God Bless You!

  • George

    Thanks for this. Unfortunately, I got here a little too late. I got the virus (grrr…) and before I arrived here, I ran Spybot Search & Destroy, and that program deleted all of my “Temp” files, which included all of my normal Windows 7 shortcuts in the Start menu (e.g. everything in Accessories, System Tools, etc.). :-(

    How do I get all of this stuff back???

    • Stelian Pilici

      Hello George,
      The one thing that you shouldn’t have done is removing the temp files!!Lets try to recover your shortcuts:

      1. Right click on your Windows Start menu and select Properties.
      2. Next put a check mark on
        Store and display recently opened programs in the start menu
        Store and display recently opened items in the start menu and taskbar
      3. Click on Customize and click on Use default settings at the bottom
      4. Browse to C:\ProgramData\Microsoft\Windows and right click on Start Menu folder and click on Restore previous versions
      5. Now select a snapshot before you were infected by the rogue,click on restore

      This should restore back your start menu and other icons however for your Pinned items,you’ll have to re-select again those who you like and want on the task bar. Stay safe!

  • Nettie Bell

    Help! I am having trouble launching into safemode with networking. I either get a blue screen of crash dump or I get to safemode (slowly) finally, a failed to connect to a window service message appears. Everything is frozen and still seems to be controlled by malicious software. Do you have a remedy?

    • Stelian Pilici

      Hello Nettie,
      Lets try to fix your computer,please run the below tools while in Normal Mode;
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window.
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • Anna

    Thank you so much! I seriously don’t know what I would’ve done without your help! I know what I need to about computers but I knew nothing about this stuff. I tried downloading this thing where you can watch tv on your computer (because my boyfriend is obssesed with the new halo 4 game) I haven’t got to watch my shows lol Now I know never to download anything on my computer again haha I thought I lost everything & was balling my eyes out! :/ Can I delete all of these downloads or should I keep them on my computer? I don’t want to mess anything else up.

    • Stelian Pilici

      Hello Anna,
      Yes,you can uninstall all the tools that we’ve used, however if you want you can keep Malwarebytes and HitmanPro and run regular scan with these products… You choice… Just stay away from malware!:P

  • Hrishi Joshi

    My PC was infected with this crazy virus. I followed the steps exactly as listed and after a few rounds of scans, I’m all good now!

    THANK YOU!!!

  • chris

    Wow, great step by step instruction, so simple even I could follow it. Thank you so much!!!

  • Sarah

    I could just…you just saved me forty bucks, a serious telling off from my mom, and over 60,000 words of novel writing. I was in the air for a while their, since my laptop was acting a bit differently, but I looked at all of your suggestions for the comments Thank you thank you thank you thank you so. Much.

  • DoNotT

    thank you stelian!

  • Gert-Jan

    Hi,

    On one of our pc’s we got this virus and immediately after an offer for removal service at USD 80,00 or so. A confirmation of orderxyourorderpm.com> with exactly the codes as in your story. Does orderXyourorderpm.com> belong to you or do you know this organisation?

    • Stelian Pilici

      Hello Gert,
      NO!And you should not pay any money to anyone who is using this type of techniques!
      Again,DO NOT PAY FOR ANY MALWARE REMOVAL SERVICES. Just follow this guide and if you need help,you can reply to this post.
      We have a strong privacy policy and I will NOT never contact you via email or give to anyone your address.
      Stay safe!

  • Android

    Thanks!

  • Paige

    Hi,

    I used your guide to remove the File Recovery virus from my computer and was able to recover, thank you very much. Since then, however, my Office Professional 2010 has lost it’s activation and any attempts to reactivate (tried re-installing) are not sucessful. The error code 0×80070001 pops up. The microsoft registry fix doesn’t seem to help. Have you encountered this? Thanks.

  • Janet

    You are a lifesaver! I now have my files back thanks to you. The only that didn’t work for me is the RogueKiller (step 6). I was able to download it, pre-scan then scan but it will stop as soon as it gets to ‘Finding Proxy’. Windows Internet Explorer stopped working. Did this several times. Will this be an issue? All the steps worked except that. Thank you soooo much again for being so kind in helping malware/virus victims like me. :D

    • Stelian Pilici

      Hello Janet,
      As an additional steps,you can run a scan with the following tools:

      STEP 1: Run a scan with Emsisoft Emergency Kit.

      1. Please download the latest official version of Emsisoft Emergency Kit.
        EMSISOFT EMERGENCY KIT DOWNLOAD LINK (This link will open a download page in a new window from where you can download Emsisoft Emergency Kit)
      2. After the download process will finish , you’ll need to unpack EmsisoftEmergencyKit.zip (Right click on it and select Extract all) and then double click on EmergencyKitScanner.bat
      3. A pop-up will prompt you to update Emsisoft Emergency Kit , please click the “Yes” button.After the Update process has completed , put the mouse cursor over the “Menu” tab on the left and click-on “Scan PC“.
      4. Select “Smart scan” and click-on the below “SCAN” button.When the scan will be completed , you will be presented with a screen showing you the malware infections that Emsisoft Emergency Kit has detected.Make sure that everything is Checked (ticked) and click on the ‘Quarantine selected objects‘ button.

      STEP 2: Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish
  • Jan Stevens

    I ran the malwarebytes program but it did not recognize the file recovery malware. Any suggestions?

    • Stelian Pilici

      Hello Jan,
      Go ahead and run the HitmanPro and RogueKiller scan,then follow it up with a Malwarebytes quick scan.Don’t forget to run Unhide.exe for get your files and folders back.
      As an additional steps,you can run a scan with the following tools:

      STEP 1: Run a scan with Emsisoft Emergency Kit.

      1. Please download the latest official version of Emsisoft Emergency Kit.
        EMSISOFT EMERGENCY KIT DOWNLOAD LINK (This link will open a download page in a new window from where you can download Emsisoft Emergency Kit)
      2. After the download process will finish , you’ll need to unpack EmsisoftEmergencyKit.zip (Right click on it and select Extract all) and then double click on EmergencyKitScanner.bat
      3. A pop-up will prompt you to update Emsisoft Emergency Kit , please click the “Yes” button.After the Update process has completed , put the mouse cursor over the “Menu” tab on the left and click-on “Scan PC“.
      4. Select “Smart scan” and click-on the below “SCAN” button.When the scan will be completed , you will be presented with a screen showing you the malware infections that Emsisoft Emergency Kit has detected.Make sure that everything is Checked (ticked) and click on the ‘Quarantine selected objects‘ button.

      STEP 2: Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish
      • Jan Stevens

        Did not need the Emsisoft. The Hitman and Rogue Killer
        did the job. Thank you so much.

        • Stelian Pilici

          Stay safe Jan!:)

  • Itworks

    This is awesome!!!!!IT WORKS!!:D

  • tom

    Multumesc. Ai fost salvarea mea. Nota 10 pentru tine. Meriti si mai mult Nota 10 cu FELICITARI. Multumesc,esti inexplicabil. TNK :)

    • Stelian Pilici

      Salut Tom,
      Ai grija de tine!

  • Mirandann

    Hi – I got the file recovery virus removed from my computer (i think). Now my computer keeps rebooting after about 1-2 mins. Is this associated with the virus? Any suggestions on how to fix this problem now. Appreciate your help. Thanks!

    • Stelian Pilici

      Hello Mirandann,
      It always does that or ?When exactly it reboots?Did you try to load your computer in Safe Mode with Networking?

  • daisy

    Hello, when I enetered the activation key it did not work as I needed an email address as well! What email address do i put in?

    • Stelian Pilici

      Hello Daisy,
      You can use any email address…. fake@email.com
      Good luck!

  • Brent

    Great results! I was glad to find this site a few days ago when this virus suddenly appeared. The virus files were successfully erased and my computer was back to normal in a couple hours (…longest time was for the file scan step).
    THANK YOU for the clear explanation and wonderful advice.

  • Joseph Sullivan

    Thanks for the help. My friend got the File recovery virus. The only issues we have no is that the start/programs in windows now say empty and the bookmarks are gone from his browsers, Opera, Firefox, and Internet Explorer. Do you know how to get any of these back?

  • V

    Thank you, very useful walktrough on how to remey to the problem, my problem is solve an everything seems to run back like it use to.

    Many thanks.

  • Tim

    As others have said, these instructions were outstanding. Slight differences in my procedure were as follows: At the end of Step 4, when I rebooted in Normal Mode, the problem was still there; so I rebooted in Safe Mode and continued the Steps from that point. Then, after completion, I got a warning that my Win 7 was no longer genuine and had to reset that.

  • Laura

    Thank you SO very much for this helpful guide! Despite the virus being on my work laptop, my IT department was useless, telling me just to run McAfee (which said I had no viruses/problems). The only glitch I had was in using Hitman Pro, since the free trial was not available to me (corporate computer). I tried running Kaspersky, as someone else suggested, but that didn’t turn up any threats. However, ESET found it and took care of it for me. Just thought I’d share that in case anyone else has similar issues! Thank you, thank you, thank you.

  • Max Xavier

    You are a rock star, man. Wish I was in your area as I need my favorite laptop repaired !

  • Denise

    hello i just want to say thank you so much I was able to fix my sisters’ computer in no time. Thank you for making my life easier .

  • Mark

    Stelian,
    You are the man! Your directions were very detailed and easy to follow. Thank you. After much angst, my computer is back in business. –Mark

  • Teresa

    Dude! You totally rock! Even a no-tech-skill flunkie like me was able to follow these instructions and kick some FRV ass! Coluldn’t have done it without you, though, so giving credit where it is due! Thank you sooooo much! Did I mention you rock? :o)

  • Jennifer

    I think I’m in LOVE! Thank you … Other sites had steps 1-4 but it just wasn’t enough to do the job. I couldn’t get to any of my pictures or internet favorites until I ran this whole process. Thanks for saving me!

  • Erika López

    You rule!!! Ty so much for the info, got my life back in track :D

  • John Wilson

    WOW! I had a few worries along the line, but it seems everything is back in order from the infection yesterday.

    After the first MalwareBytes run when I rebooted, the screen of File Recovery reappeared and seemed active, but finally stopped.
    I also got an error message the there was a problem starting cleanup.dll, the module could not be found.

    I ran MalwareBytes a second time and the File Recovery screen appeared again, seemed active but finally stopped.

    I continued from there with your process and in the end everything seems to have worked great.

    You have truly done all of us a valuable service by providing this information.

    Thanks so much,

    John

    • Mike

      I’m having same issue. When I rebooted after anti-malware (in normal mode) file recovery screen appeared again. You mentioned that it went away. I am currently running anti-malware scan a second time, will see what happens.

      • Stelian Pilici

        Hello Mike,
        Can you please go ahead and perform the HitmanPro and RogueKiller scan….. And then reply back with the results.. :D

        • Mike

          Okay, it seems that everything went back to normal (but I did notice that there is an icon on desktop called “File recovery”

          • Stelian Pilici

            Hello Mike,
            That should be just an left over and harmless file from this infection.Right click on it and select delete to get rid of it.
            NEXT,for your peace of mind, please perform the following scans:
            STEP 1: Run a scan with Emsisoft Emergency Kit.

            1. Please download the latest official version of Emsisoft Emergency Kit.
              EMSISOFT EMERGENCY KIT DOWNLOAD LINK (This link will open a download page in a new window from where you can download Emsisoft Emergency Kit)
            2. After the download process will finish , you’ll need to unpack EmsisoftEmergencyKit.zip and then double click on EmergencyKitScanner.bat
            3. A pop-up will prompt you to update Emsisoft Emergency Kit , please click the “Yes” button.After the Update process has completed , put the mouse cursor over the “Menu” tab on the left and click-on “Scan PC“.
            4. Select “Smart scan” and click-on the below “SCAN” button.When the scan will be completed , you will be presented with a screen showing you the malware infections that Emsisoft Emergency Kit has detected.Make sure that everything is Checked (ticked) and click on the ‘Quarantine selected objects‘ button.

            STEP 2: Run a scan with Eset Online Scanner.

            1. Download ESET Online Scanner utility.
              ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
            2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
            3. Check Yes, I accept the Terms of Use
            4. Click the Start button.
            5. Check Scan archives
            6. Push the Start button.
            7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
            8. When the scan completes, push Finish
        • Mike

          It worked! Thank you!!

  • Rick

    Thank you! File recovery could not have hit at a worse time. We have generally recovered but 2 problems remain. Web browsing is now extremely slow and the Microsoft office license/key is not being recognized and I can’t find my email with the key.

    • Stelian Pilici

      Hello Rick,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:
      STEP 1 : Run a scan with Combofix
      Download ComboFix from one of the following locations:
      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)
      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me if your machine is ok and the logs.

  • Graham Watt

    Thanks for the very thorough article and links. While I was familiar with Malwarebytes tools, you’ve gathered several good ones and following your instructions, and some others sites for specific registry keys/paths, I’ve been able to kill off this “secure file recovery” virus/malware. I believe the source of this instance of infection likely was “Playpickle dot com” or “flonga dot com” which my kids found somehow via their own grapevine and went to in search of free web-based games. (Telling myself to “Remember to configure a “USER” account without admin rights and USE it. Don’t just click download, okay, and Run blindly.”)

    Thanks for the blog post and detailed replies.
    Keep up the excellent work.

  • 3.75ips

    Thank you! Very well written document. I also used the system restore to an earlier day/time feature in Windows. For years I have struggled with getting the F8 to work at strat-up, but after a few attempts it does. One day I hope all these cyber criminals are found, prosecuted and spend a long-time in prison. This is a serious crime.

  • Jim

    Thank YOU! These viruses are getting harder to kill and people like you are lifesavers.

  • Chris

    This walk through was great. However, I’m not unable to remote desktop into the once infected computer.

    Very Odd. Any suggestions?

  • Meyer2250

    Thank you so much. Took a while, but was worth it.

  • Aron

    hi, there, very very very very, many thanks from here,, good detail explanation,
    many thanks
    Aron DK

  • Max

    Thanks for your detail explanation, thee problem has beam resolved……. Many thanks again

  • Jennifer

    THANK YOU! From tears to gratitude, I appreciate that you have taken the time to post this for all of us to use. You saved my sanity and my GPA!

  • Mark

    This terrible virus hit my computer the other day and I was able to find your site for help. I’m running Vista on my computer. I didn’t follow your first step and do the Registration codes for File Recovery. I went directly to the File Recorvery Removal Instructions and followed all the steps. It worked to the point that the “File Recovery” virus doesn’t show up but there still has to be something that is wrong. When I open in normal mode as soon as I try to open anything it locks up my computer and I have to stop the power to shut it down. I’m able to open and write this message through the “safe mode with networking”. At least this lets me know that everything is not lost. I tried using the Malwarebytes Chameleon as well with the same results. Is there anything else that you can suggest that may help me in my situation?

    • Stelian Pilici

      Hello Mark,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:
      STEP 1 : Run a scan with Combofix
      Download ComboFix from one of the following locations:
      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)
      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs.

  • autoverzekering

    Thank you!

    • Raymond

      I at first thought this was overkill and too geekish. I was wrong, many thanks for making the process easy to follow. I managed to fix my pc 30 mins before a presentation. I do make regular Acronis backups just in case.
      What virus/malware program should I use to stop this happening again? Microsoft Security Essentials did not help.
      Many thanks

  • Jens

    Hello,

    I got this virus on the computer and found this website. I did all the steps and now the computer works as before, but it seems like the File Recovery still is on the computer. I dont get these fake alerts and images anymore but I can still see the program File Recovery on the start menu and the shortcuts to it. Any help would be appreciated, thanks./ Jens

    • Stelian Pilici

      Hello Jens,
      That file is most likely just a left over file which you can delete.HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:

      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
        • System Memory
        • Hidden startup objects
        • Disk boot sectors
        • Local Disk (C:)
        • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, close the program

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish
  • Abdu

    WOW, that is all I can say. And, of course, a BIG THANK YOU!!!

  • Robert

    Stelian,

    I discovered this virus on my wife’s laptop last week and didn’t get a chance to attempt to remove it. While I was away on business, she rebooted it and attempted to use it. Now I can’t get it to boot in safe mode. All it does is stay idle on the page loading screen. Help!! Her system is Dell Vostro w/Windows 7. Thanks in advance, Robert

    • Stelian Pilici

      Hello Robert,
      Lets try to fix your computer,please run the below tools while in Normal Mode;
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

      • Robert

        Stelian,

        Her computer won’t boot normal mode either. I just tried. It is stuck on the “Page is loading, please wait. This may take up to 30 seconds” page.

        • Stelian Pilici

          Is this what you are seeing: http://www.youtube.com/watch?v=I42YnigbWDE ?

          • Robert

            Yes

            • Stelian Pilici

              Robert,it seems like you have a ransomware attack so this File Recovery is the least of your worries.
              Try following this video and see if this will fix your problems: youtube.com/watch?v=6bVbCABjf38

              • Robert

                Stelian,

                It’s nice to know that there are still fine human beings like yourself who make positive contributions to society. Thank you many times over, Robert

                • Ganesh Krishnan

                  Absolutely true.. well said Robert.. Stelian is a hero for me..
                  I got two more doubts to ask Stelian though:

                  1. Why some of my startup shortcuts are showing “empty” when i click on “expand “option ??

                  2. All the icons which earlier used to come under a single up arrow button have now come spread across my bottom right hand side corner near the date & time area ?

                  I ran almost all softwares as you said but I’m a little worried whether these viruses/malware/trojans etc is still there in my Dell XPS 15 laptop. May be because this is my first time but sir you see I have to do internet banking and all from now on and I’m scared to proceed beacause this happend. Kindly advice. Also FYI, I use Avast 7 latest one and before this virus inflicted, this avast only blipped about some malware site, etc.. blocked etc.. Nothing more did it do to stop this stupid thing. So I also need your advice as to setting up a good software firewall against these creepy things popping up and also killing these if any still exist in my laptop.

                  I’m deeply thankfull to your effort here. You sir did really help me very much.

                  Once again unending gratitude & thankfullness with expectations of a quick & positive reply. :)

                  Ganesh Krishnan, Kerala, India. :)

                  • Stelian Pilici

                    Hello Ganesh,
                    1.Can you please follow the instructions from this guide: http://malwaretips.com/Thread-Files-still-hidden-after-smart-hdd-removal-and-unhide-exe?pid=55462#pid55462
                    2.For your peace of mind, please perform the following scans:
                    STEP 1: Run a scan with Emsisoft Emergency Kit.

                    1. Please download the latest official version of Emsisoft Emergency Kit.
                      EMSISOFT EMERGENCY KIT DOWNLOAD LINK (This link will open a download page in a new window from where you can download Emsisoft Emergency Kit)
                    2. After the download process will finish , you’ll need to unpack EmsisoftEmergencyKit.zip and then double click on EmergencyKitScanner.bat
                    3. A pop-up will prompt you to update Emsisoft Emergency Kit , please click the “Yes” button.After the Update process has completed , put the mouse cursor over the “Menu” tab on the left and click-on “Scan PC“.
                    4. Select “Smart scan” and click-on the below “SCAN” button.When the scan will be completed , you will be presented with a screen showing you the malware infections that Emsisoft Emergency Kit has detected.Make sure that everything is Checked (ticked) and click on the ‘Quarantine selected objects‘ button.

                    STEP 2: Run a scan with Eset Online Scanner.

                    1. Download ESET Online Scanner utility.
                      ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
                    2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
                    3. Check Yes, I accept the Terms of Use
                    4. Click the Start button.
                    5. Check Scan archives
                    6. Push the Start button.
                    7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
                    8. When the scan completes, push Finish
  • Kathryn

    Hi,

    I’m so glad I found this site, as I just got this virus and it is a nightmare! I’m sure this will all work perfectly but unfortunately I can’t get started as the virus won’t let me connect to the internet so I can’t download any of this stuff. I tried using the activation code as you advised someone else but it just said it wasn’t valid. I also downloaded the various programmes on another computer, put them on a disc and tried to get them on my laptop. But the virus has hidden everything, so when I click on start I can’t go to the ‘my computer’ bit and find the disc I’ve got the programmes on. I have taken steps to ‘unhide’ files, and a lot of my desktop icons came back, but unfortunately nothing in the start tab came back (apart from ‘paint’ which isn’t very helpful!). Could you give me some advice on what to do, as I just don’t know how I can get rid of it if I can’t go on the internet directly and can’t find the disc… sorry if this is a silly question, I don’t know much about computers. any help would be HUGELY appreciated! Thanks,
    Kathryn

    • Stelian Pilici

      Hello Katryn,
      Can you please run a scan with Combofix,Complete Internet Repair and Farbar Service Scanner so that I can get an idea on what’s going on :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with Complete Internet Repair utility

      1. Download Complete Internet Repair utilityto your desktop
      2. Unzip all the files to their own folder on the desktop
      3. Within the folder double click CIntRep
      4. Select the following items,then press the GO button.
        • Reset Interent Protocol (TCP/IP)
        • Repair Winsock (Reset Catalog)
        • Renew Internet Connection
        • Flush DNS Resolver Cache
        • Reset Windows Firewall Configuration
        • Reset the default hosts fie

      STEP 3: Run a scan with Farbar Service Scanner

      1. Download Farbar Service Scanner from the below link.
        FABAR SERVICE SCANNER  (This link will automatically download Farbar Service Scanner on your computer)
      2. Run the ulity and checkmark all the boxes
      3. Click on the Scan button.
      4. Add the log that will produce in your next reply.

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Ruchi

    There’s another way to do this without using any software..
    Just Run MSCONFIG on your PC
    Choose Selective Startup
    Click on the ‘Startup’ tab
    Uncheck all programs
    Click OK and Restart

    Now your PC will start without the annoying File Recovery thing

    Locate the File Recovery Shortcut on the desktop and Go to properties
    Check its target file
    (On my PC it was- C:\Documents and Settings\All Users\Application Data\ttffgdhsjj.exe)
    Go to that location and delete the file(s) with that name
    Go to the Desktop and Delete the File Recovery Shortcut
    Empty you recycle bin

    Nw you can get your original startup setting with MSCONFIG again

    Ta-da!
    My PC worked fine after that..
    Hope this helps :- )

  • Matt

    Just a Thank You for this post. Tryed restore point befor finding your post. Wish i had found this blog first. I am all set. Thanks again Matt

  • Ben

    Help I got rid of the stuff and got my files and desktop pic back but I’ve been stuck with one problem….. my internet is going as slow as molasses before the recovery file virus it was fast but now its slow please help!!!!!

    • Stelian Pilici

      Hello Ben,
      Can you please run a scan with Combofix and Complete Internet Repairso that I can get an idea on what’s going on :
      STEP 1 : Run a scan with Combofix
      Download ComboFix from one of the following locations:
      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)
      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important!: Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with Complete Internet Repair utility

      1. Download Complete Internet Repair utilityto your desktop
      2. Unzip all the files to their own folder on the desktop
      3. Within the folder double click CIntRep
      4. Select the following items,then press the GO button.
        • Reset Interent Protocol (TCP/IP)
        • Repair Winsock (Reset Catalog)
        • Renew Internet Connection
        • Flush DNS Resolver Cache
        • Reset Windows Firewall Configuration
        • Reset the default hosts fie

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

      • Ben

        My internet is still slow

        • Stelian Pilici

          Can you please post here the Combofix log? :) You’ll be able to find it in C:\Combofix.txt

  • Ken

    Thanks so much for your help!!!
    I did have some problems trying to load some of the software to my PC, but was able to load them on to my laptop with no problem and then transferred the files to my PC with a thumb drive. All worked as you stated.
    Thanks again!! Ken :)

  • http://www.palmoceanview.com Monica

    OM Friggin’ G!

    That was crazy! But I am almost as good as new. Just have to replace my wall paper and my side bar (clock and various other news and stocks), did not fully load up. Not sure if I just need to reset everything. Sort of PO’d that my virus checker (Trend Micro Titanium) didn’t catch this for the price I pay for it. Sheesh!

    Thank you Thank you THANK YOU.

    • Monica

      OH… and PS… YOU ROCK!

  • Daniel

    So, trying to boot to safe mode with networking in order to download the needed programs, but WinXP is yelling about activation. I know it was activated a few years ago when I built the PC. HELP!

    • Stelian Pilici

      Hello Daniel,
      Lets try to fix your computer,please run the below tools while in Normal Mode;
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • Brad Z

    Thank you Thank you Thank you… easy to follow step-by-step instructions. Laptop running good as new with file access restored. Cleanup and restoration took about 2 hours, but worth every minute. You rock!

  • T.J.

    Hey guys I just had to clear this up for one of my users, and well done on getting the correct tools to help. One tip I can leave for everyone is this virus relies on the internet to get its live updates so disconnect your network cable (make sure you download and save the tools to a jump drive on a different computer first) and open ‘Task Manager’ the process is R627O85S7KwoPp9.exe find it and END the task. This will allow you to continue on with the tools provided by this site and prevent the pest to manifest…….if you do this correctly you can skip straight to MalwareBytes.

    • K

      T.J. – I can’t find the process you listed in my task manager. Anything else I can look for. I did download the recommended tools to a flash drive. I have a wireless connection and I turned that off (external switch) prior to starting computer in safemode. Flash drive will install, but I can’t see a way to open it and launch programs. Thank you for help.

      • Stelian Pilici

        Hello K,
        Just follow the guide…..it’s the easiest way to get rid of this infection :)

  • Zach

    I have an HP laptop and everything was pretty successful until after the HitmanPro reboot and now I am getting the error “No Bootable Device”.

    Have you seen this before?

  • Ben

    Hi,

    Rkill won’t run. It says that Rkill has terminated. Can I jump in the Malwarebytes Anti-Malware (trial) Full system scan? Please, need reply thank you.

    • Stelian Pilici

      Hello Ben,
      Yes of course,you can try to do the Malwarebytes scan if this product installed on your machine!

  • AmberGO

    Thank you SO much! Our computer is ESSENTIAL to our business and these steps were SO clear, concise, and easy to follow! THANK YOU!!!!

  • BM

    Ohhh my gosh that was horrible! Thank you soooo very much!!!

  • Harry Peng

    This morning, I could not even boot my computer. After following the instruction, all my issues were fixed. The instructions were very helpful and easy to follow! Thanks for saving us from the “black”days!

  • Anton Wentzel

    Dude, You Rock !!!!!!

    I lost everything…nearly…lol

    Tried this and it worked wonders. I am at stage * and I have all my desktop Icons back.

    Only thing that caused me some head ache was installing mallwarebytes. The Virus kept on killing the installaion just as it completed downloading. I noticed that the Malware Icon became visible as the error message came up and I took a chance in trying to run it as the error apeared. This worked and I updated and ran Malewarebytes while the error screen was still on.

    Thanks again Buddy, you saved my arse.

    • Stelian Pilici

      Stay safe Anton!:D

  • Brian

    I can’t get past Step 2. I am unable to reestablish Internet connections necessary to proceed. When I go into the Internet Tools Options, the LAN use proxy box is already un-checked. Is there something else I’m missing or another way around this?

    THanks

    • Stelian Pilici

      Hello Brian,
      Can you please try to use the license key provided in the article to see if this infection will let you connect to the Internet.
      If no,then we will need to transfer some files via an USB stick to the infected computer.
      Waiting for your reply.

      • Brian

        Do you mean I should transfer RKill to the computer via a USB stick and run it that way? If so, I will look for an RKill link that doesn’t auto-run the files – so they can be saved and transferred.

        • Brian

          I transferred RKill to the infected computer and ran it in safe mode. It took 14 seconds to complete the log and found nothing. Does this sound normal? Having trouble with this one, and I normally don’t have issues with killing off malware. Thanks.

          • Brian

            And HitmanPro won’t work when transferred over, because I have no Internet connection. That seems to be the root of my issues. Is there any other way to get around this malware to connect to the Internet? Step 2 is not working for me. The proxy server for LAN box never has a check beside it. So there’s nothing for me to un-check.

            • Stelian Pilici

              Hello Brian,
              Can you please run a scan with Combofix,Complete Internet Repair and Farbar Service Scanner so that I can get an idea on what’s going on :

              STEP 1 : Run a scan with Combofix

              Download ComboFix from one of the following locations:

              COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
              COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

              VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

              • Close any open browsers.
              • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
              • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
              • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
              • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
              1. Double click on ComboFix.exe & follow the prompts.
              2. Accept the disclaimer and allow to update if it asks
              3. When finished, it shall produce a log for you.

              Notes:

              1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
              2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
              3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

              STEP 2: Run a scan with Complete Internet Repair utility

              1. Download Complete Internet Repair utilityto your desktop
              2. Unzip all the files to their own folder on the desktop
              3. Within the folder double click CIntRep
              4. Select the following items,then press the GO button.
                • Reset Interent Protocol (TCP/IP)
                • Repair Winsock (Reset Catalog)
                • Renew Internet Connection
                • Flush DNS Resolver Cache
                • Reset Windows Firewall Configuration
                • Reset the default hosts fie

              STEP 3: Run a scan with Farbar Service Scanner

              1. Download Farbar Service Scanner from the below link.
                FABAR SERVICE SCANNER  (This link will automatically download Farbar Service Scanner on your computer)
              2. Run the ulity and checkmark all the boxes
              3. Click on the Scan button.
              4. Add the log that will produce in your next reply.

              Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Jodi

    Question: I already had malwarebytes on my computer. I did an update and ran a scan but it did not detect anything. Should I have uninstalled it and downloaded it again? or just move on to the next step?

    • Stelian Pilici

      Hello Jodi,
      No,just move on to the next step.Good luck!

  • Joseph Key

    Hi,
    I decided to trust you on the false positives and carried on. My PC is now back.
    Fantastic. Thank you so much. You are amazing.
    However, the standard ID I use does not have a complete start menu list. Now, I have all standard user accounts on the D drive, separate to the admin ID on the C drive. I looked in smtmp and found folders called 1 which contained empty folders and 4 which is completely empty.
    Could the incomplete start menu be due to the users being on the D drive?
    I am not complaining, good grief no.
    My pc is back working and I cannot thank you enough.
    Thank goodness I found you.
    Keep up the good work.
    Best regards,
    Joseph

  • Paul Williams

    Amazing I followed the instructions and it worked thanks alot its heaven sent had this problem for months legendary I didnt think it would work but it did now i can veiw by pictures from my smart phone on my p.c tuers!!!!!!!!!!

  • Joseph Key

    McAfee says the websites for roguekiller and unhide are dodgy when I try them.
    Can you advise please?
    I was doing ok up to that point.
    Thanks

    • Stelian Pilici

      Hello Joseph,
      You can ignore the warning from McAfee as it’s only a false possitive.However,if you don’t want to do that ,you can use this two alternative tools:
      1.ESET Online Scanner is similar to RogueKiller.Here are the instructions on how to perform a scan:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      2. Unhide Non System Files is similar to Unhide.exe.You can download this tool from here ,and just run it.
      Good luck!

  • Lucio

    Everything worked great except File Recovery still shows up in my “All Programs” list with an uninstall option. What should I do?

    Thanks for all your time & efforts!!!

    • Stelian Pilici

      Hello Lucio,
      HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:

      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
        • System Memory
        • Hidden startup objects
        • Disk boot sectors
        • Local Disk (C:)
        • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, close the program

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      As far as the left over shorcuts,you can just delete them ,as I’m sure that if you press them,nothing will load. Stay safe.

  • Martie

    Thank you!!! My computer is alive and the programs work. Bless your heart for sharing this.

  • Paola

    Thank you so much! You saved my computer!!!!!!

  • Alex

    I tried all of the above steps, and File Recovery is still there. Do you have any tips I can try to get it off?

    • Stelian Pilici

      Hello Alex,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:
      STEP 1 : Run a scan with Combofix
      Download ComboFix from one of the following locations:
      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)
      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs.

  • Potemkin

    Thank you so much. Worked perfectly. I am concerned my anti virus did not pick it up though.

  • Paul

    I still was unable to remove the file recovery program. Also the Hitman Pro software did not offer a free activation selection

    • Stelian Pilici

      Hello Paul,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:
      STEP 1 : Run a scan with Combofix
      Download ComboFix from one of the following locations:
      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)
      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs.

  • Nam

    I got this virus on my PC today and try to cleanup using your instruction.
    I finished 1st step.
    While I’m running Malwarebytes software system is going to sleep mode(monitor is going off) and can’t see anything so restarting the machine and running Malwarbytes again….can’t finish scanning……keep restarting….
    please help me on this….

    • Stelian Pilici

      Hello,
      Lets try to fix your computer,please run the below tools while in Normal Mode;
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • PS

    I feel silly – but I can’t seem to get past the very first steps. I restarted in Safe Mode with Networking, but I don’t see Internet Explorer…Can you help, please?

    • Stelian Pilici

      Hello PS,
      While in Normal Mode,please try to download and run Malwarebytes Chameleon:

      1. Hold down the WINDOWS key and press the R key
      2. ,this should brind up the Run box…. In it, please type the below content to download Malwarebytes Chameleon.

        iexplore.exe http://downloads.malwarebytes.org/file/chameleon

      3. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      4. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      5. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      6. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      7. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      8. Upon completion of the scan, if anything has been detected, click on Show Result
      9. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      10. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      2.Please perform a scan with HitmanPro and RogueKiller as seen on the guide.


      3.Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to see how everything is running…. Good luck!

  • Ankit

    Hey thanks buddy. I got my Desktop back. :)

  • Mashhood tariq

    Oh DudE u r my rock star ! love u !!!! MAY u live long and happy happy !
    u saved my pc’s life !!

  • Alison Peterson

    WOW I can only say great tutorial, I’ve been a computer Technician now for like 7 years and now understand that restoring back to factory settings is not a solution oooohhh yeeesss!

  • Kris

    Hello-

    I was finally able to download chameleon, and I actually got the DOS screen. It just stops working when the black screen says “killing known malicious processes”… :( I am getting more stressed by the minute becuase absolutely nothing is working!

    • Stelian Pilici

      Hello Kris,
      Lets try to fix your computer,please run the below tools while in Normal Mode(this is the regular mode in which usually windows is!!DO NOT LOGIN into safe mode with networking!);
      First try to run Mawlarebytes in Chameleon mode,if you experience any problems,try to run RogueKiller and then re-try the malwarebytes scan!
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • Jack

    If there was a prize for the best help website, you should get it!

    Thank you very much. You made my day. You’re the best!!!!

    Greetings from Germany;

    Jack

  • mattc

    The process works but I’ve managed to shorten it quite a bit by using system restore. If the infected computer creates regular restore points.
    1 – Run Rkill to kill the process.
    2- Open a command prompt and navigate to c:\windows\system32
    3 – Run systempropertiesprotection.exe – This opens up system restore and from there you can select a recent restore point. Restore and everything should be as it was. I’ve fixed 2 computers with this method and it takes maybe 15 minutes.

  • Kerry

    hello,

    I can’t open firefox as it says it is already running in the background. Can you help me fix that so I can remove the file recovery?

    Thank you!

    • Stelian Pilici

      Hello Kerry,
      While in Normal Mode,please try to download and run Malwarebytes Chameleon:

      1. Hold down the WINDOWS key and press the R key
      2. ,this should brind up the Run box…. In it, please type the below content to download Malwarebytes Chameleon.

        iexplore.exe http://downloads.malwarebytes.org/file/chameleon

      3. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      4. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      5. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      6. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      7. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      8. Upon completion of the scan, if anything has been detected, click on Show Result
      9. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      10. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      2.Please perform a scan with HitmanPro and RogueKiller as seen on the guide.


      3.Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to see how everything is running…. Good luck!

  • dani

    probando

  • Brett

    Thanks a million… I was worried, but thanks to you it all turned out right!
    I am asking anyone who reads this and has been saved by this web page to like it, g+1 it ; tweet it… Thats how we all can fight back!

  • PS

    AWESOME!!! You guys just saved my data!!! Thank you so much!!

  • Brad

    THANK YOU FOR THIS ARTICLE! Thought my computer was dead. Malwaretips rocks!

  • Per-Einar

    Thank you very much!! Everything is almost back except desktop functions and
    shortcuts. Any idea?

  • Matt

    This is a pre-thank you while I’m waiting for your software suggestions to remove this horrible virus. Thank you!!! This virus ruined my night, but you saved my expensive machine and work files (I’m hoping). Thank God I stumbled across your site. Again, thank you for this awesome step by step guide and information!

  • AlanBrado

    Thank you Man, you’re the best!

  • Dee

    Another fan….many thanks!

  • CarExpert99

    Thank you so much…, worried sick, just bought a new $3,000 laptop and this happens??? Gave me the shock of my life. To the Russian who made this virus… GO GET A REAL JOB!!!, instead of annoying everyone else.
    TY

  • John

    Thank you SO much for these instructions. My Dad’s computer got this virus, I followed your instructions to the tee, and it worked perfectly. Thank God there are people like you out there to help us out; otherwise, it would have cost us many hours of aggravation and a whole lot of money. Keep up the good work.

  • Wahab

    Thanks Alot broh Thanks alot this WORDS…. really you guys are the best that u saved my time and my harddisk from being again formatted. Thanks to the site :)))))) m sooo happy

  • dconnor shaw

    rkill isnt working this is the second time ive got file recovery
    rkill just says….

    • Stelian Pilici

      Hello Shaw,
      Lets try to fix your computer,please run the below tools while in Normal Mode;
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

    • Glenn

      When I execute the HITMANPRO does not have the option for the free trial. I loaded the latest version 361 for 64 bit. Is there an option I am missing. I have one file left to remove after Malwarebytes and iit will not remove it. Thanks.

      • Glenn

        Used Kaspersky Virus Removal Tool and it worked. Thanks for all the information.

  • Ariana

    Thank you very much, Stelian! Cannot thank you enough for the step-by-step, easy to understand and effective solutions for the removal of Recovery File Virus. My computer is back to normal. Your page should always top Google search results for this virus removal.

  • Kayleen

    Doing great through step 6. When I rebooted after running Hitman, my computer came up frozen with the screen distorted at my Windows log in screen. Have hard rebooted twice and am getting the same frozen screen. Can you advise?
    Thanks!!!!

    • Kayleen

      Actually I’ve only completed through step 5. When I hard reboot which is the only thing I can do, it boots up fine up until the final screen where I would normally put in my windows password to unlock my computer. It flashes this screen for just a second then the screen distorts with horizontal lines with the same coloration as the windows password screen. At this point my computer is completely frozen. Mouse won’t work. Can’t soft reboot. Only thing I can do is to hard reboot with the same result.

    • Kayleen

      Ok so I rebooted again, but this time pressed F8 and had it boot up in safe mode with networking. Then I was able to complete your last three steps including step 8. As I rebooted again to “set” my background settings, I let it reboot with the normal setting. Once again it reboots normally until the screen where I put in my windows password to access my computer. I can type in my password very quickly but within about two seconds the screen distorts again to those horizontal lines with the windows login screen coloration and the computer is frozen again.

      • Stelian Pilici

        Hello Kayleen,
        It really loks like the dispay driver got corrupted by this infection.Can you please uninstall it,restart and then reinstall it back in.
        NEXT,can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

        STEP 1 : Run a scan with Combofix

        Download ComboFix from one of the following locations:

        COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
        COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

        VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

        • Close any open browsers.
        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
        1. Double click on ComboFix.exe & follow the prompts.
        2. Accept the disclaimer and allow to update if it asks
        3. When finished, it shall produce a log for you.

        Notes:

        1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
        2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
        3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

        STEP 2: Run a scan with ESET Online Scanner:

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish

        NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
        Waiting for your reply to tell me if your machine is ok and the logs.

  • mrshaggs

    Thank you so much, Stelian. Your instructions were clear and concise, and are greatly appreciated. Keep up the good work!

    Geek in Alaska,
    mrshaggs

    • mrshaggs

      ps – I’m bookmarking this page. You got skills, d00d!

  • Sara

    Thank you soooo much!! You were truely a life saver for me. I had thought my computer had just crashed and finally given out on me because I had been having some problems with it for a while. I started researching to buy a new laptop which I really didn’t want to do right now. I thought the whole “file recovery” thing was legit until I decided to google it, found your site, and realized it was a virus. I followed all of your steps exactly and now my computer is almost as good as the day I bought it!! Thanks!!!!

  • Mikael

    Thanks for the support removing File recovery!
    But I found a map named “File recovery” with two icons, one “File recovery” and “Uninstall file recovery” under “Start” and “All programs” and on the desktop a short cut with the same name. How do I remover these? I couldn’t find them on the C drive or any map where you can find all the other program maps.

    • Stelian Pilici

      Hello Mikael,
      Right click on the folders and select Delete…this should remove those entries…
      HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:

      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
        • System Memory
        • Hidden startup objects
        • Disk boot sectors
        • Local Disk (C:)
        • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, close the program

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish
  • Susanne

    You’re my hero, you rescued my laptop! Thank you very much

    Greetings from Germany

  • Thor

    Thanks for the info.

    Have the virus right now. Had some DNS problems a few weeks ago so those are set to Google’s DNS servers. Will have to try the steps to remove this weekend.

    Any idea where this comes from? I was looking a Unitarian church sites when it first started affecting my computer.

    Also, I posted a nasty threat in their customer support screen. Any idea where they a located physically? If they are US citizens, I could be in trouble.

    • Stelian Pilici

      Hello Thor,
      This virus was created by some rusian cyber criminals and a lot of people got infected with it.
      There are a lot of entries points starting with a Java exploit or a malicious email attachment….
      Stay safe!

  • Demian

    Great guide, but wish I could get past first step. I used activation code, worked great. Booted PC in safe mode, checked ”no proxy” in Firefox. Still can’t connect to internet to download RKill. Already had Malwarebytes installed, ran a scan. Found virus, clicked ”remove”. No prompt to restart. When I restarted manually some icons reappeared but was still infected — and still can’t connect to internet to download RKill or any of the other software mentioned. All was done in safe mode. Any advice would be appreciated.

    • Stelian Pilici

      Hello Demian,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs.

  • Jami

    Thank you, Thank you, Thank you!!! I have never had anything like that on my computer. I am so glad you step by step instructions were out there. You are AWESOME!!!

  • Manoj Shah

    thank you for helping me in solving the problem, I was shocked after the attack of the file recovery virus, as I thought that I have lost all my data. Once again Thankyou very much.

  • Aurel

    Stelian, thank you from the bottom of my heart: you definitely helped me GREAT TIME to restore my computer after a File Recovery attack!!
    I’m so happy that there are such great guys on the internet!

    THANK YOU!

    • JP

      Hey, did it in safe mode. I did it with full scan cause it did not work the 1 st time. make sure you deactivate all firewall when you run Hitman. Thanks a zillion! JP

    • Demian

      Thank you for the guide, but having trouble getting started. Activation code worked great, in safe mode changed Firefox setting to ” no proxy ” but still can’t connect to download RKill. I already have Malwarebytes installed, I used it, found infection, but no prompt to reboot. Upon manual reboot, full scan shows no infection, but virus is still there. I assume I need RKill to halt processes before removal, but how can this happen when no connection to internet can be made. Please help !!!!

      • Stelian Pilici

        Hello Demian,
        You most likely have other infections on your computer.Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

        STEP 1 : Run a scan with Combofix

        Download ComboFix from one of the following locations:

        COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
        COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

        VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

        • Close any open browsers.
        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
        1. Double click on ComboFix.exe & follow the prompts.
        2. Accept the disclaimer and allow to update if it asks
        3. When finished, it shall produce a log for you.

        Notes:

        1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
        2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
        3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

        STEP 2: Run a scan with ESET Online Scanner:

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish

        NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
        Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Felix

    Good, understandable guide. It’s great that you are are doing this in your free time, so: Thank you alot!

  • kuraj

    Thanks!!

  • Liam

    Hi,

    I do not have the option to activate a free 1 time lisence for Hitman Pro 3.6.1
    I also have a flashing caution triangle in RogueKiller with “Root.mbr” beside it.

    Can anyone help?

    • Stelian Pilici

      Hello Liam,
      We can manually remove this files however let’s see if we can get rid of some of them using the below software:
      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
        • System Memory
        • Hidden startup objects
        • Disk boot sectors
        • Local Disk (C:)
        • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, close the program

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please re-run a scan with HitmanPro and post the log or a screenshot here and I’ll give you instructions on how to remove the left over files.
      Good luck!

  • Warren Yim

    Thanks a lot! Your instructions are awesome, clear and working. So glad that yours is the first in the search result of “file recovery virus”.

  • Mona Carabulea

    All I can say is a BIG: THANK YOU!!
    You saved my laptop!

  • Zvjezdan Veselinovic

    Actually, it is the File Recovery Virus. They disabled my adaptor for my LAN. I now just undisabled it. Should I reinstall Malwarebytes?

    • Zvjezdan Veselinovic

      I am running in normal mode now, where the kill worked and I reinstalled Malwarebytes. I updated it and it is scanning now. Is it safe for me to scan in normal mode now that I have internet? Or no???

      • Stelian Pilici

        Hello,
        Yes,you also run this scan while in Normal mode.
        Good lucK!:D

  • shots

    Worked like a charm! Thanks so much!

    • bxdobs

      Possibly a new twist, Vista Machine SP2 infected 9/9/2012 … in Safe Mode with Networking there was no proxy setting … however … there was something running in the background changing any attempts to connect to the internet specifically something was changing the TCPIP IP value … regardless of the addresses set, the moment the Network dialog is closed the IP address reverts to 192.168.210.152 … so … I went in to Regedit and searched for this IP address and removed all Gateway, and other related keys for this IP address … I then unistalled the Wireless Driver (device manager) then allowed the manager to reinstall the device drivers … this appears to have broken the hold on whatever was taking over the TCPIP IP settings … I am currently running Malwarebytes

      Note: I had removed this drive and installed as a slave drive on another machine … it took over 5 hours to scan 190GB on an Esata port using Malwarebytes but this procedure didn’t touch this virus??? It only found 4 unrelated issues … now in safe mode after 30 minutes Malwarebytes has found another 26 issues and still running.

      I suspect Malwarebytes may have issues with “MS” file Security when a drive is mounted as a slave … most of the vista files have permissions which won’t match the host machine.

  • Mike

    Thanks for the help, I got everything back to usual. But then 3 hours later, the same thing comes back up even after I quarantined it. This time, the process name was different but it was under the same description in task manager “AAW.” Did I do something wrong, or is this forever reoccurring?

    • Stelian Pilici

      Hello Mike,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • P

    Thank-you very much for this guide. I’m a novice and your instructions were dummy proof.

  • Sherrie

    Too little too late. I purchased this software and my computer crashed shortly thereafter. I will contact my credit card provider on this information. Much appreciated

    • Stelian Pilici

      Hello Sherrie,
      You should contact your bank as soon as possible!Also you should do a scan with the above utilities because this virus is still on your computer even after you have purchased the rogue antivirus.

  • Mike

    Why is it that when I ran RKill, it didn’t actually find anything to terminate. I clearly had the file recovery virus.

    • Stelian Pilici

      Hello Mike,
      Please go ahead with the scan recommended in the guide,then reply back and tell me how everything is working.

  • Jason

    I got this thing on my work laptop while working at home over the weekend. I can’t get the hitmanpro free 30 day license because it detected my computer as a commercial domain. Do you recommned an alternative?

    • Stelian Pilici

      Hello Jason,
      We can manually remove this files however let’s see if we can get rid of some of them using the below software:
      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
        • System Memory
        • Hidden startup objects
        • Disk boot sectors
        • Local Disk (C:)
        • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, close the program

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please re-run a scan with HitmanPro and post the log or a screenshot here and I’ll give you instructions on how to remove the left over files.
      Good luck!

  • Oly

    I’m getting and error when I try to run Malwarebytes in both the safe mode and normal modes with XP. I have run as administrator, but get gui “setup” “Access is denied” click OK and then get “ERROR” gui “setup was not completed…..”Please correct the problem and run Setup again” . I’ve tried several times as different Admins, Safe mode, etc. can’t get by this Access denied… ?

    • Stelian Pilici

      Hello Oly,
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • Aaron Z

    I got all the way to the hitmanpro part but the program says that it is not activated. I can’t find the 30 day free trail and it only gives me the option of purchasing. Did they change that recently? Now they want $19.95 for 1 year. Is there another program that I can usej for free?

    • Stelian Pilici

      Hello Aaron Z,
      We can manually remove this files however let’s see if we can get rid of some of them using the below software:
      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
        • System Memory
        • Hidden startup objects
        • Disk boot sectors
        • Local Disk (C:)
        • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, close the program

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,please re-run a scan with HitmanPro and post the log or a screenshot here and I’ll give you instructions on how to remove the left over files.
      Good luck!

  • Jae

    Thank you very much for your complete step by step instruction to restore my computer to the normal state. I will try to find a way to help others FREE just like you are doing. God Bless You!

    • kim

      OMG YOU ARE FANTASTIC n A GODSEND….TYVM for this!!!!! WOW U ARE GREAT!!!

  • Craig Williams

    Excellent article. Worked a treat. Easy to follow.

  • Henrik

    Great article, thanks!!!!!!!!

  • ScottR

    Thanks, this is a great thread. I think I got rid of the virus, but it seems to have disabled my internet. I have a TP Link wireless USB, and it no longer even acknowedges it is attached (when I plug/unplug the USB connection, the activity light on the unit does turn on). Can this virus “destroy” hardware? Or is there just some setting I need to reconfigure?

    Thanks!

    • ScottR

      Actually, got it. Virus had disabled it, just a matter of going into device manager. Phew! Thanks again, very well written tutorial!

  • Bob

    I’ve removed the Windows Recovery virus from quite a few computers using the ‘old and true malware tools’. But, your procedure and very good description of how to do it is one of the best I’ve seen. I found your site by ‘googling’ the virus, and want to say that it’s ‘one hell of a good site’. everything is readable, usable and very clear. The virus is gone and thanks to you it was real easy,, thanks again ,
    Bob Smith
    Robert Smith Consulting
    Fort Bragg, California

  • sanddunesaddict

    I followed the instructions and File reovery is still on my computer…
    My catalyst control center keeps popping up with errors.

    • Stelian Pilici

      Hello sanddunesaddict,
      Can you please run a scan with Combofix and ESET online scanner and post the logs here so that I can get an idea on what’s going on :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

      • SMuse

        Hello,
        Thanks for your tips.
        I had the smae problem and here’s the log:

        ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        c:\programdata\iHbG8O6dS4kC1u
        c:\programdata\iHbG8O6dS4kC1u.exe
        c:\programdata\KRvLBPIruJNA.exe
        c:\swtools\APPS\CSBED\CSBE\ACTIVATION_104\_desktop.ini
        c:\swtools\APPS\CSBED\CSBE\ACTIVATION_104\BIN\_desktop.ini
        c:\windows\SysWow64\jucheck.exe
        c:\windows\SysWow64\jusched.exe
        Q:\AUTORUN.INF

        • Stelian Pilici

          Hello SMuse,
          How is your machine running right now?
          Can you please run a scan with Kaspersky Virus Removal Tool:
          Click here to download the Kaspersky Virus Removal Tool.

          1. Save it to your desktop.
          2. Double click the setup file to run it.
          3. Follow the onscreen prompts until it is installed
          4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
            • System Memory
            • Hidden startup objects
            • Disk boot sectors
            • Local Disk (C:)
            • Also any other drives (Removable that you may have)
          5. Then click on Actions on the left hand side
          6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
          7. Click on Automatic Scan
          8. Now click the Start Scanning button, to run the scan
          9. After the scan is complete, close the program
  • Nathan

    This virus seems to have disabled all internet on the infected computer. I am unable to get any connection in explorer, either in safe mode w/ networking or in regular mode. Also checked to remove any proxy, but none was showing as being used in explorer. I’ve used the registration key to get it out of the way, but still have no internet for downloading the removal programs, any recommendations?

    using Win 7, Professional

    • Stelian Pilici

      Hello Nathan,
      What antivirus/firewall do you have installed on this machine? Can you please try to disable the firewall and then connect to the Internet.

  • Tida

    Not thing to say only a Big Thank You to You!!!!

    • http://om brittany

      After the malwarebytes scan.. it doesn’t prompt me to reboot. A notpad summary pops up If I restart the CPU on my own the virus is still present

      • Stelian Pilici

        Hello brittany,
        Can you perform a scan with the following utilities:

        1.Run a scan with Kaspersky Virus Removal Tool
        Click here to download the Kaspersky Virus Removal Tool.

        1. Save it to your desktop.
        2. Double click the setup file to run it.
        3. Follow the onscreen prompts until it is installed
        4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
          • System Memory
          • Hidden startup objects
          • Disk boot sectors
          • Local Disk (C:)
          • Also any other drives (Removable that you may have)
        5. Then click on Actions on the left hand side
        6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
        7. Click on Automatic Scan
        8. Now click the Start Scanning button, to run the scan
        9. After the scan is complete, close the program

        2.Run a scan with Eset Online Scanner.

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish

        As far as your browser goes,you should really start using Firefox Or Chrome as they are more secure and often updated when compared with Internet Explorer…..Also I advise you to review your rel-time protection and maybe change your antivirus.Below you can find some quick suggestions:
        Free – Avast 7 Free version or COMODO Internet Security
        Paid : Norton Internet Security 2012,Avast Internet Security 7,G-DATA Internet Security 2012 or ESET Smart Security 5.
        Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layered security config: http://malwaretips.com/Forum-Security-Configuration-Wizard

        Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)

    • Nathan

      Hey, it worked I believe. Is there a way to double check wether it was fully removed ?

      I think it’s great you put this info on the web for people to use thank you.

      • Stelian Pilici

        Hello Nathan,
        HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:

        1.Run a scan with Kaspersky Virus Removal Tool
        Click here to download the Kaspersky Virus Removal Tool.

        1. Save it to your desktop.
        2. Double click the setup file to run it.
        3. Follow the onscreen prompts until it is installed
        4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
          • System Memory
          • Hidden startup objects
          • Disk boot sectors
          • Local Disk (C:)
          • Also any other drives (Removable that you may have)
        5. Then click on Actions on the left hand side
        6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
        7. Click on Automatic Scan
        8. Now click the Start Scanning button, to run the scan
        9. After the scan is complete, close the program

        2.Run a scan with Eset Online Scanner.

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish
  • PackerFan

    I am going through the steps detailed above. Question is, if I bought into the scam how can I minimize damage (in addition to completing the steps above). Is there anything I can do about the time in which this was active on my computer becuase I was not smart enough to avoid it?

    • Stelian Pilici

      Hello PackerFan,
      This cyber criminals might have collected your personal data,when you have paid for this fake produc and they might try in the future to use your data.The best thing to do here is to inform your bank,that you are the victim of a cyber attack,they should know what’s the next step!
      As an additional step I suggest that you do a scan with ESET ONLINE SCANNER

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Stay safe!

  • Jules

    Wow,, I was just about to rip all the hair outta my head, kick my boyfriend and have an anxiety attack, until I found you!!! You are friggin GENIUS.. Thank you and my boyfriend thanks YOU! Problem fixed…

  • Rasmus

    Thank you so muth!! Works perfect!! :) You rock!
    Before I saw your instructions I was going to reset my whole system. When I was in safe mode I put over some files I didn’t wana lose to an external disk. The files I put over was just some word documents, movie and images. Is it possibly that may external hard disk now is infected (and will infect my computer the plugging it) or should it be safe because I was in safe mode when doing it?

    • Stelian Pilici

      As long as you saved just some images and movies than you are ok!
      I suggest that you perform another check…mostly for your peace of mind:
      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
        • System Memory
        • Hidden startup objects
        • Disk boot sectors
        • Local Disk (C:)
        • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, click the reports button (‘Paper icon’, next to the ‘cog’ icon) on the right hand side
      10. Click Detected threats on the left
      11. Now click the Save button, and save it as kaslog.txt to your Desktop
      12. Please copy and paste the contents of kaslog.txt in your next reply.

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      • tom

        using the registration number *brilliant* what are they going to do sue me for that lol ……thanks

  • Thy Le

    Hi! I’ve fixed all the problems. Got all the icons on desktop back. However, when I click on any of the folders, there are some folders inside showing no size. And when I click on those folders, all of my photos, documents, and music are gone. In other word, those folders are now empty. I’ve tried the unhide.exe but still did not get them back. Please reply this as soon as possible. (would be great if you email me the answer: tle9794@gmail.com or, the email above). Thank you so much for your time. I wish you all the best things.

  • Patrick

    Everything worked well. I appreciate the time and effort put into this.

    Patrick

    • Josh

      I believe the virus has made my internet explorer inaccessible. I have no icon in normal or safe mode and cannot find in all programs either. Is this typical? Any suggestions?

      • Stelian Pilici

        Hello Josh,
        Lets try another way around this
        While in Normal Mode,please try to download and run Malwarebytes Chameleon:

        1. Hold down the WINDOWS key and press the R key
        2. ,this should brind up the Run box…. In it, please type the below content to download Malwarebytes Chameleon.

          iexplore.exe http://downloads.malwarebytes.org/file/chameleon

        3. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
        4. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
        5. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
        6. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
        7. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
        8. Upon completion of the scan, if anything has been detected, click on Show Result
        9. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
        10. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

        2.Please perform a scan with HitmanPro,RogueKiller and Unhide.exe as seen on the guide.


        3.Run a scan with ESET Online Scanner:

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish

        If it still doesn’t want to work, please try the above steps while in Safe Mode with Networking.
        Waiting for your reply to see how everything is running…. Good luck!

  • Melissa

    most well written guide on the Internet!!

    • Brad

      I cant get the first step done, when I enter safe my firefox says already running and wont run and my internet explorer has completely disappeared. Also i tried the activation code twice with no luck.

      • Stelian Pilici

        Hello,
        Lets try another way around this
        While in Normal Mode,please try to download and run Malwarebytes Chameleon:

        1. Hold down the WINDOWS key and press the R key
        2. ,this should brind up the Run box…. In it, please type the below content to download Malwarebytes Chameleon.

          iexplore.exe http://downloads.malwarebytes.org/file/chameleon

        3. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
        4. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
        5. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
        6. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
        7. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
        8. Upon completion of the scan, if anything has been detected, click on Show Result
        9. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
        10. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

        2.Please perform a scan with HitmanPro,RogueKiller and Unhide.exe as seen on the guide.


        3.Run a scan with ESET Online Scanner:

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish

        If it still doesn’t want to work, please try the above steps while in Safe Mode with Networking.
        Waiting for your reply to see how everything is running…. Good luck!

  • James

    You absolutely ROCK!!!!!!!! This worked perfectly. Thanks for being so helpful and sharing this info.

  • Thy Le

    You are so awesome!!!!! I’ve spent a whole night of last night until 4 AM trying to fix this by a different way from another website. However, my laptop got frozen on the startup screen and the safe mode didnt work either this morning. Wish I was about to find this earlier. Thank you so much. I think there is still some missing files on the desktop like some word files, picture, and music. But that’s totally fine. Thank you for being so specific. Thank you and thank you

  • eperson

    Thanks for this guide, I am impressed with the detail.

    I have a machine with this infection. I have daily image backups of this machine going back two weeks. If I restore an image, what’s the best way to determine if it’s clean?

    Thanks in advance.

    • Stelian Pilici

      Hello eperson,
      Run a scan with Malwarebytes,HitmanPro and ESET Online Scanner.. if they all came up clean then you’re good to go…
      +1 for doing Image back-ups!:)
      Stay safe!

  • Erin

    Thank you, thank you, thank you! This made it so easy to get my computer up and running again. You are the best!

  • caleb

    Hi, thank you for providing these instructions for removing the file recovery virus,
    I am however having trouble running the Rkill programme even with it being renamed.
    It comes up with:
    Checking for Windows services to stop.
    * No malware services found to stop.
    Checking for processes to terminate.
    * No malware processes found to kill.
    Checking Registry for malware related settings.
    * No issues found in the Registry.
    Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
    Performing miscellaneous checks.

    Is this normal? as it says it hasn’t found any malware processes to kill etc. and I am certain I have this virus. Will this stop the other stages… malwarebytes onwards from working?

    Thank you in advance.

    • Stelian Pilici

      Hello Caleb,
      Go ahead with the Malwarebytes scan… don’t worry about RKILL… If you will have any problems please reply back.

  • Simple

    It’s so nice when people like you take the time to give clear, detailed, accurate and intensive directions on how to remove something as disgusting as this malware! Thank you so much!!!!

  • Jack

    Hi, Thanks a lot for this great guide! After finishing all the steps, most of my computer settings were restored. However, on my desktop there’s was a shortcut called File_Recovery. I try to right click it and it just freezes on the mouse “loading” image. I searched it on the start menu and there’s an option called “Uninstall File Recovery”. What should I do? I’m scared to click on any of the files.

    Thanks for all the help!

    • Stelian Pilici

      Hello Jack,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Brandon

    After doing this several times and in different orders I finally got close to being back to normal, but my internet explorer does not work. It works in safe mode, but not normal mode. I tried updating to IE9 while in safe mode, but didn’t help in normal mode. I installed Chrome in Safe mode and that does not work in normal mode, but works in safe mode. When I click on IE in normal mode an application error pops up saying “The application was unable to start correctly (0xc0000005). Click OK to close the application.” Thanks for all your help so far.

    • Stelian Pilici

      Hello john,
      Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

      • Brandon

        when I run hitman pro there are always two items that need to be replaced:

        master boot record(sector 0)
        c:smbr
        bootkit

        and

        volume boot record(sector 488368128)
        c:svbr_488368128
        rootkit

  • Los Angeles Educated G

    Thank you very much Stelian! Wonderful instructions, easy to understand and follow. I was able to follow all your steps easily enough but I encountered a problem after using RKILL. I could not stop it from rebooting for some reason so I just ended up installing Malwarebytes after it rebooted and it seems to have worked fine without a hitch. My computer is back to normal albeit some programs like by printer control server is not working and needs a re install. If anyone has a step they are having trouble with you can always adjust the steps like I did. It’s probably better to follow it to the T but sometimes its not always exactly like the author’s instructions. Follow these instructions! They aren’t trying to sell you anything, ok maybe the full versions of the programs , they are just sincerely trying to help! There are still good people out there and I thank you again for that! A+

    • Brian

      WARNING: Do not reboot your computer after running RKill as the malware process will start again , preventing you from properly performing the next step.

      Every time I use Rkill the program automatically reboots. What do I do.

      • Stelian Pilici

        Hello Brian,
        It seems like you also have a ZeroAccess rootkit on your machine.Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

        STEP 1 : Run a scan with Combofix

        Download ComboFix from one of the following locations:

        COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
        COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

        VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

        • Close any open browsers.
        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
        1. Double click on ComboFix.exe & follow the prompts.
        2. Accept the disclaimer and allow to update if it asks
        3. When finished, it shall produce a log for you.

        Notes:

        1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
        2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
        3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

        STEP 2: Run a scan with ESET Online Scanner:

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish

        NEXT,please run a scan with HitmanPro and RogueKiller
        Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Mika

    This was a great help! I’m really glad I stumbled across this. It’s pretty annoying to get Malware, but I’ve learned to fix so many of the tough ones I knew right away I needed to shut down and restart in safe mode with networking as soon as my desktop went dark. I also already had Malware Bytes on my computer, so it was pretty easy for me to run the unhide app and hitman. Thank you!

    • Bill

      I have followed each of the steps outlined, which removed the virus, restored my shortcuts, desktop, etc, however, like Randy Haben below, I cannot run Windows Update and cannot turn on Windows Defender firewall. I tried the Windows Update Troubleshooter, but it was unable to fix update.
      Any suggestions?

      • Stelian Pilici

        Hello Bill
        Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :

        STEP 1 : Run a scan with Combofix

        Download ComboFix from one of the following locations:

        COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
        COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

        VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

        • Close any open browsers.
        • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
          ———————————————————–

          • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
          • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
            ———————————————————–
          • Close any open browsers.
          • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
          • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
          • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

          ———————————————————–

         

        1. Double click on ComboFix.exe & follow the prompts.
        2. Accept the disclaimer and allow to update if it asks
        3. When finished, it shall produce a log for you.

        Notes:

        1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
        2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
        3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

        STEP 2: Run a scan with ESET Online Scanner:

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish

        NEXT,
        1. Click the Start buton
        2. Type “cmd” in the Search Box and then press Enter
        3. Right-click “cmd.exe” and select “Run as administrator”
        4. Click “Continue” on the “User Account Control” Window
        5. In the command prompt type the following command
        sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
        6.Restart your computer and check if the problem is solved.
        Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
        Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • mdxba

    Life Saver! Thank you so much for creating this for us non techies. Followed the steps and all my files were recoved. You guys ROCK!!!!!!

  • Kellie

    Worked great – cool tools.. thank you for the help!

  • Randy Haben

    Like many others, I found this blog post enormously helpful. It has taken many hours over a couple of weeks to recover from this attack. I got stuck at the Hitman Pro step. When running it I noticed it flagged the MBR (Master Boot Record). That worried me a little and when I rebooted, I got a “disk read error”. I could not find any articles to deal with that other than re-installing Windows. One problem with that is that I cannot have my original disks. However, I do have another laptop with Windows 7 and created a repair disk from that. Booting from the repair disk dvd, I discovered I could get to the command prompt and could see my hard drive and could run CHKDSK, which came back with no errors. I ran the various boot fixes and still could not get past the disk read error on startup. Then it occurred to me that maybe the partition had been deactivated. I got back to the command prompt on the repair disk and used DISKPART to set the partition (in this case partition 2 because DELL has other uses for partition 1) to active. Bingo! Now the computer boots and fine and I have been able to continue with the remaining steps. RogueKiller identified the ZeroAccess rootkit and apparently neutralized it. MalwareBytes and HitmanPro now run clean.

    Thanks again for this really useful post.

  • TexasMama

    OMG! You are a lifesaver! The instructions were easily laid out and made following easy! THANK YOU!

  • Anthony Freites

    Your information on this site is excelent the best thing about it is that is free with no gimmics . I realy appreciate this site .Got rid of that anoying (file Recovery virus) Thanks a lot for your help.

  • Richard

    Thank you for the help so far. I have spent 4 hours already researching how to fix this Live Security Platinum spyware with 2 other websites that lure you into a payment plan for protection, and following the discovery of your personal help have managed to reach step 4, but cannot find this mbam-setup icon either on the desktop or in the list of programs to run. Following advice to another in this predicament, I have jumped to Step 6 and returned to step 4 to no avail. Please can you advise? I have MS Windows XP.

    • Stelian Pilici

      Hello Richard,
      Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Next,please run HitmanPro and Malwarebytes as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • kansas

    My wife said she was looking at a cooking website when we got the file recovery virus… I thought we lost everything and she was so bummed when I didn’t think I could get our photos back! Your site saved the day and made me look like a hero!

    I praise God for the gift He has given you to help me and so many others!

    Thank you! Thank You! Thank You!

    • Los Angeles Educated G

      @Kansas,
      I agree completely..God fearing or not his post was a blessing to those needing the help…and for free..!! Wow thank you again to the author!!

  • Davey Jones

    Hi, I’ve gone through the first three steps, but once I get to the scan with malwarebyte. The program seems to freeze at the point everytime. I’ve tried uninstalling and reinstalling but nothing seem to be working. any ideas?

    • Stelian Pilici

      Hello Davey,
      Can you please run RogueKiller as seen on Step 6 and then try to run the Malwarebytes scan. Next run the HitmanPro scan and then run the Unhide utility.

      If it doesn’t work,please reply back and I’ll help you with additional instructions!

  • Jen

    Thank you soooooooo much! I was at wit’s end trying to deal with this and then I found this guide. What a relief I don’t have to wipe my hard drive.

  • Nathan Chapman

    This is amazing. You are a god

  • Vanisher3

    Easy to follow and worked like a charm…. Thanks so much!!!

  • Joy

    My mistake, follwed all steps except for Hitman Pro which did not complete. It loaded and catorgarized but did not ever complete a scan (froze)

    • Stelian Pilici

      So is your computer OK? :D

  • Joy

    Hi guys. so I followed all the steps outlined above but am still having problems. File recovery virus appears to be gone. However, I cannot get any anitvirus program to work: norton, AVG, Microsft essentials etc. The system restore will not work either “unable to restore” . Where do I go from here? Thanks in advance.

  • Tancred

    omg!thankyou very much for posing this thread. It really fixed my pc. I thought I was gonna lose my temper from that b****.
    hope you have more threads for removing viruses THANKYOU!

  • Jay

    Thank you very much for a method that really worked and instructions easy to follow.
    Also, I would like to add in case someone else had the same problem.

    After the MalwareBytes step when we boot into normal mode, I could not start Firefox because it kept telling me a Firefox process was already running and to close it first.
    In bringing up Windows task manager ( ctrl + alt + del ) I saw no Firefox process or any or process that looked unfamiliar.
    I also could not run IE as when I tried going to this website it gave me error messages saying files were missing.
    Luckily I remembered I still had Chrome on my system and in Windows task manager ran Chrome.exe in start new process tab; so that I could come back to this site and download/run remaining programs for the next steps.
    I guess otherwise one would have to download the programs in safe-mode, start in normal run those programs from Windows task manager although I don’t know if this is possible since Chrome was a registered program installed, and not only was I prevented from running Firefox, File Recovery did not let me access “My Computer”.
    Before I had problems with File Recovery today I had lots of misdirecting going on from links in google searching…I tried removing some files with HiJackThis which helped reduce the problem…but in the process may have removed some files that were causing me some problem in following the steps on this site. Again, just writing in case someone gets the same problems I did.

  • Kaprico

    Unfortunately, when I tried to implement the recovery strategy, a blue screen “page_fault_in_nonpaged_area” appeared shortly after I selected SAFE MODE WITH NETWORKING. I therefore couldn’t get access to start the process. Thoughts?

    • Stelian Pilici

      Hello Kaprico,
      Lets work in Normal mode and remove this infection:
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      NEXT,run the Unhide utility as seen on the guide.
      Waiting for your reply to tell me how everything is running!
      Good luck…

  • Andreas

    Thank you very much Stelian!

  • Forstad

    I just conclude your guide like this:

    You are the God!

    Thank you very much.

  • Lora

    I cant thank you enough!! Just used the instructions and my computer is up and running again. Most simple and easy instructions I have followed on virus removal! AWESOME!

  • Henry

    You’re step by step instructions cleared the virus & restored my computer.
    Thank you.

  • Brett T. Smith

    Hey Stelian,

    Just got this nasty bugger cleaned off thanks to your help.

    Thanks a MILLION for this awesome step-by-step post!

    ~Brett

  • Olivia

    M-am gandit eu ca esti roman :) Laptopul meu s-a pricopsit cu virusul File recovery si am tot cautat instructiuni care sa ma ajute sa elimin virusul. Desi disparusera fisierele (erau ascunse), acum le-am facut vizibile (in urma altor instructiuni de pe net). Am mai gasit un tutorial destul de util care recomanda printre altele si Rogue Killer; teama este ca eu sa nu sterg ceva util functionarii pc-ului (ceva din sistem). Este vreo problema sa urmez instructiunile postate de tine avand fisierele vizibile? De cand am capatat virsului, am mai deschis laptopul de vreo doua ori cu Safe mode cu internet; din ce am citit, este important sa inlatur acel proxy? Multumesc mult! Sper sa reusesc, maine vreau sa rezolv.

    • Stelian Pilici

      Buna Olivia,
      Este indicat sa folosesti si RogueKiller.. In mod normal nu ar trebui sa fie nici o problema daca utilizezi acest program….
      In legatura cu proxy-ul , in majoritatea cazurilor, nici macar nu exista…..asa ca cel mai probabil nu ai nici un fel de proxy server instalat …….
      Urmeaza pasii de mai sus si daca ai probleme , o sa te ajut eu! :)

      Succes!

  • g anderson

    got hit with this virus yesterday, following your instructions all going well until RogueKiller, from your link or elsewhere, it hangs up, unable to download. I use task manager to halt it. No what do I do? Making me nervous as I’m not a techie and don’t want to cause more problems.

    • Stelian Pilici

      Hello,
      Can you please try now to download RogueKiller, here are is the download link : http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
      If it still doesn’t want to work , please reply to this post!

      • g anderson

        It only downloaded when I went back into safemode, I completed your instructions and as of this morning all is working fine! Thank you so much. not sure why i was unable to download from your link or from their web address direct and from another source off of google, all failed until I went back to safemode and then no problems.

  • MDS

    Hi,

    My PC was infected with this virus and I was able to follow the steps above to restore it to its previous functionality [THANK YOU !!]. However, I still see the malicious programs in my start-up list (though they are disabled so don’t affect anything). I do not see these programs in the Add/Remove programs under the Control Panel, so I’m not sure how to remove them permanently. I’ve run various anti-virus/malware tools (Kaspersky, MalwareBytes, HitmanPro, Windows Defender) and none are able to identify the residual files.

    Any advice you can provide would be greatly appreciated.

    Thanks.

    • Stelian Pilici

      Hello MDS,
      Those shortcuts are just leftover files which you can delete…… Right click on them and select ;Delete;
      Next,lets make sure your computer is really clean :
      STEP 1: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Stay safe!

      • MDS

        Hi Stefan,

        Thanks for your response. Here is what I’ve done:

        In the msconfig start-up window, I don’t get any menu to delete the shortcuts when I right click. Also, when I go to the directory path the shortcuts point to, I don’t see the files in question, so I’m not sure how to remove them from the msconfig startup.

        The RKill run came out clean. I was unable to successfully run the ESET scanner. The first time, it locked up my computer (I had left it running and had gone to work, when I came back, it had hung). I rebooted and relaunched ESET, and it ran for over 7 hours (nothing else was running to slow it down and I have an i7 chip with 8GB of RAM so it’s a pretty fast computer) and then suddenly rebooted my computer, so I’m not sure if it completed or not. Do you know where there may be a log or report stored that I can look at? Also, in the ESET Quarantine directory, I see a few files (from the first run) with extensions .NDF, .NQF, and .NQI. What are these, and should I delete them?

        I additionally ran a full scan using MalwareBytes, HitmanPro, Avira, and freeAVG, and they all came out clean. I also plan to run a full scan using the free version of Kaspersky later today.

        Let me know what next steps I should take. Thanks once again for all your guidance.

        • MDS

          Correction – in the 3rd paragraph of the previous post, it should say RogueKiller instead of RKill.

          • Stelian Pilici

            Can you please run a scan with Combofix the log here :

            STEP 1 : Run a scan with Combofix

            Download ComboFix from one of the following locations:

            COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
            COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

            VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

            • Close any open browsers.
            • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
              ———————————————————–

              • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
              • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
                ———————————————————–
              • Close any open browsers.
              • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
              • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
              • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

              ———————————————————–

             

            1. Double click on ComboFix.exe & follow the prompts.
            2. Accept the disclaimer and allow to update if it asks
            3. When finished, it shall produce a log for you.

            Notes:

            1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
            2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
            3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

            Waiting for your reply to tell me if your machine is ok and the logs from Combofix.

            • MDS

              Hi Stefan,

              Thanks for your response. Could you tell me a little bit more about what Combo-fix is and how it works?

              Right now, I think (!!) I’m clean wrt this virus, but the only residual issue I have is with the shortcuts in the startup window.

              On a related note, I managed to complete a full scan using Kaspersky’s free scanner (it took about 28 hours – it doesn’t run well when the computer is idle), and it indicated that the RKill executable file was malicious. Do I need to be worried about this?

              Thanks.

  • Ken

    Hey when i am entering activation code at first step he is also asking me the email id. And although i started it in safe mode with networking my internet is not working, how i am supposed to download the anti malware. Please reply asap. Thank you very much

    • Stelian Pilici

      Hello Ken
      You can use any email adress with the activation code (123@fake.com for instance.. )
      Next,lets work in NORMAL MODE and remove this infection..
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • Patrick

    I have been repairing PC for over ten years and this was one of the best explained virus removal and done exactly what it said on the tin. Thanks

  • chris

    I’ve been fixing computers for 25 years. This is the best set of instuction for removing a threat I think I’ve ever seen.
    And best of all, It WORKED.
    Thanks.

  • Amanda

    Thanks SO much for your easy-to-follow instructions! I didn’t have to uncheck ‘use proxy server’ and I’m not sure why. Also, I couldn’t get RogueKiller to run. Kept giving me an error message telling me it isn’t a valid win32 application. Is there a way I can fix that, or another program I can use instead? All the other programs worked and everything seems back to normal.

    • Stelian Pilici

      Hello Amanda,
      Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Next,please run HitmanPro and Malwarebytes as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Kristian

    Hi, and thanks alot for this helpfull guide, but i do have a problem. I cant get malwarebytes to install, i downloaded the free version and when i try to install i says:

    Cant open this file:

    File: mbam-download-exe.php

    • Stelian Pilici

      Hello Kristian,
      Did you let the download complete?? I’m asking because it shouldn’t end in .php ….
      Please follow this steps:
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • PHOENIX

    Hey there,
    Thank you very much for the help, I just have one question.
    Everything was going absolutely fine until I finished my HitmanPro scan. After clicking ‘Activate Free Trial’, I receive an error message telling me that my Windows Firewall is not allowing the program to run. I can’t figure out how to allow it through the Firewall, as HitmanPro isn’t on the list of programs and won’t show up when I search my computer for it.

    Any help would be sincerely appreciated!

    • Stelian Pilici

      Hello PHOENIX,
      Most likely your Windows Firewall is blocking HitmanPro to connect to the Internet……
      Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Next,please run HitmanPro and Malwarebytes as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Vionette Velazquez

    Thank you so much for your detailed instructions! It worked!! My computer is up and running!! You are awesome! God Bless!

  • KELLI

    Thank you so much for your informative guide to fixing this malware issue! I am not really computer literate, but your step by step instructions were great!!! Thank you again!!

  • Laurel

    I SO appreciate your helpful webpage!! I followed each of your steps in order, and my computer appears to be fully cured. Like others, I wonder how I got infected in the first place (had McAfee installed). If you have any recommendations on how to avoid future infections, I would be most grateful (you may contact me by email). God bless you and thank you very much for taking the time to post this. Go FCB (my son is also a huge fan)! Aloha!

  • JASON

    I can only say thank you for the data you saved me! Nice work!

  • michael

    Thanks for the concise instructions! It took a few times, but everything is good now!

  • mikeficus

    My friend, you are a force for good in the world. A thousand thanks!

  • Leo

    Hi all,

    My laptop showed the file recovery symptoms a few minutes ago. Before finding this site I did a system restore and the PC booted up “just OK”.

    I still did everything this guide says but noted that RKill didn’t find any file-recovery related processes but the log said that a fake hdd app used to be on my system. Some registry key were fixed by Rkill.

    Malwarebytes is still scanning so I’ll report back when everything is finished.

  • Kagura

    thank you so much!!!!
    i just successfully repaired my computer by following your guideline!
    really appreciate about the content you share! it is easy to understand!
    thank you!!

  • John

    What a mess this virus causes, and what a wonderful service you have provided to those affected by the virus. So many tools that had to be researched in advance and sequenced so as to produce a full restoration! Your instructions were crisp and clear and everything worked perfectly for us. We are so thankful to have our computer back and operating properly again! We are also happy to know about these many excellent products and intend to do business with them! Thank you a thousand times!

  • MT

    Everything worked well except for unhiding the menu items. I was able to unhide the menu items for the administrator account on Windows 7, log out, and back in and they are still there. However, for my standard user account, I can unhide and see the menu items, but when I log out and back in, they are gone again. Any ideas?

  • Lee

    Hi there…I cannot get my internet to work even when I uncheck the proxy.
    Any tips???

    • Stelian Pilici

      Hello Lee,
      Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Next,please run HitmanPro and Malwarebytes as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs from this utiliti

  • Henrik

    Thanx !!
    This really saved my day and everything on my computer.
    Great work Guys !!!

    • Flo

      Thank You So Very Much…I Can’t Afford It, But I Owe You Big Time! Bless You…I Got EVERYTHING Back, I Don’t Understand Virus Protection If They Don’t PROTECT! We Need More Defenders Like You Out There…Thanks Again For Walking Me Through This Sickness! :-)

    • Dave

      Thank you!!!

  • Gia

    OMG!!! You are AMAZING! I appreciate you sooo much for sharing your knowledge and time. Thank you, thank you THANK YOU!! I thought I lost my kids pictures and video footage. Then I found your site and became refreshed, empowered and unafraid. Thanks again :-)

  • Donna Bonner

    Started out for five minutes this morning great, then the computer went crazy. Something told me this file recovery was not for real. I start at 9 am and now it 6 p.m. Your instructions were great and concise and easy to follow. Just in the process of restoring the hidden icons and files. I almost had a cow this morning until I found your site. This happened on my PC and thank goodness my laptop was not acting up and was able access your site. One question , this may happen again, hope not but does system restore do the same thing as the rogue killer that restores all the hidden icons and files or do you have a chance to restore the system with the virus in it? Anyway I just want to send a BIG thank you, everything seems to be restore back to normal. Your my hero!!! :)

  • Pat

    Thanks a lot. I got the PC going again.

    The only problem was hitmanpro did not have a 30 day activation and it indicated I had a “Volume boot Record” rootkit.

  • chris

    thanks……!!!!:)

  • Jim

    I dont know to express my gratitude. Thank you.
    well written answer.
    easy to understand.
    worked fantastic.
    I was frantic, I think we all were. and you were here for us with this answer that even someone loseing their mind could follow.
    In the name of all things holy……thank you……thank you.

    • Sarah

      Thank you!!! I was totally freaked and thought I was going to lose my photos! What a lifesaver!

  • Miriam

    Thanks so much – followed the instructions and it worked! Really clear guidance provided – thanks again!

  • Stuart

    Awesome. Thanks for this page, made life a lot simpler. Just wanted to get access to all documents to back them up before doing a full format to make sure this is gone. This has been a great help, thanks

  • Florin

    Multumesc. Nu ti-am descris problema, insa indicatiile tale au fost excelente.
    Totul merge OK acum.
    Este extraordinar ce faci tu. Foarte putini oameni mai ofera ajutor asa deschis.
    Daca nu gresesc cred ca esti roman, si daca este asa, pentru asta sunt mandru si eu(fara ca eu sa am vreun merit, toata stima pentru tine)

    • Stelian Pilici

      Multumesc Florin!!
      Ai grija de tine.Salut de la Bucuresti!

  • Jeff

    Hitman Pro will not install, there is an automatic update it tries first and while updating there will be an error, and it won’t let me click on next. Force Breach mode did not work either. Any suggestions?

    • Stelian Pilici

      Hello Jeff,
      Can you please run a scan with Combofix and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Next,please run RoguerKiller,HitmanPro and Unhide.exe as seen on the guide.
      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Rhonda

    A thousand thanks…. How can I repay the favor?

    • Stelian Pilici

      Just keep your computer malware free and have an awesome life!!:D
      Stay safe!

  • David

    Me and my dad tried to use hitmanpro however when it tried to look for remenants, it crashed on us TWICE. Can you help?

    • Stelian Pilici

      Hello,
      Can you please run a scan with Combofix and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Jay Hunter

    THANK YOU SO MUCH! I was horrified that my SSD was fried but thank goodness it was a virus! I had a look around and THANK YOU for your excellent tutorial/links to programs to solve the problem. It’s now back in the pink! You guys are awesome!

  • Joy

    I’ve had to go at this piecemeal. Run Hitman successfully, then updated Malwarebytes. Didn’t open auto, went through files, now on DOS prompt that reads – Killing known malicious processes, please wait. Been here over an hour. is this normal?

    • Joy

      forgot, run Hitman, then RKill, now stuck at Malware

    • Stelian Pilici

      No,it’s not normal…Please run another re-named version of Malwarebytes Chameleon.. It should not take more than 5 minutes to kill the malicious process….
      Waiting for your reply to tell me how is everything working…

      • Joy

        Attempted multiple runs of the Malwarebytes Chameleon to find one that works as your earlier response to Eric suggested. None ever opened the program as typical, stayed in DOS command, each one remainig with that same notice. I was never able to get RogueKiller to load. Downloaded UnHide and after Hitman, RKill, and Unhide, everything appeared to be back to normal. Ran Malwarebytes this am and it seems good. Thank you.

        • Stelian Pilici

          Hello Joy,
          So your computer is OK now right?Or you need assistance?

          • Joy

            Stelian, It’s working! Thank you very much.

  • Joy

    On my son’s computer, it has been on here awhile apparently.
    I’ve had to go at this piecemeal. I’ve run Hitman successfully, then updated Malware. Malware didn’t open automatically. DOS prompt reads – Killing known malicious processes, please wait. Been here for over an hour. Is this normal?

    • Stelian Pilici

      No,it’s not normal… Please run another re-named version of Malwarebytes Chameleon.. It should not take more than 5 minutes to kill the malicious process….
      Waiting for your reply to tell me how is everything working…

  • Monica

    I used these steps a few weeks ago and THOUGHT I had success. The same trojans appeared again last night. When trying to download the mbam-setup file in step 4 all I was able to download was a php file. This didn’t happen the first time I had to go through this process.

    I’m hoping this round works. It’s very frustrating, especially since I’m not sure HOW I got the trojans as I don’t click on any unknown links, etc.

    • Stelian Pilici

      Hello Monica,
      Can you please run a scan with Combofix and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

  • Bubba

    THANK YOU!! Totally saved my laptop :) Respect to you! :)

  • Thuso Machaea

    Thank you very much, you have saved my life big time. Everything worked just fine!

    Thank you again!

  • Chris

    Stelian – you rock dude!
    Thanks for the detailed instructions…they worked great!
    You are great – God bless you!

  • richard

    thanks a million! fixed everything perfectly

  • Rreichardt

    Thank you very much.

  • phil

    worked great!

  • Erika

    Hi, thanks so much for giving this info. HitmanPro founda Bootkit in the Master Boot Record (which it wanted to replace) and a Bad Configuration in the Boot Configuration Data (which it wanted to delete). I noticed that Javier had a similar issue that resulted in the language changing to Spanish so I did not allow HitmanPro to fix these to things. Do you think it is safe to run the program again and allow these changes?

    • Stelian Pilici

      Hello Erika,
      If you have an infected MBR then you need to replace it, that is your only option… It most cases it won’t cause any problems so you don’t really need to worry! :)
      If you don’t then you’ll have browser redirect to malicious webpages and other unwanted behavior…

  • thankful

    thank you

  • Jenny

    omg i actually love you. thanks so much!

    • http://malwaretips.com/blogs/file-recovery-virus/ Raq

      You are a life saver!!! Thank you so much!!

  • Jonathan Rigg

    Hi Thanks for all tips , although its not working for me at the moment :(

    I do STEP 3: Run RKill , but as soon as I do it it come s up with a message.
    “This system is shutting down. Please save all work in porgress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

    Time before shutdown 00.00.59

    This then counts down to zero and reboots , and Im back to square one.

    Also below this is says
    The system process
    C:\\WINDOWS\system32\lsass.exe terminated unexpectedly with status code 0. The system will shut down and restart.

    HELP , its doing my head in :(

    • Stelian Pilici

      Hello,
      Lets work in Normal mode to get around this:

      Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      2.Please perform a scan with HitmanPro,RogueKiller and Unhide utility as seen on the guide.


      3.Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • exmelange

    THANK YOU, THANK YOU, THANK YOU…….easy to follow and WORKED! You guys are AWESOME!

  • Eric L

    Hi, it’s after I paid this damn virus then I found this website. So since I already paid for this virus so do I start from step 2 to clean it up? (another weird thing here, on their website they offer full refund on your payment, I did that anyways after my computer got normal again, and if I don’t get it back I will go see my credit card company.)

    • Eric L

      Im sorry I mean step 3

      • Stelian Pilici

        Hello Eric,
        You should contact your bank and dispute the charge stating that the program is a scam and a computer virus.they should know what to do from there.
        NEXT,you still need to remove this virus…so please follow this steps:
        Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

        1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
        2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
        3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
        4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
        5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
        6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
        7. Upon completion of the scan, if anything has been detected, click on Show Result
        8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
        9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

        2.Please perform a scan with HitmanPro,RogueKiller and Unhide utility as seen on the guide.


        3.Run a scan with ESET Online Scanner:

        1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
        2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
        3. Check Yes, I accept the Terms of Use
        4. Click the Start button.
        5. Check Scan archives
        6. Push the Start button.
        7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        8. When the scan completes, push Finish
        • Eric L

          Thank you so much! I think my computer is back in normal and I will definitely go to dispute that damn payment. A small question here, after I ran the unhindered utility folders and files shows up, and there is a folder called administrator on my desktop, is this folder originally being there? Can I hide it or remove it?

          • Stelian Pilici

            Glad to see everything is ok now!Yes you can remove that folder if you don’t need it… :)

            • Eric L

              Dear Stelian, I got another problem right now. After I done every steps, my background still change to a black back ground every one or two hours. I ran roguekiller each time, and the program detect a key type call WallPP every time I scan it. And then I delete it but one or two hours later, it happens again. Do you have any idea why is it?

              • Eric L

                Oh sorry I just got it fix. Thank you so much for your help!

                • doubleu

                  replies like that don’t help. for other people experiencing this same issue, what did you do to fix it Eric L?

                  • Stelian Pilici

                    Hello doubleu,
                    You can always follow this steps..
                    STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

                    1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
                    2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
                    3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
                    4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
                    5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
                    6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
                    7. Upon completion of the scan, if anything has been detected, click on Show Result
                    8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
                    9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

                    STEP 2: Run a scan with RogueKiller

                    1. Please download the latest official version of RogueKiller.
                      RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
                    2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
                    3. After the scan has completed, press the Delete button to remove any malicious registry keys.
                    4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

                    STEP 3 Please perform a scan with HitmanPro as seen on the guide.
                    If you are having problems starting this program please use the ForceBreach mode as described in the guide.


                    STEP 4: Run a scan with ESET Online Scanner:

                    1. Download ESET Online Scanner utility.
                      ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
                    2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
                    3. Check Yes, I accept the Terms of Use
                    4. Click the Start button.
                    5. Check Scan archives
                    6. Push the Start button.
                    7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
                    8. When the scan completes, push Finish

                    Waiting for your reply to tell me how everything is running!
                    Good luck…

  • Donnie

    OK so I Got this comp working now but no antivirus will work,or windows update. what now

    • Stelian Pilici

      Hello Donnie,
      Can you please run a scan with Combofix and ESET online scanner and post the logs here :

      STEP 1 : Run a scan with Combofix

      Download ComboFix from one of the following locations:

      COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
      COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

      VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

      • Close any open browsers.
      • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
        ———————————————————–

        • Very Important! Temporarily disable your anti-virusscript blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
        • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
          ———————————————————–
        • Close any open browsers.
        • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
        • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
        • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

        ———————————————————–

       

      1. Double click on ComboFix.exe & follow the prompts.
      2. Accept the disclaimer and allow to update if it asks
      3. When finished, it shall produce a log for you.

      Notes:

      1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
      2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
      3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

      STEP 2: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
      What antivirus are you using?

  • Lee Patzius

    Wow thank you! Your step by step instructions worked perfectly. I’m not a pro by any means but your procedure and the powerful programs downloaded really nailed it. Amazing. Thank you so much!

  • Barry Hesk

    Thanks Stelian – great instructions and tools.

  • Russ Bugary

    -Thanks a million – worked like a charm. I just wished I knew how this nasty malware entered my system.

    Kudos – Russ

  • Frankie

    Lot of thanks. You are The BEST!!

  • Sarah

    Wow.. Thank you so much!!! Easy to follow instructions you are a life saver very greatfull :-)

  • Javier N.

    I need help!! After running Hitman Pro, I restarted my computer (HP Paviliom dm1) and it booted into Win7 Home Premium (i use Home Basic), in english (my PC is in spanish) and with no apparent way to return to the previous partition. Do you have any solutions? It doesn’t even show me the options to select a user account, it’s like its a completely different computer. Please, help!

    • Stelian Pilici

      Hello Javier,
      You have a Master Boot Record infection which HitmanPro fixed.. this is the reason why your computer is now booting into the English version.

      • Javier N.

        Do you know any fixes for this? I’ve going crazy over this for the last two days!

  • Bob Mc

    I LOVE YOU! (Don’t tell my wife…)

    Thanks for this – you saved our day. Superman wears pajamas with YOUR picture on it.

  • D

    Thank You very much! Appreciate you time and effort explaining in detail and step-by-step. It worked and successfully removed the nasty virus….Keep up the good work.

  • Mandeep

    Thank u man very useful guide…ui saved us :)

  • Roten

    Tnx, this save my day!
    Great guide that really worked.
    Thanks one more time.

  • Gabriel

    THANK YOU VERY MUCH!!!! YOU ARE A GENIUS!!! YOU SAVED ME!!!!!

  • denise

    This virus is popping up when I’m in safe mode too. It wont let me run anything.

    • Stelian Pilici

      Hello ,
      Lets work in NORMAL MODE to see if we can get around this :
      Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      2.Please perform a scan with HitmanPro as seen on the guide.


      3.Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish
  • BBF

    THANK YOU! THANK YOU! THANK YOU !

  • Simon

    Hi! Great writeup, but I’m having trouble using it. I have gone to safemode with networking on my infected laptop but IE is completely hidden and can’t be searched. FireFox is visible but when I try to open it it says FireFox is busy and another application is already open. There are no programs running anywhere, and I can’t browse to follow your tutorial. Help please.

    • Stelian Pilici

      Hello,
      Lets try another way around this
      1While in Normal Mode,please try to download and run Malwarebytes Chameleon:

      1. Hold down the WINDOWS key and press the R key
      2. ,this should brind up the Run box…. In it, please type the below content to download Malwarebytes Chameleon.

        iexplore.exe http://downloads.malwarebytes.org/file/chameleon

      3. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
      4. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
      5. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      6. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      7. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      8. Upon completion of the scan, if anything has been detected, click on Show Result
      9. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      10. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      2.Please perform a scan with HitmanPro,RogueKiller and Unhide.exe as seen on the guide.


      3.Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish
  • Anders

    Thanks a LOT for your time spend putting this instruction up!
    This “File Recovery” is really a nasty thing. But thanks to you, and the wonderful tools, my PC is back and rocking again :-)
    Visca el Barca!

  • winc

    great work

  • Jae

    Thank you SOO much for putting the time into this page, it’s the ONLY site that I know of that completely removes the File Recovery virus and restores everything back to normal on my system.

  • http://www.elaineedwards.blogspot.com Elaine

    Thank you!!! Thank you!! That was a nightmare of a day before I googled that nasty virus from my phone and found your website. I did it step by step and my computer is better than it was before the virus. Thank you!!!

  • Peter

    Thanks a million for taking the considerable time and effort it took to post this comprehensive solution. I was hours trying to sort it out on my own without success. Lucky there are people like you out there who will help.
    Many Thanks Again

  • David

    Absolutely Brilliant! Thank you so much for posting this. Worked like a dream. And as a bonus, the process found and scrubbed other malware tht had really been slowing my computer down. It is fresh out of the box fast now.

    Again – many thanks.

  • Jasbeck One

    Thanks bro, i really apreciate your help in circunstances like this… i was so desperate before your post. Gracias hermano

  • Troy C. Giersdorf

    I had the File Recovery virus on my PC when I got home last night. I am thinking that it was a time-bomb virus. My non-updated two year old version of Malwarebytes’ wouldn’t detect it. After running RKILL, I downloaded the new version of Malwarebytes’ Pro, but I had to run it as iExplore.exe, same as RKILL, to get it to install. Then I ran the Unhide utility. It’s great to be able to see the contents of my desktop, documents, music, pictures and my hard drives again, and to be confident that I am once again virus-free. Thanks for this excellent help page.

  • Armando

    Stelian,
    Thanks for this excellent guide! Do you have any idea where this came from or how it gets onto one’s machine? Just curious, as I am usually very careful with what I browse, open, download or install and this was a complete shocker.

    • Stelian Pilici

      Hello,
      There are several ways this virus spreads…. via email attachments or via an infected executable from a compromised website…. :)

  • paul

    thanks so much, awesome advise. really easy to understand.
    thanks again

  • Channi

    A very big thank you!!!! Keep up the great work!

  • Lisa

    Help! I am trying to follow instructions, but my computer is attached to the Internet via wifi- and I can’t get internet acess with safe mode plus networking, it seems.
    Also, the LAN settings do not show A proxy server connection at all

    • Stelian Pilici

      Hello,
      While in Normal Mode,can you access the Internet?If yes,please follow this steps:
      STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
      1.Here are the direct download links for HitmanPro,
      - http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
      - http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
      2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
      Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
      3. Let HitmanPro scan and remove the detected infections.

      STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
      1.Download any re-named version of Rkill (direct download links bellow):
      RKILL DOWNLOAD LINK #1
      RKILL DOWNLOAD LINK #2
      RKILL DOWNLOAD LINK #3
      2.Next,please perform a scan with Malwarebytes and then do a RogueKiller and Unhide.exe scan as seen on the guide


      STEP 3. Run a scan with ESET Online Scanner

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push List of found threats
      9. Push Export to Text file  and save the file to your desktop using a unique name, such as ESET Scan. Include the contents of this report in your next reply.Note - when ESET doesn’t find any threats, no report will be created.
      10. Push the back button.
      11. Push Finish

      Waiting for your reply to tell me how everything is working.. :) Good luck!

  • Tom

    Superb step by step instructions, many thanks.

  • Mr. Z

    Stelian Pilici…people like you are there so systems are safe…many thanks to you, i F***’d this virus to death.

  • Christie Lewis

    Wow!! Your help saved me! I was so freaked out! Thanks for the step by step, clear instructions and minimizing the “techie talk” that is way out of my league!!
    Thanks again! I really appreciate it!

  • kiki

    I can not thank you enough!!! I had no idea what I was going to do!
    Thank you so very much!!! :)

  • malwarekiller

    thanks!!

  • Jess

    Thank you so much! Without this, I wouldn’t know how to return my computer back to normal. I can’t thank you enough!! :)

  • Mike

    Thanks for your help. Much appreciated. Thought I would have to reinstall Windows 7. Probably saved my marriage too!!!

  • Duffy

    in the 1st step when you enter the activation code, it comes up the a read me note some crap about “thanking you” and theres a “customer support” number. I HIGHLY recommend giving them a call or a few calls or enough calls to annoy them just as much as you are annoyed of their adware. haha ya the whole time i was working on getting rid of this i called over and over and over and over and over and over cussing the crap out of them for their lovely adware. so manytimes they wont answer me anymore:(
    in case you didn’t get the number its 1(888)880-6899. use google mail to make free phone calls. that way the number can’t be traced or called back

    • Brian

      Thank you, but, I notice that it is the same person all the time. They only have one support person!!!!

  • Peter

    Thank you SO MUCH for posting this! It was a real life (and money) saver!!!Fixed my computer while reading your instructions on my phone! You ROCK! THANKS AGAIN!!!

  • Eric

    Awesome! My system has been restored. Thank you very much!

  • Sera

    A gazillion thanks for taking the time to put this together for us! You are a total life saver and you are so very much appreciated!

  • Eric

    Great stuff, somehow this nasty crept its way onto my Win 7 Pro machine and these instructions look to have pretty much cleaned it off. Just a few leftovers/comments:

    1. Hitman Pro didn’t give me a 30-day trial option to do the cleaning, so I just bought the 1 year subscription

    2. The Unhide utility will also unhide files/folders that were originally hidden, so you might see new folders that you haven’t seen before

    3. File Recovery files / shortcuts got left on the desktop and in the Start menu, so just nuke those manually. A few in C:\ProgramData also (random-characters.exe).

    Keep up the great work mate!

  • Phil Rabbit

    God Bless You!

  • Husker

    Thank you for this tutorial. It worked for the most part. Really appreciate it.

  • lmfz

    You are my hero!!

  • Gary

    Thank you so, so much for posting the instructions to resolve this matter; the solution provided worked perfectly.

  • Doru, Wash. DC

    Multumesc, foarte mult!

    • Stelian Pilici

      Salut si ai grija!!:)

  • kelly

    2nd time I have needed your help & both sucessful! thank you!!

    • Robert

      It took a little while but i ve gotten rid of the beast, thank you so much

  • Fuzzy

    THANK YOU SO MUCH! You magnificent Malware Fixing Warlock you. Instructions were straight forward and easy. Though a little lengthy, I appreciate how thorough this is, and saved me at least a day of re-formats and re-installs.
    I Would love to figure out how on earth I got this Virus/Malware in the first place, I had Avira Free installed at the time, but regardless, thank you. If I ever find out how I got this, I’ll post again =)

  • Barbara

    OMG!
    Thank you so much! BIG HUG.
    Barbara

  • Edward

    Thank you for providing these instructions – they were clear, simple, easy to follow and worked!

  • Eleuterio

    Tus consejos me fueron de gran utilidad,
    muchas gracias.

    Suerte!

  • Glen

    Stelian, you’re a legend mate! Thanks for the comprehensive, easy to understand guide. It saved me from rebuilding my pc unnecessarily. You will reap many rewards from your generosity. Cheers, Glen

  • Ern Shern

    Thanks! this guide really helped me a lot!
    I’m just wondering though, will all this steps ensure the total removal of the virus or could it be still lurking around?

  • Michael Quinlan

    Having helped a friend get rid of this nasty, I echo the gratitude in the previous responses. I suggest that a donate box be available on
    this page so that the painstaking effort neede to combat these abberations of humanity can be rewarded.

  • Ed Love

    Brilliant, many thanks from down under!

  • Laura

    Soooo happy! After the virus attack, I was nervous and skeptical of every download, but my faith that there are good people in the world has been restored! Followed each step and am completely back to normal. Phew! You rock!!!

  • J.Milt

    Thank you very much for this very good explanation.
    I found it easier to download all programs on another computer on an usb stick and then start with the cleaning as the browser could not be started on the infected computer.

  • Priscilla

    Hi, I’m a brazilian girl, with the same problem, and so happy because you help me!!! Thanks so much!!!

  • todd

    Outstanding tutorial both in level of detail and completeness. You saved me a massive headache…thanks a ton!

  • Charlotte

    Thank you! This has been a huge help. The only thing I will add is that the version that I got shut down my internet. I checked another site and was able to use the RogueKiller to get it working again by using FixProxy, FixHost, and FixDNS. I wasn’t able to use the HitmanPro without the internet, and HitmanPro was essential to removing the virus (for me at least). Thought I would share incase anyone else is having that problem!

  • Kerry

    You have no idea how much trouble you saved me, the only changes are that I went ahead and bought hitman pro. The only thing missing was how to restore the paths on the start menu. After cleaning up everything I still couldn’t see anything on my menu. The virus had put all the start up menu paths in a temporary folder, the steps listed by you were perfect and in addition to the steps below I was good as new

    The location of lost shortcuts / icons are:
    Windows XP – “C:\Documents and Settings\%username%\Local Settings\Temp\SMTMP”
    Windows Vista/7 – “C:\Users\%username%\AppData\Local\Temp\SMTMP”

    Inside that folder there are 3 folders named 1, 2 and 4.
    Folder “1″ has all the Program icons.
    Folder “2″ has all the Quick Launch Icons.
    Folder “4″ has all the Desktop icons.

    Restore the content in folder 1 to:
    Windows XP: C:\Documents and Settings\All Users\Start Menu
    Windows Vista and Windows 7: C:\ProgramData\Microsoft\Windows\Start Menu

    Restore the content in folder 2 to:
    Windows XP: C:\Documents and Settings\\Application Data\Microsoft\Internet Explorer\Quick Launch\
    Windows Vista and Windows 7: C:\Users\\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\

    Restore the content of folder 4 to:
    Windows XP: C:\Documents and Settings\All Users\Desktop
    Windows Vista and Windows 7: C:\Users\Public\Desktop

  • Dan Carrel

    You are a livesaver!! Amazing tutorial. Just fixed my computer. Thanks so much!

  • lawrence

    Shoutout from Singapore:
    Amazing tutorial, every single step extremely clear and easy to execute. Considering that I am clueless with computers, you are a lifesaver.

  • Steve

    Two weeks ago I got the SMART virus then yesterday the ‘File Recovery’ virus. Both times the advice given here fixed my computer.

    Thank you soooo much. GREAT site.

  • Lisa

    You are a genius – and a Godsend. Thank you so much for your detailed and simple to follow instructions. I spent all day yesterday dealing with this virus. My computer guru was busy on another project so we were left to fix this ourselves. If not for your guide, we would have been up the proverbial creek. Much appreciated! (You are now my Go-To guide for any computer issue. I will tell everyone that I know to visit this site.)

  • ron b

    Wow! What a life saver! Took a minute to clear things up, but your advice was right on the money…thanks would have been dead in the water without you.

  • michael mercier

    this shit happened to me and it also deleted (or appeared to do so from all files are currently missing). anyone know the company name that supports this virus so i know who to hunt down and remove the limbs? erm i mean sue.

  • Jay

    Fixed my problem! Thank God you’re the #1 result on Google!

  • smart-guy

    thank you so much!

  • Mikhail Diatchenko

    I just helped a friend recover her PC from this virus. Worked very well. Thanks!

  • Jim

    Thanks a ton! This is a particularly nasty one but your easy instructions enabled me to slay it!

  • Devin Faulkner

    I was hit with this ridiculus virus this morning, it took a while but your instructions and software suggestions brought back my computer.
    THANK YOU x 1000!

    • Stelian Pilici

      Stay safe Devin!:)

  • Joyce.RO

    Thanks… You saved my computer!

  • Richie

    Very good, detailed instructions and a lot of work must have gone into preparing them!!
    I had the bad luck of somehow getting this fake “file recovery” tool, despite having on-access protection turned on, in Avira. :-( It’s not even clear how it all happened. I suspect internet browsing but how??
    Unfortunately, I may have got a more malicious version or had multiple infections because when I tried to run the suggested tools, either the installation was thwarted or the operation was tempered with (“access is denied”), so I did not get anywhere with them. Even websites that contain relevant information were redirected on the infected PC. After spending a whole weekend reading security forums and downloading and trying various tools, checking things like the host file, I had some partial success but my system is now totally untrustworthy and I will have to reinstall everything, starting with reformatting the HD.
    The sad thing is that “file recovery” being ransomware, expecting a payment, it would be possible to follow the money trail it’s just that the relevant agencies and government organizations are incompetent, corrupt, could not give a hoot and unwilling to cooperate with other countries.
    I appreciate all the work the security companies are doing but by definition, they are always a step behind and shall I say they have a bit of conflict of interest. If they do too good a job, they reduce their own business.

    • Richie

      Whew! It took a couple of days but I think I’m fixed now. I will probably still do an orderly system reinstallation soon but I did not want to do the data migration earlier, in case I just spread the infection.
      I had a whole soup of problems in addition to File Recovery, including a boot kit and a root kit, my internet searches redirected, anti malware products blocked, icons disappearing from the task bar, some menu items hidden, slow PC, unable to do an orderly shutdown, problems with USB sticks, and the list just goes on and on. The only thing I did not have is the black desktop. Yippee!
      To Stelian’s credit, this is the most comprehensive guide I’ve found to date, to zap File Recovery and all the other crap and bring the system back to as it was before, as much as possible. I must have trawled through 100 pages in search of a fix and downloaded software after software. More time was spent on doing background checks before I downloaded something to poke around my Registry, MBR etc.
      I think all the scans and manual operations did enough to get things going. An important step was to run ‘attrib -h /s /d’ on C:\ after which I could install/run all the programs in the article above, without trouble. It’s worth running all of them because they all picked up on things the previous tool missed or was not designed to look for.
      In the end I’m now so happy I either bought a license or made a donation for the most effective tools.
      …and yes, somebody should wring the neck of whoever designed “File Recovery” and it’s ilk.
      Thanks again Stelian and Malwaretips!! You saved my sanity. :-)

  • Goog

    thanks!You are 100% Awesome!

  • loriann

    A very comprehensive and easy to follow process to remove the File_Recovery virus from your computer. You folks are AWESOME! Thank you so very much. It took a few hours, but now everything on my computer is back to the way it was before this malicious attack.

  • Borsecu

    I was ready to format my computer then I found this website… I can only say :THANK YOU!
    You guys are the BEST!!!

    • clive

      A big thank you, only lots a couple of hours when I thought it would be days.
      thanks again
      clive

    • Mark Frazer

      Thanks a million for this fix. It’s nice to know there are people out there like you. More power to you. Your generosity has restored some of my faith in human nature. Thanks again!!