Instructions: Remedies of Windows XP // Vista Recovery

TipsMake.com - For current system cleanup programs, the general use is to 'clean' the entire temp folder before proceeding with other processes. The purpose of this process is often quite good, because this is also the place to stay for malicious programs, malware, viruses. so it will significantly shorten the processing time after this. But it is not only us who know how to do this, but the hackers also grasp this simple principle, so hackers have continued to create some fake security software with the purpose of trying to properties to move important users' files or data to this temp folder.

The most common common cases are fake Recovery Software and Windows Restore security in today's Windows XP or Vista operating system, many of the user's system files will be "secretly" transferred to the directory % temp% smtmp . After the system is infected, you absolutely cannot delete the data in this directory as you normally would, or use other support tools such as CCleaner. until the recovery process is completed. and everything is back to normal.

More specifically, these fake programs will temporarily hide and transfer all desktop shortcuts and Start Menu shortcuts to the % temp% smtmp folder , then continue to create 4 more subdirectories:

% Temp% smtmp1 => Allusers Start Menu % Temp% smtmp2 => Allusers Quick Launch % Temp% smtmp3 => Quick LaunchUser PinnedTaskBar % Temp% smtmp4 => AllUsers Desktop

If you don't 'clean' the temp folder, you can restore these shortcuts, and in the other case, use the restoresm utility to retrieve commonly used shortcuts (download, extract and run restoresm.bat file).

Some steps to follow:

To continue, please follow the instructions as shown below. Specifically, you will learn more about the Windows Recovery spoofing program - cleverly disguised under the guise of a system analysis and optimization utility, after installing it into Windows they will work and provides a lot of false information and the current state of the operating system, and offers measures to improve by advanced functions - these functions are only activated when the user agrees to pay through a Number of common forms. And essentially, Windows Recovery is installed via the Trojan route infecting Windows, the next time the program will start automatically with the system, and for each such time, the messages are false about The status of the operating system, storage partition, or hard drive is displayed.

Some pictures of fake Windows Recovery program

On the other hand, in order for users to "trust" that the operating system is in an unstable state, Windows Recovery has made the internal data part of the folders 'disappear' completely, For instance, when users open some paths like C: WindowsSystem32 , instead of seeing the list of system folders and files as usual, they will only see a few different folders, which do not contain any data. They do this by secretly adding hidden - hidden properties and file and folder files, and changing Windows' display mechanism, so users cannot see hidden files and folders..

Besides, Windows Recovery also makes it impossible for users to boot and use any programs on the computer. The manifestation of this is that when you start any program, the program will automatically disappear, and instead report an error that the application or storage hard drive is having problems. The purpose of hackers doing this is to protect the fake program from other security software. Common error messages look like this:

Hard Drive Failure ?ã tìm th?y h? th?ng m?t v?n ?? v?i m?t hay nhi?u cài ??t IDE / SATA hard ??a. Có nên th? l?i b?n ch?y l?i h? th?ng.

System Error L?i l?i khi ??c h? th?ng t?p tin. ?ang ch?y m?t thi?t b? xác ??nh h? th?ng ?? ki?m tra các ??a ??a c?ng cho l?i.

Critical Error Hard drive critical error. ?ang ch?y m?t thi?t b? xác ??nh h? th?ng ?? ki?m tra các ??a ??a c?ng cho l?i. Windows không tìm th?y ??a ??a c?ng. Hard drive error.

After closing these messages, the system continues to offer several options as follows:

Fix Disk Windows Recovery Diagnostics will scan the system to identify problems. Start or Cancel

If you select Start, the program will start to review, and display some results similar to the following:

Windows Recovery Diagnostics Windows tìm th?y m?t l?i t?p tin c?ng. M?t v?n ?? v?i các rãnh ghi ? c?ng ?ã ???c tìm th?y. N?u ???c th? l?i ?? t?i t?p tin sertified theo ?ây ?? ki?m tra các l?i không tìm th?y problems. B?n có mu?n t?i h?p l? software?

That's just a few warning messages trying to convince users that the operating system is experiencing serious problems related to the hard drive:

Không cho phép ??ng nh?p ??ng nh?p ???c phép Registry defragmentation required 32% of HDD space is unreadable Bad các rãnh ghi trên bàn phím b? l?i ho?c b? h?ng RAM GPU temperature is critically high. Urgent b? nh? RAM (RAM) c?n thi?t c?n thi?t b? h?ng Drive C initializing error Ram Temp is 83 C. Optimization là c?n thi?t cho kích c? chính quy. Hard drive không ?áp ?ng ??n system l?nh Data Safety Problem. System integrity is at risk. Registry Error - Critical Error

Besides, while WindowsRecovery works, the program will continuously display false information from the Windows taskbar. Examples are as follows:

Critical Error! L?i tìm th?y trình ?i?u khi?n clusters. Private data is at risk.

Critical Error Không tìm th?y Hard Drive. Missing hard drive.

Critical Error RAM memory usage is critically high. RAM memory failure.

Critical Error Windows không tìm th?y ??a ??a c?ng. Hard drive error

Critical Error! Windows không th? l?u các d? li?u cho t?p tin System32496A8300. T?p tin ?ã b? m?t. Có l? l?i này b? l?i v?i m?t l?i máy tính c?a b?n.

Critical Error L?i l?i khi ?ã xác ??nh khi ch? m?c ???c l?u tr? d? li?u trên ? c?ng. C?n thi?t b? kh?i ??ng

System Restore H? th?ng ?ã ???c xác ??nh sau khi l?i l?i. Ch? xác th?c d? li?u và thi?t b? c?ng xác th?c

Activation Reminder Windows Recovery Activation Advanced module activation required to fix errors and performance issues. Please purchase Advanced license module to activate this software and enable all features.

Low Disk Space B?n ?ang ch?y m?t ??a bên ngoài không trên ??a ch? ??a (C:).

Windows - No Disk Exception Processing Message 0x0000013

To fix it, you will need some support tools as follows:

- FixNCR.reg: use this file to be able to use executable files *.exe

- Rkill: run this file to remove active processes of malware

- RogueKiller: Another way to stop malware activity before using MalwareBytes

- Unhide: use this file to remove hidden properties of files and folders after being infected

- TDSSKiller: remove the type of rootkit TDSS exists on the system

Note that you should not reboot after using RKill or RogueKiller or the processes generated by malware will automatically reappear, users must use MalwareBytes immediately, fully updated and scanned. ( Full scan ) the entire system to eradicate threats.

In addition, if the order of the data files and programs used to open is disturbed or affected by the infection process, please refer here to fix:

- Dougknox XP is used on Windows XP

- With Windows Vista

- Windows 7 Continue, to restore the Accessories Program Files menu, we can use accrestore.zip, after downloading, you unzip and run the file AccRestore.exe, click the Restore button to proceed.

To restore the Admin Tools Program Files menu , use admintools.zip - unzip, activate the *.exe file and click the Restore Administrative Tools items button .

Good luck!