Windows Recovery Series

Windows Recovery Series Description

Type: Rogue AntiSpyware Programs

Screenshot

Windows Recovery Series – A Bogus Security Program in the FakeVimes Family

Windows Recovery Series is a malicious application disguised as a security program. Windows Recovery Series has no actual anti-virus components. Rather, Windows Recovery Series is designed to carry out a scam that involves attempting to sell useless security software to its victims. Malware applications like Windows Recovery Series are known as rogue security programs. Windows Recovery Series, in particular, belongs to a large family of rogue security programs known as the FakeSysDef family of rogue security software.

The FakeVimes family of bogus security programs has been around since 2009, and PC security analysts are well acquainted with members of this malicious group of scareware. Because of this, most security applications have the capability of dealing easily with the FakeVimes fake security programs. However, PC security researchers have detected a large number of fake security software in the FakeVimes family that was released in 2012. These newest members of the FakeVimes family are more difficult to remove than previous iterations, because of their association with a dangerous rootkit component.

Apart from Windows Recovery Series, other examples of malware in the 2012 version of FakeVimes fake security programs includes System Defragmenter, Ultra Defragger, HDD Control, Win HDD, Win Defrag, Win Defragmenter, Disk Doctor, Hard Drive Diagnostic, HDD Diagnostic, HDD Plus, HDD Repair, HDD Rescue, Smart HDD, Defragmenter, HDD Tools, Disk Repair, Windows Optimization Center, Scanner, HDD Low, Hdd Fix.

How Windows Recovery Series Works to Steal Your Money

Windows Recovery Series is designed to make inexperienced computer users panic by scaring them with numerous misleading alerts and fake error messages (because of this, malware like Windows Recovery Series is often referred to as 'scareware'). These messages will claim that the victim's computer is severely infected with malware. While this is technically true, what Windows Recovery Series fails to tell the computer user is that Windows Recovery Series itself is part of a Trojan infection causing these fake error messages. Windows Recovery Series is also designed to prevent its victims from gaining access to websites or applications related to computer security, as well as causing other problems on the infected computer, such as system instability and decreased performance.

While our PC security analysts strongly advise against paying for Windows Recovery Series, you can still obtain a registration code in order to 'unlock' this fake security program. Simply enter the code 0W000-000B0-00T00-E0020 when prompted. While this registration code will not remove Windows Recovery Series from your computer, it will cause it to stop displaying most of its annoying fake error messages. However, this will not delete Windows Recovery Series from your computer. To do that, it is necessary to use a reliable anti-malware program with anti-rootkit capabilities. ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

Technical Information

Screenshots & Other Imagery

SpyHunter Detects & Remove Windows Recovery Series

Windows Recovery Series Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Recovery Series creates the following file(s):
# File Name MD5 Detection Count
1 Protector-sett.exe 18510cef2424d343a6b9905529f9c5fc 3
2 Protector-dogk.exe 7d36f6d8800613a0d1a854903e34e459 1
3 %AppData%\Inspector-[RANDOM].exe N/A
4 %AppData%\Protector-[RANDOM].exe N/A

Registry Details

Windows Recovery Series creates the following registry entry or registry entries:
Registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "rudbxijemb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-2-17_2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe

More Details on Windows Recovery Series

The following messages associated with Windows Recovery Series were found:
Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.
Error
Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection.
Warning
Firewall has blocked a program from accessing the Internet.
Windows Media Player Resources
C:\Windows\system32\dllcache\wmploc.dll
C:\Windows\system32\dllcache\wmploc.dll is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.
Warning
Firewall has blocked a program from accessing the Internet.
Windows Media Player Resources
C:Windowssystem32dllcachewmploc.dll
C:Windowssystem32dllcachewmploc.dll is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.
Warning! Identity theft attempt Detected
Warning! Identity theft attempt Detected
Hidden connection IP: 58.82.12.124
Target: Your passwords for sites

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.