Windows Recovery – scam. How to remove Windows Recovery fake system defragmenter

It is our responsibility before you to tell about another malicious program that has recently been developed by the load of crooks and is now being spread in the world wide web. It has the name of Windows Recovery. This is by all means the rogue application that is running fake PC scan and pretends to be some superb analysis and optimization tool that shows fictitious information in order to scare you into thinking that there is a serious disfunction with your system. Windows Recovery generally penetrates into PC via Trojans that present fabricated error reports and security warnings on the attacked PC. All such notices tell many lies that there are certain serious errors with your PC’s HDD and then suggests you to download and install a tool that can supposedly fix your workstation. After pressing on of such warning alarms notifications, Windows Recovery will automatically be downloaded and installed onto your PC.


WindowsRecovery virus

Windows Recovery virus

Immediately after installation Windows Recovery will be tuned up in such a manner that it will be started automatically with every Windows startup. The user will face plenty of error notices when then try to execute the programs or uninstall files. Windows Recovery will then suggest you to performs scanning of your system, which of course will fictitiously reveal very many errors and it would state that it is impossible to repair them until you buy the registered version of the rogue. If one tries to apply so-called defragmenter program the message will tell that it is required to launch in Safe Mode and then show a fake Safe Mode background that claims of itself to defrag your PC. Thus, don`t be deceived and don`t let them scare you. Never obey their advises and do not remove any which were falsely identified. They try to cheat you and make you think that your PC doesn’t work as it should; Windows Recovery will also pervert your system in such a manner that some folders on your PC would reveal no data. Thus, when user opens such folders, for example, C:\Windows\System32\ or other drive letters, instead of common list of files it will display a different folder’s contents or show that the folder is entirely empty. All such well-designed tricks are performed n order to convince you that there is corruption on your HDD and that`s the reason why your files are not detected. After you close these warning notifications, new ones will come up which would state that this product that is able to aid you in repairing your HDD.

Taking the aforesaid information into consideration, remember this: Windows Recovery scares the user about problems with security of PC system and it thus must be removed immediately after revealing its dwelling on the attacked PC. Remember, that only reputable anti-virus program can render you real superb protection which aids to avoid secret infiltrations of this or any other junkware. You can get all this achieved by following the removal instructions stipulated below. These advises include both manual and automated recommendations. The choice is all yours.

Windows Recovery automatic remover:

1. Download the latest version of GridinSoft Trojan Killer to clear (not infected) computer and install it.

2. Update the virus database.
3. Copy the entire folder “GridinSoft Trojan Killer” to your jump drive (memory stick). Normally it is located at the following path: (C:\Program Files\GridinSoft Trojan Killer). “C” stands for the system disk of your computer. The name of the system disk, however, can be marked with another letter.
4. Open your jump drive (memory stick). Find the folder “GridinSoft Trojan Killer” there. Open it , find the file under the name “trojankiller.exe” and rename it to “iexplore.exe”.
5. Move memory stick to infected PC, open “GridinSoft Trojan Killer” folder and run iexplore.exe. Optional: copy the folder “GridinSoft Trojan Killer” from your jump drive to some other folder created on your PC and run “iexplore.exe”.

The procedure of removal of Windows Recovery virus with GridinSoft Trojan Killer is similar to removal of Windows Diagnostic virus as shown at this video:

Windows Recovery manual removal guide:

Delete Windows Recovery files:
%TempDir%\[random]
%TempDir%\[random].exe
%TempDir%\dfrg
%TempDir%\dfrgr
%Desktop%\Windows Recovery.lnk
%Programs%\Windows Recovery
%Programs%\Windows Recovery\Windows Recovery.lnk

Delete Windows Recovery registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run “[random]”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”

14 Comments

  1. Mirian says:

    Olá, estou com um pequeno problema, peguei este virus e estou tentando exclui-lo, baixei este program sujerido pelo site, mas quando ele encontra o virus, o pc reinicia, e não áh a exclusão do virus; o que devo fazer? me ajudem, estou desesperada.
    obrigada.

  2. David Cesar says:

    I subscribed to your “trojan-killer” software to get rid of the dreaded “window recovery” trojan but found that after everyting was cleaned I lost all of my document files, pictures and a whole mess of other files. How do I recover them?

  3. Arthur Dent says:

    David, it’s unlikely that you’ve lost anything. I’ve run across this virus/malware on two computers at work in the last two days. In both cases it merely marked the files of the user as hidden. Go to Folder Options in Windows Explorer, View -tab and select “Show hidden files and folders”. After that you should be able to see your files, go to their properties and unmark them hidden.

  4. Alice says:

    Life saver! Thanks for this! I was so worried I had lost all my files and was pullin’ my hair out ovdr this. Nice and easy instructions on how to get rid of the this rogue junk. Thanks Andy!

  5. Anna says:

    La guida dice di i Eliminare i file di ripristino di Windows, ma dove si trovano? poi tutti i miei documenti sono scomparsi!

  6. Steve says:

    This solution (plus your unhider.exe) worked perfectly. Thanks!

  7. nelson says:

    everything works great thanks guys now my search in my start menu and folders won’t find any of my files, any help?

  8. nelson says:

    nevermind on the previous post, is started working again

  9. Gretel says:

    I got rid of the Trojan but Unhider isn’t working on my Vista – desktop is black although sidebar shows as does icons installed after the infection (Malabytes and Avast). Only one user on the machine is blacked out . . . ideas?

  10. Eve says:

    I use my laptop for all my work and when i got this virus, I panicked as I hadn’t backed anything up, a quick call to someone who knows their stuff said it wasn’t part of windows and was a virus. I found this page and prayed it would work, you obviously have to pay for the full version for you to be able to remove the virus, which I was happy to do so. I easily removed the virus but still had a blank desktop, but found all my files had been moved to another location, thankfully all safe, so i just copied it back to the right location, reset my wallpaper and breathed a sigh of relief..now off to back up my files on the external hard drive just in case!

  11. saturnus says:

    Merci de m’avoir indiqué que mes dossiers seraient retrouvés avec AFFICHER LES FICHIERS CACHES..
    MAIS LES PROGRAMMES ONT DISPARU de “TOUS LES PROGRAMMES ” ET programm files reste disparu

    Tandiq que j’aperçois mes programmes sur
    panneau de configuration.
    J’attends vos conseils, merci.

  12. Klaus says:

    Husk at unhider.exe skal køres som administrator ! Ellers kan den ikke se i Startmenu foldere

  13. julia bandonni says:

    OLÁ A TODOS!! GENTE EU ESTOU SOLUÇANDO AQUI DE TANTO CHORAR DE ALÍVIO!!! ACHEI QUE TIVESSE PERDIDO TODOS OS MEUS ARQUIVOS POR CAUSA DESSE VÍRUS FILHO DA PUTA, MAS, COMO O ARTHUR DENT FALOU, SÓ ESTAVAM OCULTOS. MUITO OBRIGADO A TODOS!!! BOA SORTE SEMPRE!!!

  14. Hans says:

    Habe mir gestern diesen Sch… auch eingefangen, und jetzt zum Glück alles wieder OK. Die verloren gegangenen Dateien wurden nur versteckt.. , es ist alles wieder da, nur die Desktop-Verknüfungs- Icons muss man teilweise wieder zufügen. Aber das ist auch in ein paar Minuten gemacht.

Leave a comment

*