Someone brought me their computer; it is infected with the fake System Check trojan. I have seen this malware once before; it appears to be quite destructive. The previous time, I used MalwareBytes to remove it and ended up having to delete the user account as it had been extensively corrupted.
This time, the user hopes to salvage his music and photos (doesn't everyone in this situation?). There are three user accounts on the machine (his is John),. John can log in, but I do not see any folders for John under the Windows 7 Users folder.
Is there away to repair the damage caused by System Check and restore John's user account libraries, music and photos? Also, what is the best way to disable and remove the System Check malware?
John thanks you in advance!