File Restore Virus

Also Known As: File Restore Rogue
Distribution: Low
Damage level: High

File Restore virus - how to eliminate it from your PC and unhide your files?

What is File Restore?

The File Restore fake system optimizer originates from a family of rogues called FakeHDD. This fake program imitates the process of scanning your computer hard drive for errors and generates a large list of supposedly-detected critical problems. To make the detection list appear authentic, this fake software also generates various fake hard drive-related error pop-ups and hides most of the files stored on your computer. Do not mistake File Restore for a legitimate system optimizer, since this program is a scam created by cyber criminals. The main purpose of this fake scanner is to scare PC users into believing that their computer hard drive has bad sectors, in order to sell a useless license key to fix them.

file restore virus

This rogue program is categorized as 'scareware', since it displays fake error messages and 'detects' fake problems in order to deceive computer users. In fact, there is likely to be nothing wrong with your computer hard drive; File Restore simply attempts to persuade you to believe otherwise in order to steal your money. Whilst the majority of rogue programs attempt to scare users into believing that their PC is infected with viruses, File Restore targets your hard drive - suggesting that you may lose your stored files.

File Restore rogue is proliferated using Trojans and drive-by downloads. Cyber criminals responsible for releasing this scam use malicious websites, fake program updates, and other trickery (fake video codecs, etc.) in order to infect computers connected to the Internet. If you see this program on your desktop performing a hard drive scan, your PC is infected with a File Restore virus. To eliminate this rogue from your computer, use the removal guide provided. Removing this File Restore rogue, however, is not enough - complete all of the steps below to regain control of your missing files.

A fake error message generated by the File Restore virus:

"Your computer is in a critical state. Hard disk error detected. As a result, it can lead to hard disk failure and potential loss of data. It is highly recommended to repair all found errors to prevent loss of files, applications and documents stored on your computer."

"Error while relocating TARE sectors."

"The storage device has failed a self-test."

Instant automatic removal of File Restore Rogue: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Spyhunter is a professional automatic malware removal tool that is recommended to get rid of File Restore Rogue. Download it by clicking the button below:
▼ DOWNLOAD Spyhunter By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Spyhunter.

Quick menu:

File Restore virus removal:

After the fake HDD check is performed by the File Restore virus, click 'Repair Issues', in the opened window choose 'I already have an activation code. Click here to activate', and enter this information:

Registration E-mail:
Activation Key: 08467206738602987934024759008355

You can now download and install the recommended spyware remover, which will completely remove this fake system optimizer from your computer.

If you cannot download or run the spyware remover, try running the registry fix (link below). It enables execution of programs. Download the registryfix.reg file, double click it, click YES and then OK.

File Restore virus removal instructions (on infected computer):

If you were unable to remove File Restore virus using the removal tools, follow these removal instructions to perform some steps manually and help the removal process.

1. Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.


Video showing how to start Windows 7 in "Safe Mode with Networking":

2. Open Internet Explorer, click Tools and select Internet Options. Select "Connections".

internet-explorer-options internet explorer internet connections


3.Click LAN settings, if 'Use a proxy server for your LAN' is checked, uncheck it and press OK.

internet options lan settings internet explorer proxy settings

4. Download legitimate anti-spyware software to fully remove File Restore from your computer.

6. After removing the File Restore virus, reset your Hosts files. Do not skip this step, since this malware modifies your Hosts file, and you will encounter browser redirect problems.

The Hosts file is used to resolve canonical names of websites to IP addresses. When it is changed, the user may be redirected to malicious sites, despite seeing legitimate URLs in address bar. It is difficult to determine sites are genuine when the Hosts file is modified. To fix this, please download the Microsoft Fix It tool, that restores your Hosts file to the Windows default. Run this tool when downloaded and follow the on-screen instructions. Download link below:

Complete these steps if after removal of File Restore virus your Desktop icons and files are missing:

Step 1
File Restore virus hides most user files. If you cannot see your files do not panic. The files are not missing, they are simply hidden. When downloaded, Spyware Remover removes the infection. Please download and run this tool to unhide your files (Link below). It is important to run this tool only when infection has been removed from your computer as it will be useless if run on an infected computer.

When the unhide files tool finishes, your Windows desktop icons may remain missing. To fix missing desktop items after spyware infection, download this .REG file. Double click when downloaded, click Yes, and then click OK. Reboot your computer and your desktop items should now be visible.

Step 2
Reboot your computer to check if everything is OK and the File Restore virus rogue is removed. Check that you can locate all of your files. If some files are still missing, open My Computer, Click Tools, then select Folder Options... and under View tab select radio button "Show hidden files and folders", press OK. You will now see all hidden files and folders. To unhide them, Right click on the file or folder, then select Properties and uncheck the "Hidden" check box.

That's it! You're done.

Other tools known to remove File Restore virus:


The fake antivirus programs (also known as "rogue antivirus programs" or "scareware") are applications that tries to lure computer users into paying for their non-existent full versions to remove the supposedly detected security infections (although the computer is actually clean). These bogus programs are created by cyber criminals who design them to look as legitimate antivirus software. Most commonly rogue antivirus programs infiltrate user's computer using poop-up windows or alerts which appear when users surf the Internet. These deceptive messages trick users into downloading a rogue antivirus program on their computers. Other known tactics used to spread scareware include exploit kits, infected email messages, online ad networks, drive-by downloads, or even direct calls to user's offering free support.

A computer that is infected with a fake antivirus program might also have other malware installed on it as rogue antivirus programs often are bundled with Trojans and exploit kits. Noteworthy that additional malware that infiltrates user's operating system remains on victim's computer regardless of whether a payment for a non-existent full version of a fake antivirus program is made. Here are some examples of fake security warning messages that are used in fake antivirus distribution:

Fake pop-up used in rogue antivirus distribution example 1

Fake pop-up used in rogue antivirus distribution example 2

Computer users who are dealing with a rogue security software shouldn't buy it's full version. By paying for a license key of a fake antivirus program users would send their money and banking information to cyber criminals. Users who have already entered their credit card number (or other sensitive information) when asked by such bogus software should inform their credit card company that they have been tricked into buying a rogue security software. Screenshot of a web page used to lure computer users into paying for a non-existent full version of file restore rogue and other rogue antivirus programs:

example of a webpage used to collect payments for fake antivirus programs

To protect your computer from file restore rogue and other rogue antivirus programs users should:

  • Keep their operating system and all of the installed programs up-to-date.
  • Use legitimate antivirus and anti-spyware programs.
  • Use caution when clicking on links in social networking websites and email messages.
  • Don't trust online pop-up messages which state that your computer is infected and offers you to download security software.

Symptoms indicating that your operating system is infected with a fake antivirus program:

  • Intrusive security warning pop-up messages.
  • Alerts asking to upgrade to a paid version of a program to remove the supposedly detected malware.
  • Slow computer performance.
  • Disabled Windows updates.
  • Blocked Task Manager.
  • Blocked Internet browsers or inability to visit legitimate antivirus vendor websites.

If you are experiencing problems while trying to remove file restore rogue from your computer, please ask for assistance in our malware removal forum.

If you have additional information on file restore rogue or it's removal please share your knowledge in the comments section below.

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

Malware activity

Global virus and spyware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
File Restore Rogue QR code
A QR code (Quick Response Code) is a machine-readable code which stores URLs and other information. This code can be read using a camera on a smartphone or a tablet. Scan this QR code to have an easy access removal guide of File Restore Rogue on your mobile device.
We Recommend:

Get rid of File Restore Rogue today:

▼ REMOVE IT NOW with Spyhunter

Platform: Windows

Editors' Rating for Spyhunter:
Editors ratingOutstanding!

[Back to Top]

Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Spyhunter.