Severity scale:  
  (71/100)

Data Recovery virus. How to remove? (Uninstall guide)

removal by Ugnius Kiguolis - -   Also known as Data Recovery | Type: Spyware
12

Data Recovery virus is a fake PC optimization tool created to make you forget about normal routine on your computer. Even more, this malware does all it is capable to do in order to earn some money for its creators – as soon as it gets on the system, it tries to convince you into believing that your hard drive has various errors and that you must purchase its commercial version in order to fix it. However, it doesn't really detect all these issues it claims to have found. All its errors reported are fake and the only real problem is the same Data Recovery virus. Instead of keeping this fake PC defragmenter, remove Data Recovery from your computer. This will help you to bring your PC to normal. It is another alias for so called Data Recovery virus which we call Smart Data Recovery or Smart Repair.

HOW CAN I GET INFECTED WITH DATA RECOVERY?

Data Recovery gets into a computer using backdoors, like software vulnerabilities and security holes spotted on the system. Typically, all its files are downloaded by trojans infiltrating the system through those holes that additionally modify the Registry and add new unwanted files on some of the system directories. Of course, all these changes remain undetected by a user but he definitely notices additional problems caused by Data Recover virus. This fake PC defragmenter starts getting on the nerves of its victim by displaying fake alerts and scanners every time PC is rebooted. All these bogus alerts announce about hard drive errors detected in such form:

Requested registry access is not allowed.
Registry defragmentation required
Hard Drive rotational speed decreased by 20%
Disk drive C:\ is unreadable.
System files are damaged.System is unstable.
The problem may cause errors while loading operating system
Ram memory speed decreased significantly and may cause system failure.

Hard drive boot sector reading error

System blocks were not found

Error 0x00000024 – NTFS_FILE_SYSTEM

Error 0x00000078 – INACCESSIBLE_BOOT_DEVICE

Error 0x0000002E – DATA_BUS_ERRORError 0x00000050 – PAGE_FAULT_IN_NONPAGED_AREA

The DRM attribute value is too small before disk scan

Critical Error

Hard Drive not found. Missing hard drive.

We must warn you that you should never believe in Data Recovery which is another fake defragmenter spreading on the Internet. It does not detect any of its problems reported and displays only fake issues and errors. The only reason why it does that is trying to lure people into buying its commercial version.

HOW TO REMOVE DATA RECOVERY VIRUS

The main rule you need to remember is that you must ignore all Data Recovery alerts and scanners. In addition, you must contact your credit card company to dispute the charges if you have purchased this fake PC defragmenter. Finally, we highly recommend you to remove Data Recovery virus if you have spotted it on your machine. Try using our anti-spyware programs Reimage and Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus that will find and remove infected files for you. In addition, if you can't launch any of thse scanners, reboot your infected machine to safe mode with networking first.

The latest parasite names used by FakeHDD:
[newest id=”fakehdd”]

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Data Recovery virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Data Recovery virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Alternate Software
Plumbytes Anti-Malware
We have tested Plumbytes Anti-Malware's efficiency in removing Data Recovery virus (2012-08-03)
Malwarebytes Anti Malware
We have tested Malwarebytes Anti Malware's efficiency in removing Data Recovery virus (2012-08-03)
Hitman Pro
We have tested Hitman Pro's efficiency in removing Data Recovery virus (2012-08-03)
Webroot SecureAnywhere AntiVirus
We have tested Webroot SecureAnywhere AntiVirus's efficiency in removing Data Recovery virus (2012-08-03)
Data Recovery virus snapshot
Data Recovery virus

Data Recovery virus manual removal:

Kill processes:
[random].exe

Delete registry values:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Use FormSuggest" = 'Yes'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "CertificateRevocation" = '0'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnonBadCertRecving" = '0'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktop "NoChangingWallPaper" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments "SaveZoneInformation" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer "NoDesktop" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ".exe"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ""

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem "DisableTaskMgr" = '1'

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "CheckExeSignatures" = 'no'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "Hidden" = '0'

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced "ShowSuperHidden" = '0'

Delete files:
%LocalAppData%[random].exe

%StartMenu%ProgramsData Recovery

%StartMenu%ProgramsData RecoveryData Recovery.lnk

%StartMenu%ProgramsData RecoveryUninstall Data Recovery.lnk

%Temp%smtmp

%Temp%smtmp1

%Temp%smtmp1

%Temp%smtmp2

%Temp%smtmp3

%Temp%smtmp4

%UserProfile%DesktopData Recovery.lnk

Removal guides in other languages


  • David Wright

    Great article with excellent detail something that is missing from many of the other websites I have seen.