Windows Recovery is a scareware which masquerades as a system performance optimization tool. Belonging to the FakeSysdef trojan family, it comes in many names including HDD Defragmenter, Check Disk, Windows Repair, Windows Restore, Windows SafeMode, Windows Fix Disk and Windows Recovery. It uses a variety of fake warning alerts about non-existent errors in computer hard drive, memory and Windows registry to try and cheat gullible users. This rogue optimization software disables Windows Task Manager and Quick launch bar. It also hides All Programs, My Documents and Administrative Tools menu items to confuse and scare the victims.

After continuous bogus error messages, the system is forcibly restarted every few minutes. On restart the rogue software runs a scan automatically and declares finding of multiple errors. The desktop background is blanked and the unclose-able Windows Recovery window hogs the focus.

Scareware like WindowsRecovery are commonly installed when users are redirected to fake online scanner pages, fraudulent porn sites, illegal cracks/warez sites and fake ‘video codec required’ pages distributed through out the Web by cyber criminals using blackhat SEO techniques, Spam and Malicious flash advertisements.

WindowsRecovery Removal (How to remove WindowsRecovery)
  1. Boot in to Windows Safe Mode with networking
  2. Download or from a clean computer download and copy to a removable drive like CD, DVD or USB flash drive. MalwareBytes’s Anti-Malware Free edition (mbam-setup.exe) and TDSSKiller – often this family of scareware comes bundled with the TDSS rootkit
  3. Right click and save the file Fakesysdef_unhide.txt to your desktop. Rename the file from Fakesysdef_unhide.txt to Fakesysdef_unhide.cmd. This file will help to reveal the files and folders hidden by this rogue optimizer.
  4. Run the TDSSKiller utility to check for the rootkit.
  5. Double-click mbam-setup.exe to start the installation. Proceed with installation following the prompts. Make sure that the following option is checked when you finish the installation: Update Malwarebytes’ Anti-Malware.
  6. Once the update is completed, Launch Malwarebytes’ Anti-Malware and select Perform full scan in the Scanner tab. When the scan is completed, click “Show results“, confirm that all instances of the rogue security software are check-marked and then click “Remove Selected” to delete them. If prompted restart immediately to complete the removal process.
  7. To unhide files and folders hidden by this rogue optimizer, double-click and run Fakesysdef_unhide.cmd.


http://www.malwarehelp.org/windowsre...oval-2011.html