Windows Recovery

Posted: March 22, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	304

First Seen:	March 23, 2011
Last Seen:	January 8, 2020
OS(es) Affected:	Windows

Windows Recovery is a rogue defragmenter and system maintenance program that creates false system information reports to alarm you into giving away your money. As just a copy of many other rogue security applications, Windows Recovery attacks your PC with well-known tactics like causing fake alerts, showing scans that indicate nonexistent infections and crashing unrelated applications to reduce your security. Although you should remove Windows Recovery as quickly as possible, this process is best done by an appropriate anti-malware program, since some versions of Windows Recovery may use rootkits that are difficult to delete without assistance.

Windows Recovery – Purveyor of Boundless (Fake) Information

Windows Recovery is strongly related to other threats, with some examples being Windows Repair, Windows Tool, Windows Diagnostic and Windows Fix Disk. Windows Recovery clones all try to look highly professional, but you can easily identify them by their identical interfaces along with outright hostile functions.

When Windows Recovery first infects your PC, Windows Recovery will place entries into your Windows Registry that let Windows Recovery run whenever you boot the computer. Windows Recovery will offer many supposed services – RAM monitoring, HDD and system protection, junk file cleanup and a wide variety of other features that sound good but aren't being actually implemented in Windows Recovery!

Instead of offering useful information, Windows Recovery will try to fool you into purchasing a registration key by creating the appearance of heavy system damage. Windows Recovery does this by displaying errors like the below nigh-continuously:

Low Disk Space
You are running very low disk space on Local Disk (C:).

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

Activation Reminder
Windows Recovery Activation
Advanced module activation required to fix detected errors and performance issues. Please purchase Advanced Module license to activate this software and enable all features.

Windows - No Disk
Exception Processing Message 0x0000013

Critical Error
Hard Drive not found. Missing hard drive.

Critical Error
Windows can't find hard disk space. Hard drive error.

Critical Error!
Damaged hard drive clusters detected. Private data is at risk.

Critical Error
RAM memory usage is critically high. RAM memory failure.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Attempting to use any of the scanning functions that Windows Recovery offers you in bad faith will result in just more errors. Some commonly-reported scanner errors include:

Requested registry access is not allowed. Registry defragmentation required.

32% of HDD space is unreadable

Registry Error - Critical Error

Drive C initializing error

Bad sectors on hard drive or damaged file allocation table

GPU RAM temperature is critically high. Urgent RAM memory optimization is required to prevent system crash.

Hard drive doesn't respond to system commands

Ram Temperature is 83 C. Optimization is required for normal operation.

Read time of hard drive clusters less than 500 ms

Data Safety Problem. System integrity is at risk.

Recovering from Windows Recovery

Even if you know that Windows Recovery is just a rogue security program to be removed ASAP, actually deleting Windows Recovery can be difficult. Windows Recovery will block applications that could be used to restore system health or remove malware – both Windows tools like MSConfig and anti-virus scanners may be nonfunctional while Windows Recovery is active. Windows Recovery shows the following errors when crashing a program:

System Error
An error occurred while reading system files. Run a system diagnostic utility to check your hard disk drive for errors.

Hard Drive Failure
The system has detected a problem with one or more installed IDE / SATA hard disks. It is recommended that you restart the system.

Critical Error
Hard drive critical error. Run a system diagnostic utility to check your hard disk drive for errors. Windows can't find hard disk space. Hard drive error.

Removing Windows Recovery is made even more complex by the potential presence of a related Rootkit.TDSS rootkit infection. These infections are known for corrupting memory processes, hijacking web browsers, and playing obnoxious audio advertisements. Deleting Windows Recovery rootkits is absolutely not something you should attempt to do manually except as a last resort!

Proper removal of Windows Recovery can be accomplished by switching to Safe Mode for the cleanest possible environment, and then running a scan with your choice of updated anti-malware application. You may need to rename the program file to squeak it past Windows Recovery's program filter, but as a known threat, Windows Recovery has a well-developed software solution.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%USERPROFILE%\local settings\application data\alxjviag.exe

File name: alxjviag.exe
Size: 548.86 KB (548864 bytes)
MD5: 2815ade59dbcfacc7cfb9cf6703afbad
Detection count: 267
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\local settings\application data
Group: Malware file
Last Updated: May 3, 2011

%ALLUSERSPROFILE%\Application Data\16113460.exe

File name: 16113460.exe
Size: 467.96 KB (467968 bytes)
MD5: d9f552ac44acfa8bb2e62ee506b79d1a
Detection count: 77
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data
Group: Malware file
Last Updated: March 23, 2011

%ALLUSERSPROFILE%\IQoRoRfnYmWW.exe

File name: IQoRoRfnYmWW.exe
Size: 547.32 KB (547328 bytes)
MD5: 690241d2868ca9d2b9b7358b15732a3f
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: January 8, 2020

Windows Recovery

Threat Metric

Windows Recovery – Purveyor of Boundless (Fake) Information

Technical Details

File System Modifications

Related Posts

Leave a Reply