System Repair

13 July 2011 Rogue 0 Comment

System Repair is a virus that will disguise as a useful application. System Repair will conduct a PC Performance and Stability Analysis Report that shows several errors on hard drive. At this point, the rogue application will advise users to fix the errors. An attempt to resolve system issues will open a new browser window that will process payment for the licensed version of the program. It will take full credit card information to transact with the site before one can obtain the licensed version of the rogue software. After having the full version of System Repair, everything still remains and malware will still be present on the PC.

Usually, System Repair virus will infect a computer by exploiting security vulnerabilities. The program can be downloaded and installed without users full knowledge. In fact it can be delivered silently by a Trojan. Its presence can be recognized by an excessive pop-up of fake alerts and security notice. An automated virus-scan is also performed each time Windows is started. Since it is an untrusted application, expect that System Repair will provide fabricated results to further deceive victims.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

System Repair Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “System Repair”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the system and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to System Repair Virus.
4. Registry entries created by System Repair must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of System Repair start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart the computer.

System Repair Removal Tool:
In order to completely remove the threat from a computer, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected computer.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be get rid as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by System Repair:
%AllUsersProfile%\~
%AllUsersProfile%\~r
%AllUsersProfile%\.dll
%AllUsersProfile%\.exe
%UserProfile%\Desktop\System Repair.lnk
%UserProfile%\Start Menu\Programs\System Repair\
%UserProfile%\Start Menu\Programs\System Repair\Uninstall System Repair.lnk
%UserProfile%\Start Menu\Programs\System Repair\System Repair.lnk

System Repair Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “<random>.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “<random>”