Data Recovery (DataRecovery) virus removal

Data Recovery is yet another malware or fake and rogue virus which states of itself to be a decent restoration program. Data Recovery is a clone of another recent malware known as System Recovery. Both of these applications are entirely useless and fictitious. They do not help you obtain your real data recovery but they mess up your PC just like other scams and malwares.

Data Recovery virus

Data Recovery virus

The scam called Data Recovery stands for the dangerous threat for your system so it should be treated like a real virus. The main sign of Data Recovery`s presence in your computer are unwanted popup notifications that contains warnings and alerts about the condition of your system. These annoying popups are shown by Data Recovery on your PC when your workstation is contaminated with this scareware. The purpose of Data Recovery rogue is to scare users with bogus notifications telling your that your system is infected with malwares and you should use Data Recovery software to get rid of these viruses. As soon as you are convinced and agree to use solutions suggested by Data Recovery it will ask you to pay for the registration fee of full version (which is as useless as the trial one). That is the aim of this Data Recovery virus. Do not purchase it because this malicious device is a scareware.
Keep in mind that all these warnings, alerts and virus removal suggestions made by Data Recovery threat are fake. This program is totally a rogue application and it is specially designed to extort your funds by selling its useless security products. You should ignore these warnings, avoid buying this program, avoid clicking any link within its popups and refrain to install any of the components it promotes. All you have to do is to immediately delete it from your computer upon successful detection. Below please find the good instructions on how to do it with the programs developed by GridinSoft company. Three programs are necesary for this goal – GridinSoft Trojan Killer, GridinSoft Unhider and GridinSoft Restore. Please carefully watch the similar video guide on how to use them correctly.

Fake information presented by Data Recovery malware:

  • Hard drive rotational speed decreased by 20%
  • Drive C initializing error
  • Disk drive C:\ is unreadable
  • System files are damaged. System is unstable.
  • GPU RAM temperature is critically high. Urgent RAM memory optimization is required to prevent system failure
  • The problem may cause errors while loading your operation system
  • RAM memory speed decreased significantly and may cause a system failure
  • Hard drive does not correspond to system requests
  • Damaged hard drive clusters detected. Private data is at risk. Restore is required
  • C:\System32\drivers is damaged. This problem may cause a system failure
  • Hard drive rotational speed exceeds system limits and may cause a system failure
  • Boot sector of the hard drive is damaged
  • Hard drive space less than technical limits
  • RAM Memory temperature is 83

The following fake error messages normally popup in the right-bottom part of user’s desktop. No doubt, they all should also be disregarded by you.

  • Critical Error!
    HDD clusters are partly damaged. Segment load failure
  • Critical Error!
    Windows OS can’t detect a free hard disk space. HDD error
  • Critical Error!
    Damaged hard drive clusters detected. Private data is at risk.
  • Critical Error!
    Hard Drive not found. Missing hard drive.
  • Critical Error!
    RAM memory usage is critically high. RAM memory failure.
  • Critical Error!
    Windows can’t find hard disk space. Hard drive error
  • Critical Error!
    Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.
  • Critical Error!
    A critical error has occurred while indexing data stored on hard drive. System restart required.
  • System Restore
    The system has been restored after a critical error. Data integrity and hard drive integrity verification required.
  • Activation Reminder
    Data Recovery Activation
    Advanced module activation required to fix detected errors and performance issues. Please purchase Advanced Module license to activate this software and enable all features.
  • Low Disk Space
    You are running very low disk space on Local Disk (C:).
  • Windows – No Disk
    Exception Processing Message 0x0000013

Data Recovery automatic removal:

GridinSoft Unhider download link:
www.trojan-killer.net/download/unhider.exe

GridinSoft Restore download link:
www.trojan-killer.net/download/restore.exe

Data Recovery manual removal:

Delete Data Recovery files:

  • %LocalAppData%\
  • %LocalAppData%\.exe
  • %LocalAppData%\~
  • %LocalAppData%\~
  • %StartMenu%\Programs\Data Recovery\
  • %StartMenu%\Programs\Data Recovery\Data Recovery.lnk
  • %StartMenu%\Programs\Data Recovery\Uninstall Data Recovery.lnk
  • %Temp%\smtmp\
  • %Temp%\smtmp\1
  • %Temp%\smtmp\1
  • %Temp%\smtmp\2
  • %Temp%\smtmp\3
  • %Temp%\smtmp\4
  • %UserProfile%\Desktop\Data Recovery.lnk


Delete Data Recovery registry entries:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" =
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU "MRUList"

6 Comments

  1. Andrés says:

    Maldito Virus Me Bloqueó Todo Mi Pc
    Me Figuró Formatearlo ,Yo Creo Q Es Mejor
    Pero Es RePorquería
    Me Reinició Mi Pc Y Casi No Deja Iniciarla NormalMente

  2. axel says:

    EL programa trojan, me pide una clave de autentificaciòn?? q onda

  3. King says:

    Hey Andy,

    Your manual steps saved my computer. Thanks a million buddy!

  4. Carmen says:

    Yo tengo el mismo problema pero no tengo acceso a internet ni puedo ejecutar ninmgun comando manualmente pues no me aparecen opciones en el icono de inicio tengo windows xp, pueden ayudarme

  5. Malin says:

    THANK YOU so much! I didn’t realise at first that I had to run the “unhider” and “restore”, but once I did everything I thought I had lost came back. Can’t tell you how grateful I am!

    Superthanks.

  6. tchoupi says:

    you have to uptade your link in french language:
    http://trojan-killer.net/fr/download/restore.exe

    this ‘french’ link does not exists, have to use the default one:
    http://trojan-killer.net/download/restore.exe

    thanks a lot 😉

Leave a comment

*