Data Recovery

From Wiki-Security, the free encyclopedia of computer security

Data Recovery Information
Type: Spyware
Analysis: Installs & gathers info from a PC without user permission.
Infection: By downloading freeware & shareware.
Symptoms: Changes PC settings, excessive popups & slow PC performance.
Detection Tool: >>> Download SpyHunter's Spyware Scanner <<<

SpyHunter's spyware scanner is intended to quickly scan and identify spyware on your PC. If you wish to eliminate spyware from your PC and prevent future spyware attacks, we recommend you buy SpyHunter's spyware removal tool, which includes full technical support and a Spyware HelpDesk to tackle spyware that is uniquely affecting your PC.
IE Alert:

If you are using Internet Explorer and can not download SpyHunter, please use a different browser like Firefox or Chrome.

Data Recovery is phony computer analysis and optimization program or a defragmenting program that was created and designed, solely, for the purposes of scamming unknowing computer users out of as much of their hard earned cash as Data Recovery can manage. As is true of almost all fake computer program of this kind, Data Recovery is a malicious malware product, known as a rogue defragmenter, which attempts to launch a nasty scareware campaign on all computer systems Data Recovery successfully compromises.

In order to fulfill its malicious end of scamming targeted computer users, Data Recovery was instilled with an arsenal of malicious scareware tactics that are one-hundred percent meant to forcefully convince you that your computer system's hard drive is rampant with all kinds of problems, various errors and other serious issues.
This is a lie.

Data Recovery's attempt to sell you this falsehood that there is something seriously wrong with your system is nothing but this cyber scam's ultimate tactic.

If this program successfully convinces you that: a) Data Recovery is a legitimate program, and b) that there is something seriously wrong with your system's hard drive, then Data Recovery will immediately try to sell you this utterly useless program's 'registered' quick fix program. The problem with this is that Data Recovery is entirely bogus, its quick fix program is just as useless as the version currently plaguing your computer system and, as a fake computer defragmenter, Data Recovery is incapable of scanning for, detecting and/or correcting any of the supposed problems on your computer system.

The Data Recovery Family of Rogue Defragmenters and Its Malicious Behavior

Data Recovery is yet another malicious product created by the criminals behind the Fake HDD family of bogus computer defragmenting programs. This means that Data Recovery can claim rogue precursor family members the likes of Windows Repair, System Repair, Data Recovery, Windows Recovery, and Windows Restore. Each of these rogue defragmenters is extremely dangerous and harmful to any computer system Data Recovery comes across, and Data Recovery is no different. Data Recovery can be summed up as an identical, carbon-copy like replica of each of its seditious predecessors.

This malicious application's arsenal of scareware tactics comprises malevolent tactics, such as fake hard drive scans, bogus error detection reports that make countless sham claims about various supposed hard drive errors and other problems on infected systems and phony pop-up security alerts that strengthen and highlight the nasty, mock claims made by Data Recovery's system scans and error detection reports. malware analysts have reported that Data Recovery is known to produce phony pop-up alerts, which bear the following messages:

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

Critical Error!
Damaged hard drive clusters detected. Private data is at risk.

Critical Error
RAM memory usage is critically high. RAM memory failure.

Low Disk Space
You are running very low disk space on Local Disk (C:).

Critical Error
Hard Drive not found. Missing hard drive.

Critical Error
Windows can't find hard disk space. Hard drive error.

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

If you discover that your computer system has become one of Data Recovery's victims, it is strongly advised that you take the necessary steps to have this nasty, corrupt program completely removed from your computer.

To check your computer for Data Recovery, download SpyHunter Spyware Detection Tool.

SpyHunter spyware detection tool is only a scanner meant to assist you in detecting Data Recovery and other threats. If you detect the presence of Data Recovery on your PC, you have the opportunity to purchase the SpyHunter removal tool to remove any traces of Data Recovery.


Detection of Data Recovery (Recommended)

Data Recovery is difficult to detect and remove. Data Recovery is not likely to be removed through a convenient "uninstall" feature. Data Recovery, as well as other spyware, can re-install itself even after it appears to have been removed.

You also run the risk of damaging your computer since you're required to find and delete sensitive files in your system such as DLL files and registry keys. It is recommended you use a good spyware remover to remove Data Recovery and other spyware, adware, trojans and viruses on your computer.

Run a Data Recovery scan/check to successfully detect all Data Recovery files with the SpyHunter Spyware Detection Tool. If you wish to remove Data Recovery, you can either purchase the SpyHunter spyware removal tool to remove Data Recovery or follow the Data Recovery manual removal method provided in the "Remedies and Prevention" section.

Method of Infection

There are many ways your computer could get infected with Data Recovery. Data Recovery can come bundled with shareware or other downloadable software.

Another method of distributing Data Recovery involves tricking you by displaying deceptive pop-up ads that may appear as regular Windows notifications with links which look like buttons reading Yes and No. No matter which "button" that you click on, a download starts, installing Data Recovery on your system. Data Recovery installs on your computer through a trojan and may infect your system without your knowledge or consent.

If you think you may already be infected with Data Recovery, use this SpyHunter Spyware dectection tool to detect Data Recovery and other common Spyware infections. After detection of Data Recovery, the next advised step is to remove Data Recovery with the purchase of the SpyHunter Spyware removal tool.


Data Recovery may attempt to change your computer's desktop, hijack your browser, monitor your Internet browsing activities, change system files, and can do this without your knowledge or permission. Therefore, it is strongly recommended to remove all traces of Data Recovery from your computer.

Remedies and Prevention

Data Recovery, as well as other Spyware, are constantly evolving and becoming more advanced to avoid detection. Data Recovery along with its variants can install in different locations and even when you try to uninstall it you find they reappear when you reboot your computer.

Install a good anti-spyware software

When there's a large number of traces of Spyware, for example Data Recovery, that have infected a computer, the only remedy may be to automatically run a Spyware scan from a good anti-spyware software designed to detect Data Recovery and other types of spyware.

Remove Data Recovery manually

Another method to remove Data Recovery is to manually delete Data Recovery files in your system. Detect and remove the following Data Recovery files:


  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[RANDOM CHARACTERS].exe

Other Files

  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[RANDOM CHARACTERS]
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Recovery\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Recovery\Data Recovery.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Recovery\Uninstall Data Recovery.lnk
  • %Documents and Settings%\[User Name]\Desktop\Data Recovery.lnk
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %AppData%\Protector-[rnd].exe task
  • %AppData%\Protector-[rnd].exe reg
  • %AppData%\Microsoft\Internet Explorer\Quick Launch\Data_Recovery.lnk
  • %Desktopdir%\Data_Recovery.lnk
  • %Programs%\Data Recovery\Data Recovery.lnk
  • %Programs%\Data Recovery\Uninstall Data Recovery.lnk

Registry Keys

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS].exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU "MRUList"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[rnd_0].exe %CommonAppliData%\[rnd_0].exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe

External links

Is your computer infected with spyware? Download SpyHunter's spyware detection tool to check for spyware on your PC.

Disclaimer Information
This website, its content or any portion of this website is NOT affiliated with, connected to, or sponsored by Data Recovery or its creators in any way. This website does not advocate the actions or behavior of Data Recovery and its creators. Our objective is to provide Internet users with the know-how to detect and remove Data Recovery and other Internet threats.

The readers of this article should not mistake, confuse or associate this article to be an advertisement or a promotion of Data Recovery in any way. The content provided on this website is intended for educational or informational purposes and is provided "AS IS" with no warranties, and confers no rights.