File Rescue

Posted: October 25, 2012

File Rescue Description

File Rescue is a member of or FakeHDD, a grouping of similar rogue defragmenters and file cleaners that display fake hard drive information and request money to fix imaginary problems. While there are many different names for variants of Fakesysdef, File Rescue and its relatives are consistent in their repetitive usage of warnings about RAM, misallocated files, overheated CPUs, bad HD sectors and other hardware problems that aren't based in reality. Any attempts to use File Rescue to fix these fake errors will result in File Rescue requesting money, which malware researchers recommend against spending – since File Rescue doesn't have any functional features that would benefit your computer. File Rescue, like many PC threats, uses changes to the Registry and code injection techniques as part of its installation, and the usage of anti-malware software is recommended to delete File Rescue without any unwanted side effects.

Don't Let Your PC Be the Damsel that File Rescue Swoops in to Save

File Rescue can be installed by various means, although prominent infection vectors include fake online scanners (that request that you download File Rescue to fix problems that appear to be detected in their fake scans) and media downloads that install File Rescue while pretending to be movie player updates. File Rescue's installation uses common exploits to allow File Rescue to launch automatically with Windows. Additionally, malicious DLL components of File Rescue are injected into normal system files, which complicate the removal of File Rescue. The installation of File Rescue also may force your computer to reboot and display File Rescue immediately.

File Rescue uses a range of fake system error-related pop-ups, as well as fake hard drive scans, to make your computer look as though it's experiencing severe hardware problems. Many of the errors that File Rescue claims to detect are highly improbable and, in some cases, even impossible to occur without causing your PC to crash. Naturally, File Rescue doesn't have any actual error-detecting functions, and these attacks don't serve any purpose except to incite victims into throwing money away on an 'advanced module' for File Rescue. malware research team has analyzed many PC threats related to File Rescue that practice similar behavior. Some examples include Many, but not all of these fake defraggers will use interfaces identical to that of File Rescue's, excepting the brand name.

Saving Yourself from File Rescue's HD Salvation

The attributes essential to File Rescue's identity as a fake file-repairing utility may be its pop-up alerts and scans, but malware experts have expressed more concern about its other attacks, which are unrelated to File Rescue's scamware disguise. Issues that may plague File Rescue-infected computers include:

  • Internet Explorer settings that are modified to make web-browsing risky (with respect to contact with malicious content or compromised transfers of confidential data).
  • Programs may be blocked by File Rescue without cause, even if File Rescue claims that blocked programs are damaged or infected.
  • File Rescue also may be used to connect to a remote server. This backdoor vulnerability can be used to launch other attacks against your computer.

With all of these traits, File Rescue should be considered a meaningful security threat, and malware researchers recommend using anti-malware software to delete File Rescue and its relatives if you see any signs of them on your computer.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to File Rescue may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[RANDOM CHARACTERS_0].exe %CommonAppData%\[RANDOM CHARACTERS_0].exe

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.