Title: Windows Recovery

Type: Rogue Antispyware

Also known as: WindowsRecovery

Remove Windows Recovery
Removal instructions

Severity scale:

(62 / 100)

Windows Recovery is a fake disk defragmenter that displays fake error messages and pop-ups to make you think that your computer has some serious hard drive problems. The rogue program prompts to pay for a full version of the program to fix the errors. If you choose to purchase this bogus program, you will lose your money and give your credit card details to the scammers who created this malware. Please use the removal instructions below to remove Windows Recovery from your computer as soon as possible.

Windows Recovery enters the system via Trojans, infected websites and fake online scanners. The program runs system scanner and later on reports critical errors detected on your system. It warns you that some of your private data might be lost because of the lack of free space, RAM memory usage, etc. The truth is that it is fake information and Windows Recovery only wants you to believe your system is infected. Windows Recovery will offer you purchasing a full version of its program with a promise that this will fix everything. However, its real intention is to receive your money, but in return you won’t get anything. Do not buy this rogue program. It won't help you. In order to stop all malicious activities on your computer you should remove it upon detection. You can remove Windows Recovery manually too, but remember that manual removal guide was made for the rogue program only and do not include other possible malware, rootkits.

Related files: [random].exe [random].dll Windows Recovery.lnk

Windows Recovery properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Stays resident in background

Windows Recovery snapshot:

Automatic Windows Recovery removal:

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.
By Downloading any provided Anti-spyware software to remove Windows Recovery you agree to our privacy policy and agreement of use.

remover for Windows Recovery

SpyHunter is recommended remover to uninstall Windows Recovery. You should confirm using free trial that it detects current version of parasite.

Note: Tested and Confirmed means that we have tested spyware remover with multiple versions of Windows Recovery and got the best results. There might be updated or modified version of particular parasite that require manual killing of parasite process or an update. In such case try other removers in the line.

Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove Windows Recovery using SpyHunter please report this to us.

Malwarebytes Anti Malware

Download | review

Tested and Confirmed! Malwarebytes Anti Malware removes Windows Recovery (2011-03-23 09:25:56)

STOPzilla

Download | review

Tested and Confirmed! STOPzilla removes Windows Recovery (2011-03-23 09:25:56)

Spyware Doctor

Download | review | tutorial

We are testing Spyware Doctor's efficiency at removing Windows Recovery (2011-09-20 23:46:35)

XoftSpySE Anti Spyware

Download | review

Windows Recovery manual removal:

FORUM:
Discuss Windows Recovery in
spyware removal forum

Kill processes:
[random].exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "[random].exe"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "[random]"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "CheckExeSignatures" = 'no'
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Use FormSuggest" = 'yes'
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = '1'

HELP:
how to remove registry entries

Unregister DLLs:
[random].dll

HELP:
how to unregister malicious DLLs

Delete files:
[random].exe [random].dll Windows Recovery.lnk

HELP:
how to remove harmful files

Delete directories:

Phone Support to remove Windows Recovery

QR code for Windows Recovery removal instructions:

QR is short for Quick Response. They can be read quickly by the mobile phones. QR codes can store more data than standard barcodes, including url links, geo coordinates, and text.

The reason we add QR code to the website is that parasites like Windows Recovery are really hard to remove on infected computer. you can quicly scan the QR code with your mobile device and have manual removal instructions to uninstall Windows Recovery right in your pocket.

Simply use the QR scanner and read removal instructions from mobile device.

SYMPTOMS OF rogue antispyware INFECTION

Rogue AntiSpyware virus usually imitates the legal anti-spyware software or some essential system components. Typically virus gets inside the computer with a help of trojans, that use security vulnerabilities for that. After getting inside the system, it tries to make it look like your system is infected with the numerous parasites, so it starts ‘scanning’ and finds numerous threats.

All rogue Anti-spyware along with Windows Recovery have the same purpose: Get your money by using scare tactics. If you will believe that that fake threats are real and pay them money, you will not get them back even if you will ask to cancel the order in your Bank. All the infections are deceptive and you dont need to purchase their Paid version. You need to remove Rogue virus itself.

Information added: 2011-03-23 09:25:56
Information updated: 2011-09-20 21:09:20

Additional resources:

Attention: If you know know a reputable website reated to security threats, please add a link here: add url

more resources

Caroline

I have just got this nuisance virous and cant seem to get rid of it as I am no expert. Can anyone provide a guide for dummies to get rid of this.

Also can you assure me that this will not upload another virous

Thanks

Caroline

Reply »

2011 05 05

An thony

What the program actually does is to change the attributes of all of your files to hidden. Even though you remove the program your files are still hidden. I took me numerous hours to go in and try to "unhide" all of my files. I also have to use the original installation disks to recover the Start files as they too were emptied.
Microsoft Security Essentials was able to pick up the program and get rid of it after infection. As mentioned you can get rid of it but you need to manually go in and repair the damages that this program causes.

Reply »

2011 05 11

Post Comment:

Attention: Use this form only if you have additional information about Windows Recovery parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Related discussions:

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.

Remove Windows Recovery Removal instructions

Automatic Windows Recovery removal:

Windows Recovery manual removal:

QR code for Windows Recovery removal instructions:

SYMPTOMS OF rogue antispyware INFECTION

Additional resources: