How to Remove Windows Recovery virus (Manual Removal Guide)

[ziyadkhalid]

pl/s if you can write in computer what you are click .

thanks

[6cmc9]

Who don't you just talk

[tyranus7]

Is there any chance this virus also affect my autofill google feature?? No longer working after this damn virus..

[Jubjang3]

If there is no presenting of any icon on the desktop what should i do ?

[AvtomatPruneJuice]

i got rid of the virus, because it isnt there anymore spamming my desktop, BUT my task manager is still locked wtf?

[maw88ify]

Use Linux Mint for your porn , and pirating need !!! Only use Windows for Games , and some software... For everything else use Linux Mint problem solved .

[WhereYaBoss]

@Palmar3s Thanks. This worked for me. 

[enditall727]

THERE IS A NEW VIRUS ON THE BLCK CALLED----------> "BlueFlare anitvirus" <---------watch out for it

now i have to find a way to remove it -_-

[braty0007]

Could you possibly do a video for Windows 7 with this virus??

[Fashinable20]

Where do you find this random letters folder? It seems like all you do is copy and paste them.....

[lovelylady232]

ok, so i cant get on the internet on my laptop todownload malearebytes, so can i download it on a flashdrive and then put it on my laptop to fix the problem.....please,i need my laptop back

[gringolazlo]

@lovelylady232 start your laptop in safe mode (restart, tap f8 as its booting) click 'start with networking' 

[tcaputo13]

@gringolazlo I believe I removed the virus, but now, my internet is not sending me to where I need to go. I heard that is part of the virus. How does one rectify this?

[gringolazlo]

@tcaputo13 do you mean google redirect? I had google redirect and it was fixed with a free trial of hitman pro. 3.5 is the last version i beleive.

[JapzHD]

@Palmar3s

I did everything, but when I come to use unhide.exe it says :

Please be patient while your files are made visable again.

Processing c:\

Then it does nothing.

[Palmar3s]

@JapzHD

Well, it depends on how many files you have on your computer, the virus hides away every single file (each photo, documents, music). I did it and it took around 15-20 minutes. How long have you waited? It should come back automatically.

[JapzHD]

@Palmar3s

I apologize, I was just being inpatient.

I retried, left my computer to it.

When I came back everything was sorted.

Thanks!

[isgeriu]

i can't find the files in 'Application Data' folder. any ideas? :o

[stfueverlast]

I ve got it twice in 3 weeks :S but I've always managed to remove it. thanks!

[xelaswan]

what if its hidden my run.exe program?

[MrFictive]

Does anyone know if this virus takes credit card information? Should I be changing around my numbers & passwords just to be safe, or is it not worth it?

[MrCodblog]

@MrFictive Yeah mate it does, thats the whole point of it... Change your shit now.

[Mannybanks00]

this virus is a bitch it took me 2 hours to kinda solve it since my PC was not in control i got black or blue screen every time i booted up i freaked out when it said fixing problems then asked me for $84!!. i was like what?! Microsoft don't charge like this rite there and then i knew i got a virus!!. i got it for messing around with my email spam box. cleaning it up and it bit me in the ass. beware downloading a zip file sent by some shipping company and mine was saying UPS. i order all the tim

[AdamJ617]

Hi. I'm trying as hard as I can to remove the Windows Recovery in XP, but I'm can't open regedit.exe as the taskbar disappears for a minute or so, and when I open regedit.exe in MSDOS, MSDOS disappears. I need help. I can only open Firefox, but can't open IE6. I want everything back normal. Please help.

[AvtomatPruneJuice]

yeah thanks got rid of that little bastard virus, but my files are still not visible which sucks about to run unhide.exe now. Oh and good guide but there was a few missing steps for me i had to manually delete the regedit that kept me from opening my task manager.

[AvtomatPruneJuice]

my pc shut it self off when i tried to manually delete i got 3 of the regedits out though im about to try again.

[taurus7745]

@HxC740SxC

thx for posting that! I completely freaked out when I found that all my pics from like weddings and stuff were gone. Thx again!

[Eld0g5]

the virus wont aloud me to start the windows task manager :S what can i do?

[akkellaa]

@Eld0g5

Have u tried to press alt+ctrl+del this opens task manager as well.

[akkellaa]

that works, thank u

[venmus93]

Awesome help! Thanks soooo much for posting it!

I was really screwed, and not the fun kind of screwed either!

[iflyrjs]

ran malwarebytes first did a restore then ran unide.exe

run it from bleeping computers website there's a link in some of the posts near the bottom click on the icon twice from your desktop

a dos window opens and it says to be patient took about 5 mins.

I did it the other way the first time by just clicking on RUN and it wouldnt work.

everything is back as it was before

[tbraysmanee1]

is all that malwarebytes stuf free!?!?!?!?

[Jal1mal]

i tryed to fix this virus by the phone, but the owner told me that he didn't had any files visible at c:

-.-

if it possible please post the command line commands to delete the keys from Alluser folder

[HxC740SxC]

@Jal1mal if he didnt have any files visible then they are listed as hidden. to make the files visible again what you halfta do is go to your start bar. then go to settings and click on control pannel then go to folder options. then click on the tab where it says view. then look for something that says "hidden files and folders" and it should have it set as do not show hidden files. check the part that says show hidden files. and that should make the files re-visible. hope this helpd

[Jal1mal]

@HxC740SxC

yeah .. figured that out eventually after waching 3-4 more videos :D

i got little bit angry if he kept telling me that there is no files on c-drive xD

anyway , it would be nice if this 'little' notice would be added to video :)

[jppereza]

excelente!

[jppereza]

Excelente!



[TheBrataccas]

helpful vid thx

[RifleRaid]

What if I removed the icon of Windows? Will it affect anything?

[tsooj7063]

So many thanks :D

[jewcity92]

I booted in safemode with networking, downloaded Malwarebytes' Anti-malware and updated it and ran a full scan. It worked. The desktop icons were still hidden so I googled and downloaded unhide.exe which brought everything back. There was an icon that said (and a few folders in the start menu too) windows recovery. I scaned them with the aforementioned and when told they were harmless deleted them and then deleted them from the recycle bin.

[amvmaniac1]

i did it and it got erased but now i cant put a background what should i do??

[ProMontageEditor]

All of my files are gone. My program files and what not. Please Reply!

[jeysson14]

ok so i " think " i removed it but my background is still black and everytime i try to chnage the theme the taskbar color chnages but the pictures dont appear background stay black

i have windows 7

[ProMontageEditor]

@jeysson14 I have the same Problem! Mssg me if you have found the soloution.



[jeysson14]

@ProMontageEditor i fixed it :D

[MrScracha]

One of the few virus' I just backup and reinstall windows for. It affects so many registry keys and touches so many files, it's just not worth the hassle.

[lucyd22]

Does anyone know if you can run anti malwarebytes in safemode with networking or do you need run a normal boot? Thank you

[conroetech1]

@lucyd22 yes you can

[lucyd22]

Does anyone know if you can run anti malwarebytes in safemode with networking or do you need run a normal boot? Thank you!

[goodforyou3000]

My computer denies access to to documents and settings even though i have administrative control. I have set my computer to unhide documents and folders. How can I access the folder for windows 7.

[vaporx9]

it also tells me access denied when i try to go into some files

[lupele1412]

I tried to open and remove appdattamicrosoftrandom.exe but it says that all my files are hidden! how do I Unhide them? Please and Thank you soooooooo much

[MissPurpleBoots]

All my files are gone... Where are they?

[Thund3rJunky]

@MissPurpleBoots Your files are not deleted, they are just hidden.

[vaporx9]

when you say "[random]

" what do u mean

[StrangeKobold]

Thanks for uploading this; worked like a charm!

[meepfeet]

My taskmanager won't open (it's grey)

[jortiz67]

ok the damn clicks are annoying...LOL...Thank you for the Vid nevertheless...Great work....

[neuroxik]

You fuckin' saved my life :)

Yet anotehr comment from me (there's a chr post limit), when in appdata (under All Users), because they're all named differently from pc to pc, just order by modified to see those 4-7 last files with weird names and Shift-Delete

[darkeyce02]

i tried to download anitvirus program that said would get rid of it but once they all scanned they wanted money....so i just did a system restore and got rid of it, it didnt make everything visible so i just went to folder options and clicked show hidden and all my data is ther...anything this virus says is fake

[darkeyce02]

@darkeyce02 oh and use anti malwarebytes to make sure everything is gone once you get rid of it

[loughlan]

Too bad it's locked task manager...

[neuroxik]

@loughlan If can't access taskmgr, go run->gpedit.msc , then User Config'->Admin' templates->System->right click "remove task manager->properties & chk Enable. Then, in regedit, HKEY_CURRENT_USER\Software\Mic­­rosoft\Windows\CurrentVersion­\­Policies\System & DELETE the taskmgr key

[frekijsimpson]

did all this and seemed ok but still have problems.. tried going to msn or netflix and get redirected to majorly bogus sites.

time to reformat.

[frekijsimpson]

how does this virus get into your system in the first place?

[ovidiu299]

@frekijsimpson Was made by ,,windows'' to scary people who don't have license. I found it in my PC too, this morning and now i am trying to destroy this virus. (The internet is full of fake programs who say, that it will help you to repair your pc.)

[frekijsimpson]

@ovidiu299 ..but do you know if it comes from misc websites or from being hidden/attached to random web pics..??

I ended up doing a full reformat to get it off completely. this video did help some put didn't cure it completely.

[ovidiu299]

@frekijsimpson I found on the internet informations which says that this windows error/virus it is self install after you click ,, 1 time'' on an automatic upgrate message from windows. I didn't reformate my PC because i don't know how to do it. So far i cure it 60% but it is a real pain because it's working very very slow. Like 200% slower. I don't believe that i will cure it 100%. I think maybe 80-90%.

[finn0006]

the disabled my desktop and task manager and put a bunch of junk in my registery

[elainekain]

oops - System Restore link under Help & Support, will proceed to a calendar in 2 steps

[elainekain]

NOW - let's all curse these lowlifes with a plague of rashes, boils, hives across their bodies that will not heal and torment them day and night so being in their own skin is hell... and may it not heal as long as they're A-holes... and may they only find relief when they begin undoing the harm they have caused!

[elainekain]

the virus HIDES your programs - go into C file and find the option to show hidden files in toolbar - click on Properties and unclick 'hidden' - keep searching for this program to make sure all copies are deleted, it had some links hid under various settings -- good luck

XP users - AFTER deleting virus, to recover desktop, under 'start' menu, help & support, click the 'system recover' highlighted link - select previous date to recover original desktop

[ClawlessReaver]

at 0;37 which processes should I end in the task manger window, since you dont really explain. mine are different from yours but i mean how do you know which ones to delete? thanks =)

[a1rud]

Great guide thanks

For the ones that cant kill the process because task manager is not working use: rkill to kill the process then run malware to detect and delete the virus then taskmanagerfix (freetool) to enable taxk manager and finally unhide.exe to see the files... it works for me

[101yazmon]

This is a great video i removed this sucky virus thank you :) <3

[Berniethomas68]

Okay this video kind of sucks because there is no human voice explaining what steps to take and all you can hear is clicks

[Nukkro]

i cant even fucking access the task manager, it's greyed out.

any suggestions?

[ThaJaimzterr]

I did everything in this video until the folder part in the end because this virus hid or disabled everything!!! Every program and folder. Help???

[jeanjenel]

for vista computers %appdata% = %programdata%

[omgkitkatcookies]

I have vista and in the "Run" folder in the registry I had alot of files there. Which one do I delete? Also there is nothing in my application data folder, just the microsoft one.

help?

[TheFreakinRican123]

For some reason I can't enter safe mode when I restart my computer. Can anyone help me?

[layton59]

Task Manager is not clickable. I am calling Microsoft tomorrow to solve the whole f**king problem.

[enditall727]

@layton59 yea it happened to mine to just google "how to restore task manager" or something to that degree

that's how i got mine back

[8iLLz]

GO INTO SAFE MODE. SYSTEM RESTORE A COUPLE OF WEEKS/DAYS BEFORE U GOT THE VIRUS. THEN VIEW YOUR HIDDEN FILES AND UNHIDE THEM FOLLOW THIS TUT. :)

youtube.com/watch?v=4mLh7guLGb­A

THUMBS UP THIS DOES WORK. + RUN A DECENT MALWARE PROGRAM AFTER.

[EazZiB]

@dimitris251 activate safe mode then u get all system files

[shwetank07]

i have got rid of the virus but, can any one tell me how to make my PC back to normal

some of my problems are- i) my start menu is blank ii) some of my desktop icons are missing. I know a more simple way to get rid of the virus just P.M. me as i cant post the link.

[snopuff13]

i got this virus and i have no clue how to get rid of it..and how to restore my programs

[ColeHarvey12]

i got a virus of a youtube converter which i downloaded yesterday...

[Buba101shrimps]

windows recovery has stopped me from been able to use my task manager. it comes up with "task manger has been disabled by your administrator", there is however no administrative profile on my PC. ive got rid of the pop up with spyware doctor, but my computer is slow as fuck and still has remenants of windows recovery, for example i have nothing on my start menu and it keeps hiding my documents.

[iTzexZACKly]

Yea alot of these files you are going to i do not have and i still have the virus.

[MadGoatProduction]

This actually helped, though i didn't have all the files this video showed i deleted the ones i did then i was finally able to update my virus protection (im using malwarebytes) and it finally detected all the bad software and got rid of it.

BE VERY CAREFUL CHANGING OR REMOVING ITEMS FROM YOUR REGISTRY

[deagleusp2]

помогло!



[Mayistabyou12]

my c drive appears as (empty). what do. have deleted registry stuff and scanned with MBAM, (had to open it via run.exe as i have nothing showing in my computer or start list)

[zeshybadboy]

Hey guys i figured out how to fix the virus this is no joke lol just send me a personal message if you want to know how to. :D

[thecmpdc]

the new version of this freaking virus disables the task manager.. glad i re-enabe it, and removed the virus.. thanks to your help!

[Jackzuk]

This video actually helped, my below comment was meant for another video. Sorry to the user who uploaded this. On writing this from a phone and can't remove my comment at this time

[mukmewx]

@Jackzuk lol I was going to say, what exactly is not free?

[Jackzuk]

This is NOT FREE...

I spent the whole day scanning my computer with the programme mentioned in this video and it 'found' some infections but said I had to buy a licence to get them removed! Funny how that wasn't mentioned in the video

[Jackzuk]

This method is NOT FREE.... I got the spy doc programme, spent the who day scanning my computer, it 'found' lots of stuff but said I needed to buy a licence if i wanted to remove them. Funny how that didn't come up on the video!!

[webhead86104]

Going to try this tomorrow! I have Hundreds of unsaved photos!!! Hope this works!!! :)

Thanks!

[plurunum]

vid helped a ton! WindowsRecovery virus has been upgraded, so it now disables taskmanager. need to use program like rkill.exe to stop the processes, then can use regedit to change registry entries. also, another program called combofix.exe should fix random audio.

[enditall727]

@plurunum what does rkill.exe do? what should i do with it?

the task manager think also would not work on mine either

[plurunum]

@enditall727 its a small program used by some virus/malware tech support sites that scans the processes running on your computer and stops any that are suspected of being a virus (it will do automatically, what you would be doing in taskmanager manually)

[DeM0nM1NdSlAvR]

ok i think i removed it with system estore but now i get random audio ads in my backgrounds and an error in command sequence in internet explorer keeps popping up. plz help me

[TheChicken424]

ight for the hidden folders iv been messin with shit and u go to controll panel and go to folder options go to view and look where it says show hidden folders thats all i got

[artfulgooner]

Fixed that...but my 'all programs' on the start menu is empty..(windows 7)

[mukmewx]

@artfulgooner IDK if you have found out yet but you will need a program to "unhide" all of your info, look for one in google

[artfulgooner]

So if all my files have been 'hidden' how do i unhide them all?

[blade0381]

I hope u realize your print is way to small to see what the fuck you are even clicking on

[plurunum]

@blade0381 dude, rather than cursing out the guy who's trying to help, why don't you just expand to full screen mode and you'll see everything fine ... moron.

[mukmewx]

@plurunum lol some people are so dumb, they are so dumb, fer real....

[lunaone]

All of my files in \Application Data are hidden and I can't unhide...help????

[familyguystwie]

wont let me open task manager FUCKIN annoying

[waynetech10]

A lot of these files weren't on my computer, for some reason. Nothing was in the "policies" folder, and application data wasn't there.Could it possibly be named something else?

[shwetank07]

@waynetech10 The way in the video is more complicated. I can help everyone, download the malware-byte it will automatically remove the virus. And to recover all you files download the unhide.exe

If you want the links just P.M. me as links cannot be posted. Remember to run the software in safe mode.

This is the most worst virus i've ever seen. It'll not take more than 15 mins and its too easy.

[neuroxik]

@waynetech10 the processes will be named different from pc to pc, but it's generally a long string of chars, say NMgf563bvbvb.exe, usually 2 of them.Had a couple of "atrib" processes, not sure if related but hadn't seen em before. If can't access taskmgr, go run->gpedit.msc , then User Config'->Admin' templates->System->right click "remove task manager->properties & chk Enable. Then, in regedit, HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Policies\System & DELETE the taskmgr key

[GabrielMynd]

i tried to post the bleeping computer link but was unable to

go to bleepingcomputer virusremoval remove windows recovery

[GabrielMynd]

bleepingcomputer has step by step way to get rid of the windows system recovery virus and at step 17 a link will run an unhide.exe file that brings all your files back in minutes

[jj62ud]

Delete Windows Recovery Registry Entries:

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Explorer\Advanced “Hidden” = ’0′

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Explorer\Advanced “ShowSuperHidden” = 0′

[jj62ud]

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Policies\Attachments “SaveZoneInformation” = ’1′

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Policies\System “DisableTaskMgr” = ’1′

HKEY_LOCAL_MACHINE\SOFTWARE\Mi­crosoft\Windows\CurrentVersion­\policies\system “DisableTaskMgr” = ’1′

HKEY_CURRENT_USER\Software\Mic­rosoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’

HKEY_CURRENT_USER\Software\Mic­rosoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’

[jj62ud]

Delete Windows Recovery Registry Entries:

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Policies\ActiveDesktop “NoChangingWallPaper” = ’1′

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u­:/bnl:/ble:/sdf:/lrh:/iul:/iul­m:/fhg:/clq:/kqf:/`wh:/lqf:/lq­df:/lnw:/lq2:/l2t:/v`w:/rbs:’

[jj62ud]

Delete Windows Recovery Registry Entries:

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Run “.exe”

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Run “”

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Internet Settings “CertificateRevocation” = ’0′

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Internet Settings “WarnonBadCertRecving” = ’0′

[kobesan7767]

I did all the steps that you told me too, but when I restarted my computer, nothing was there. I went to Start\Control Panel\Folder Options\View, and clicked "Show hidden files and folders. I also unchecked "Hide extensions for known file types" and "Hide protected operating system files". I applied the settings, but now all my desktop icons appear faded out. They also will not open. For example, I have the game "Starcraft 2" on my computer. However, when I open them, they crash. Please Help!!!!

[velenvskaelhas]

@kobesan7767 I had a similiar problem, i did it all but WoW "play2 button no longer worked so had to go to the program files to play it, you may have to use A program called "unhide.exe" just type it into google, download it, then let it run

[inuyasha1sasuke]

What do you do if you get an error alert saying that Windows Recovery disabled (or something) your task manager? No matter how many times I press Alt, Ctrl, and delete that same error message always pops up. This virus has removed basically ALL my files and is working on my SYSTEM files. Help please? :D System restore doesn't even work in safe mode~

[rspoke]

@inuyasha1sasuke the virus basically hid all your files, your files are probably still there, all you have to do is use an ATTRIB command in the command prompt to unhide your files and delete the windows recovery files, if you dont know how to use ATTRIB google it

[RobotNinjaPlatypus]

Umm... Those four file you deleted at 3:24... I accidentally renamed all those and some other files that also have paper icons and for some reason the files you showed me are in the program data folder in Vista. I'm sorry I'm new to this one please help?

[Metal4AllEternity]

thanks