Windows Recovery

Windows Recovery - How to remove?

This fake program comes through Trojan. After this bogus program infects your computer it will display various fake security messages and will perform fake computer scans. You will see security messages saying that there is something wrong with your hard disk drive. This program tries to fool you by imitating HDD malfunction. It will hide your files and will state that you must purchase a full version of this program to fix this problem. Don't buy this program it's a scam. All these tasks are only performed to fool you into purchasing a non existent program licence.

If you buy this program your computer will still be infected and you will only loose your money. Furthermore your banking information will be at risk. If you have enter your banking information into this program you should contact your credit card company and explain that you have been tricked into purchasing a fake computer optimizer.

Windows Recovery is a malicious program which was designed to imitate a computer's hardware malfunction. This rogue program pretends to scan your computers hard disk drive for errors and then comes up with a big list of found errors. It states that the detected errors could lead to a potential data loss, to further scare you into believing it Windows Recovery will hide your desktop icons and Start Menu items. Internet criminals who created this rogue computer optimizer is hoping that computer users will fall for this trickery and will purchase Windows Recovery to fix their computers. The reality is that Windows Recovery is a scam that doesn't actually scan your computer, it only imitates this process and then forces PC users into activating it's full version to fix non existent HDD errors. You should ignore all the statements made by this program and remove it from your computer.

Such fake warning messages will be displayed by Windows Recovery:

"Hard Drive Failure The system has detected a problem with one or more installed IDE / SATA hard disks. It is recommended that you restart the system"

"System Error An error occurred while reading system files. Run a system diagnostic utility to check your hard disk drive for errors"

"Critical Error Hard drive critical error. Run a system diagnostic utility to check your hard disk drive for errors. Windows can't find hard disk space. Hard drive error"

"Fix Disk Windows Diagnostic Diagnostics will scan the system to identify performance problems. Start or Cancel"

"Windows Diagnostic Diagnostics Windows detected a hard disk error. A problem with the hard drive sectors has been detected. It is recommended to download the following sertified <sic> software to fix the detected hard drive problems. Do you want to download recommended software?"

"Critical Error Windows can't find hard disk space. Hard drive error"

"Critical Error! Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware"

"Critical Error A critical error has occurred while indexing data stored on hard drive. System restart required"

"System Restore The system has been restored after a critical error. Data integrity and hard drive integrity verification required"

"Activation Reminder Windows Diagnostic Activation Advanced module activation required to fix detected errors and performance issues. Please purchase Advanced Module license to activate this software and enable all features"

"Low Disk Space You are running very low disk space on Local Disk (C:)"

"Windows - No Disk Exception Processing Message 0x0000013"

Ignore these messages. They are fake and only tries to scare you. Remove this fake optimizer from your PC.

Automatic Windows Recovery spyware removal:

Before downloading, enter Windows recovery advanced module registration key in the registration window:
8475082234984902023718742058948
Use any not real e-mail address. It will not remove the infection, but will show your files and desktop icons

Remover for
Windows Recovery
NOTE: If installation fails, you can try downloading customized installer which was built by our technicians to bypass Windows Recovery spyware infection. Your browser may report that this file is unsafe. Please ignore these warnings. Download customized installer

Complete these steps if after removal of this spyware your Desktop icons or files are hidden:

Step 1
This Infection Hides almost all user files. If You can't see your files don't panic. The files are not missing. They are just hidden, but still here. When downloaded spyware remover removes the infection, please download and run this tool to unhide your files (Link below). It is important to run this tool only when infection is already removed from your computer. This unhide files tool will be useless running it on infected computer.

When unhide files tool finishes, your windows desktop icons may still be gone. To fix missing desktop items after spyware infection download this .REG file. Double click when downloaded, click yes and then click ok. Reboot your computer, your desktop items now should be visible.

Step 2
Reboot your computer to check if everything is ok and Windows Recovery rogue spyware is gone. Check if you can find all your files. If some files are still missing, open My Computer, Click Tools, then select Folder Options... and under View tab select radio button "Show hidden files and folders", press OK. Now you will see all hidden files and folders. To unhide them Right click on the file or folder, then select Properties and uncheck "Hidden" Check box.

That's it! You're done.

Manual Step-by-step removal instructions of Windows Recovery.

If you are unable to remove Windows Recovery, you can use this manual removal instruction. Use it at your own risk. If you don't have strong computer knowledge you could harm your operating system. Use it only if you are an experienced computer user. (Instructions on how to end processes, remove registry entries...)

Step 1
Try entering a retrieved Windows Recovery advanced module licence key. Click "activate" button on the right-bottom side of the main Windows Recovery window. Enter these registration details:

E-mail:              This e-mail address is being protected from spambots. You need JavaScript enabled to view it
Activation key:  8475082234984902023718742058948

If it works, this bogus program will be disabled and you will be able to remove it without constant interventions. Note, that this infection constantly mutates and keys may be changed. After this procedure you will be able to see your files and install legitimate spyware remover to remove this infection. If registration key doesn't work, proceed to Step 2.

Warning! Entering activation key will not remove this infection! It will only disable fake warnings. This spyware will run in background and will keep collecting your data!

Step 2
Load your computer in safe mode with networking. Click Start, click Shut down, click Restart, click OK. During your computer starting process press F8 key on your keyboard multiple times until you see Windows Advanced Option menu, then select Safe mode with networking from the list.

Step 3
Open Internet explorer, click Tools and select Internet Options. Select "Connections".

Step 4
Click LAN settings, if a "Use a proxy server for your LAN" is checked, uncheck it and press OK.

Step 5
Download HijackThis and save it on your desktop. Some malicious programs are able to block HijackThis so when you click the download link, in the Save dialog rename HijackThis.exe to iexplorer.exe and only then click the Save button. After saving the file on your desktop, double click it. In the main HijackThis window click “Do a system scan only” button. Select these entries (place a tick at the left of the entry):

Windows XP:
O4 - HKCU\..\Run: [<random>.exe] %AllUsersProfile%\Application Data\<random>.exe
O4 - HKCU\..\Run: [<random>] %AllUsersProfile%\AppData\<random>.exe

Windows Vista and Windows 7:
O4 - HKCU\..\Run: [<random>.exe] %AllUsersProfile%\<random>.exe
O4 - HKCU\..\Run: [<random>] %AllUsersProfile%\<random>.exe

After selecting required entries, click "Fix Checked". After this procedure you can close HijackThis and proceed to the next removal step.

Perform these actions:

End these Windows Recovery processes:

[random]

Remove these Windows Recovery registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "<random>.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "<random>"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = 0'

Delete these Windows Recovery files:

%AllUsersProfile%\~[random]
%AllUsersProfile%\~[random]r
%AllUsersProfile%\[random].dll
%AllUsersProfile%\[random].exe
%AllUsersProfile%\[random]
%AllUsersProfile%\[random].exe
%UserProfile%\Desktop\Windows Recovery.lnk
%UserProfile%\Start Menu\Programs\Windows Recovery\
%UserProfile%\Start Menu\Programs\Windows Recovery\Uninstall Windows Recovery.lnk
%UserProfile%\Start Menu\Programs\Windows Recovery\Windows Recovery.lnk

Step 6
Download and install antispyware software to completely remove the infection. We recommend Spyware Doctor. If you can't run or installation fails, try downloading our Customized installer. After removal completes, perform these steps to unhide files and desktop icons

Other tools, known to remove Windows Recovery:

• iS3 STOPzilla
• Malwarebytes Anti-Malware

General tips on removing Windows Recovery :

*If you can't download anti-spyware software: Click on the download link, when the save dialog opens change the file name (example: when downloading mbam-setup.exe rename it to iexplore.exe).
*If you have installed anti-spyware program but you can't run it: Click Run, type %ProgramFiles% and press Enter. Open folder of your anti-spyware program, search for executable file and rename it. (example: Open Malwarebytes’ Anti-Malware folder, right-click on the main executable file (mbam.exe) then click rename. Rename the mbam.exe file to iexplore.exe, winlogon.exe firefox.exe ...
*If you can't access your anti-spyware software, try creating a new user account:
Click Start -> Settings -> Control panel.
Click User Accounts and create a new account.
Reboot your computer and login using a newly created user account.
*After this procedure you should be able to access your anti-spyware programs. Update and run a full system scan.

Some malicious software modifies browser settings and disables downloads of spyware and virus removing software. If you have problems downloading anti-spyware software with Internet Explorer, try downloading with Chrome, FireFox, Opera, etc.

If you can't access Internet:

Load your computer in safe mode. Click Start, click Shut down, click Restart, click OK. During your computer starting process press F8 key on your keyboard multiple times until you see Windows Advanced Option menu, then select Safe mode with networking from the list.

Start Task manager. Press ctrl+alt+del (or ctrl+shift+esc) and end task the processes of rogue program. ( if after this procedure you can't access any programs press ctrl+alt+del, click File, select New Task, and type explorer.exe then press OK.

Open Internet explorer, click Tools and select Internet Options. Select Connections, then click LAN settings, if a Use a proxy server for your LAN is checked, uncheck it and press OK.

After this procedure you should be able to access Internet. Now you can download anti-spyware software from our "Top spyware removers" section and run a full scan. Download, install and don't forget to update your selected anti-spyware program. Then run a full system scan.

Adittional information: