Windows Recovery virus – how to get rid of fake WindowsRecovery manually

March 23, 2011 By

Windows Recovery is another virus (a fake rogue software) which claims to be a powerful windows and system security tool. Windows Recovery tool is a clone of Windows Safemode virus and System Diagnostic virus. All these softwares (including Windows Recovery) are bogus and useless. Windows Recovery is a scamware thats wants you to pay for its full version to protect your system from damages caused by viruses and spywares, Remember, Windows Recovery virus has no ability to detect and remove viruses or fix windows problems but it is a virus itself and it is a dangerous threat for your pc.
fake windows recobery virus Windows Recovery virus how to get rid of fake WindowsRecovery manually

Just like other rogue spywares, WindowsRecovery virus uses the fake alerts and warning messages to scare user. It displays bunch of fake critical errors telling you about hard disk error, problem with RAM, System restore problem and many other errors. Mostly Windows Recovery virus attacks with fake hard disk drive errors. It may warn you of no disk found, or low disk space, or damage hard drive or something else. for example:

Fix Disk
Windows Recovery Diagnostics will scan the system to identify performance problems.
Start or Cancel

Critical Error!
Damaged hard drive clusters detected. Private data is at risk.

Critical Error
Hard Drive not found. Missing hard drive.

Critical Error
RAM memory usage is critically high. RAM memory failure.

Critical Error
Windows can’t find hard disk space. Hard drive error

Remember! All these warning messages and alerts displayed by Windows Recovery virus are fake. This program is specially designed to extort your money by offering you to buy its fake system security and optimization products. You should ignore these warnings, avoid buying this program, avoid its installation and immediately remove it from your computer upon detection.

How to remove Windows Recovery virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.

Stop Windows Recovery processes:
[random name].exe

Disable Windows Recovery DLL files:
[random name].dll

Delete Windows Recovery Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = 0′

Delete Windows Recovery files:
%AllUsersProfile%\~[random]
%AllUsersProfile%\~[random]r
%AllUsersProfile%\[random].dll
%AllUsersProfile%\[random].exe
%AllUsersProfile%\[random]
%AllUsersProfile%\[random].exe
%UserProfile%\Desktop\Windows Recovery.lnk
%UserProfile%\Start Menu\Programs\Windows Recovery\
%UserProfile%\Start Menu\Programs\Windows Recovery\Uninstall Windows Recovery.lnk
%UserProfile%\Start Menu\Programs\Windows Recovery\Windows Recovery.lnk

Auto Removal

To remove this virus Automatically, We suggest following tools:

Super Anti Spyware (Download)

OR

Malware Bytes Anti-Malware (Download)


Filed Under: 1: Spyware Removal Tagged With: , , , ,

Windows LowLevel Solution virus – how to get rid manually

March 23, 2011 By

Windows LowLevel Solution is a virus promoting fake security products. This rogue program is similar to Windows Emergency System and Windows support system virus. Don`t get tricked by Windows Low-Level Solution virus as it is designed to trick users into buying this useless software “WIndowsLowLevelSolution”.

fake Windows Lowlevel Solution virus Windows LowLevel Solution virus how to get rid manually

Screenshot of Windows LowLevel Solution virus above shows that how much this virus looks a legitimate antivirus software in first look. The virus offers many computer and internet security services (which it dose not perform in real). After getting into a computer via trojans and worms, Windows LowLevel Solution virus acts like a legitimate antivirus software. It runs its fake virus scan utility on infected computer and then generates some scan results telling user that Windows LowLevel Solution has detected viruses and spywares and some other windows problems that must be fixed very soon to protect your system from further damages. Then it offers a threat prevention solution. It offers the user to install additional updates of Windows LowLevel Solution to get rid of viruses and windows errors. Once user is convinced that his computer is infected and he wants to install Windows LowLevel Solution full version, the virus asks to purchase the license key. That is the goal of Windows LowLevel Solution virus.

Please Remember! All these warning messages and alerts displayed by Windows LowLevel Solution virus are fake. This program is specially designed to extort your money by offering you to buy its fake system security and optimization products. You should ignore these warnings, avoid buying this program, avoid its installation and immediately remove it from your computer upon detection.

How to remove WIndows Low Level Solution virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.
Stop Windows Lowlevel Solution processes:
%UserProfile%\Application Data\[random].exe

Remove Windows Lowlevel Solution Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore “DisableSR ” = ’1?

Remove Windows Lowlevel Solution files:
%UserProfile%\Application Data\[random].exe

Auto Removal

To remove this virus Automatically, We suggest following tools:

Malware Bytes Anti-Malware

download Windows LowLevel Solution virus how to get rid manually
OR

Super Anti Spyware

download Windows LowLevel Solution virus how to get rid manually

Filed Under: 1: Spyware Removal Tagged With: , , , ,

Windows Safemode virus – how to get rid manually

March 18, 2011 By

Windows Safemode is another fake optimization software coming from rogue virus family. Windows Safemode is a bogus program just like other fake windows security tools i.e. System Diagnostic virus and Windows Efficiency Magnifier. All these programs are useless and are spread by hackers via trojans to extort your money. Windows Safemode is also a scamware like other rogue program that want you buy their full versions for doing nothing good to your computer.
fake Windows Safemode virus Windows Safemode virus how to get rid manually
Windows Safemode looks like windows tool and System diagnostic virus in appearance. It uses the same trick of rogue spywares. Displays annoying popup windows and alerts and warning messages to scare user. It runs its fake scanner on infected computer and shows some fake critical error messages about hard drive problems and RAM over heating problems that do not concern your pc in real. Examples of fake errors displayed by Windows SafeMode virus:

Windows detected a hard drive problem.
A hard drive error occurred while starting the application.

Ram Temperature is 83 C. Optimization is required for normal operation.

Requested registry access is not allowed. Registry defragmentation required

32% of HDD space is unreadable

Remember! All these warning messages and alerts displayed by Windows Safemode virus are fake. This program is specially designed to extort your money by offering you to buy its fake system security and optimization products. You should ignore these warnings, avoid buying this program, avoid its installation and immediately remove it from your computer upon detection.

How to remove Windows Safemode virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.
Stop Windows Safemode processes:
[random name].exe

Remove Windows Safemode Registry Entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run “[random]”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”

Remove Windows Safemode files:
%TempDir%\[random]
%TempDir%\[random].exe
%TempDir%\dfrg
%TempDir%\dfrgr
%Desktop%\Windows Safemode.lnk
%Programs%\Windows Safemode
%Programs%\Windows Safemode\Windows Safemode.lnk

Auto Removal

To remove this virus Automatically, We suggest following tools:

Malware Bytes Anti-Malware

download Windows Safemode virus how to get rid manually
OR

Super Anti Spyware

download Windows Safemode virus how to get rid manually

Filed Under: 1: Spyware Removal Tagged With: , , , ,

Windows Diagnostic virus – how to get rid manually

March 14, 2011 By

Windows Diagnostic virus is a fake widnows defragger tool which has no ability to diagnose and fix computer problems. It claims to belong from microsoft windows utilities and tools. Windows Diagnostic is a scamware designed by hackers to earn money from innocent internet users by selling fake security products. This malware known as Windows Diagnostic is dropped into computers with the help of trojans and worms. After getting into a computer, it displays its fake diagnoses window that shows fake scan to trick user considering it a real tool. Windows Diagnostic displays many different errors and warning popups to scare user. like:

Requested registry access is not allowed. Registry defragmentation required

32% of HDD space is unreadable

Ram Temperature is 83 C. Optimization is required for normal operation.

Windows detected a hard drive problem.
A hard drive error occurred while starting the application.

Windows Diagnostic
Windows detected a hard disk error.
A problem with the hard drive sectors has been detected. It is recommended to download the following sertified software to fix the detected hard drive problems. Do you want to download recommended software?

Remember! All these warning messages and alerts displayed by Windows Diagnostic are fake. This program is specially designed to extort your money by offering you to buy its fake system security and optimization products. You should ignore these warnings, avoid buying this program, avoid its installation and immediately remove it from your computer upon detection.

How to get rid of Windows Diagnostic virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.
Stop Windows Diagnostic processes:
[random name].exe

Disable Windows Diagnostic DLL files:
%AllUsersProfile%\Application Data\[random].dll

Delete Windows Diagnostic Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′

Remove Windows Diagnostic files:
%AllUsersProfile%\Application Data\~[random]
%AllUsersProfile%\Application Data\~[random]
%AllUsersProfile%\Application Data\[random].dll
%AllUsersProfile%\Application Data\[random].exe
%AllUsersProfile%\Application Data\[random]
%AllUsersProfile%\Application Data\[random].exe

Auto Removal

To remove this virus Automatically, We suggest following tools:

Malware Bytes Anti-Malware

download Windows Diagnostic virus how to get rid manually
OR

Super Anti Spyware

download Windows Diagnostic virus how to get rid manually

Filed Under: 1: Spyware Removal Tagged With: ,