System Recovery Virus

By | September 7, 2011 | 0 Comment

System Recovery virus is must avoid application. It may sound like real computer utility software but the truth is, it is exists as nuisance to system. System Recovery happens to be bad software in disguise. Existence of rogue program such as this signifies that not all dreadful programs are able to restrain by prevalent anti-virus and anti-malware product.

System Recovery is modeled in exquisite graphical user interface to easily betray users. The fact that it mimics the look of legitimate system utility software the more believable it can be to susceptible victims. When it gains trust, very timely that pop-up messages are displayed serving as convincing factor to further trick a target.

Every now and then, System Recovery files redundant memory errors. It also states severe hard drive and system problems in form of fake alerts like the following:

Fix Disk
Windows Recovery Diagnostics will scan the system to identify performance problems.
Start or Cancel

Critical Error
Hard drive critical error. Run a system diagnostic utility to check your hard disk drive for errors. Windows can’t find hard disk space. Hard drive error.

System Error
An error occurred while reading system files. Run a system diagnostic utility to check your hard disk drive for errors.

As mentioned, these warnings are fake. Extensive display of these alerts soon will be realized as nuisance rather than valid notification. For this reason, there is no reason to obtain the licensed version. Avoid System Recovery by any means.

Type Rogue
Sub-Type FakeAV
OS Affected Windows XP, Windows Vista, Windows 7

What are the Symptoms of System Recovery Infection?

System Recovery Virus Scanner

In an attempt to further mislead computer users, System Recovery uninterruptedly issue fake alert messages such as these:

Critical Error!
Damaged hard drive clusters detected. Private data is at risk.

Critical Error
Hard Drive not found. Missing hard drive.

Critical Error
RAM memory usage is critically high. RAM memory failure.

Critical Error
Windows can’t find hard disk space. Hard drive error

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

It will modify Windows Registry and add the following entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\ActiveDesktop “NoChangingWallPaper” = ‘1’
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer “NoDesktop” = ‘1’
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\System “DisableTaskMgr” = ‘1’
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run “(random).exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run “(random)”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\policies\system “DisableTaskMgr” = ‘1’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Explorer\Advanced “Hidden” = ‘0’

The threat will drop the following malicious files:
%LocalAppData%\(random)
%LocalAppData%\(random).exe
%LocalAppData%\~(random)
%LocalAppData%\~(random)
%StartMenu%\Programs\System Recovery\
%StartMenu%\Programs\System Recovery\System Recovery.lnk
%StartMenu%\Programs\System Recovery\Uninstall System Recovery.lnk
%Temp%\smtmp\
%UserProfile%\Desktop\System Recovery.lnk

Leave a Reply

Your email address will not be published. Required fields are marked *