 |
| A screen shot of Check Disk |
(Thanks to rogueamp)
Check Disk is promoted through the use of trojans and other malicious software, e.g. fake/infected web pages. The authors of the rogue program may also promote it on Facebook, Twitter and other social networks. Once installed, Check Disk will pretend to scan your computer for errors. The scan won't take long. After the fake scan it will report 11 errors and recommend system defragmentation. In Windows XP and Windows Vista it will display fake safe mode screen if you choose to defragment your hard drive. The rogue program won't display the fake safe mode screen if you use Windows 7. That's probably the main difference. Some of the fake computer errors Check Disk detects:
Requested registry access is not allowed. Registry defragmentation requiredFurthermore, CheckDisk will block nearly all programs on your computer and display the following error message:
Read time of hard drive clusters less than 500 ms
Bad sectors on hard drive or damaged file allocation table
Drive C initializing error
Hard drive doesn't respond to system commands
Data Safety Problem. System integrity is at risk.
Registry Error - Critical Error
Windows detected a hard drive problem.
A hard drive error occurred while starting the application.
If you attempt to run a program enough times it will eventually work. Last, but least, Check Disk will display fake errors messages and pop ups from your Windows taskbar. The text of some of the alerts you may see include:
Critical Error!
Damaged hard drive clusters detected. Private data is at risk.
Critical Error
Hard Drive not found. Missing hard drive.
Critical Error
RAM memory usage is critically high. RAM memory failure.
System RestoreCheck Disk is from the same family as Ultra Defragger and HDD Defragmenter.
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.
Without a doubt, you can not trust this program. It's a scam. You should contact your credit card provider and dispute the charges or even cancel your credit card if you have already purchased Check Disk. Then please follow the removal instructions below to remove Check Disk and related malware from your computer using legitimate anti-malware software. XyliBox and Siri posted the CheckDisk registration code: 0973467457475070215340537432225. We do not guarantee that it will work, just give it a try. Click on Help & Support button and enter the code. If it works, the rogue program won't block malware removal tools and other programs making the removal procedure a bit easier. If you have any questions or additional information about Check Disk, please leave a comment. Good luck and be safe online!
Check Disk removal instructions using Process Explorer (in Normal mode):
1. Download Process Explorer and end Check Disk process:
- [SET OF RANDOM CHARACTERS].exe
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Check Disk removal instructions (in Safe Mode with Networking):
1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm
NOTE: Login as the same user you were previously logged in with in the normal Windows mode.
2. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Check Disk associated files and registry values:
Files:
- %Temp%\[SET OF RANDOM CHARACTERS]
- %Temp%\[SET OF RANDOM CHARACTERS].exe
- %Temp%\dfrg
- %Temp%\dfrgr
- %Temp%\[SET OF RANDOM CHARACTERS]>.dll
- %Temp%\tmp2.tmp
- %UserProfile%\Desktop\Check Disk.lnk
- %UserProfile%\Start Menu\Programs\Check Disk\
- %UserProfile%\Start Menu\Programs\Check Disk\Check Disk.lnk
- %UserProfile%\Start Menu\Programs\Check Disk\Uninstall Check Disk.lnk
C:\Documents and Settings\[UserName]\Local Settings\Temp (in Windows 2000/XP)
C:\Users\[UserName]\AppData\Local\Temp (in Windows Vista & Windows 7)
%UserProfile% refers to:
C:\Documents and Settings\[UserName]\ (in Windows 2000/XP)
C:\Users\[UserName]\ (in Windows Vista & Windows 7)
Registry values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS].exe"
No comments:
Post a Comment