Home Malware Programs Rogue Anti-Spyware Programs Windows 7 Repair

Windows 7 Repair

Posted: June 17, 2011

ScreenshotWindows 7 Repair is a rogue defragger that tries to sell you the myth that Windows 7 Repair exists to fight system errors and fragmentation-related PC issues. However, the real motive driving Windows 7 Repair, is the desire to steal your money and credit card information. Instead of finding real errors, Windows 7 Repair will report fake ones, along with attacking Windows Explorer, your browser and other applications, to make these threats seem realistic. Never give websites that are affiliated with Windows 7 Repair your personal information or money, and delete Windows 7 Repair from your computer as soon as you have access to a quality security program.

Windows 7 Repair: Capitalizing on False Advertising and Vaporware Features

Windows 7 Repair is a member of a large and long group of rogue defragmenters. Recent members of the Windows 7 Repair gang include operating system variants like Windows XP Repair and Windows Vista Repair, as well as other clones that use slightly different names like Windows XP Restore and Windows 7 Restore. Individual members of the Windows 7 Repair group use most of the same code over and over again, although they may be updated to change their appearances slightly, and to avoid being detected by the same anti-virus threat definition updates.

The defragging features that Windows 7 Repair offers you will consistently, tell you that your PC is being threatened by serious hard drive errors. Even though other diagnostic programs will not see a thing, Windows 7 Repair will continue to create warnings like the following, to make you believe that your PC is nearing total self-destruction:

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

Critical Error
RAM memory usage is critically high. RAM memory failure.

Critical Error
Hard Drive not found. Missing hard drive.

Critical Error
Windows can't find hard disk space. Hard drive error

Critical Error!
Windows was unable to save all the data for the file System32496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error!
Damaged hard drive clusters detected. Private data is at risk.

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

The errors that Windows 7 Repair's reports are false positives that are created strictly to make you want to purchase a full version of Windows 7 Repair. It should go without saying that this is highly undesirable, and will make you the victim of fraud. However, you may want to try registering Windows 7 Repair with the freely-available code '8475082234984902023718742058948.' This stopgap measure may cause Windows 7 Repair to reduce Windows 7 Repair's attacks so that you can remove Windows 7 Repair without trouble.

And If Windows 7 Repair Didn't Convince You Before....

Of course, the wildly-exaggerated errors that Windows 7 Repair announces wouldn't be very credible if they didn't cause side effects for your computer. Windows 7 Repair will create these side effects as well, which will make it more difficult to delete Windows 7 Repair and bring you into contact with Windows 7 Repair-affiliated websites.

  • Windows 7 Repair will alter Windows Explorer to hide the contents of certain folders at random, making it look like folders are empty or that you have the wrong files. However, if you use another file-viewing program, you can see that your files are unharmed.
  • Windows 7 Repair can also stop various programs from running at all, most prominently Windows tools like Task Manager and anti-virus applications.
  • Even your web browser is in danger of being attacked, although Windows 7 Repair may choose to hijack it instead of causing it to crash. Hijacks can redirect you to the Windows 7 Repair homepage or other malicious websites, display fake error messages, create pop-ups or redirect you away from safe sites.

ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AllUsersProfile%\Application Data\[RANDOM CHARACTERS]
    2 %AllUsersProfile%\Application Data\[RANDOM CHARACTERS].dll
    3 %AllUsersProfile%\Application Data\[RANDOM CHARACTERS].exe
    4 %UserProfile%\Desktop\Windows 7 Repair.lnk
    5 %UserProfile%\Start Menu\Programs\Windows 7 Repair\
    6 %UserProfile%\Start Menu\Programs\Windows 7 Repair\Uninstall Windows 7 Repair.lnk
    7 %UserProfile%\Start Menu\Programs\Windows 7 Repair\Windows 7 Repair.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0?HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0?HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0?HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1?HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1?HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1?HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[RANDOM CHARACTERS].exe”HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[RANDOM CHARACTERS]”HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1?

One Comment

  • Aurore Moline says:

    AVG identified a trojan horse, but when I say to remove it the system warns me that removing could make my system crash.  I don't know if it is safe or not.  I thought maybe it says that for every find no matter what it is.  How can I decide if I should remove it or not?

Loading...